Subject: Email bar bof in Yokohama?

From: Ted Lemon <[email-masked]>
Date: Thu, 29 Oct 2015 01:33:04 +0000

I am curious to know whether the various participants in this conversation are planning to be in Yokohama, and whether, if so, they might be interested in an f2f discussion on this topic.   I know that there are some peoples' noses a bit out of joint, and it's clear to me that the way I phrased one of my earlier messages had something to do with that, but I think there is a fruitful discussion to be had, and my experience with many of the folks participating in this conversation is that we do better face to face.

On the topic of putting peoples' noses out of joint, I would just like to say that I do in fact think that SMTP and the rest have been a smashing success, and when I spoke about the authors not anticipating the internet of 2015 in all its glorious horror, my point was not to criticize them for failing to have done so, but simply to say that because the internet is what it is in 2015, some of what was designed in the good old days before the first green card spam didn't survive contact with the enemy, and I think we can do better.

In particular, I find the mass aggregation of email discomfiting for a variety of reasons, privacy being one, horrible usernames being another, and part of my motivation for being a gadfly about this is that I would really like to figure out if it's possible for people and companies that aren't Google or Yahoo to have any hope of participating in a global email transport system anymore.

---

From: John C Klensin <[email-masked]>
Date: Thu, 29 Oct 2015 00:13:44 -0400

--On Thursday, October 29, 2015 01:33 +0000 Ted Lemon
<[email-masked]> wrote:

> I am curious to know whether the various participants in this
> conversation are planning to be in Yokohama, and whether, if
> so, they might be interested in an f2f discussion on this
> topic.

Ted, while I would be interested in such a discussion, I will
not be in Yokohama.  I might be able to participate in a
discussion remotely, but that could equally be held at some
other time and, as you point out, some of us do better f2f.

>...
> some of what was designed in
> the good old days before the first green card spam didn't
> survive contact with the enemy, and I think we can do better.

Some of the people involved in this discussion are aware that
I've had one mailbox or folder (among many) that has migrated
among machines and domains but has basically existed for more
than 35 years (yes, it predates SMTP).  During that time, not a
single spam or other unwanted message has been deposited in it.
Its ideas of valid credentials have evolved over the years but
the basic entry condition is that the sender (and sender
address) must not just be whitelisted but must be able to prove
that the message came from that sender.  Now those constraints
are clearly impossible for general purpose use, if only because
they imply that senders must be pre-qualified in some way before
messages are accepted.   But the point, as usual, is that there
are tradeoffs in all of this, many of which would exist even if
we junked the current mail environment and went to a single-hop
environment (something that I continue to believe is impossible
in practice, even without the spam problem).

> In particular, I find the mass aggregation of email
> discomfiting for a variety of reasons, privacy being one,
> horrible usernames being another,

Indeed.  Even if one moves beyond privacy issues to concerns
about law enforcement access with all of the trappings, there is
a huge practical difference between "dear third party, give us
everything in Ted's mailbox and don't tell Ted we asked/demanded
it" and "dear Ted, give us everything in your mailbox and don't
tell Ted... whoops".

>  and part of my motivation
> for being a gadfly about this is that I would really like to
> figure out if it's possible for people and companies that
> aren't Google or Yahoo to have any hope of participating in a
> global email transport system anymore.

If the answer is "no" and the earlier comment that email
standards are set today, not by an open process but by a handful
of large providers working in concert (including those two),
then one meeting that ought to be held, with appropriate lawyers
present, would discuss a class action antitrust suit against the
companies involved.  It could be more effective, interesting,
and profitable than whining on the IETF list and, given that
standards-setting hypothesis, would presumably be prerequisite
to any real progress.

     john

---

From: Ted Lemon <[email-masked]>
Date: Thu, 29 Oct 2015 11:07:58 +0000

> other time and, as you point out, some of us do better f2f.

Thanks.  I'm sorry you won't be there--you are one of the people I was hoping could participate.   Unfortunately, it looks like the next N IETFs are all difficult travel IETFs for U.S. folks, which is fair enough considering how many U.S. IETFs we have had recently.

> it" and "dear Ted, give us everything in your mailbox and don't

Yup.   It also avoids the rich motherlode problem: if you have a hundred million mailboxes on your service, and someone breaks in, a hundred million peoples' privacy could be compromised (of course, this is an oversimplification, since I think google has some pretty solid security fu, for example, but we've seen other large providers, particularly the US government, hit by this recently).

> standards-setting hypothesis, would presumably be prerequisite

FWIW, I do not think that there is any bad action going on here.  Google accepts email from my server just fine, actually quite a bit better than a lot of Postfixes, because small sites so frequently use greylisting.   I haven't noticed Yahoo doing anything particularly good or bad.   The problem is not bad action, but simply that nobody is motivated to make things work in a distributed matter other than a few people like us.   And the big providers, by dint of their size, have really big problems, and really big staffs that are working on them, so it's not surprising that they move more quickly than we do and think me at least as a bit of a dilettante (it would be pretty funny if they thought of you that way).

