Subject: [Asrg] The fundamental misconception about paying for mail

From: John Levine <[email-masked]>
Date: 28 Nov 2008 15:39:32 -0000

Barry says:
>The simple assertion:
>
>  If spammers had to pay fairly for the resources they use then there
>  would be no spam problem as we know it today.
>
>is prima facie true and obvious, or should be.

Indeed it is true.  But this is equally true and obvious:

  If senders of e-mail had to pay fairly for the resources they use
  then there would be no e-mail as we know it today.

Every sender of mail gets a free ride, both legitimate ones and
spammers.  We all know that receiving mail is vastly more expensive
than sending it.

We receivers cheerfully give the legit senders a free ride because we
find their mail worth reading.  If we imagined some sort of settlement
system to charge back costs to senders, and even if we imagine,
despite all the experience to the contrary, that the settlement system
itself didn't cost orders of magnitude more than the settlements it's
supposed to handle, that would still kill vast amounts of mail that
people want, such as this very mailing list.  Some senders would pay,
but probably not the ones you're most eager to hear from.  It'd be the
ones who'd otherwise send you paper mail, e.g., your electric bill,
and banks offering you credit cards.

How would we keep from killing all the mail we want?  The only method
anyone has ever proposed is for the recipients to skip charging
settlements to senders they like.  But once you know who you wouldn't
charge, you don't need the charges, you just whitelist the ones you
wouldn't have charged and filter the rest.  You'd still need some way
to get new senders into your whitelist, but the complete failure of
systems like Vanquish offers no reason to expect that charging is the
way to do it.

R's,
John

PS: If I seem a bit crabby about this, perhaps it is because I have
spent considerable time researching the way that proposed micropayment
systems work, researching the cost models for e-mail, telephone calls,
paper mail, and other messaging systems, and trying to build models
for the way filtering and charging might work and how they might or
might not scale and how they might be subverted by hostile parties.

So when someone shows up who hasn't bothered to do any research of his
own but just starts up with proposals that research would show have
failed in the past or have fundamental scaling or economic problems,
well, I guess I feel like an ISP talking to a kid saying "any idiot
can run an ISP, you just set up a couple of Linux boxes and some
modems and the customers come flowing in."

PPS: To anyone who is about to say "then don't do it that way, do it
some other way", we all want a pony, too.

_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Fri, 28 Nov 2008 10:51:30 -0500 (EST)

>   then there would be no e-mail as we know it today.

I'm not convinced.

> We all know that receiving mail is vastly more expensive than sending
> it.

Yes...but.

> find their mail worth reading.

Right.  So, to what extent does that mean that mean that "pay fairly"
would mean that the senders would have to bear the full cost?

It seems to me that fairer "pay fairly" would have the recipients
assuming those costs to the extent that they value the mail.  When I go
visit a friend, I don't ask the friend to pay for half the transport
cost (gas, transit ride, whatever); the visit is valuable enough to me
for me to assume those costs myself.  (With some friends, visits go
both ways and mostly balance out; with others, they don't, but, in the
cases where I do the visiting more, the visits are valuable enough for
me to be willing to assume an "unfair" share of the transport cost.)

Same goes with email, only the fundamental costs are _much_ lower, and
are almost entirely human time.  (Yes, there are other costs, but they
are _tiny_ compared to the human-time costs.)

That's basically what e-postage is based upon: an attempt to impose
fair payment based on a notion of fairness somewhat like that one.
(Not that this says anything about the myriad of other reasons
e-postage won't work in anything like today's world, such as the
impossibility of a suitable micropayment scheme.  Just that I don't
think "fair" is quite as simple here as you make it out to be.)

> wouldn't have charged and filter the rest.

That too isn't quite as simple as you make it out to be.

First, that assumes that the "skip charging" decision is based solely
on the sender's identity.  This is a reasonable first approximation,
but not more than that; it's totally plausible to me that I might want
some mail from a sender but not other - as with a company who sends me
both stuff I want (order confirmations, say) and stuff I don't (ads).
Today, we object to such things being mixed in the same email stream,
but that's because we need (FSVO "need") to make mechanized filtering
decisions based on simple prima-facie properties of the email.)

Second, that assumes that the decision to charge or not is based on
properties simple enough to be tested mechanically.  If we had this
mythical payment scheme, I know of some people I would wave off the
charges for most mail from, but would definitely charge for things like
chain email or yet another copy of the latest bigoted "joke" meme.

Third, it assumes that we have sender identities reliable enough that
we can mechanically detect whether the mail is from someone you don't
want to charge (or filter).  (I suppose this can be handwaved under "if
you're discussing a mythical system, it can have as many counterfactual
properties as you want".)

> some other way", we all want a pony, too.

Speak for yourself - I live downtown in a big city and have nowhere at
all to keep a pony.  I'd much rather have about another thousand square
feet of machine-room space. :-)

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: mathew <[email-masked]>
Date: Fri, 28 Nov 2008 12:43:21 -0600

>  then there would be no e-mail as we know it today.

Really? Bandwidth and disk space are cheap. If it cost me a penny to  
send each e-mail, I don't see that it would make any difference to how  
much e-mail I sent. You could probably even increase the price to 5¢  
per message and I wouldn't blink. How much e-mail do you think the  
average person sends, and do you have any sources to back up your  
estimate?

> find their mail worth reading.

No, we give them a free ride because the incremental cost of each  
message we receive is so close to zero as to be effectively zero.

I'm signed up for a dozen or more commercial promotional mailing lists  
from companies I do business with, because it costs me nothing to  
receive the additional e-mail, and I can auto-filter it into a folder  
because they're known senders. However, SMS messages cost me actual  
money to receive, so in spite of all the useful services available via  
SMS, there are exactly zero companies I have authorized to send me  
messages via that mechanism.

> [...] that would still kill vast amounts of mail that
> people want, such as this very mailing list.

Only if you assume a system where everybody is required to pay all the  
time, which is a ridiculous strawman. There's no technical reason why  
I should not be able to simply whitelist traffic from this list to be  
delivered for free.

Even if the hypothetical system was so dumb that it required everyone  
to pay to send e-mail all the time, a lot of things that used to be  
handled as e-mail are handled as web feeds now, and this list could  
easily be one of them.

> wouldn't have charged and filter the rest.

Indeed. If your list of correspondents is fixed, whitelisting is a  
perfect solution.

>  You'd still need some way

I'm more inclined to believe that the failure of Vanquish is due to  
the fact that (a) it's $40 a year, and (b) it's so obscure that (for  
example) I hadn't heard of it.

> might not scale and how they might be subverted by hostile parties.

Has this research been published?

Going back to whitelisting...

What's effectively happening these days, in my experience, is that  
we're ending up with a solution consisting of whitelisting plus  
introductions, where the cost of introduction is signing up to one or  
more social networking websites. And commercial traffic is moving out  
of e-mail entirely, towards web feeds.

This seems to match the research I've seen, that suggests that younger  
people consider e-mail to be something that old people use, and they  
don't see any use for it; they just use the messaging services of the  
social networking sites.

And of course, a lot of the commercial traffic is moving towards the  
social networking sites too. Where, strangely enough, it seems not to  
be impossible to charge commercial senders small fees per message.

mathew

---

From: der Mouse <[email-masked]>
Date: Fri, 28 Nov 2008 14:14:22 -0500 (EST)

> message we receive is so close to zero as to be effectively zero.

Who's this "we"?  The cost of a received email to me is substantially
greater than zero.  Even the ones that are delete-on-sight cost me at
least a few seconds of my time.

> However, SMS messages cost me actual money to receive, so in spite of
> all the useful services available via SMS, there are exactly zero
> companies I have authorized to send me messages via that mechanism.

That's an interesting analogy.  SMSes cost me no money at all to
receive, but I go to moderately extreme lengths to avoid stray SMSes
because the human-layer costs involved are much higher.  (Typically,
they wake me up.)

>> [...] that would still kill vast amounts of mail that people want,
>> such as this very mailing list.
> Only if you assume a system where everybody is required to pay all
> the time, which is a ridiculous strawman. There's no technical reason
> why I should not be able to simply whitelist traffic from this list
> to be delivered for free.

Except that that leaves you wide open to spam forged to appear to be
from the list - or even sent through the list.

