Subject: [Asrg] attention bonds, was Email Postage

From: John R Levine <[email-masked]>
Date: Sat, 22 Nov 2008 15:02:07 -0500 (EST)

>> Ooh, there's a bad idea I haven't seen for a while.
>
> [citation needed]

It's not very hard to type "attention bonds" into Google, but if you don't 
want to do that, here's a blog entry I wrote a few years ago:

http://weblog.johnlevine.com/Email/attentionbond.html

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: mathew <[email-masked]>
Date: Sat, 22 Nov 2008 20:07:15 -0600

> http://weblog.johnlevine.com/Email/attentionbond.html

So, to briefly summarize your objections and comment on them...

1. There's no way to set up a micropayment system that can't be hacked
around.

Evidence? That's a pretty strong assertion, given that we have systems like
SSL in place.

1.a. Bad guys will send fake payments from fake banks.

Which won't clear. Remember, unlike the checking system and the credit card
system, we can assume that every system that might need to be able to verify
a payment is connected to the network.

1.b. Bad guys will induce lots of people to e-mail them so they can collect
the payments.

Yeah, right. Just like everyone currently replies to spam messages they get?
I'm sure they'll be even more likely to reply when it might cost them money.

1.c. Bad guys will forge mail purporting to be from your friends.

And? It doesn't matter if they forge the identity, if they still have to
pay. It's the paying that makes the spamming uneconomical, not the
verification of identity. But if this really became a problem, smart friends
would start using S/MIME.

2. The infrastructure is too expensive for micropayments to work.

Maybe. It seems to me that if you can sell an MP3 or ringtone for a dollar,
or sell an SMS message for 10 cents and handle all the billing and still
make a profit, then selling an SMS-sized cryptographic postage hash for a
dollar ought to be pretty manageable.

3. It'll kill e-mail from countries with non-convertible currencies.

So anyone who cares about hearing from those countries can set up filters on
their inbox. And the rest of us, including people like me who currently
spam-filter everything from those countries anyway, can ignore that issue.

4. The banking system can't deal with that many transactions.

Yes, we might need O(1000) PayPals, by your figures. How many ISPs are
there?

5. There's no way to distinguish real banks, hence no way to distinguish
their bonds from (say) First Deceased Military Officers' Bank of Lagos,
Nigeria (sic).

Like there's no way to distinguish legitimate SSL certificate issuing
authorities, right?

6. It'll need strong authentication, and if you have strong authentication
you might as well just use that to solve the problem.

Like how? Please enlighten us as to how strong authentication can solve the
spam problem more directly, as we already have a workable scaleable strong
authentication system in S/MIME, and if we can leverage it to stop spam then
I'm ready to give it a try right now.

mathew

---

From: SM <[email-masked]>
Date: Sun, 23 Nov 2008 00:51:58 -0800

At 18:07 22-11-2008, mathew wrote:
>1. There's no way to set up a micropayment system that can't be hacked around.
>
>Evidence? That's a pretty strong assertion, given that we have 
>systems like SSL in place.

That doesn't prevent click fraud.

>1.b. Bad guys will induce lots of people to e-mail them so they can 
>collect the payments.
>
>Yeah, right. Just like everyone currently replies to spam messages 
>they get? I'm sure they'll be even more likely to reply when it 
>might cost them money.

There is a phishing industry.

>And? It doesn't matter if they forge the identity, if they still 
>have to pay. It's the paying that makes the spamming uneconomical, 
>not the verification of identity. But if this really became a 
>problem, smart friends would start using S/MIME.

S/MIME has been around for some time.  Although identity verification 
is a problem, there still isn't significant adoption of S/MIME.

>So anyone who cares about hearing from those countries can set up 
>filters on their inbox. And the rest of us, including people like me 
>who currently spam-filter everything from those countries anyway, 
>can ignore that issue.

In my opinion, a document that uses such an argument won't make it 
through the Standards process.

Any proposal that seeks to replace the existing email system will 
only gain adoption if it provides a significant incentive for the 
user base to switch to it.  The idea that solving the spam problem is 
the only inducement needed fails to take into account why some people 
still use email even though most of the messages are "unwanted".

Please don't read my comments about your arguments as saying that 
they don't hold.  They may likely be valid for some sections of the 
user base who will be induced to switch to the system you are 
advocating.  If you can build such a system and sell it, it may turn 
into a successful venture.

Regards,
-sm

---

From: John Levine <[email-masked]>
Date: 23 Nov 2008 16:55:46 -0000

Gosh, I love beating my head against the wall.

So since all of these objections have been addressed over and over and
over in the past few months, I'll let anyone who cares read the
archives.  People who think that micropayments will solve the world's
problems would also benefit by learning a little bit about the way
that banks work.

Oh, except this one that hasn't come up lately.

>authentication system in S/MIME

If S/MIME were scalable in practice, we'd all have S/MIME keys.  But
we don't.  Why is that?

R's,
John

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 23 Nov 2008 12:40:29 -0500

> Evidence? That's a pretty strong assertion, given that we have systems like

A few hundred million fully-compromised systems.  Any proposal like this
must also be accompanied by a viable plan to un-compromise those systems
and keep them that way.  Otherwise it's dead on arrival.

(Of course, if we could uncompromise those systems and keep them that way,
then for the most part, we wouldn't need this proposal or others like it.)

> Yeah, right. Just like everyone currently replies to spam messages they get?

Yes, many people reply to spam messages or -- because they foolishly
use mail clients that parse HTML, follow the URLs given in them.

So a second necessary demonstration is that any proposed system must
not rely on end users to make spam/not-spam determinations, because
they've shown that they're pretty bad at it.

> pay.

Not if they forge it from your friends' systems, which of course they
have long since demonstrated that they can do at will.

> 2. The infrastructure is too expensive for micropayments to work.

It is, by multiple orders of magnitude.

And so on.  There is really no point in going through the rest of these.

