Subject: [Asrg] Microsoft publicly announces Penny Black PoW postage project

From: Steve Schear <[email-masked]>
Date: Fri, 26 Dec 2003 09:14:53 -0800

http://news.bbc.co.uk/2/hi/technology/3324883.stm

Adam Back is part of this team, I think.

Similar approach to Camram/hahscash.  Memory-based approaches have been 
discussed.  Why hasn't Camram explored them?

steve

BTW, Penny Black stamp was only used briefly.  It was the Penny Red which 
was used for decades.  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Art Pollard <[email-masked]>
Date: Fri, 26 Dec 2003 10:34:52 -0700

>http://news.bbc.co.uk/2/hi/technology/3324883.stm

The concern that I would have is whether Microsoft has any patents 
currently in existence or any submarine patents that Microsoft will 
finalize in 5-10 years and demand a lock on e-mail if it is adopted.

I wouldn't worry about such techniques from most other companies since most 
try to be on the up-and up but Microsoft has a history of pulling stunts 
such as this. (Such as when they programmed early versions of Windows to 
crash when DRDOS was running which killed DRDOS. Novell won the suit but 
Microsoft still had the permanent lock on the market at that point.)

What would be nice though is if someone could set the amount of time it 
takes to have messages pass through.  For example, the president of IBM 
would have a higher "cost" for his time than the average home user.

-Art
-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

---

From: Art Pollard <[email-masked]>
Date: Fri, 26 Dec 2003 12:27:18 -0700

One problem I see with Microsoft's approach is that spammers could build 
server farms to combat it.  In fact, the fact that it uses RAM access 
speeds as a speed determining factor rather than CPU speeds has in fact 
just as serious a problem as the CPU speed issue.

Spammers could build server farms with cheap inexpensive computers and 10 
computers would allow them to send out 10 times the amount of spam.

By basing the algorithm on disk access times rather than CPU times, it 
would mean that spammers could then use cheap inexpensive computers to 
solve the puzzle.  For example, how expensive would it be to buy Pentium 
100's, 486's or even 386's (if you can find them) and build a server 
farm?  These used systems could be had for less than $100 and perhaps far less.

It might help slow down the "home" spammer but surely those that send out 
the bulk of the spam can afford additional computers to divide up the CPU 
processing load (and the power to power them.)

-Art

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 26 Dec 2003 13:45:49 -0500

[Subject changed as per posting guidelines, was "Re: [Asrg] Microsoft
publicly announces Penny Black PoW  postage project". Mod.]

Some interesting quotes:

> The idea was originally formulated to use CPU memory cycles by team 
> member Cynthia Dwork in 1992. But they soon realised it was better to
>  use memory latency - the time it takes for the computer's processor 
> to get information from its memory chip - than CPU power.

They are addressing one of the problems with HashCash - spammers with
faster computers can do it faster, and also mobile users will have
problems as well.

> That way, it does not matter how old or new a computer is because the
>  system does not rely on processor chip speeds, which can improve at 
> rapid rates.
> 
> A cryptographic puzzle that is simple enough not to bog down the 
> processor too much, but that requires information to be accessed from
>  memory, levels the difference between older and newer computers.

One problem that I see with this that nothing prevents spammers from
building specialized chips to do the computation. I remember sometime
ago that a specialized computer or chip was build to crack DES. But then
again, I am not a big cryptography expert and a lot of the details here
are murky.

This brings us to another interest quote in the article:

> "Microsoft's idea is to shift this cost burden from the recipient to 
> the sender, which in itself seems like a reasonable sentiment." But,
> he said, for such a scheme to be all-encompassing, there would have
> to be some provision for open standards, so that it is not 
> proprietary to Microsoft.

I wouldn't be suprised if they came here asking for standards on their 
technology, but if that does happen, they are required to disclose their 
IPR ahead of time.

What is also strange to me, is that they are releasing this by 
themselves, not as part of their "big gorilla" alliance with AOL and 
Yahoo. Taking into account that Yahoo released their proposal by 
themselves as well, it raises questions about their alliance.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
  "Why are both drug addicts and computer aficionados both called 
users?" (Clifford Stoll)
-------

---

From: "Vinny" <[email-masked]>
Date: Fri, 26 Dec 2003 17:10:28 -0600

For example, how expensive would it be to buy Pentium
> farm?  These used systems could be had for less than $100 and perhaps far
less.

Much cheaper, in fact. Try retrobox.com, or this url:

http://www.retrobox.com/rbwww/home/search_results_pc_computers.asp?bin_id=world&page=1&Manufacturer_ID=&CPU_ID=&CPU_Speed_ID=&RAM_ID=&HD_Size_ID=&CD_ROM_Flag=&Price=&order_by=price%5Fcurrent%5Fselling%5Fprice+asc

At this web page, at the time I looked at it, they were offering a Pentium
2, 133 mhz, 64 mb ram for $11.00, but you'd have to pay $30 or so for
shipping.

> processing load (and the power to power them.)

But every little decrease in spam helps. There was a slashdot article a
while back about a Bible thumping grandma spammer, (I would provide the url,
but /.'s search function is not coming up and Google's not helping) and we
really need to get those spammers out of the way. How much spam do they
account for? We'll never know until we try. And if we make spamming more
costly, more technical knowledge required, then we can start cutting into
the biggest spammers profit margins.