> handled as e-mail are handled as web feeds now, and this list could

This sounds like "what's more, it doesn't matter if it _does_ kill off
email, because there are other things taking over from email anyway".

I disgaree.  You can go use your web feeds if you like.  I'll stick
with email, thankyouverymuch.  I actually hope "most people" join you
in jumping to the web; if the population of email users drops back to
pre-September-that-never-ended levels, spam might move off email.

> be impossible to charge commercial senders small fees per message.

Well, sure.  They have a "post office", in that all communication goes
through a central clearinghouse organization.  It works fine, at small
scales and with many such clearinghouses.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign

---

From: John Levine <[email-masked]>
Date: 28 Nov 2008 19:49:58 -0000

>average person sends, and do you have any sources to back up your  

There are 650 recipients on this mailing list.  Are you willing to pay
$32.50 for each message you send to it?  If not, do you think someone
else should pay?  Who should it be?

R's,
John

---

From: Alessandro Vesely <[email-masked]>
Date: Sat, 29 Nov 2008 11:56:17 +0100

mathew wrote:
> [...] There's no technical reason why I should not be able to
> simply whitelist traffic from this list to be delivered for free.

Is that because a list subscriber (you, I presume) happens to be the 
postmaster at the receiving site? If not, do you mean all users have 
both the permissions _and_ the patience to whitelist lists that they 
subscribe to?

I'm asking because I see no means for automated registration of 
opt-ins. Am I missing something?
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 29 Nov 2008 11:31:30 -0000

>opt-ins. Am I missing something?

Nope.  This is another interesting question that could benefit from
some research.

If recipient systems had some way to know what bulk mail their users
had asked for, there would be all sorts of benefits.  They could skip
the spam filtering for the requested mail, know when to display an
unsubscribe button vs. a spam button, and probably more that doesn't
immediately occur to me.

But it's tricky, since there is little standardization among signups
(particularly when one party is handling signups or sending for
another) and it's hard to come up with something with usable human
factors to verify that a putative signup actually happened.  I hope we
can all agree that the Windows Vista approach of asking "Is this OK?"
every two minutes isn't it.

R's,
John

---

From: Barry Shein <[email-masked]>
Date: Fri, 28 Nov 2008 17:22:27 -0500

[I added the required POSTAGE key to the subject line]

 >   then there would be no e-mail as we know it today.

How much do you believe a typical email costs? How many have you sent
this month. Multiply the two numbers together and report back.

Individual spammers send O(billion) per day. Now, take that cost from
the first part and multiply instead by a billion.

Whaddya think?

 > spammers.  We all know that receiving mail is vastly more expensive

Well, perhaps therein lies the problem.

 > find their mail worth reading.

Well, actually, you assume the cost is borne by others in most cases,
and hope that system remains financially viable.

I don't know what your definition of legit senders is but I'm not so
cheerful about the amount of email I apparently open myself up to when
I buy a little trinket over the internet or similar.

"Cheerful" is certainly a strong overstatement from my point of view.

I must get a few messages per hour from orgs who would argue they have
a "legit" reason to send to me, from online vendors to trade rags, to
folks who buy my name from those trade rags et al and all day pelt me
with "Free Webinar!" and "New White Paper on How To Give Us More of
Your Money!"

And it grows without bounds.

Not to mention, as an ISP, the monotonically increasing number of
these "legit" messages which continue to be sent to accounts closed
years ago.

If the cost to the senders is zero then what's the motivation for them
to ever clean up their lists?

So, I'm not comfortable with your characterization.

I'll only go so far as to say: There exists at last one email I
receive for which I cheerfully give a free ride to the sender, and
probably even N where N>1, but of the M messages I receive daily N<<M
(i.e., N is much smaller than M).

And speaking as an ISP I'd have to say that N<<<M, that is, N is a
tiny percentage of emails received here, since so much of it, maybe
80% or more, is addressed to no recipient here.

I think we can design within the parameters that as currently
conceived very, very little of the email received at most sites is
desired by the recipient. And even less would the recipient care if
the sender got to send it for free, e.g., come-ons from online
vendors, you might even enjoy receiving them, but that doesn't mean
you care if they are free or not so long as you don't have to pay for
them explicitly.

 > If we imagined some sort of settlement

What experiences are these?

I know there's a myth that goes around that for example most of the
cost of a telephone call comes from the billing itself but every time
that passes by someone who actually knows something about the topic,
like has worked in telecom cost analysis w/in large telcos, they find
it an amusing idea.

Besides, an economist might well tell you there isn't anything even
inherently wrong with that even if it were true. The cost of something
isn't based on your personal sense of engineering efficiency or
similar, it's based on what people will pay for the good or service.

Billing etc is honest work, it pays employees, it rewards
stockholders, etc.

And if it causes resources to be used responsibly and distributed
fairly so that costs are borne by those who incur those costs then all
the better!

At some point we begin to sound like heavy-handed central planners,
cut lunch breaks in half!, why should consumers pay for these workers'
lunch breaks!

I mean, hey, maybe you're ok with lunch breaks but not billing costs
but that begs the question.

The point is central planning versus (reasonably) open markets.

Now, I'm hardly some sort of free market nut, but I also get
suspicious when someone is trying to dictate pricing models rather
than enabling them.

 > supposed to handle, that would still kill vast amounts of mail that

Orders of magnitude! Now, these examples I really want to see!

 > people want, such as this very mailing list.  

Again, you're pre-supposing a particular pricing model and working
backwards from there.

Many, many times in this thread I have addressed this particular
canard yet you will come back every time as if it has never been said.

So, being a patient person, I will try again:

Individual spammers send out about a billion msgs per day.

I doubt this list sends out 10,000 a day but let's use that number,
10^9 vs 10^4, a difference of 10^5.

Now, if this hypothetical system cost the list 1c per day ($36.50/year
other than years divisible by four except if divisible by 400 when
it's $36.60), then at the same rate it would cost that spammer
$1,000/day. I doubt that spammer could pay $1K/day legitimately. Yet
I'd imagine $36.50/year is negligible.

But even that assumes a very simplistic, one rate fits all,
non-progressive scale.

Is there any inherent reason why we would (if we could) adopt a very
simplistic, one rate fits all, non-progressive scale?

I don't think so.

As a not for profit (IETF) you might get certain classes of email for
free or nearly so. Etc.

Once one decides to set pricing then there's a lot of latitude in
designing a pricing model.

But without pricing all you really have is bickering about what is
meant by "unsolicited" or "legit" etc.

 > ...Some senders would pay,
 
*I* never proposed any such thing.

I think the idea that it'd be up to the recipient to establish the
pricing model is nonsensical, so we agree.

 > settlements to senders they like.

How can you say this when I have typed in a perfectly reasonable model
perhaps a dozen times even just in the past several days?

Either you're not reading any of this thread or you don't understand
it or you're willfully ignoring what's been said.

Nothing I have ever said, nor believe, involves recipients deciding
who to charge or not charge.

That would be as flawed a model as if the postal service let you
decide how much postage each mail item you receive was charged at the
door!

Imagine, the postman stands there and you go thru the mail for you w/
him/her/it and you say to him/her/it): Ok, this one I want, um, 40c,
this one, not sure, how about a dime, no this one not at all, return
it...

But actually you're proposing the opposite, no? This mail I really
want, charge them zero, this one I'm curious about, oh, charge them
40c, this one I don't want at all, just return it.

Oh yeah that'd work...NOT!

 > ...But once you know who you wouldn't

Well, no one (or at least not I!) is proposing any such system.

It's a straw man.

 > might not scale and how they might be subverted by hostile parties.

Yet you've completely missed everything said in this thread and just
proceeded to repeatedly present unworkable models and declared them
(and by extrapolation all others) unworkable.

 > modems and the customers come flowing in."

Many have done just that and done pretty well! But let's not quibble,
I get your point.

 > some other way", we all want a pony, too.

I don't know what this means. I assume it's meant to forestall any
further discussion by attempting to propose systems which might
actually work or at least are plausibly different from those you
consider implausible?

I suggest you pay closer attention to what is actually being said
rather than dredging up unworkable systems and declaring them
unworkable.

Several people here seem to have picked up on what I have been
actually talking about and seem interested even if just from an
abstract point of view, but some see that it could be practical or at
least is no more impractical than anything else being discussed.

I'll say it again: This is a research group. If every possible detail
has been worked out before the idea is raised then it's hardly
research.