---Rsk

---

From: mathew <[email-masked]>
Date: Tue, 25 Nov 2008 09:05:31 -0600

> If S/MIME were scalable in practice, we'd all have S/MIME keys.  But

You still haven't explained how strong authentication can solve the spam
problem. Once you do that, we can discuss whether S/MIME is scalable.

mathew

---

From: mathew <[email-masked]>
Date: Tue, 25 Nov 2008 09:11:47 -0600

On Sun, Nov 23, 2008 at 11:40, Rich Kulawiec <[email-masked]> wrote:

> A few hundred million fully-compromised systems.

So, how come SSL hasn't been hacked around?

>  Any proposal like this

In that case, all proposals are dead on arrival and we may as well shut down
this list.

> they've shown that they're pretty bad at it.

Since the definition of spam, for me, is what I say it is, you've just
eliminated the possibility of any system that might categorize spam.

> have long since demonstrated that they can do at will.

The last time I received spam sent by a friend's system was... never. I'm
sure it happens, but the fact that it does isn't a consideration as far as
*I* am concerned.

And again, you're raising a hurdle it's impossible to pass. If you assume
that a system can only be acceptable if it cannot be bypassed by
compromising systems, then no system is going to be acceptable.

> It is, by multiple orders of magnitude.

So how come we have SMS?

mathew

---

From: mathew <[email-masked]>
Date: Tue, 25 Nov 2008 09:17:42 -0600

> Gosh, I love beating my head against the wall.

Well, the feeling's mutual. It seems that there's a community of people on
this list who believe that:

- No system is acceptable if it allows me to say what I consider spam.
- No system is acceptable if it can be bypassed by completely compromising
machines.
- Systems like SMS where people are billed 10 cents a message are
economically impossible.
- No system is acceptable unless it will gain widespread adoption
immediately.
- No system is acceptable unless it is usable by everyone on the Internet.

...and so on. Offering nothing positive, these naysayers shoot down every
proposal with the same tired objections that have been addressed over and
over and over as unreasonable or out of touch with reality.

mathew

---

From: "Al Iverson" <[email-masked]>
Date: Tue, 25 Nov 2008 10:21:33 -0600

> over and over as unreasonable or out of touch with reality.

As one of the naysayers, please allow me to encourage everybody who
thinks they can build such a thing to go do it. I think it's possible.
It just takes many millions of dollars, and it won't cover all email,
leaving some pretty big gaps.

Look at Goodmail....Daniel did it, is doing it. He didn't spend a
month of Sundays debating it with geeks on a list. Notice a difference
in approach there? Look REALLY closely. (DID IT, vs CRYING ABOUT HOW
PEOPLE ARE SO MEAN ABOUT IT NOT BEING A GREAT IDEA.)

Look at DNSBLs -- an example of a spam filtering mechanism that is
commonly accepted as best practice, even though it is heavily debated
by geeks and non-geeks. SORBS, Spamhaus, etc., they just went ahead
and did it. They decided the rules and decided to sell themselves, see
if they can drive recipient sites to agree and use their filters. To
varying degrees, of course, and some DNSBLs are run by morons. But
again, what's the difference there? Less debating, more doing.

Lessons to learn: There is no need to announce an e-Postage system on
this, or any other, geek-laden discussion list. If you do, you will be
pelted with eggs. If you want to make something happen, go make
something happen. Build it, then try to get people to come.

Regards,
Al Iverson
-- 
Al Iverson on Spam and Deliverability, see http://www.spamresource.com
News, stats, info, and commentary on blacklists: http://www.dnsbl.com
My personal website: http://www.aliverson.com   --   Chicago, IL, USA
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Tue, 25 Nov 2008 08:33:47 -0800

> something happen. Build it, then try to get people to come.

Conversely, if you try and build it and fall into exactly the
problems that either you didn't find out about because you didn't
ask people who know what they're talking about, or because
you did ask them but didn't want to believe or dig into the details
of the replies, you'll end up having wasted an awful lot of time
and effort that could have been avoided, and likely have people
pointing and laughing.

But when you get to the point of insulting people about how
they're wrong and you're right, you've probably extracted all
the wisdom you're going to get from that group of people, and
it's probably time to go and implement something.

In protocol development circles there's nothing much more
compelling than successfully interoperating implementations.

Cheers,
   Steve

---

From: Seth <[email-masked]>
Date: Tue, 25 Nov 2008 11:38:33 -0500 (EST)

> - No system is acceptable if it allows me to say what I consider spam.

Any system that blocks "what you consider spam" requires telepathy.

> - No system is acceptable if it can be bypassed by completely compromising

The easier it is to bypass a system, the less useful that system is.
The more this bypassing costs innocent victims (including incompetent
ones), the less useful that system is.

> - Systems like SMS where people are billed 10 cents a message are

They obviously exist.  Of course, heavy users pay $5/month for
unlimited messages.

> - No system is acceptable unless it will gain widespread adoption

No system that provides no immediate benefits to early adopters will
get wide adoption without coercion.

> - No system is acceptable unless it is usable by everyone on the
> - Internet.

A system that can't be used by a significant fraction of those I
communicate with thereby lacks value to me.

> ...and so on. Offering nothing positive, these naysayers shoot down
> every proposal with the same tired objections that have been
> addressed over and over and over as unreasonable or out of touch
> with reality.

"Running code and rough concensus"  You haven't provided the first,
why worry so much about the second?

Seth

---

From: mathew <[email-masked]>
Date: Tue, 25 Nov 2008 10:41:44 -0600

> it's probably time to go and implement something.

Given that the initial response was patronizing dismissal, I'm not sure
there was any wisdom on offer. I'm wondering if this list continues to serve
any useful purpose.

mathew

---

From: Rich Kulawiec <[email-masked]>
Date: Tue, 25 Nov 2008 11:46:45 -0500

> So, how come SSL hasn't been hacked around?