---

From: John C Klensin <[email-masked]>
Date: Thu, 29 Oct 2015 09:46:46 -0400

--On Thursday, October 29, 2015 11:07 +0000 Ted Lemon
<[email-masked]> wrote:

> Thanks.  I'm sorry you won't be there--you are one of the
> people I was hoping could participate.   Unfortunately, it
> looks like the next N IETFs are all difficult travel IETFs for
> U.S. folks, which is fair enough considering how many U.S.
> IETFs we have had recently.

The issues for me are only partially costs and other "difficult
travel" issues.  With the Apps Area changes and reduction in the
number of WGs that are directly relevant to topics to which I
think I bring special expertise, it is hard for me to look at,
e.g., the IETF 94 agenda and conclude that it would be worth
giving up a whole week even if the meeting site were
travel-convenient.  So, without questioning the decisions
themselves, we are creating a reverse chicken-and-egg problem
around some topic groups.

>...
> Yup.   It also avoids the rich motherlode problem: if you have
> a hundred million mailboxes on your service, and someone
> breaks in, a hundred million peoples' privacy could be
> compromised (of course, this is an oversimplification, since I
> think google has some pretty solid security fu, for example,
> but we've seen other large providers, particularly the US
> government, hit by this recently).

yep.  Another part of this is that, while we often think of
things as having become a two-tier problem with a few giant
providers and a shrinking number of very small ones, it is
really three-tier, with, e.g., ISPs who offer email as a
collateral service (and who haven't outsourced those services to
one of the giant providers) in the middle.   It is a common
characteristic of those ISPs that email is a loss center --
something they have to do, but not something that will ever
produce any revenue and for which, for other reasons, almost no
one will ever select a different ISP because of bad email
service.   While I agree with you about Google (and maybe most
of their competitors in that tier), I've had lots of reasons to
be less optimistic about that ISP tier.

>> standards are set today, not by an open process but by a
>> handful of large providers working in concert (including
>> those two), then one meeting that ought to be held, with
>> appropriate lawyers present, would discuss a class action
>> antitrust suit against the companies involved.  It could be
>> more effective, interesting, and profitable than whining on
>> the IETF list and, given that standards-setting hypothesis,
>> would presumably be prerequisite to any real progress.
> 
> FWIW, I do not think that there is any bad action going on
> here.  Google accepts email from my server just fine, actually
> quite a bit better than a lot of Postfixes, because small
> sites so frequently use greylisting.   I haven't noticed Yahoo
> doing anything particularly good or bad.   The problem is not
> bad action, but simply that nobody is motivated to make things
> work in a distributed matter other than a few people like us.
> And the big providers, by dint of their size, have really big
> problems, and really big staffs that are working on them, so
> it's not surprising that they move more quickly than we do and
> think me at least as a bit of a dilettante (it would be pretty
> funny if they thought of you that way).

I didn't mean to suggest malice, although it can look that way
from the outside and to those who assume evil intent first and
then go looking for examples.  However, when a handful of
providers who together dominate the presumed market get together
to figure out how to mitigate those really big problems and do
in a way that hurts providers who are not part of that
self-selected group that is considered a priori illegal in some
jurisdictions.   For reasons that are ultimately the same as
those you  mention above and elsewhere, getting more careful
attention to the small provider situation and keeping protocols
interoperable across the whole range of SMTP implementations may
require some significant non-technical stimulus.

    john

---

From: Linus Nordberg <[email-masked]>
Date: Fri, 30 Oct 2015 01:23:22 +0100

Ted Lemon <[email-masked]> wrote
Thu, 29 Oct 2015 01:33:04 +0000:

| I am curious to know whether the various participants in this
| conversation are planning to be in Yokohama, and whether, if so, they
| might be interested in an f2f discussion on this topic.  I know that
| there are some peoples' noses a bit out of joint, and it's clear to me
| that the way I phrased one of my earlier messages had something to do
| with that, but I think there is a fruitful discussion to be had, and
| my experience with many of the folks participating in this
| conversation is that we do better face to face.

The thread 'draft-josefsson-email-received-privacy' over at perpass@ has
been discussing a meetup. Tuesday night seems to be the latest
unchallenged suggestion.

I'd be interested to meet email people, regardless of nose
configuration.

---

From: Ted Lemon <[email-masked]>
Date: Fri, 30 Oct 2015 05:50:56 +0000

> been discussing a meetup. Tuesday night seems to be the latest

Tuesday night works for me!

---

From: "John Levine" <[email-masked]>
Date: 30 Oct 2015 07:01:22 -0000

>| might be interested in an f2f discussion on this topic. ...

>I'd be interested to meet email people, regardless of nose

They're somewhat related, could probably discuss them over
consecutive beers.

R's,
John