Subject: [Asrg] The Solution To Spam - The Second Response

From: "Mark McCarron" <[email-masked]>
Date: Sat, 28 Jun 2003 21:46:01 +0000

Thankyou for your responses to The Solution To Spam - The First Response.  
My responses are in the body of the text below.

This post refers to the 'GIEIS' Anti-Spam system.  The details can be viewed 
here, updates will be posted in the course of
the next few days, please check regularly:

http://homepage.ntlworld.com/giza.necropolis

Thankyou for the feedback on this matter,

Mark McCarron.

At 3:47 AM +0000 6/28/03, Mark McCarron wrote:
&gt;The graphic is for email clients such as Outlook=20
&gt;express and Eudora, etc.&nbsp; A new graphic is=20
&gt;downloaded for each email.&nbsp; The system has no=20
&gt;intention of stopping legitimate email even=20
&gt;automated systems.&nbsp; They just register with an=20
&gt;'EAS' provider and all mail is sent through it.=20
&gt;Legitimate businesses will have to provide legal=20
&gt;company registration details (such as reg.=20
&gt;company number, etc).&nbsp; They receive a special=20
&gt;code, upon agreeing to a legally binding

This list has had this type of discussion before.
Those are approximately the requirements=20
necessary for an SSL certificate.&nbsp; SSL=20
certificates currently last one year at about=20
$100/cert.&nbsp; The margins are such that virtually=20
no background checks are done.&nbsp; And of course=20
there is no revocation, arbitration or=20
verification done for how you use it afterwards.=20
I would guess that, at a minimum, the level of=20
support you are requesting would result in a fee=20
on the order of $1000/year in order to support=20
the necessary infrastructure and support needs.=20
It might be somewhat lower because the volume of=20
sales would be many orders of magnitude higher=20
than SSL certs, but I can't see it being any=20
cheaper.

Mark's response:

This system does not use SSL nor will it ever.  It will use (most likely) a 
modified version of a PGP source as the basis of it's encryption method.  
Therefore, the prices you quoted are not accurate.

Additionally you need another class of=20
certification there, and I don't know how you're=20
going to do it.&nbsp; Mail servers are run by many=20
people, not just &quot;registered&quot; companies.=20
Validating a random individual is even harder=20
than validating companies.&nbsp; (Never mind what=20
happens when you have someone like a friend of=20
mine, a long-time security expert, who has never=20
owned a credit card in his life.)

Mark's response:

Individuals who run mail servers for there own private use will not have 
access to 'GIEIS'.  They should move to an email client and connect through 
an ISPs 'EAS'.  Also, no credit card, no access.

&gt;Excellent points.&nbsp; Let's deal with the first=20
&gt;one, there is millions of mail servers in the=20
&gt;world, however, all these mail servers have one=20
&gt;thing in common, they are linked to the internet=20
&gt;backbone via some form of ISP.&nbsp; This is why I am=20
&gt;referring to ISPs.&nbsp; Therefore, we take this=20
&gt;common point and

Yes and no.&nbsp; There are millions of mail servers.=20
Those mail servers are connected through an=20
&quot;ISP&quot;.&nbsp; However in the case of most company=20
connections that ISP does *not* currently provide=20
email service (or if they do, not at the QoS=20
required by the company).&nbsp; So you are asking all=20
of those ISPs to start providing a service that=20
they don't currently provide at all, never mind=20
how you are going to integrate that into the=20
company email servers.

Mark's Response:

Essentially, yes.  There would be an adopt of die policy.  Legal frameworks, 
especially those concering International law are expensive and time 
consuming.  The truth is to get 'near global' legal compliance could take 
decades.  By this stage, the Internet as you now know it, would be a thing 
of the past.  Sacrafices must be made, if I have to amputate to save a 
patient's life, then I will do it.  Integration will be the responsibility 
of the ISP concerned.  If adopted by the major industry players of ISP and 
email, there would be nothing the rest of the world could do about it.  Even 
through legal challanges.  There is no law stating you cannot take all 
reasonable steps to protect your network.

&gt;independant body.&nbsp; If set up in partnership with=20
&gt;the largest email and ISP providers, then the=20
&gt;rest of the industry would be assured of its=20
&gt;reputation,

Let's see.&nbsp; That would be AOL and Microsoft.&nbsp; What am I assured 
of?&nbsp; :-^

Mark's Response:

This document and system is not here to pass a 'popularity' test with 
Internet users.  It is aimed at the large corporations with the cash-flow to 
support the system.  Not only will this system eliminate spam, but the 
majority of email based assaults on remote machines, chain-mail, and scam 
emails.  The system will be between 99-100% effective and will run a 
zero-tolerance program.