Why should anyone bother?  If the goal is, for example, to send spam,
then it's not necessary.  If the goal is to steal end-users' credentials
or credit card numbers or whatever, then a keystroke logger will suffice.
If the goal is to read the contents of the end-users' disk volumes
(for whatever purpose) then just reading them will do.

> In that case, all proposals are dead on arrival and we may as well shut down

No, there are plenty of other ideas (and implemented systems) which do not
rely on the presumed integrity of those end-user systems.

> Since the definition of spam, for me, is what I say it is [...]

That is not the correct definition of spam.  The correct definition
of spam (in the context of SMTP) is "unsolicited bulk email".

> sure it happens, but the fact that it does isn't a consideration as far as

If you are going to propose a global solution, then you must take account
global problems.  You should also not presume that spammers will sit back
and do nothing if/when it's deployed -- they're already demonstrated the
ability to respond rapidly and undercut poorly-thought-out ideas and
implementations.  So one of the questions that should occur to you
is *why* spammers, having that ability well in hand, have largely not
bothered to exercise it...thus far.

> compromising systems, then no system is going to be acceptable.

In the case of end-user systems, yes.  No proposed anti-spam methodology
can rely on the integrity of end-user systems, because we are all well
aware (or should be) that they are already compromised in enormous numbers,
with more becoming so every day.  (Conversely, any that *does* rely
on that presumed integrity is very brittle, and will be completely
undercut whenever it pleases spammers to do so.)

Note please: "end-user systems".  I think there's at least a fighting
chance of securing non-end-user systems by judicious choice of operating
system, configuration, etc.

---Rsk

---

From: "David Nicol" <[email-masked]>
Date: Tue, 25 Nov 2008 10:47:07 -0600

> there was any wisdom on offer. I'm wondering if this list continues to serve

Networking; social; procrastination; I guess it depends on your, er,
utility function.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: "Al Iverson" <[email-masked]>
Date: Tue, 25 Nov 2008 10:47:42 -0600

> there was any wisdom on offer. I'm wondering if this list continues to serve

This list (and others) are great places to find like minds to work
with on (offlist) collaboration. If you're not finding anybody who
finds your idea worth making a time (or even thought) investment in,
then I sympathize, but it's probably time to find your own path
without us.

My take on things like e-Postage is basically build it, show it to me
working at an ISP or three, and then I'll care. I, like a lot of
others here, are worn down from the endless exclamations of "I've
designed the next big thing!" from each subsequent generation of noobs
with perl experience and a gosh gee golly mentality. Seriously, it
happens constantly. If I had a nickel for every time somebody
suggested e-Postage, I'd be rich, and I'd have enough left over to
make Steve Atkins and John Levine rich, too.

Best,
Al

---

From: mathew <[email-masked]>
Date: Tue, 25 Nov 2008 10:47:52 -0600

> Any system that blocks "what you consider spam" requires telepathy.

Apple should patent their software telepathy then.

> ones), the less useful that system is.

I disagree. I don't see that shielding the incompetent and unwise from the
cost of their ignorance and poor decisions is a necessary feature of all
systems.

> They obviously exist.

OK, so we can be done with the "it's economically impossible" canard?

> communicate with thereby lacks value to me.

So don't use it. Nobody has ever said that you personally will be required
to collect attention bonds, or that everyone will be required to. However,
it was objected that *I* shouldn't be able to collect them, because people
from countries with non-convertible currencies wouldn't be able to pay.
Hence the response that I don't communicate with anyone in such countries.

> why worry so much about the second?

If you have a working implementation, who cares about consensus?

mathew

---

From: mathew <[email-masked]>
Date: Tue, 25 Nov 2008 10:51:41 -0600

On Tue, Nov 25, 2008 at 10:46, Rich Kulawiec <[email-masked]> wrote:

> Why should anyone bother?

To phish.

> rely on the presumed integrity of those end-user systems.

Such as?

> of spam (in the context of SMTP) is "unsolicited bulk email".

And who, other than me, knows what I solicited?

> global problems.

Maybe you have a different definition of "global". To me, a global solution
is one that is not restricted by geography; it's not necessarily a system
that anyone can use. The telephone network is a global system, but there are
still plenty of people who can't afford or can't use a telephone.

mathew

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 25 Nov 2008 10:47:38 -0700

On 25/11/2008 09:21, "Al Iverson" <[email-masked]> wrote:

> pelted with eggs.

+1

---

From: "Al Iverson" <[email-masked]>
Date: Tue, 25 Nov 2008 14:50:39 -0600

Hi Barry,

Somehow your message to the list was misdirected to me by accident.

Regards,
Al Iverson

---------- Forwarded message ----------
From: Barry Shein <[email-masked]>
Date: Tue, Nov 25, 2008 at 2:45 PM
Subject: Re: [Asrg] attention bonds, was Email Postage
To: [email-masked]

I think this note labels you clearly a fucking idiot.

Take yourself off the list and then we can all stop bothering you.

Fucking idiot.

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 25 Nov 2008 16:16:21 -0500

> If you are going to propose a global solution, then you must take account

Indeed.

He's almost certainly been spammed by a friend's system.  Lots. It's
seldom obvious, and usually indirect, but the reality is that once a
machine is owned, just about _anything_ can happen.  Why haven't they
been "getting around" SSL and S/Mime?  Because they haven't needed to
... yet.  There's relatively limited benefit for the effort.  But once a
"solution" that uses them becomes common and popular, it _will_.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 26 Nov 2008 01:12:04 -0000

>If you have a working implementation, who cares about consensus?

Only people who want to interoperate.

But please, since you've evidently figured out how to solve all the
problems that we morons think are insoluble, build a working
implementation and prove us all wrong.  Until then, you're just
blowing smoke.

R's,
John

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 26 Nov 2008 17:22:18 +0100

>> The correct definition of spam (in the context of SMTP) is
>> "unsolicited bulk email".
> 

The senders who have been solicited to send it.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Seth <[email-masked]>
Date: Wed, 26 Nov 2008 12:14:48 -0500 (EST)

> The senders who have been solicited to send it.