-- 
        -Barry Shein

The World              | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Fri, 28 Nov 2008 17:40:46 -0500

> me to be willing to assume an "unfair" share of the transport cost.)

Fair is therefore a very dangerous word in this context.

The conception is if you are a bulk emailer you should be paying for
your email sending, just as you would if it were paper mail tho no
doubt at a much lower per piece rate recognizing the costs.

If you're not a bulk emailer then rates can almost certainly be such
that your costs would be effectively if not actually zero as my
example in a previous message indicated but briefly:

If we assume a spammer sends O(10^9) pieces per day and scale the rate
to be about $1,000/day for that privilege (just a hypothetical) then
your sending even 10^4 msgs/day would amount to about a penny a day.

And even that assumes an overly simplistic rate structure. Just toss
in 1,000 msgs/day free for the average user, or even 10,000, and your
spammer can't live with that, they can't send 10K/msgs/day and stay in
business, so they're well into the paying area.

At 1c/10K beyond that lists like this one might cost $50/year and even
that could be waived or a much larger cap imposed (like 100K/day) for
valid not-for-profits etc, perhaps some modest yearly flat fee.

etc etc.

I doubt very much that someone like Amazon either sends 1B msgs/day or
would balk at costs like $100K/year for what they do send if that was
the way it was. There is value in such a scheme to them if it were
imposed fairly, mainly that their mail would no longer compete with
all that spam in every mailbox.

BECAUSE, the underlying assumption, spammers wouldn't be able to pay,
their business model relies on massive amounts of free resources.

Ok, from there the mind naturally turns to enforcement.

But since in my mind we haven't gotten past this first hurdle of how a
rational pricing model might even work I see no need to plow headlong
into that subsequent topic immediately.

 > think "fair" is quite as simple here as you make it out to be.)

There's no need for a micropayment scheme if it's the bulk senders who
pay.

So at least what I have proposed is independent of any micropayment
scheme whatsoever.

 > chain email or yet another copy of the latest bigoted "joke" meme.

Again, the idea of each recipient making the decision is, to my mind,
entirely unnecessary and undesireable.

The ONLY decision that has to be made is by each MTA:

    Does this email have valid "postage"?
         YES: pass it on.
         NO: drop it.

Again, can immediately jump into what is meant by valid postage but to
my mind we haven't even settled on something as simple as the above
example. Unless we do we can't really proceed to matters dependent on
some meeting of the minds on this much.

 > properties as you want".)

Another reason why, like the post office or many other such systems,
we only care if the message has valid postage, not who it is from.

 > feet of machine-room space. :-)

As a resident of the City of Boston I am told I still have grazing
rights in The Commons (park) downtown but, due to some tragedy back in
the 1600s I am discouraged from transporting livestock to/from there.

-- 
        -Barry Shein

---

From: Alessandro Vesely <[email-masked]>
Date: Sat, 29 Nov 2008 18:02:31 +0100

> unsubscribe button vs. a spam button, and probably more that doesn't

Yup, it could be web2 enabled -contrast that to, say, unsubscribe 
URLs, whose unspecified behavior may include human interaction.

> every two minutes isn't it.

IMHO, it might be triggered at the SMTP forwarding level: An MTA knows 
it is replacing or exploding the recipient, and it may learn that the 
target MTA supports signup handshakes from its EHLO response. At that 
point it should lookup a local database to learn if it has already 
done the handshake, if it is currently underway, or if it may be 
initiated right now. In the first case (already), the db lookup may 
yield an id/passwd pair to use with SMTP AUTH.

Doing the handshake may bring some advantages and imply some 
responsibilities. Thus, a well designed solution allows to negotiate a 
convenient forwarding agreement(*). Otherwise, the MTA just forwards 
the message as it has always done. After postmasters upgrade their 
servers with a software that implements that mechanism, subscriptions 
will automatically start to be traced on new messages.

[*] http://fixforwarding.org/wiki/forwarding_agreement
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Sat, 29 Nov 2008 09:06:03 -0800

> every two minutes isn't it.

The benefits are obvious as they're much the same benefits
large senders and recipients negotiate today.

There's one part that's usually ignored when a group that is as far  
removed
from mainstream reality as this one is starts to discuss the issue - and
that's that mailing list subscriptions are not triggered from within the
MUA by, well, anyone normal. They're triggered from within a web  
browser.
That means that any MUA-centric approach or SMTP protocol level
approach has an awful lot of difficulties to overcome.

Cheers,
   Steve

---

From: Michael Thomas <[email-masked]>
Date: Sat, 29 Nov 2008 09:20:49 -0800

Even if you could do something clever here, would it make much if
any operational difference? I got the impression from Mark Delany at
Y! that mailing list traffic is a drop in a very large ocean. I'm guessing
that bulk mail is probably higher but still pretty much noise level to
large providers.

       Mike

---

From: Steve Atkins <[email-masked]>
Date: Sat, 29 Nov 2008 09:30:28 -0800

> that bulk mail is probably higher but still pretty much noise level to

Without explicit whitelisting in place, wanted bulk mail (mostly
broadcast mail) is one of the biggest components of false positives
in spam filters (due to both traffic patterns and content).

Large providers expend quite a lot of effort to ensure delivery of
wanted bulk mail. If there were a magic wand they could wave
that would make all that free (or at least trivially automatable) then
they'd leap at it. That doesn't mean there's huge pent-up demand
for it, as the manual whitelisting approach mostly works, but there's
not total disinterest either.

Cheers,
   Steve

>> IMHO, it might be triggered at the SMTP forwarding level: An MTA  
>> knows it is replacing or exploding the recipient, and it may learn  
>> that the target MTA supports signup handshakes from its EHLO  
>> response. At that point it should lookup a local database to learn  
>> if it has already done the handshake, if it is currently underway,  
>> or if it may be initiated right now. In the first case (already),  
>> the db lookup may yield an id/passwd pair to use with SMTP AUTH.
>>
>> responsibilities. Thus, a well designed solution allows to  
>> negotiate a convenient forwarding agreement(*). Otherwise, the MTA  
>> just forwards the message as it has always done. After postmasters  
>> upgrade their servers with a software that implements that  
>> mechanism, subscriptions will automatically start to be traced on  
>> new messages.
>>

---

From: Seth <[email-masked]>
Date: Sat, 29 Nov 2008 12:50:39 -0500 (EST)

> the first part and multiply instead by a billion.

I think spammers will steal resources to continue sending spam at the
expense of other people.

Just like they do now.

> meant by "unsolicited" or "legit" etc.

And with pricing you have to ensure that the "right" people pay it.

And if you could do that, you wouldn't need pricing.

> perhaps a dozen times even just in the past several days?

How does your model enforce that spammers pay (and not the owners of
zombied machines)?

> who to charge or not charge.

So who does get to decide?

Seth

---

From: Seth <[email-masked]>
Date: Sat, 29 Nov 2008 12:52:25 -0500 (EST)

> example in a previous message indicated but briefly:

So your solution starts with solving the "identity" problem, in order
to prevent a spammer from creating a billion identities each of which
gets charged 0?

Seth

---

From: Alessandro Vesely <[email-masked]>
Date: Sat, 29 Nov 2008 18:53:12 +0100

> that bulk mail is probably higher but still pretty much noise level to

The idea sketched below can be applied not only to mailing lists, 
newsletter, and other bulk mail, but also to single-recipient 
forwarding, and possibly secondary MXes. I know the "but also" part 
amounts to even less traffic than the former. Even if it's not high 
volume, forwarded mail prevents from tracing a well defined boundary 
between sender's and recipient's "realms", and thus to enforce 
boundary checks.

---

From: Michael Thomas <[email-masked]>
Date: Sat, 29 Nov 2008 10:14:34 -0800

> not total disinterest either.
Well, it seems with bulk auth (spf/dkim) getting to be pretty common
for the whitelists, the work you allude to must mainly be in other areas
of the overall problem? Or is it the case that the care and feeding of
the ESP's whitelist is onerous too? If a large component is the latter,
you'd think that would be pretty easy to outsource to the enterprising
minded.

       Mike

---

From: John Levine <[email-masked]>
Date: 29 Nov 2008 18:23:47 -0000

>Even if you could do something clever here, would it make much if any
>operational difference? I got the impression from Mark Delany at Y!
>that mailing list traffic is a drop in a very large ocean. I'm
>guessing that bulk mail is probably higher but still pretty much
>noise level to large providers.