&gt;&nbsp; furthermore, the system must operate within=20
&gt;legal boundries.&nbsp; Mailing lists must be=20
&gt;associated with a bonafide website, also they=20
&gt;must contact 'GIEIS'

What is a &quot;bonafide&quot; website, and how do you tell?

Mark's response:

By making the hosting company part liable under our 'Terms of Agreement' 
without which, they cannot send emails.  Also, further checks are done with 
the ISP involved, who must provide a written reference sponsoring them to 
'GIEIS'.

&gt;&nbsp; directly for setup.&nbsp; A credit card will be=20
&gt;required and a $1 (=A31) charge will be made to=20
&gt;it.&nbsp; Also, a mailing adress and telephone=20
&gt;contact information would be required.&nbsp; They=20
&gt;will receive a written copy of the 'Terms of=20
&gt;Service' which they must sign and send back to=20
&gt;'GIEIS'.&nbsp; Upon reception 'GIEIS' will implement=20
&gt;the account with their ISP.&nbsp; The emails then=20
&gt;sent will be analysed by heuristics.&nbsp; Each=20
&gt;message will also be parsed for HTML code, such=20
&gt;as IMAGE tags and jpg, bmp images.&nbsp; As the=20
&gt;majority of mailing systems use either ASCII or=20
&gt;UNICODE text only, spam can be detected, blocked=20
&gt;and the offender's credit card billed with a=20
&gt;fine.&nbsp; I have not placed estimates on the cost=20
&gt;of implementation.&nbsp; The industry is loosing $12=20
&gt;Billion a year, even if the partnership spent $1=20
&gt;Billion per year (an outragous amount) they=20
&gt;would still be saving $11 Billion.&nbsp; The=20
&gt;'beancounter' (accountants) would love that.

There are several problems here.
=46irst of all, when you see all those numbers=20
about &quot;losing&quot; $12billion, they don't mean that=20
literally.&nbsp; They are talking about productivity=20
costs and opportunity costs and such.&nbsp; The &quot;fact&quot;=20
that spam costs $12B does not mean that companies=20
have $12B to spend if it went away.&nbsp; Furthermore,=20
the costs of spam are spread over millions of=20
people, whereas the costs of your service are=20
focused on a much smaller group of companies.

Mark's Response:

You don't know I am a mathematician and a trained UK accountant as well.  
So, I will not be harsh on you :)  Productivity costs, refers to increased 
wage/production payments.  This is an expense, a VERY real cash-flow, I can 
assure you.  The same goes for lost business opportunities, this is source 
of capital, another VERY real cash-flow.  Their reference to $12 Billion is 
therefore, extremely literal.  These costs are not spread across millions of 
people, no one has the time to do research like that.  Quotes like that are 
often solely based upon the Fortune 500 companies.

Also, you need to rethink the scale of the email=20
system.&nbsp; You are envisioning centralized systems=20
using complicated software to analyze the content=20
of email messages.&nbsp; First of all--there's no way=20
in hell anyone is going to allow a third party to=20
analyze the content of their email.&nbsp; Secondly,=20
the existing mail system carries billions of=20
messages a day.&nbsp; The infrastructure to analyze=20
that kind of flow simply does not exist, nor is=20
likely to.

Mark's Response:

All suspect email communications are intercepted at the telecommunications 
level by government authorities in each nation, in the US it by the NSA/CIA, 
and in the UK it is the GCHQ.  If they do not agree to analysis of mailing 
lists, then they simply will be excluded from 'GIEIS' systems.  As I stated 
before, I am not seeking 'popularity' vote, but rather a complete end to 
fraudulent email of any form through forced measures.  'GIEIS' is designed 
to be the equivilent of a digital army.  Of course the infrastructure 
exists, we can currently send that volume, there is no problem in analysing 
it too.  If government agencies can perform heuristics of over 50 Million 
voice communications in 30 minutes
then analysing email will be a walk-in-the-park.

&gt;True.&nbsp; However, there will most likely be a=20
&gt;period of introduction, for example 6 months.=20
&gt;Then there will be a D-Day from which point, the=20
&gt;system becomes exclusive.&nbsp; This will force the=20
&gt;rest of the industry to adopt or face not being=20
&gt;able to communicate with other networks.&nbsp; The=20
&gt;result of non-compliance would be the loss of=20
&gt;their customer base.

Millions of end users would have to update their=20
software (if it's possible--often, especially in=20
the third world, they may be running machines and=20
operating systems which are no longer supported).=20
Millions of MTAs changed.&nbsp; ISPs implementing new=20
software that has never been tested.&nbsp; Entirely=20
new business relationships with all of the ISP=20
clients.&nbsp; New requirements on how email is=20
routed, with all company email going through=20
centralized servers that didn't exist before.=20
The creation of an extra-govermental organization=20
with the ability to put any company out of=20
business at a whim.