Only if they get confirmation.

(Even the spammer who forged the solicitation doesn't _know_ if the
recipient also solicited the message.)

Seth

---

From: Rich Kulawiec <[email-masked]>
Date: Wed, 26 Nov 2008 12:52:42 -0500

On Tue, Nov 25, 2008 at 10:41:44AM -0600, mathew wrote:
> there was any wisdom on offer.

That's because we (for some values of "we") have seen the same thing
proposed many times over.  And (speaking for myself only) my perception
is that each new proposal repeats the pattern of overlooking profound,
instrinsic difficulties.  That is, these proposals focus on narrow
tactical points while ignoring larger strategic issues or pretending
they don't exist or minimizing their significance.

And in addition: the adversary reads this list and many others.
The adversary is smart, well-funded, highly motivated and occasionally
innovative.  Surely any proposal we consider has to take into account
that the adversary won't just passively stand by while it's implemented
and blithely accept its consequences.  Much more likely -- and we've
seen this already -- is that the adversary will conduct careful analysis
designed to uncover ways to repurpose and exploit any steps we take.
In this particular case, layering a micropayment system on top of
a known-insecure foundation seems to me to be doing much of the
adversary's work pro bono.

---Rsk

---

From: Barry Shein <[email-masked]>
Date: Tue, 25 Nov 2008 21:04:13 -0500

> Only people who want to interoperate.

What I sincerely do not understand is why it is so important for some
people to not just fast forward through the messages which they
personally believe will not be fruitful but instead to stop and try
their level best to discourage the conversation entirely.

All that does is act as a multiplier, a lot of the volume in the past
few days on "email postage" has been nothing but meta-discussion on
whether or not to discuss email postage (including, unfortunately,
this message.)

As each point of view wanders from the technical merits it of course
gets more heated because we have exited "research discussion" and
entered a realm of trying to control each other's behavior.

Maybe it's the influence of television, we shout at the TV, change the
channel, get annoyed at the lousy programming which isn't holding our
attention, etc.

But this isn't television, this isn't entertainment, the merit or
value of a technical discussion isn't how well it holds your attention
personally.

That said, since we've now gone over a decade with little effective
progress with spam, and it is still very destructive, perhaps phrases
like "interoperate" need to be examined.

I sense once again a nostalgia for a small-town culture where everyone
behaved (or was run out of town) is competing with a realization that
things have changed.

I don't see the spam problem as purely in the realm of
interoperability if by interoperability one means a certain symmetry
among all players, servers and clients et al.

Some asymmetry may be necessary to get this problem under
control. With luck it will be a reasonably voluntary asymmetry,
reasonable, not perfect, just reasonable.

 > implementation and prove us all wrong.  Until then, you're just

You see, this is just unnecessary. This is a research group, not a
"show us your working implementation group and we'll try to set down
how many bits in a flag field" group.

This spam problem remains incredibly intransigent and shooting down
ideas with hair-trigger impatience because you personally don't see
your way clearly through to the end is not productive.

I've been involved in research, off and on, for over 30 years.

Research is not a simple linear process. Sometimes one re-opens old
ideas when nothing else is working to see if something has been
missed.

The simple assertion:

  If spammers had to pay fairly for the resources they use then there
  would be no spam problem as we know it today.

is prima facie true and obvious, or should be. It is a given that
crime is a spammer's stock in trade, their business model does not
allow for fair payment for resources.

That, in a sentence or two, is the essence of email postage or similar
ideas: How can we make spammers pay fairly for the resources they use?

It's different than:

  Spammers will slam me with thousands of messages a day, how can I
  not see them or at least not "believe" them?

Which sums up about 99% of the rest of the discussion.

To some extent it has a fallacy inherent because it overwhelmingly
characterizes the "spam problem" as a problem only for the end-user
who is interrupted or distracted by spam.

But as I've tried to present here that is only the tip of the iceberg,
albeit the tip which is out of the water and the one most people sit
on so understandably find attractive. Unfortunately for me I live in
the cold, dark, murky depths of the rest of the 'berg, as do most
ISPs.

There is also all the bandwidth and computrons which must be devoted
to this filtering and blacklisting. Someone pays for all that and the
cost just rises and rises. All that keeps it from driving the business
models over the edge is that the computrons keep getting cheaper and
cheaper. But there's still the software technology, etc.

The main place these two views meet is at the "starve a fever, feed a
cold" point which is the theory that maybe if we could effectively
filter out all (or almost all) of this spam through blacklists and
DKIM-like schemes and spamassassin schemes etc. that PERHAPS the
spammers would give up since they're not getting through. That is, it
would choke off their livelihood.

There is no hard evidence that this starvation theory is true, it is
perhaps a compelling theory, but yet to be proved.

It is not even clear we can filter down the spam influx sufficiently
to make life pleasant except perhaps when individuals agree to live
within virtual gated communities.

Consequently, the two approaches:

    1. Stop the end-user from seeing the spam.

    2. Make the spammer pay for what s/he uses.

seem to me equally valid topics of discussion, each with various
sub-topics (1b. help the end-user realize a message is not from a
trustworthy source, 2b email postage: threat or menace?)

But the meta-discussion isn't productive.

Personally, I can skim through it quickly enough, but clearly some
fool themselves into thinking that the meta-discussion is urgent and
important when, in my opinion, it is anything but, it's just sniping,
all heat, no light.

-- 
        -Barry Shein

The World              | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Wed, 26 Nov 2008 19:07:51 -0500

Well, I realize there's a lot of emotional investment in this "moral
hazard" view of spam as "stuff I don't want and/or didn't ask for" but
I still think a more reasonable definition is bulk email which is
unpaid for (analogous to postage.)