I was more thinking about ESP style mail, Valuable Offers to Our
Beloved Customers and the like, either from explicit signup or opt-in
when you buy something.  That seems interesting to me since it is
relatively easy to detect bulk mail if you can look at enough of it
(look at DCC, for a notable example) but it is painful to tell the
solicited bulk mail from the spam.

R's,
John

---

From: Steve Atkins <[email-masked]>
Date: Sat, 29 Nov 2008 10:26:05 -0800

On Nov 29, 2008, at 10:14 AM, Michael Thomas wrote:

> of the overall problem?

That sort of auth gives you the identity of the author, but that's just
the first aspect - necessary, but not sufficient. Reputation is another
aspect to that - how do you decide whether mail from that author
is wanted mail? And how do you differentiate between wanted
mail and unwanted mail from the same author?

There are some obvious approaches - manual vetting, wait for
mail to be delivered and track the reputation and so on - and they're
in use. But they're not cheap to do, and they don't work that well,
especially in the case where the same author sends mail that's
perceived in different ways be recipients. I know dozens
of FTEs who work on, basically, this stuff.

They also don't scale well, in terms of number of interacting parties,
which tends to leave small senders out in the cold.

> Or is it the case that the care and feeding of

I'm not sure what you mean by ESP's whitelist there.

Don't forget that one relevant identity here is the identity of
the author - Pfizer or Amazon - not the sender (which may
be the same as the author or a third party ESP).

Before we head off into the weeds, though, my only point here
is that there would be some interest from ISPs in a cheap way to
confirm that a particular email is solicited, but it's not a critical
problem.

The reason for that is that it is extremely difficult to distinguish
wanted bulk mail from unwanted bulk mail. Knowing whether a
particular message was solicited or not is a very useful
data point in making that decision.

Cheers,
   Steve

---

From: Bart Schaefer <[email-masked]>
Date: Sat, 29 Nov 2008 10:29:07 -0800

On Nov 29, 11:31am, John Levine wrote:
}
} If recipient systems had some way to know what bulk mail their users
} had asked for, there would be all sorts of benefits.  They could skip
} the spam filtering for the requested mail, know when to display an
} unsubscribe button vs. a spam button, and probably more that doesn't
} immediately occur to me.

Since we're talking about X-ASVP elsewhere ... isn't the above what
X-ASVP was desgined to do?  Or have I misunderstood X-ASVP?

A few years ago I had an idea for a similar sort of registry, but I
was persuaded by those who argued that it would fail because no one
has a financial incentive to become an early adopter.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 29 Nov 2008 18:29:10 -0000

> There's no need for a micropayment scheme if it's the bulk senders
> who pay.

You keep asserting this, but without ever offering even the merest
hint about how it might be implemented in anything resembling a
realistic fashion.

How do you plan to identify and charge bulk senders without counting
the mail?  Spammers already go to considerable effort to disguise
their bulk mail as a lot of different non-bulk mail.  How do you
expect to keep bulk senders from sneaking under the radar by
masquerading as a lot of non-bulk senders?

R's,
John

---

From: Bart Schaefer <[email-masked]>
Date: Sat, 29 Nov 2008 10:38:56 -0800

On Nov 29,  6:02pm, Alessandro Vesely wrote:
}
} John Levine wrote:
} > But it's tricky, since there is little standardization among signups
} > (particularly when one party is handling signups or sending for
} > another) and it's hard to come up with something with usable human
} > factors to verify that a putative signup actually happened.
} 
} IMHO, it might be triggered at the SMTP forwarding level: An MTA knows 
} it is replacing or exploding the recipient, and it may learn that the 
} target MTA supports signup handshakes from its EHLO response. At that 
} point it should lookup a local database to learn if it has already 
} done the handshake, if it is currently underway, or if it may be 
} initiated right now. In the first case (already), the db lookup may 
} yield an id/passwd pair to use with SMTP AUTH.

Is it just me, or does this sound an an awful lot like ...

> Simplest would probably be to model the base mechanism after the DSN
> standard (RFC3461).  Client sends EHLO, server responds that it will
> accept postage.  Client appends a parameter to the MAIL command with
> the identity of its payment service(s).  Server accepts or declines,
> attaching an extended status code for details.  Client then appends
> to the RCPT command a parameter indicating how much the sender is
> willing to pay for this message, and server accepts or declines,
> again with an extended status indicating the charge the server wants
> to deliver the message, regardless of whether it was declined.

We're just replacing postage with signup verification.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Michael Thomas <[email-masked]>
Date: Sat, 29 Nov 2008 10:55:24 -0800

> mail and unwanted mail from the same author?

Well DKIM can give you both fwiw. I'm not sure how reputation
maps to "wanted" or not since there's a non-trivial amount of "unwanted"
bulk mail by users who don't know/want to get off a list they had signed
up for. The bulk mailer can be squeaky clean and still have that problem,
of course.
> of FTEs who work on, basically, this stuff.

But this sort of thing could be largely outsourced for a price, right?
Assuming that you did that, couldn't the mail provider's  spam
button (aka the "I don't want this" button) feedback to that service
if it's on the white list who in turn provides feedback to the bulk mailers
to remove them from their mailing lists?
> I'm not sure what you mean by ESP's whitelist there.

ESP as in Y!, etc. Not the bulk senders.
> data point in making that decision.

Yeah, sure. I'm not even sure "solicited" makes a useful distinction
either, since those arguments usually devolve into legalistic claptrap.
If you think of the "junk" button in terms of "I don't like this" for
whatever reason, we might make some progress in teasing out people's
fickle intents. You'd think that legitimate bulk mailers would have a
pretty big incentive to heed a consistent "I don't like this" to one of
their lists/campaigns/whatever so as not to harm their overall reputation.
Assuming that the feedback loop was completed, of course.

          Mike

---

From: Paul Russell <[email-masked]>
Date: Sat, 29 Nov 2008 14:00:40 -0500

> How does your model enforce that spammers pay (and not the owners of

Why shouldn't the owners of zombied machines pay for their negligence?  The
owners of most, if not all, zombied machines are completely oblivious to the
current problem and are likely to remain in that state until the problem hits
their wallets.  An email postage scheme might make some of them aware of the
problem, but only if postage is charged for every message.  Any scheme which
allows a certain number of free messages per time period will be exploited by
spammers, who will simply tune their zombies to stop sending messages before
they pass the free threshold.

-- 
Paul Russell, Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame
[email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: SM <[email-masked]>
Date: Sat, 29 Nov 2008 11:48:48 -0800

>Why shouldn't the owners of zombied machines pay for their negligence?  The

Because if you annoy a significant number of your customers, it can 
favor your competitors.  There's an industry that uses that kind of 
financial argument to make an example.  That hasn't changed the 
user's behavior.

Some ISPs use technical means instead of financial incentives to put 
a stop to what is described as unacceptable usage.  Consumers do not 
like metered usage as they have been accustomed to free and 
unlimited.  It's easier to trickle the link that to fine the subscriber.

Regards,
-sm

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 29 Nov 2008 15:15:32 -0500

On Sat, Nov 29, 2008 at 02:00:40PM -0500, Paul Russell wrote:
> Why shouldn't the owners of zombied machines pay for their negligence?  

On a philosophical level, I agree with you: it is the responsibility of
every person with anything connected to the 'net (from a /32 to a /8)
to ensure that that it's not an operational hazard to everything and
everyone else.  So -- on that philosophical level -- I'll go one step
further and say that they should be disconnected until they demonstrate
the personal responsibility that I think is a prerequisite for the
privilege of 'net access.

But on a practical level, we passed the point whether either approach
might possibly work about twenty years ago.  There are now so many
reasons why it'll never happen that I'm not even going to try to
enumerate them.  I think the best we can hope for is increased use
of "sandboxing", and even that's not very likely.

---Rsk

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 29 Nov 2008 17:55:57 -0500

> unsubscribe button vs. a spam button, and probably more that doesn't

I concur that this is an interesting (but as you went on to say, tricky)
problem.  One of my concerns with this approach is that it would require
tracking subscriptions on a per-user basis, which has some serious
privacy implications, especially given the demonstrated inability of
many entities to keep their data locked up securely.