This isn't an anti-spam proposal.&nbsp; It's something out of George Orwell 
:-).

Mark's Response:

Drastic problems require drastic solutions.  Current policies and blocking 
attempts are only adding to the problem.  This will end the issue 
once-and-for-all.  It would be Orwellean if there was some form of 
censorship was involved, however, no one is suggesting this.  You almost 
make it sound like a conspiracy is going on.  I would ask you to consider 
this, think of all the emails you have sent today, why would 'GIEIS' waste 
good money on hiring someone to  read your (or anyone elses) email?  
Frankly, I don't think we would be really interested in who is doing who, 
who is fighting with who, who is who's best friend.  Also, as I stated 
before, government agencies all over the world already have this capability. 
  As for upgrading millions of users, there is already a push for the new IP 
standard to be
implemented by the US Military.  It would be no different than this, give it 
6 months to one year and the change over will be complete then 'GIEIS' will 
patrol the Internet.

&gt;blind and severely visually impaired.&nbsp; We have=20
&gt;not forgot about this highly important client=20
&gt;base.&nbsp; Such as a simple puzzle in brail,=20
&gt;something that would be difficult to automate=20
&gt;for but simple enough for a human to do.

Umm.&nbsp; Blind computer users do not use braille to=20
read the screen.&nbsp; They use screen readers that=20
read the text to them.&nbsp; But anyway, I'm sure you=20
could deal with it.

Mark's response:

Are you trying to tell me braille output does not exist?  I have installed 
quite a number personally.  Also, a screen  reader can read a puzzle just as 
well as any other text.  You are quite correct, I can deal with it.

However on the whole, I would say that the=20
proposal is socially, politically, commercially=20
and technically impossible to implement.&nbsp; It=20
makes incorrect assumptions about how people use=20
email, how they update software, how companies do=20
business, how ISPs do business, how email travels=20
from point a to point b and who sends it.

Mark's Response:

Social and political concerns are of no interest.  It is technically 
feasible, beyond any doubt, or the system concept could not have even been 
designed.  Also, commercial companies would benfits from the system being 
able to reach a wider audience as people will not have spam to fear from by 
subscribing to corporate information/mailing lists.  Add to this the 
additional capital saved plus the additional revenue gained from new 
customers and our commercial companies will be
extremely happy.  The system makes no such assumptions.  It re-writes the 
rule book.

Mark McCarron.

_________________________________________________________________
Stay in touch with absent friends - get MSN Messenger 
http://www.msn.co.uk/messenger

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Sat, 28 Jun 2003 20:57:54 -0400

I've replied to this off-list (what can I say, I'm a sucker). 
However my recommendation (if anyone cares) is that further on-list 
replies to this proposal are a waste of bandwidth.  We have quite 
enough pointless battles as it is.  Battling over whether it's 
feasible to implement a fascist NGO with complete control over your 
company's ability to send email is probably not something we need to 
do.
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: Fearghas McKay <[email-masked]>
Date: Sun, 29 Jun 2003 18:39:18 +0100

>often solely based upon the Fortune 500 companies.

Those who are not on the RIPE Anti-SPAM WG mailing list will have missed
this introduction that Mark made there:

--==--
I fully understand that this mailing list is
non-technical, however, maybe some of you know people
who develop these systems and can pass it along.

I have been reading the open letter regarding spam by
Bill Gates.  I used to work for MSN UK as technical
support and I addressed this issue with them in
1997/1998.  At that stage MSN's email servers were open
to the world, although filters were in place, I found
that I could send spam without to many problems.

I have considered this problem extensivly for the last
5 or 6 years and have developed a solution.  This
solution is highly cost-effective and eliminates
challange-response systems.
--==--

To call a RIPE list non-technical is interesting however a quick google
search also shows up:

>"And Mark McCarron, an associate and advisory board member of
>The Great Pyramid of Giza Research Association, wrote a research
>article called "The Epsilon Theory."  Mark calls it "Wild Speculation."
>Nevertheless, he may have discovered how to regenerate living tissue!
>The article may be viewed in the Development section of his website,
>The Case for the Giza Necropolis Primer, at:
>
>     http://homepage.ntlworld.com/giza.necropolis/index.html

He also claimed on the RIPE list that he has approached 500 ISPs and within
a day 90% said that they would deploy his proposed system. He was
unfortunatly unable to provide us with any names or references.

In short I would suggest that we do not feed the troll.

Cheers

	f

PS SInce