I don't particularly care if it was solicited or not. If I call Sears
and ask them to send me a catalogue that doesn't compel the post
office to bring it to me for free (I don't think Sears has a catalogue
any longer, but whatever.)

It also removes most of the judgement. Who really wants to argue
whether something is "solicited" or not?

It's a rathole. For example, subsidiaries, partners, etc. Ebay owns
paypal, so if you told ebay to send you updates does that mean paypal
can also send you "updates"?

Also, I bought like one or two little things from Amazon a while back
and to this day they send me email every single day pitching
something, often trying to relate it back to the book I bought in some
way but often not, just random, or very general (buy anything over $XX
by Friday and shipping is FREE!)

Is that spam?

I don't really care. I just think if they had to pay for delivery
maybe they wouldn't pelt me and everyone else daily.

Right now the only thing which limits Amazon (et al) is what volume
they imagine will really piss me off at them and they try to stay on
the safe side of that, it's purely PR and marketing.

Apparently that's once per day except sometimes when it's twice a day
because there's something really, really important coming up like
Christmas, or Tuesday.

Anyhow, go ahead, keep trying to make up an entire economic and
justice system.

Unfortunately, lacking any leadership, the big backbone types have
another plan, net non-neutrality.

-- 
        -Barry Shein

---

From: John Levine <[email-masked]>
Date: 27 Nov 2008 17:26:43 -0000

>their level best to discourage the conversation entirely.

Well, OK.

New rule: all future messages about e-postage, attention bonds, and
other pay-to-spam schemes MUST have the word "postage" in the subject
line.  Then we can put it in our killfiles.

I mean it, by the way.

R's,
John

---

From: Rich Kulawiec <[email-masked]>
Date: Thu, 27 Nov 2008 13:40:04 -0500

> ideas: How can we make spammers pay fairly for the resources they use?

And the essence of the answer is: you can't.  It's impossible, both now
and for the forseeable future.  It doesn't matter what scheme you (or
anyone else) come up with, it can't be done.

Unless...

Unless you can figure out a way to uncompromise ~10e8 systems *and keep
them that way*.  Because as long as those systems are out there, spammers
have the ability to make other people pay for their spam at will.

And AFAIK, nobody has a viable solution to that problem.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Thu, 27 Nov 2008 14:33:44 -0500 (EST)

> Unless you can figure out a way to uncompromise ~10e8 systems *and
> keep them that way*.  Because as long as those systems are out there,
> spammers have the ability to make other people pay for their spam at
> will.

And, ironically enough, that fix would mostly eliminate the need for
anything like e-postage.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Bart Schaefer <[email-masked]>
Date: Thu, 27 Nov 2008 12:11:12 -0800

On Nov 27,  1:40pm, Rich Kulawiec wrote:
}
} Unless you can figure out a way to uncompromise ~10e8 systems *and
} keep them that way*. Because as long as those systems are out there,
} spammers have the ability to make other people pay for their spam

Maybe we shouldn't care, provided that it's not the receivers who pay.

I don't see a high-profile industry consortium arguing about how to
prevent PBXs from being cracked to make fraudulent calls.  When a
phone system gets compromised, someone eventually notices it and does
something, including possibly calling law enforcement.

What fraction of owners of those ~10e8 compromised PCs *ever* find
out they have a problem?

A few misguided anti-virus systems tried sending return email notices
about compromised machines.  Bad idea on several levels.  But what if
the notices about compromised machines went back through some entirely
other channel, like a hardcopy letter sent by the ISP to which the
compromised machine is connected?

What does it take to get ISPs to monitor the situation, and to send out
those kinds of notices to potentially thousands of customers?  What does
it take to get those customers' attention when notified?

Does it really matter if there's a noise level of some compromised PCs
floating around, if there's a way to keep it tamped down?  The problem
right now is that it's running amok with no direct feedback.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Thu, 27 Nov 2008 15:31:11 -0500 (EST)

>> spammers have the ability to make other people pay for their spam

Or third parties.  Good point.  Provided it's the pwn3d's machines
legitimate owners, I'm inclined to agree with you.

> What does it take to get ISPs to monitor the situation, and to send
> out those kinds of notices to potentially thousands of customers?

Some do this to some extent already.  I don't know how many; I suspect
it's very few, but have no specific evidence either way.  (The one I
work for, for example, has a few rudimentary efforts in this direction
in place.  Perhaps it helps that our customer base is smaller than most
mass-market providers'.)

To get it to happen on a large scale, you have to make it cheaper to do
that than to ignore the issue - where "cheaper" is as perceived by the
people responsible for the decision, which is not the true cost.

> What does it take to get those customers' attention when notified?

The ISP I work for finds that getting cut off from the net usually
works in those few cases where a phone call from us doesn't.  Perhaps
we're unusual in this regard.  (And cutting the offending machine off
from the net solves the immediate problem even in those cases where it
doesn't get the customer's attention.)

If it were happening enough, we might have to institute some kind of
cleanup fee.  But, usually, we find that customers are glad to be told
when their machines get zombied - and in this respect I suspect we
_are_ unusual; our customers are mostly smallish businesses and
generally don't get blustery and "that can't be" when told we're seeing
misbehaviour emanating from their machines.  (The ones that aren't SMEs
are mostly ex-staff or friends thereof, not completely at arm's-length,
which both self-selects for sanity and predisposes them to believe such
a report from us.)

/~\ The ASCII				  Mouse
\ / Ribbon Campaign

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 28 Nov 2008 14:23:17 +0100

> unpaid for (analogous to postage.)

By your definition this mailing list consists of spam, doesn't it?

I still like better the definition that Rich quoted previously in this 
thread, namely
>>>> "unsolicited bulk email".

I wonder why it isn't mentioned on the ASRG's FAQ.

> I don't particularly care if it was solicited or not. [...]

Unsolicited is the key concept. The fact that solicitations are not 
being registered is even more astonishing than the missing definition 
of spam.

> [...] Is that spam?