-Vinny

---

From: Thomas Harold <[email-masked]>
Date: Fri, 26 Dec 2003 18:54:57 -0500

Vinny wrote:
 >>farm?  These used systems could be had for less than $100 and perhaps far
 >
 > less.
 >
 > the biggest spammers profit margins.

(slashdot link)

http://yro.slashdot.org/article.pl?sid=03/12/14/198202

The Life of a Spammer
Posted by timothy on Sunday December 14, @02:28PM
from the neighbor-v-neighbor dept.
An anonymous reader writes "The Atlanta Journal-Constitution ran an
interesting article today about the life of a "small time" spammer. It
is interesting to note that even a religiously zealous grandmother can
mire our inboxes with junk." That's Flo Fox, of Slidell, LA.

(my comments)

HashCash / Penny Black proposals suffer from one flaw that I see... they
assume that there is no legitimate reason for a low-budget organization
to send high volumes of e-mail.  Driving up the costs for spammers also
drives up the costs for things like public mailing list servers.
Unfortunately, I'll bet spammers have deeper pockets or else they'll
just hijack additional machines to meet their quotas (something the
legitimate low-budget organization can't/won't do).

It's still an interesting idea, but I'm not sure that it's practical in
the real-world.

---

From: "Vinny" <[email-masked]>
Date: Fri, 26 Dec 2003 18:33:15 -0600

> http://yro.slashdot.org/article.pl?sid=03/12/14/198202

(stuff deleted)

> It's still an interesting idea, but I'm not sure that it's practical in

Thanks, that was the article I referred to.

And, yes, I think you're absolutely right. There are legitimate reasons for
small businesses/organizations to send out large quantities of email. (like
this mailing list) The problem is, they can't possibly waste that much time
sending each email, which is why I think the SPF spec is such a good idea.
But, just for the sake of argument, can't we use MS's plan, then for those
email sources that can't waste the time, just whitelist on an individual
basis? I actively ferreted out this list, actively sent an email to
subscribe. The ASRG mailing list people didn't send me an email out of the
blue, asking me "Do you want to join this anti spam list?". I can't think of
any non spam situation that wouldn't be covered by the MS plan/Hashcash +
individual whitelisting. People I don't know that really want to contact me
(e.g. an old high school friend) can still contact me out of the blue, and
for the legitimate mass emailers, I can whitelist.

Of course, there are smarter people than me on this list. Anyone want to
point out deficiencies in my argument?

-Vinny

---

From: Thomas Harold <[email-masked]>
Date: Fri, 26 Dec 2003 23:21:09 -0500

Art Pollard wrote:

>> <SNIP>
> Well, it could be combined with a whitelist.  Basically, the first 
> message (the subscribe message) could be HashCash/Penny Blacked.  Then 
> the subscriber would add them to a whitelist.  If the user failed to do 
> so after a couple of days, a warning message could be sent out and if 
> the person again didn't whitelist the mailing list, the mailing list 
> could unsubscribe them.
> 
> Not too bad really.
> 
> -Art

That thought also crossed my mind, where only untrusted domains would be 
required to Hash Cash / Penny Black (either through a whitelist or 
domains that don't have reverse-MX information).  Which makes it a bit 
more like the real-world concept of "friends are always welcome, 
strangers have to show multiple forms of ID before they get past the 
front door".  A targeted system would make it more palatable as you're 
only requiring strangers to do the calculation (or any system that 
doesn't seem quite on the up-and-up).

However, it's difficult to currently identify "friends", so any sort of 
targeted Hash Cash / Penny Black solution requires other things to be in 
place first.  (Reverse MX systems, mail servers that sign outbound mail 
with a private key that matches the public key in the DNS, etc.)

Seems a shame to waste all those CPU cycles though... pity they couldn't 
be turned into encryption cycles of the actual message content.

---

From: david nicol <[email-masked]>
Date: 26 Dec 2003 22:36:38 -0600

> http://news.bbc.co.uk/2/hi/technology/3324883.stm

Where does microsoft get off, taking credit for the idea of cost
shifting?

-- 
david nicol
Late to bed and late to rise makes it difficult to quote Poor Richard.

---

From: david nicol <[email-masked]>
Date: 26 Dec 2003 22:43:33 -0600

> be turned into encryption cycles of the actual message content.

They can and they are.  Those bold individuals who only accept
incoming mail with valid GPG signatures -- do they receive much spam?
Although you only need to sign your spam once before you distribute
it like so many blowing cottonwood seeds blowing in the midsummer winds
so never mind

carpe diem!  carpe diem!

---

From: Thomas Harold <[email-masked]>
Date: Sat, 27 Dec 2003 12:36:33 -0500

> it like so many blowing cottonwood seeds blowing in the midsummer winds

That is true if you're talking about signed e-mail... I was thinking 
more along the lines of using those CPU cycles to encrypt each message 
using the recipient's public key.

(Not that this has much to do with the CPU-payment models, just a sigh 
of pity that the CPU cycles are essentially being wasted... which wastes 
energy.)