As to the "report as spam" button, I think that should be taken
away entirely, as users have conclusively proven that they can't tell
spam from not-spam, phish from not-phish.  (If they *could*, then
the scope of at least one of these problems would be considerably less.)

---Rsk

---

From: Seth <[email-masked]>
Date: Sat, 29 Nov 2008 18:02:23 -0500 (EST)

> Why shouldn't the owners of zombied machines pay for their

They should.  But at the suggested prices, they won't notice, and
nothing will happen except that a lot of people pay an extra
<$1/month.  How does that help me?

> An email postage scheme might make some of them aware of the
> problem, but only if postage is charged for every message.

And only if it's large enough to notice.

Seth

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 17:30:30 -0600

> least a few seconds of my time.

I was talking about financial cost, as I thought was obvious.

> from the list - or even sent through the list.

Spammers could bypass all my spam filtering right now, and probably that of
many other people, if they could reliably automatically guess what mailing
lists their victims are on. Has anyone seen any evidence that they are
capable of doing so?

Mailing lists might need to implement S/MIME to avoid such a problem.

> email, because there are other things taking over from email anyway".

Spam is the thing that's killing off e-mail. Stuff that used to be handled
as e-mail is increasingly being handled as web feeds, whether or not a
pay-to-send model is implemented for e-mail. The fact that some things might
need to move out of e-mail if pay-to-send were implemented, is not a valid
reason to object to pay-to-send if those things were already moving out of
e-mail anyway.

> scales and with many such clearinghouses.

I was commenting on the "it's economically infeasible to charge small
per-message charges" argument that was put forth on this list recently.

mathew

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 17:37:13 -0600

> else should pay?  Who should it be?

I assume that people who wanted to receive mail from non-commercial mailing
lists like this one would need to agree to receive it without payment.

mathew

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 17:40:32 -0600

On Sat, Nov 29, 2008 at 04:56, Alessandro Vesely <[email-masked]> wrote:

> mathew wrote:
>
>> [...] There's no technical reason why I should not be able tosimply
>> whitelist traffic from this list to be delivered for free.
>>
>
> postmaster at the receiving site?

No, it's because even web mail systems these days have filtering. Gmail
does, for example. That's what I use.

> If not, do you mean all users have both the permissions _and_ the patience
> to whitelist lists that they subscribe to?

If users don't have the patience to set up their mail systems to receive
non-commercial mailing list traffic without charge to the sender, then they
won't receive the e-mail, will they?

> I'm asking because I see no means for automated registration of opt-ins. Am
> I missing something?

Huh? You can handle automated registration of opt-ins exactly the same.
Nothing about this mailing list or the software that runs it would need to
change if we had attention bonds.

mathew

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 29 Nov 2008 19:29:31 -0500

> lists their victims are on. Has anyone seen any evidence that they are

Yes.  I have spam-in-hand from multiple incidents.  And it is of course
not necessary for them to guess, since they could (a) subscribe to those
lists and harvest part of the subscriber list (b) grab the archives of
[some] lists and harvest part of the subscriber list (c) go through the
"address books" and stored mail on any zombied system and note any mailing
list which any mail address in use on that system is subscribed to
(d) go through any zombie which happens to be a mailing list server (e) etc.

So why don't we see more of it?  I suspect because it's not worth
their trouble -- yet.

---Rsk

---

From: John Levine <[email-masked]>
Date: 30 Nov 2008 00:31:54 -0000

>I assume that people who wanted to receive mail from non-commercial
>mailing lists like this one would need to agree to receive it without
>payment.

Now wait a minute.  A day ago someone purporting to be you said that
even at a nickel a message the cost would be trivial:

> If it cost me a penny to send each e-mail, I don't see that it would
> make any difference to how much e-mail I sent. You could probably
> even increase the price to 5c per message and I wouldn't blink.

Now we find that outgoing mail is so expensive that you want special
rules to avoid paying for some of it.  Better make up your mind -- is
your mail stream too cheap to care about or not?  For that matter, if
people are willing to waive the fee for mail from the IRTF, why
wouldn't they waive the fee on every list they sign up for, commercial
or otherwise?  After all, they get all that mail without being paid
now.

Finally, if we'd still need special handling to whitelist the mail we
think is nice, what problem would a vast e-postage system be solving?

R's,
John

---

From: Steve Atkins <[email-masked]>
Date: Sat, 29 Nov 2008 16:47:28 -0800

> think is nice, what problem would a vast e-postage system be solving?

Wanted mail from strangers. This is *the* hard thing to handle, and  
while
I don't think a vast e-postage scheme will be of much help, I've not  
seen
much else that looks any better.

Cheers,
   Steve

---

From: "Chris Lewis" <[email-masked]>
Date: Sat, 29 Nov 2008 21:20:43 -0500

> So why don't we see more of it?  I suspect because it's not worth

It certainly is, if only by way of zombied machines.

The users here getting the highest volumes of spam (in one case > 16,000
/day in bursts) have only one thing in common.

Membership in lots of IETF related activities, especially mailing lists.

The second most common attribute is membership in IEEE lists.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 21:21:29 -0600

On Sat, Nov 29, 2008 at 13:48, SM <[email-masked]> wrote:

>>  The
> Because if you annoy a significant number of your customers, it can favor
> your competitors.

So if Microsoft annoy a significant number of their customers by making it
easy for third parties to spend all their e-mail postage credits, people
might start to favor Microsoft's competitors?

Wait, weren't you supposed to be arguing that this was a bad thing?

mathew

---

From: mathew <[email-masked]>
Date: Sat, 29 Nov 2008 21:28:53 -0600

On Sat, Nov 29, 2008 at 18:31, John Levine <[email-masked]> wrote:

> rules to avoid paying for some of it.

No, I'd happily pay a nickel a message for messages send to this mailing
list.

The problem is that the mailing list software is multiplying up the traffic,
adding additional cost. That additional cost is another issue entirely, and
requiring that participants in lists such as this use whitelists--i.e. share
the cost--is a reasonable suggestion, it seems to me.

For that matter, if
> or otherwise?

If they want to, they can. That leaves them in exactly the same position
they're in today.

That's one of the key points of an attention bond system--nobody has to
impose it on their friends. That's why I prefer it to Barry Shein's idea of
more centralized, standardized charges.

> Finally, if we'd still need special handling to whitelist the mail we T
> think is nice, what problem would a vast e-postage system be solving ?

The problem of the 99% of e-mail that isn't from mailing lists like this
one, of which 95% is spam.

Like I said, I *already* give mailing lists like this one special handling.
So just a matter of the filter changing from "Skip inbox, place in IETF
folder" to "Ignore the fact that no attention bond was enclosed, skip inbox,
place in IETF folder".

mathew

---

From: SM <[email-masked]>
Date: Sat, 29 Nov 2008 23:35:25 -0800

At 19:21 29-11-2008, mathew wrote:
>So if Microsoft annoy a significant number of their customers by 
>making it easy for third parties to spend all their e-mail postage 
>credits, people might start to favor Microsoft's competitors?

I don't think so as it's the ISP which is charging the subscriber and 
that's the competition I'm talking about.

>Wait, weren't you supposed to be arguing that this was a bad thing?

No.

Rich explained who is responsible for the hazard.  I mentioned why it 
may be difficult to fine the subscriber for the negligence when the 
he/she has been sold the idea of "unlimited" service.

If e-mail postage is introduced and is a success, subscribers may 
elect to do away with using the ISP for mail services and SMTP 
access.  That can be a good thing or a bad thing depending on where you stand.

Regards,
-sm

---

From: Alessandro Vesely <[email-masked]>
Date: Sun, 30 Nov 2008 13:50:02 +0100

> Mailing lists might need to implement S/MIME to avoid such a problem.

Received-SPF: pass (Address passes the Sender Policy Framework)
   SPF=MAILFROM;
   sender=[email-masked];
   remoteip=64.170.98.32;
   remotehost=mail.ietf.org;
   helo=mail.ietf.org;

and

irtf.org text = "v=spf1 ip4:64.170.98.0/26 ip4:64.170.98.64/28 
ip4:64.170.98.80/28 ip4:6 4.170.98.96/29 ip4:208.66.40.224/27 
ip6:2001:1890:1112:1::0/64 -all"

---

From: Alessandro Vesely <[email-masked]>
Date: Sun, 30 Nov 2008 14:02:29 +0100

> We're just replacing postage with signup verification.