What you are talking about is "somewhat abusive mass marketing". It 
may be considered spam, but it bears no false identification and is 
not sent via zombies. Just to note that you cannot impose payments on 
criminal activities.

> maybe they wouldn't pelt me and everyone else daily.

That statement is only correct given the current contingency. At other 
times, mass marketing through paid media, e.g. phone, results in 
intolerantly frequent calls. In general, money is not trustworthy as a 
unit of measure, and it tends to propel crime more often than it 
prevents it.

---

From: Seth <[email-masked]>
Date: Fri, 28 Nov 2008 12:19:07 -0500 (EST)

Barry Shein <[email-masked]> wrote:

> I don't particularly care if it was solicited or not.

I do.  That's what matters.

> If I call Sears and ask them to send me a catalogue that doesn't
> compel the post office to bring it to me for free (I don't think
> Sears has a catalogue any longer, but whatever.)

There is no "the post office" in email.

If Sears pays The Delivery Company to carry stuff around for Sears,
and The Delivery Company hands it to the front desk of my condo (since
the building is private property, that's as far as they can go), then
I _do_ expect my condo manager to deliver it to me (hold it for me,
whatever I've asked them to do) for "free" (actually, as part of the
services I pay them for every month).

That seems a lot more analogous to email.

> whether something is "solicited" or not?

I don't care whether the local Chinese restaurants pay somebody or not
to slip menus under my door, *I don't want those menus*.

> can also send you "updates"?

You should be specific in what you tell them.  If eBay pays $X/month
to have their email delivered, does that cover PayPal?  Same rathole.

> Also, I bought like one or two little things from Amazon a while
> back and to this day they send me email every single day pitching
> something, often trying to relate it back to the book I bought in
> some way but often not, just random, or very general (buy anything
> over $XX by Friday and shipping is FREE!)
>
> Is that spam?

What did you _tell_ Amazon when you bought those things?  What have
you told them since?

> maybe they wouldn't pelt me and everyone else daily.

So if I _want to_ receive their ads, you would prevent that from
happening (because neither Amazon nor I am willing to make whatever
payments you want to require)?

> the safe side of that, it's purely PR and marketing.

Plus laws, so apparently you haven't told Amazon to stop mailing you
(or you could sue them as an ISP).

> because there's something really, really important coming up like

Strange how I buy stuff from Amazon a lot more than you do, have their
credit card (two, actually), and still get an order of magnitude less
mail from them than you're claiming.

Seth

---

From: "David Nicol" <[email-masked]>
Date: Fri, 28 Nov 2008 13:31:29 -0600

> And AFAIK, nobody has a viable solution to that problem.

I disagree.  Rich, and others who maintain this conviction, seem to be
blind to the gap between "apply the scheme to those who sign up for
the scheme" and "apply the scheme to everyone in general from the top,
down, as if there was a top that could enforce application of the
scheme"

The first is possible, the second is not.  Tainting discussion of the
first by pointing out the difficulties with the second is
nonproductive.

I believe this message to be, while meta, on-topic and compliant.

David Nicol

-- 
signature closed for repair
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 28 Nov 2008 20:07:48 -0000

> the scheme"

Oh, I think we all agree that it's not hard to build a walled garden.
But it's not very interesting, either.  There are plenty of failed
attempts to be found by anyone who bothers to do some research.

R's,
John

---

From: "David Nicol" <[email-masked]>
Date: Fri, 28 Nov 2008 14:42:29 -0600

On Fri, Nov 28, 2008 at 2:07 PM, John Levine <[email-masked]> wrote:
> it's not hard to build a walled garden.

Not if you're they kind of person who reads this list, no.  But is
there a walled-garden-O-matic for those that don't?  Systematic
treatment of why walled garden initiatives fail?
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Seth <[email-masked]>
Date: Fri, 28 Nov 2008 18:34:22 -0500 (EST)

> treatment of why walled garden initiatives fail?

They don't necessarily fail.  LiveJournal, Twitter, FaceBook, etc. are
all walled gardens, and they all work fine.

They just don't _replace_ other technologies.

Seth

---

From: John Levine <[email-masked]>
Date: 28 Nov 2008 23:54:24 -0000

>treatment of why walled garden initiatives fail?

Good questions (really).  Perhaps you could do some research.

R's,
John

---

From: Barry Shein <[email-masked]>
Date: Fri, 28 Nov 2008 15:56:07 -0500

> And AFAIK, nobody has a viable solution to that problem.

Well, tightly managed white lists work just fine and approach 100%
efficacy.

Here, try this experiment: Set up a filter to throw away all mail
which isn't apparently from this list and received: from the usual
ietf server(s). Throw everything else away.

I don't see how 10^8 compromised systems can get past that, short of
the ietf mail server being compromised which could happen but isn't
likely, and is less likely to persist long enough to be much of a
concern.

Lather. Rinse. Repeat.

Many people do just that sort of thing, run strict white listing.

Often what they do is have one personal acct which is strictly
whitelisted and another (or 10) which are more open.

Now, why isn't that a disproof of your assertion?

Because everyone won't adopt this approach?

Well, that's not at all what you said. And, short of quibbling
"everyone" even that's arguable.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Fri, 28 Nov 2008 15:59:36 -0500

> And, ironically enough, that fix would mostly eliminate the need for

But we're back to the overlap point of the two approaches to spam
elimination, if I may review:

  a) Make it so I don't see spam or at least don't trust it (filtering
  etc.)

vs.

  b) Make it so spammers have to pay for their resources in one way or
     another so they don't send it in the first place.

The overlap is: If we could achieve either at a high level of efficacy
then spammers would starve, they would all go out of business.

"b" of course presumes that the spammers' business model is
unsupportable if they had to pay for their resources.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Fri, 28 Nov 2008 18:06:26 -0500

> I do.  That's what matters.

And you generally find that the post office will bring your mail for
free (to the sender) or the telco will deliver SMS's (to the sender or
whomeve) for free because you solicited them?