Postage is for each message, signup for sender/recipient pairs.
Postage uses headers/micropayment, signup SMTP AUTH.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 08:40:49 -0500

> Received-SPF: pass (Address passes the Sender Policy Framework)

Neither S/MIME nor SPF (nor DKIM nor other similar)  will do the slightest
thing to avoid this particular problem, since any spam emitted from
a fully-compromised system will pass these checks just as readily as
any non-spam.

---Rsk

---

From: Alessandro Vesely <[email-masked]>
Date: Sun, 30 Nov 2008 15:04:33 +0100

Michael Thomas wrote:
> Steve Atkins wrote:
>> it is extremely difficult to distinguish wanted bulk mail from 
>> unwanted bulk mail. Knowing whether a particular message was 
>> solicited or not is a very useful data point in making that 
>> decision.
> 
> Yeah, sure. I'm not even sure "solicited" makes a useful 
> distinction either, since those arguments usually devolve into 
> legalistic claptrap.

"Unsolicited" still makes the difference between spam and legitimate 
bulk email. Having some data that might be held as legal evidence 
would be a further incentive for legitimate bulk mailers to behave 
correctly.

> If you think of the "junk" button in terms of "I don't like this"
> for whatever reason, we might make some progress in teasing out
> people's fickle intents.

Doesn't that stem from the overall UI design? For example, YouTube's 
text comments sport a "good"/"bad" pair of buttons, beside a "spam" 
button, to classify comments. More buttons, less fickleness.

> You'd think that legitimate bulk mailers would have a pretty big
> incentive to heed a consistent "I don't like this" to one of their 
> lists/campaigns/whatever so as not to harm their overall 
> reputation.

Yes, responsible bulk senders take any step they can in order to make 
it clear they are not spammers. In addition, I think they would also 
be interested in finer feedback, i.e., more buttons.

> Assuming that the feedback loop was completed, of course.

Currently, FBL is only available for extra large ESPs. (About a dozen 
of them?) Isn't that a limitation?

With the minuscule amount of email traffic I have, I don't think 
anyone would even consider applying to get FBLs from my servers. I 
assume that's because entering into an agreement takes a finite amount 
of human resources. Isn't it possible to automate the subscription 
mechanism, so that users of small ESPs can return that feedback to 
bulk mailers too?
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Alessandro Vesely <[email-masked]>
Date: Sun, 30 Nov 2008 15:18:14 +0100

> a fully-compromised system will pass these checks just as readily as

I thought when you talked about <<doing anything technical about spam 
*that requires treating those systems as trustworthy*>> you meant end 
user machines, not servers.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Michael Thomas <[email-masked]>
Date: Sun, 30 Nov 2008 07:16:33 -0800

Alessandro Vesely wrote:
>>> solicited or not is a very useful data point in making that decision.
>>

It might make a difference to somebody, but not to end users. There
seems to be three states to end user thinking:

1) I'm not done with this message
2) I'm done with this message
3) I didn't like this message, and don't want more like it

Note that #3 often coincides with spam, etc, but it is not a
1:1 mapping.
> button, to classify comments. More buttons, less fickleness.

I'd say that given the volume of email lots of people go through, it's near
miraculous that the current delete/junk differentiator works at all. The 
problem
isn't with the two buttons, it's that UI designers have put the wrong 
label on
the "Junk" button. Users will not be fooled though: the Junk button really
is the "I don't want this (anymore)" button and they all know it. And it's
certainly not their problem that the UI designers maintain their procrustean
stance that their users are the ones who are wrong, stupid, unreliable, 
etc, etc.

In short, these designs need to conform to the way that users manifestly
use them, and that includes putting legitimate but unwanted email into the
current "Junk" folder. It's not their fault that the logic behind that 
button
isn't figuring out the best way to gag the unwanted mail at its source if
possible, or build filters which are more selective, and based on better
clues (cf DKIM, SPF...).
> mechanism, so that users of small ESPs can return that feedback to 

Sure, unless we built something where a domain holder could relatively
easily assert itself and have some standardized mechanism to "Get me off 
this
list/campaign" all of this FBL stuff is likely to based off of 
handshakes between
large entities. The latter is not impossible given existing auth 
infrastructure, but
it's not by any means free either. So it would be nice to see a variety 
of these
bilateral agreements, how they work, what their efficacy is before 
rushing off
to solve a general problem.

So to that end, do, say, AOL and EBAY work together? What do they do?
How well does it work? How well does it scale human/automaton-wise?
Is, say, AOL  thinking about expanding access to other EBAY-like creatures?
Is there some sort of 80/20 rule on who they would take and who they 
wouldn't?
If there is, what logic drives the 80/20 classifier?

If we can get answers to these kinds of questions over a larger set of ESP's
and Etailors/legitimate bulk senders some patterns _may_ emerge and _may_
point toward standardization making the situation better.

---

From: John Levine <[email-masked]>
Date: 30 Nov 2008 16:03:13 -0000

>The second most common attribute is membership in IEEE lists.

Do you think the bad guys are specifically trolling for lists, or is
it just that the IETF had unredacted online archives for a long time?

R's,
John

---

From: mathew <[email-masked]>
Date: Sun, 30 Nov 2008 11:20:36 -0600

> that's the competition I'm talking about.

It may be your ISP who sells you postage, but switching to another ISP won't
let you avoid using postage.

Rich explained who is responsible for the hazard.  I mentioned why it may be
> difficult to fine the subscriber for the negligence when the he/she has been
> sold the idea of "unlimited" service.

You're not fining the subscriber. You're selling them the postage they need
to send e-mail. If someone pwns them and uses up all their postage, you are
not involved in the process of imposing that financial burden. Just like
it's not the USPS's problem if someone steals the stamps out of your wallet.

mathew

---

From: Barry Shein <[email-masked]>
Date: Sat, 29 Nov 2008 13:46:24 -0500

On November 29, 2008 at 11:31 [email-masked] (John Levine) wrote:
 > ...I hope we

My impression was that it was the only "practical" solution (from the
point of view of their engineering costs and time-frame) they could
think of to the problem of malicious email, web pages, etc running
malware.

If you look back at the archives on this list a couple of years it's
possible the idea even arose right here. I remember a thread that kept
coming back to "ok, then just ASK the user before you let something
like an email run a program".

I'm not kidding, my memory on this is a little sketchy but I remember
either some microsoft engineers sending me email asking if I thought
this could help and/or commenting on the list at the time.

It would be interesting to know if the virus infection rate is any
lower on Vista.

Of course, there're probably several factors, but it would still be
interesting inasmuch that if the answer is "no it's about the same" we
can conclude the idea was a loser, but if it's "yes, lower" then
perhaps this helps even if it's not as convenient as it might be. Its
behavior could be refined.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Sat, 29 Nov 2008 14:31:01 -0500

> I think spammers will steal resources to continue sending spam at the

But if your MTA won't accept the email because they don't have valid
"postage" then it won't do them (the spammers) much good.

 > And with pricing you have to ensure that the "right" people pay it.

Why? Do you find this a problem with paper mail?

There are certainly some classes of "stamps", and some enforcement is
involved to prevent, e.g., for-profits from using non-profit rates,
actually there are quite a few details, but certainly as a recipient
you don't worry about all this much, you just get some mail and read
some of it, throw the rest away, etc.

One major difference is that the "free" email system provides no
effective economic infrastructure for enforcement of any sort.

 > And if you could do that, you wouldn't need pricing.

Well, we don't need "that", i.e., judging who is worthy of sending
beyond their paying the freight, so that's a straw man.

 > How does your model enforce that spammers pay (and not the owners of

Spammers need to send a lot more email than zombied machines would
normally be allocated by default.

If we want to get creative "stamps" on the internet could also have a
"rate" charge.

That is, we'll give you 1,000 msgs/day free but only if your rate
never exceeds 100/second for so many seconds (I'll save you the math,
there are 86,400 seconds in a day, so 1,000/day requires 86.4/second.)
Otherwise we either shut you off or raise the rate (your choice,
choose one checkbox please.)

Spammers can't live with rate-limiting either tho most mortals can,
particularly if it's numbers like so-many msgs per second.

etc.

That could work in a typical zombie situation where the infected host
is owned by an end-user and port 25 outbound is blocked so everything
has to go through the ISP's MTA/MSA.