 > There is no "the post office" in email.

No, but anything which is charged for has an agent involved in the
charging. Often many (e.g., credit cards->processors->bank->vendor.)

 > That seems a lot more analogous to email.

No, it is not, as you said Sears paid for the delivery.

In email the sender paid nothing other than their bandwidth and
computron costs (if that, e.g., zombies), which is more analogous to
the printing and production costs of the catalogue or trucking them
down to the post office.

 > to slip menus under my door, *I don't want those menus*.

Well, if they had to pay postage do you think you would get as many?

Anyhow, so what? Spam is not analogous to the occasional chinese
menu. It's more like having to get a shovel to dig a hole big enough
to find your door because 5-ton dump trucks of chinese menus are being
unloaded on your door daily.

I think we all tend to agree that inherent to spam being a problem
worthwhile discussing is its volume.

Ihat is, if we got one spam per week (no filtering) I doubt we'd spend
our time worrying about it like this.

 > to have their email delivered, does that cover PayPal?  Same rathole.

Well, like any postage scheme, they may affix their stamps to whatever
they like if they're authentic and paid for.

So that question is moot.

 > What did you _tell_ Amazon when you bought those things?  What have

What difference does that make, really?

Actually, I am sure that if there was any checkbox I saw that said I
DID NOT want any email solicitations etc I would have checked (or
unchecked as the case may be) them, I never, ever say yes to that
stuff.

So either they managed to slide something past me, or they ignored my
requests/checkmarks, or they never really asked and have decided that
if I bought something from them my mailbox is their playground.

I suspect the latter.

 > payments you want to require)?

Well, only to the extent that we "prevent" them from sending you paper
mail by requiring postage be paid.

Now you're off in the realm of some utopian communist sort of polemic,
charging for food starves babies and all that -- food should be FREE!

Are you sure that's where you want to go?

 > (or you could sue them as an ISP).

Well, I'm not so sure about any such laws.

But you're quibbling the specific example to death which is a very
boorish method of argument.

Bulk email senders should pay.

The rest is only some attempt to explain what is meant by that.

I really am not all that interested in your interpretation of the
CAN-SPAM act and how it applies to customers who have done business
with Amazon.

 > mail from them than you're claiming.

Maybe your filters are dropping the rest?

Maybe it's BECAUSE you buy a lot more that you get less email
solicitation.

Maybe we need a more objective measure.

Maybe this specific line of reasoning isn't really interesting or
germaine, at some point it's just argument for argument's sake since
if I got even exactly as many messages as you get it would still
support my point.

Therefore, I enter a motion of dismissal on prima facie evidence:

  Opposition has just presented evidence sufficient to prove our case
  so we request that we not be required to present any further on this
  specific matter.

         -b

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 29 Nov 2008 13:28:25 -0500

> likely, and is less likely to persist long enough to be much of a

If the system of any subscriber is compromised, or if the email
credentials (username, password, server triplet) of any subscriber
are used on a system which is compromised, then the adversary has the
ability to send mail as the subscriber.  Note that compromise of some
systems will lead to disclosure of many sets of email credentials.

(So why haven't we seen more of this to date?  There's no need for
spammers or phishers to bother.  However, it's abundantly clear that
they have had this ability for years and can exercise it at will.
And no doubt were we so silly as to deploy an infrastructure that
they've already thoroughly defeated, they *would*.)

---Rsk

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 29 Nov 2008 14:20:35 -0500

> down, as if there was a top that could enforce application of the

Irrelevant, *and* a mischaracterization of my position.

It's irrelevant because it doesn't matter which of the two scenarios
above prevails; all of these schemes are pre-failed because they
all presume that something is true which is emphatically false: network
endpoints are secure.  All of these proposals thus amount to attempts
to layer a trust mechanism on top of an already-known badly-broken base.

(And, I might add, a base which continues to become still more broken,
both in terms of extent and severity.)

---Rsk

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 21:39:51 -0600

> anyone else) come up with, it can't be done.

If it's impossible to prevent spammers from using other people's resources
merely by technical changes to how e-mail works, then why don't we see
enormous problems with spammers using other people's resources to host web
sites?

mathew

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 21:44:38 -0600

> They just don't _replace_ other technologies.

http://www.mappingtheweb.com/2007/07/11/facebook-email/

http://mashable.com/2007/11/07/uk-social-networks-email-clients/

http://www.web-strategist.com/blog/2007/04/03/i-only-use-email-to-communicate-with-old-people/

I too get more personal messages from friends via Facebook than I do via
e-mail, which is why I say that if we just sit here insisting that the spam
problem can't be solved, e-mail will just fragment into walled gardens like
we had before the Internet.

mathew

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 21:47:07 -0600

> to layer a trust mechanism on top of an already-known badly-broken base.

I think you're on the wrong mailing list. You should be on the "how do we
un-pwn a few million Windows PCs" list, if you think that that's an
essential prerequisite to doing anything technical about spam.

mathew

---

From: Seth <[email-masked]>
Date: Sun, 30 Nov 2008 00:40:39 -0500 (EST)

> enormous problems with spammers using other people's resources to host web

There are spam gangs that host both web servers and DNS servers on
dialup sites, changing every few minutes.

Seth

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 07:09:56 -0500

> essential prerequisite to doing anything technical about spam.

First, it's not a few million, it's a few hundred million.

Second, it's not a prerequisite to doing anything technical about spam.
It's a prerequisite to doing anything technical about spam *that requires
treating those systems as trustworthy*.

---Rsk

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 07:11:10 -0500

> enormous problems with spammers using other people's resources to host web

We see exactly that.  Are you not aware that spammers have, for years,
hosted their web sites on zombies and used fast-flux DNS techniques
to distributed traffic to them?

Really, you should at least make a perfunctory effort to acquaint yourself
with the rudiments of the spam problem before proposing solutions for it.