 > So who does get to decide?

Well, algorithms.

An ISP or corporation might, if the system were effective, choose to
not accept any email without proper "postage".

In other schemes this decision might be left to the recipient's
machine tho at some point we're quibbling semantics, that is, the
recipient's machine hosts the MTA, etc, they're their own ISP/corp.

In a scheme where it's up to your MTA you could choose to accept all
of it, ignore the postage, just like you could shut off every spam
filter if you like.

Anyhow, the point is that you make it sound like we get this added
burdensome burden of deciding which mail to accept in this scheme.

I say, as far as the scheme is concerned, the only question is "valid
postage? Yes/NO".

Of course you could filter further at any point you control.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Sat, 29 Nov 2008 15:12:06 -0500

> masquerading as a lot of non-bulk senders?

Does this mean we've moved beyond the "moral" issue?

In a sentence I could imagine something along the lines of postage
meters, it's up to the bulk sender to purchase the "postage", likely a
cryptographic scheme which identifies the purchaser uniquely
(analogous to DKIM) and allows the sending of however many "stamps"
were purchased, a countdown system.

There are many working systems, business models, on this planet which
do not require or even attempt perfection.

Even the US post office doesn't begin to try to check every single
letter or postage meter mark tho optical scanning has improved their
capability.

But as another example the ASCAP system requires radio stations to
become ASCAP members (pay a base fee) and provide certain information
about their programming and audience according to generally accepted
standards. For example, that they're an easy-listening station in with
an audience of 100,000 (potential vs typical) and so on.

Based on that information a charge is assessed which passed on to
songwriters as royalties.

Can they cheat? Of course they can cheat. But the real question is
what are the chances they would get caught and what is the penalty?

ASCAP pays people (perhaps indirectly) to listen to radio stations and
otherwise sample and compare, and see if they're cheating. They don't
pretend to check every station but the penalty would be losing your
ASCAP membership, paying owed fees, fines, penalties, possibly being
sued, etc.

They can do this reasonably effectively because they charge so have
money to do this investigation and enforcement.

There are many systems in everyday use which amount to something
similar.

A scheme doesn't have to be airtight by any means to be effective.

What is of some importance is knowing that a "stamp" is authentic.

In that sense it's less a stamp and more like a postage meter mark,
tho cryptography (again, a la DKIM) can make it stronger than your
typical postal meter.

A system like that works when recipients, particularly MTAs, begin
refusing email without plausible postage.

But there's no micropayment involved, any more than there is in the
ASCAP scheme.

Of course ASCAP relies on the fact that WABC can't pose as KPFK due to
radio frequency allocation etc.

But I can't really see Amazon posing as Yahoo either, we have IP
server blocks to check and other info.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Sat, 29 Nov 2008 16:04:10 -0500

> Why shouldn't the owners of zombied machines pay for their negligence?

Well, at that point we not only enter the realm of morality, we enter
the realm of marketing.

But I don't think it's particularly the charge of a group like this to
delve into either except perhaps at the extremum or out of curiosity
or completeness' sake.

Let a thousand business models bloom. Or as the X11 people would say,
"mechanism, not policy".

-- 
        -Barry Shein

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 12:49:15 -0500

> user machines, not servers.

I do mean that.  The point I'm trying to make (and may not be making
very well) is that there's no way for an external entity, like a server,
to programatically tell the difference between (a) a real/non-spam
message sent by the former owner of a zombie and (b) a spam message sent
by the new owner of the zombie.  Either the former or new owner could
cryptographically sign it, and those signatures are indistinguishable.
And once a message is handed off to any mail server which will accept
mail from that zombie (which probably means any topologically local as
well as any for which the former owner possessed credentials) there's
nothing different about a spam vs. non-spam message.

Sure, a skilled/experienced human could inspect such a message and
in at least some cases, make a reasonably reliable estimate, but
that's not much help.

---Rsk

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 12:59:46 -0500

> it just that the IETF had unredacted online archives for a long time?

That's a fascinating question, and I have no idea of either of those
are the answer -- or whether some other factor is in play, or perhaps
multiple factors.

But one thing I'm more sure of every year is that there is less and less
reason to worry about redacting or obfuscating addresses.  Spammers now
have so many ways of harvesting them [1] that it's pointless to try to
stop them.  (And redacting the archives of publicly-available mailing
lists is futile, since spammers can simply subscribe and harvest all
incoming traffic.  Similar for any Usenet archive, since newsfeeds
aren't all that scarce/expensive.)

I think the best course is to presume that any email address that's
used to originate traffic will eventually end up in spammers' hands
and plan defenses accordingly.

---Rsk

[1] Including searching the contents of any compromised system, including
any removable media and/or inspecting network traffic visible to it.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 30 Nov 2008 13:05:09 -0500

> it just that the IETF had unredacted online archives for a long time?

Yes.  And they'd be spamming thru the lists if the the lists let 'em.
Anybody remember Krazy Kevin?
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 13:10:25 -0500

On Sun, Nov 30, 2008 at 07:16:33AM -0800, Michael Thomas wrote:
> And it's certainly not their problem that the UI designers maintain
> their procrustean stance that their users are the ones who are wrong,
> stupid, unreliable, etc, etc.

I agree with the general idea that UI presentations could be improved.

I think increased use of RFC 2369 headers and their corresponding
presentation would help; I've also considered the possibility of
making MUAs aware of proper opt-in signups (say, via RFC 2142 -request
addresses, which all all mailing lists should support), as it would leave
open the door for the MUA's to decline to present a "report as spam"
button while viewing any message on that list and instead present a
"request unsubscription" button (using the RFC 2369 headers) instead.
(Why do this in the MUA?  Because it's MUA behavior that needs to
be affected, and it needs to be affected even when the MUA is running
on a system that's not Internet-connected at the moment.)

I'm not at all sure that's much help, but I think we should at least
encourage compliance with RFC 2369 and RFC 2142 anyway, among others,
because (a) there's no downside and (b) it *might* help.

But:

Users have proven that they are, w.r.t. spam,  all those things
you've enumated above.  Why do you think phishing is so marvelously
successful and lucrative, for example?  Why do you think (as I've reported
elsewhere) I've seen a 100.000% false positive rate on nearly 5 years of
AOL feedback loop reports?  Why do you think that spyware (even in the
absence of drive-by downloads) is such a problem?  Why do you think that
monitoring of *outbound* mail traffic at most sites reveals a steady
stream of replies/"unsubscribes" to spammer domains, after we've spent a
decade telling people not to do that?

And arguably, this is not their fault.  Users are simply trying to get
things done, and should not be expected to be experts on spam or firewall
configuration or malware techniques or anything else like that.

---Rsk

---

From: Bart Schaefer <[email-masked]>
Date: Sun, 30 Nov 2008 10:32:39 -0800

On Nov 30, 12:49pm, Rich Kulawiec wrote:
} 
} I do mean that.  The point I'm trying to make (and may not be making
} very well) is that there's no way for an external entity, like a server,
} to programatically tell the difference between (a) a real/non-spam
} message sent by the former owner of a zombie and (b) a spam message sent
} by the new owner of the zombie.

The external entity needs to diferentiate to block all the spam from
the zombie, but it doesn't need to differentiate to report that a
message (any message) was sent using that former owner's identity.

There already exist systems like DCC that collect statistics on large
numbers of email messages at recipient servers and report back.  If
the feedback loop could be completed back to the former owner via some
external channel, in the way that a monthly statement from the phone
company lists all the telephone numbers one has called, the former
owner might have a chance to de-zombie his system.

Yes, it's whack-a-mole, but at the moment we seem to have a whole lot
of moles and no one whacking.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Sun, 30 Nov 2008 10:52:09 -0800

> owner might have a chance to de-zombie his system.

That's after the fact - which isn't a bad thing, but it's no better than
things that can be done (and is being done) by consumer ISPs at a local
level, without needing feedback loops or any other sort of global
system. (Netflow, layer 3 monitoring, walled gardens, that sort of
thing).

Cheers,
   Steve

---

From: Michael Thomas <[email-masked]>
Date: Sun, 30 Nov 2008 11:40:46 -0800

> on a system that's not Internet-connected at the moment.)