---Rsk

---

From: mathew <[email-masked]>
Date: Sun, 30 Nov 2008 11:24:26 -0600

> treating those systems as trustworthy*.

Since a pwned machine can impersonate the user to any degree necessary, that
means spammers can send e-mail which is identical to e-mail sourced by the
user. Hence you just eliminated all technical solutions to the problem. So
we may as well shut down the list.

mathew

---

From: Barry Shein <[email-masked]>
Date: Sat, 29 Nov 2008 14:55:11 -0500

> systems will lead to disclosure of many sets of email credentials.

Not if you filter at the IP level of the servers for example. Or not
for long.

My original comment suggested you whitelist so only [email-masked]
email could get to you, and only accept it if it came from an IETF
server (possibly via your internal servers, but at the border.)

10^8 zombies can't get past that.

As I said it leaves the remote possibility that they've compromised
the IETF mail servers but I don't think that's what you're talking
about, and I tend to doubt that would be a major problem.

Whitelists, if properly constructed, can work.

The problem is they're too restrictive for most people.

Anyone else remember when you could not send any email to any IBM
employee unless that employee specifically added you to their
corporate whitelist? You had to call the person on the phone or
similar (fax perhaps), or ask someone else who was whitelisted to
forward your requet.

That was in the 80s and it seemed so...draconian. Maybe it's still
like that.

I suspect in terms of spam and other unsolicited email it probably
worked pretty well depending on their own enforcement and policies.

-- 
        -Barry Shein

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 12:47:21 -0500

> we may as well shut down the list.

Not "all" technical solutions have been eliminated, just some.  And even
those measures which might in and of themselves not constitute full
"solutions" may still be useful.

---Rsk

---

From: mathew <[email-masked]>
Date: Sun, 30 Nov 2008 11:55:43 -0600

On Sun, Nov 30, 2008 at 11:47, Rich Kulawiec <[email-masked]> wrote:

> Not "all" technical solutions have been eliminated, just some.

Describe one which hasn't?

mathew

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sun, 30 Nov 2008 20:24:13 +0100

On 2008-11-30 11:55:43 -0600, mathew wrote:
> > > Since a pwned machine can impersonate the user to any degree
> > > necessary, that means spammers can send e-mail which is identical
> > > to e-mail sourced by the user. Hence you just eliminated all
> > > technical solutions to the problem. So we may as well shut down
> > > the list.
> >

Any system which either doesn't care about whether the sending system is
compromised or which puts a noticable burden on the owner of a
compromised system but not the owner of a non-compromised system.

Some examples I can think of:

* Content filters.

* Keyed address systems (where a different email address is used per
  correspondent). When an address is leaked to a spammer, the address
  can be disabled and that correspondent has to aquire a new address.

* Feedback systems where compromised systems can be effectively
  quarantined.

	hp

-- 
   _  | Peter J. Holzer    | Openmoko has already embedded
|_|_) | Sysadmin WSR       | voting system.
| |   | [email-masked]         | Named "If you want it -- write it"
__/   | http://www.hjp.at/ |  -- Ilja O. on [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 15:41:14 -0500

> Describe one which hasn't?

Okay, here's one.

Netflow and similar analysis.  An end-user system which emits an average
of 10 messages/day or makes an average of 10 outbound TCP conections/day
to port 25 which is now observed emitting 5000 messages/hour or making
5000 connections/hour is, at minimum, suspect.  It would probably be
appropriate to throttle this (either at the TCP connection level or in the
outbound MTA, as applicable) to at least minimize impact while buying time
to alert a human.  Rate-limiting like this doesn't stop all spam outright,
but it stops some spam (and stops it at the source) while providing the
opportunity to stop more.

This is by no means a panacea, however it does pass one of the many
litmus tests that must be applied to any proposed tactic: "what would
happen if everyone did it?".  It also passes a related test: "what would
happen if only some people did it?".

---Rsk

---

From: mathew <[email-masked]>
Date: Sun, 30 Nov 2008 15:52:43 -0600

> opportunity to stop more.

Aren't ISPs already doing that, though?

And of course, spammers will just move to ISPs which aren't.

So it may not be eliminated, but I question whether it counts as a solution
to anything.

mathew

---

From: mathew <[email-masked]>
Date: Sun, 30 Nov 2008 15:58:25 -0600

> * Content filters.

Cause too many false positives.

>  can be disabled and that correspondent has to aquire a new address.

Causes immense nuisance to correspondents, and the spammer can acquire the
new address as soon as the pwned system is reconfigured with it.

> * Feedback systems where compromised systems can be effectively

Users will just move to ISPs who don't kick them off the net when they get
pwned.

See? It's easy to knock down every proposal with a quick dismissive comment.

mathew

---

From: SM <[email-masked]>
Date: Sun, 30 Nov 2008 14:31:36 -0800

>See? It's easy to knock down every proposal with a quick dismissive comment.

Some of the technical solutions are based on actual specifications 
which are used for an implementation.  Maybe someone can write an 
Internet Draft about attention bonds or email postage.  We could then 
have a discussion about that instead of the usual comments.

Regards,
-sm

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 18:17:50 -0500

> Aren't ISPs already doing that, though?

Some are, as are some universities and other entities.  Some aren't.

> And of course, spammers will just move to ISPs which aren't.

Of course.

> So it may not be eliminated, but I question whether it counts as a solution

As I was quite careful to point out, it's not a panacea.  It is however,
effective where used, which is all that can be said about *any* solution.
It works with existing technology.  It does not require reliance on
end-users or on end-user systems which stand a substantial chance of
being compromised.  It does not require invention of any new protocols
nor promulgation of new standards.  It's something that many MTA/network
operators can deploy (although by no means all).

---Rsk

---

From: John Levine <[email-masked]>
Date: 1 Dec 2008 01:32:15 -0000

>Describe one which hasn't?

They've all been eliminated.  You can go home now.

R's,
John