    See, you've already lost me: I and I hope that just about everybody
    else has been conditioned to not trust those "unsubscribe" buttons
    because there's a pretty good chance that something actively evil will
    happen if you click it. *I* don't want to understand the vagueries of
    what is an is not trustworthy; I want my agent and/or things it uses
    to figure that out for me. All *I* want to do is register my Royal
    Displeasure.
> decade telling people not to do that?

So I'm not getting why you're saying that a "Unsubscribe" button in the
MUA would be a good choice? It seems like we're likely in agreement, but
I'm confused.

In any case, all of these things are successful because the margin to
success is so very low too. It's a relatively new human phenomenon
that you can reach out and touch your billion best friends for negligible
cost.
> configuration or malware techniques or anything else like that.
Of course they're not at fault. Think about how well your life would work if
at any particular meal there was 10% chance that your meal would kill you
unless you vetted it correctly. The answer is not to teach everybody how
to run a mass spectrometer, but to put in place processes and filters to 
lower that
raw 10% chance down to something far, far lower.

We're only marginally better than "If you learned to run a mass 
spectrometer"
on the spam/phish front. Our automatons need to be *way* smarter, and to
the degree that we blame the user/victim is to the degree that we miss that
point.

          Mike

---

From: "Gerald Klaas" <[email-masked]>
Date: Sun, 30 Nov 2008 12:06:34 -0800

On Sat, Nov 29, 2008 at 12:12 PM, Barry Shein <[email-masked]> wrote:

> do not require or even attempt perfection. [...]

Excellent point.  This is why I believe that recipients are capable of
running
their own stamp franking and verification;  if there were a commonly
definded
method of transport.

> what are the chances they would get caught and what is the penalty?
Do we dare open the legislation topic?  It's pretty clear that CAN-SPAM
is not effective.   If one is using "stamps", is there any legal benefit (in
the USA) ?   Might a recipient be able to legally pursue a spammer for
abusing their "stamp generator" (under fraud laws) as opposed to
CAN-SPAM?  With an out-of-SMTP-band stamp "purchase", the recipient
is able to define the process senders need to follow to obtain their
"stamps", we would hope leaving an audit trail in the process.  Clearly
fraud laws would apply if the stamps involved micropayment, maybe
not if you couldn't assign a cash value to the "stamps".

Gerald

---

From: Bart Schaefer <[email-masked]>
Date: Sun, 30 Nov 2008 13:39:41 -0800

On Nov 30,  2:02pm, Alessandro Vesely wrote:
} Subject: Re: [Asrg] Mailing list signup handshakes
}
} Bart Schaefer wrote:
} > 
} > We're just replacing postage with signup verification.
} 
} Postage is for each message, signup for sender/recipient pairs.

If the point of verified signup is to filter mail for which there
has not been a signup, then the signup has to be re-verified on each
message.  Unless you're trusting the sender, in which case I refer
you back to several messages from RSK.

} Postage uses headers/micropayment

Not necessarily, but I promised to stop expounding upon that.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Bart Schaefer <[email-masked]>
Date: Sun, 30 Nov 2008 13:51:01 -0800

On Nov 30, 10:52am, Steve Atkins wrote:
}
} That's after the fact - which isn't a bad thing, but it's no better
} than things that can be done (and is being done) by consumer ISPs at
} a local level, without needing feedback loops or any other sort of
} global system. (Netflow, layer 3 monitoring, walled gardens, that sort
} of thing).

It might not be technically better at stemming the immediate flow, but
it might be an improvement in terms of human factors -- making end
users more directly aware of the consequences, for example, or giving
ISPs more evidence for their actions.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Rich Kulawiec <[email-masked]>
Date: Sun, 30 Nov 2008 18:24:40 -0500

On Sun, Nov 30, 2008 at 11:40:46AM -0800, Michael Thomas wrote:
>    happen if you click it.

What I'm talking about -- in response to comments about UI improvements --
is an "unsubscribe" button that you only see if your own MUA knows that
you previously subscribed via a proper (COI) process.  I'm not overly
enthused wtih the idea by any means, but if we're going to think about
UI improvements, then *maybe* having the MUA try to keep track of
mailing list subscriptions is one of them.

(I do this is an entirely manual way: every mailing list I'm on gets
a procmail rule, and in that rule I make a note of the data I subscribed.
I also note when I unsubscribe and deactivate the rule.  But this is
clearly not for everyone.)

> MUA would be a good choice? It seems like we're likely in agreement, but

I think we're in agreement -- I'm not sure it's a good thing either, but
I was trying to say that *if* we're going to give users "unsubscribe"
and "report as spam" buttons then maybe there are ways to at least make
them work better.

> We're only marginally better than "If you learned to run a mass  spectrometer"

Agreed.  I regard it as "our" responsibility to deal with the spam problem,
not end users'.  (And I don't blame them unless they do something that's
actively self-destructive, e.g., following spammer "unsubscribe" links.
I blame us.)

---Rsk

---

From: John Levine <[email-masked]>
Date: 1 Dec 2008 01:30:52 -0000

>Yes.  And they'd be spamming thru the lists if the the lists let 'em.

I dunno.  If they were actually looking for lists, it would be pretty
easy to tell what list the addresses were scraped from.  Since most
lists just check that the From: line address is a subscriber, it would
be really easy to resume spamming through lists if they wanted to.

List spammers used lists because they were spamming from dialups and
couldn't push out enough mail one at a time.  Broadband and zombies
solved that problem.

>Anybody remember Krazy Kevin?

Yes.  Anyone hear him interviewed on public radio?  Not about spam,
about eating hotdogs.

R's,
John

---

From: John Levine <[email-masked]>
Date: 1 Dec 2008 01:38:08 -0000

>effective economic infrastructure for enforcement of any sort.

True.  How about some research into estimates about how much would
enforcement cost?  Then figure out what that comes to per non-spam
message (since we can safely assume that spammers won't pay.)

>choose one checkbox please.)

Oh, look, you are counting the mail.  Thanks for clarifying that.  That
reintroduces the double spending problem, too.

>particularly if it's numbers like so-many msgs per second.

Well, actually, I've seen plenty of reports of botnets dialing down the
per-bot rate to whatever it takes to avoid triggering ISPs outbound
filters.

R's,
John

---

From: John Levine <[email-masked]>
Date: 1 Dec 2008 02:33:50 -0000

>Does this mean we've moved beyond the "moral" issue?

Beats me.  Nobody has mentioned a "moral" issue but you.

>were purchased, a countdown system.

Right, that brings us to the double spending problem ...

>do not require or even attempt perfection.

  ... because none of them are attempting to work in an environment
where 98% of the attempted transactions are bogus.

Say you've dropped into the local Dunkin Donuts for a donut and
coffee.  But 98% of the cash that customers offer is counterfeit.  How
would this affect the way that cashiers work?  Would they just accept
all the cash and figure they'll call the cops when they find bogus
stuff?

If you design a system that is designed to leak a little spam, the bad
guys will aim their firehose through the leaks.  Remember, they have
millions of zombies, so if your wonderful system rejects their fake
stamps with 99% accuracy, they try 100 times as often and get the same
amount of spam through.

None of this should come as any surprise to anyone who's thought
seriously about e-postage.  I was certainly aware of it when I wrote
my white paper five years ago.

R's,
John

---

From: Bart Schaefer <[email-masked]>
Date: Sun, 30 Nov 2008 22:32:00 -0800

On Dec 1,  2:33am, John Levine wrote:
}
} Say you've dropped into the local Dunkin Donuts for a donut and
} coffee. But 98% of the cash that customers offer is counterfeit. How
} would this affect the way that cashiers work? Would they just accept
} all the cash and figure they'll call the cops when they find bogus
} stuff?

I suspect they'd make everyone pay in advance so they have time to
confirm the cash is real, and then only provide service to those who
have an account in good standing.  Then it may turn into a problem
with identity theft, but that doesn't hit their bottom line.

} ... if your wonderful system rejects their fake stamps with 99%
} accuracy, they try 100 times as often ...

This whole thing with "stamps" is antiquated.  If the problem is that
they're going to attempt 100 times as many deliveries, then forget
validating a "stamp" and charge for every delivery.  I keep seeing
propaganda from MailChannels about inbound traffic shaping; this
seems like an ideal application of it.  Let through unchecked
anyone with a history of payment and throttle everyone else (to the
point of quarantine without final delivery, if necessary) until you
know their history.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg