Subject: [apps-discuss] SPAM is IETF-s largest failure

From: Jacob Palme <[email-masked]>
Date: Thu, 8 Nov 2012 17:58:08 +0100

Talk to ordinary people, people who are not technical 
experts, as we are in this mailing list. Ask them what is 
good and bad about the Internet. You will find that most 
people will answer that spam control is IETF's largest 
failure.

IETF started as a network for university people. They 
wanted a network to make interconnection between university 
and research people easy. They had no expectation that 
these people would misuse the network such as spammers do 
today.

The root of the problem is that the cost of seinding e-mail 
is so low. You just submit your message, no fee, and a 
network of SMTP servers is eager and willing to forward 
your message to thousands or millions of recipients. We 
even get messages which ask us to buy software which makes 
it easy to forward your message to many recipients. 
Companies collect e-mail addresses from various sources and 
sell lists of millions of e-mail addresses for a low cost.

The only solution which works is to make it more expensive 
to send messages. IETF should establish a new network, 
independent of the present e-mail forwarding network, with 
separate mail servers (SMTP, POP, IMAP servers) using new, 
separate ports for spam-free e-mail. The main difference is 
that there should be a charge, perhaps 0.10 dollars, to 
submit e-mail. 0.10 dollars per recipient when you submit 
your message. The new network should use cryptographic 
methods to stop bandits from using it without paying this 
fee. The money collected from paying clients should use to 
further recognize and stop any spammers which might get 
into the new network. But the important thing is not to 
detech and stop spammers - this has been tried for many 
years and thus not work. The important thing is the fee per 
recipient for submitting messages into the new network. 
Spammers will not be willing to pay this cost. Their 
business model is built on the idea that you can for a 
negligible cost submit mail to millions of recipients. 
Their business model will collapse if they have to pay for 
submitting messages.

I expect that recipients will be happy to recieve messages 
from the new spam-free network.

There are, of course, problems with this solution.

One large problem is mailing lists. Mailing lists, such as 
the one to which I am sending this message, will be too 
costly if the list maintainer has to pay a fee for every 
recipient. And people who submit messages to mailing list 
may not be willing to pay 0.10 dollars for every member of 
the maling list. The solution will have to allow exceptions 
from the 0.10 dollars/message for messages coming from 
mailing lists. There should be some kind of authority, 
established by IETF, which identifies serious mailing lists 
which are allowed to forward messages to members of mailing 
lists. However, the 0.10 fee will pay for the cost of 
running such an authority body.

Another possible problem might be spammers who are willing 
to pay 0.10 dollars/recipient because they are able to 
identify recipients who will buy the product they are 
selling, so that the 0.10 dollar is acceptable cost. 
However, if a message is so interesting to recipients that 
senders are willing to pay 0.10 dollars per recipient for 
the sales message, then the recipients may be willing to 
read this spam and not regard it as spam.

The new network should run in parallel to the present mail 
networks. Protocols should be mostly the same as those used 
today for the mail networks used today. Recipients will 
have to modify their POP or IMAP client so that it collects 
mail from two networks, the old spam-allowing network and 
the new spam-safe network. Mail reading clients will either 
put incoming messages into two "In" folders, one for the 
new spam-free mail and another for the old spam-containing 
net. Or alternately mark messages with different colors for 
messages from the spam-free and spam-containing net. The 
result may be that most people will not want to download 
any message from the old network. But if that is the case, 
it just shows the value of establishing a spam-free network.

The establishing of a spam-free network, based on a fee per 
recipient for sending messages, will not be entirely easy. 
Some people may not be willing to pay for sending messages. 
Especially senders of private mail may not be willing to 
pay. The running of two parallel mail networks, one for 
spam-safe and one for non-spam-safe messages, will be a 
major effort for the IETF. But the gain is so large, and 
many people will be so happy for getting spam-free 
messages, that this is an effort which will cause people to 
thank IETF for the effort of establishing this new mail 
network.

The income of 0.10 dollars per recipient will allow paying 
the cost of running the new spam-safe mail network.
-- 
Jacob Palme <[email-masked]>, university professor emeritus
for more info see URL: http://www.dsv.su.se/jpalme/

---

From: ☮ elf Pavlik ☮ <[email-masked]>
Date: Thu, 08 Nov 2012 17:34:03 +0000

Excerpts from Jacob Palme's message of 2012-11-08 16:58:08 +0000:
> to send messages. 
Hi Jacob,

I see spam as an issue related not only to communication over SMTP, when it comes to using cryptography to approach this problem you can check out this email: http://www.w3.org/2005/Incubator/webid/track/issues/48

On funny side, reading your email as someone who quit using money already couple of years ago, I would not recommend solving technical/cultural issues with assumption that people will choose to continue using such a legacy information systems like monetary currencies, especially those nowadays in mainstream $, €, £ & co. :D

Cheers!

---

From: Tony Finch <[email-masked]>
Date: Thu, 8 Nov 2012 17:35:29 +0000

Jacob Palme <[email-masked]> wrote:

> The only solution which works is to make it more expensive to send messages.

Doesn't seem to have worked for the postal service.

http://www.rhyolite.com/anti-spam/you-might-be.html#e-postage

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.

---

From: "Paul C. Bryan" <[email-masked]>
Date: Thu, 08 Nov 2012 09:49:39 -0800

With a subject like this, and the numerous unqualified assertions within
the text, I should conclude you're just trolling.

If you're actually posting this in good faith, then some preliminary
research would certainly be in order. Start with some simple facts, like
the actual origin of the IETF, and investigate past attempts to prevent
spam through micropayment and proof-of-work schemes. Describe why these
initiatives failed to gain adoption, and how you propose their
shortcomings can be solved. Describe other anti-spam techniques that
major ISPs (including Gmail and Hotmail) currently use today, and why
your proposed solution will be more attractive to them than what they
already have in place.

Paul

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 8 Nov 2012 13:22:35 -0500

It isn't working for the telephone system either. The FCC is currently
soliciting proposals for blocking RoboCalls.

Spam is essentially a problem of costs, the cost to the sender is much less
than the benefit to the sender and the sender does not care about the cost
they impose on the recipients. But introducing additional costs into the
system does not eliminate the problem, it merely changes the type of spam.

Introducing cost into the system also affects people who are not spammers
at all. And no amount of handwavy attempts to dismiss that flaw are going
to change things. Telling people that they just have to accept the idea as
inevitable is not an argument.

In my last year at VeriSign I was getting over 3000 messages a day, most
were spam. I have moved my IETF related work to Gmail precisely because I
don't want to flood the corporate servers again. My gmail spam rate is much
lower, likely because many of the big boy spam houses know their success
rate against the google filter and decide it is not worth the effort. But
at any rate, my spam problem was severe and it is now effectively solved at
zero cost to me without the need for any micropayment scheme.

Another issue that the proponents of these schemes never seem to get to is
who gets the money.

On Thu, Nov 8, 2012 at 12:35 PM, Tony Finch <[email-masked]> wrote:

> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

-- 
Website: http://hallambaker.com/

---

From: Tony Finch <[email-masked]>
Date: Thu, 8 Nov 2012 18:33:31 +0000

Rather than discussing e-postage here we could go and read
http://www.taugh.com/epostage.pdf

Tony.

---

From: "John Levine" <[email-masked]>
Date: 8 Nov 2012 19:19:42 -0000

>The only solution which works is ...

The IRTF anti-spam research group has a wiki on which we've put a lot
of well known anti-spam techniques.

To save time, how about looking up yours to see where they've failed
before?

http://wiki.asrg.sp.am/

---

From: Terry Zink <[email-masked]>
Date: Thu, 8 Nov 2012 19:53:55 +0000

> With a subject like this, and the numerous unqualified assertions
> within the text, I should conclude you're just trolling.

After getting through the first 1/3 of the message, I thought that the original email was only a joke.

-- Terry

From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul C. Bryan
Sent: Thursday, November 08, 2012 9:50 AM
To: Jacob Palme
Cc: General discussion of application-layer protocols
Subject: Re: [apps-discuss] SPAM is IETF-s largest failure

With a subject like this, and the numerous unqualified assertions within the text, I should conclude you're just trolling.

If you're actually posting this in good faith, then some preliminary research would certainly be in order. Start with some simple facts, like the actual origin of the IETF, and investigate past attempts to prevent spam through micropayment and proof-of-work schemes. Describe why these initiatives failed to gain adoption, and how you propose their shortcomings can be solved. Describe other anti-spam techniques that major ISPs (including Gmail and Hotmail) currently use today, and why your proposed solution will be more attractive to them than what they already have in place.

Paul   

<snip>

---

From: Dave Crocker <[email-masked]>
Date: Thu, 08 Nov 2012 15:15:20 -0500

Jacob,

On 11/8/2012 11:58 AM, Jacob Palme wrote:
> Talk to ordinary people, people who are not technical experts, as we are
> in this mailing list. Ask them what is good and bad about the Internet.
> You will find that most people will answer that spam control is IETF's
> largest failure.

Yes, because the IETF should have found a way to prevent crime over the 
Internet, given how well others have done at preventing crime in the 
physical world.

> IETF started as a network for university people.

Not really.  From the start, the net was a collaboration among academic, 
research and /military/ sites.  What was missing, though, was a concern 
for commercial operation.  Since the net was expected to remain as an 
exemplar technology, rather than become a global service, the lack of 
certain features was not a "failure".

>                They wanted a network
> to make interconnection between university and research people easy.
> They had no expectation that these people would misuse the network such
> as spammers do today.

The first spam was 1978.  Do you think that no one saw that and 
considered it a harbinger?

> The root of the problem is that the cost of seinding e-mail is so low. .

Right.  Because after all, we do not get the equivalent of spam via 
postal or telephonic channels.

> The only solution which works is to make it more expensive to send

So, this is the place for the standard citation:

    http://craphound.com/spamsolutions.txt

Cory Doctorow meant it for humor, as nearly as we can tell, but quite a 
few of us find it helpful for filtering FUSSP proposals.

This is also a reason place the usual reminder that most problems are 
easy to solve in theory, but that workable solutions for changing a 
large infrastructure service require that one not start with simplistic 
assertions about what will work.

>    IETF should establish a new network,

The IETF does not "establish" networks.  If you want to promote a new 
service, please do.

  independent of the
> present e-mail forwarding network, with separate mail servers (SMTP,
> POP, IMAP servers) using new, separate ports for spam-free e-mail.

There is quite a bit of experience with folk who attempt, or have 
attempted, to provide such 'certified' email services.  By 'provide' I 
mean make assurance about specific senders.  You should learn about how 
delightful their life has been and how many of them have gone out of 
business.

>    The
> main difference is that there should be a charge, perhaps 0.10 dollars,

I don't remember how many business have attempted this model, but it's 
at least several.  Good luck with that.

> There are, of course, problems with this solution.

Only one:  it won't work.

> The new network should run in parallel to the present mail networks.

You might want to study issues with switching costs and the challenges 
they present as very high barriers to entry for replacement services.

d/
-- 
  Dave Crocker
  Brandenburg InternetWorking
  bbiw.net

---

From: Martijn Grooten <[email-masked]>
Date: Fri, 9 Nov 2012 12:49:06 +0000

> > There are, of course, problems with this solution.

Should this and other arguments posted here somehow not be convincing, consider the following:

There already is an implicit e-postage-like system in place. Sending email does cost money. You need to have a computer, or pay to use one at an Internet cafe, to send an email. If you want to send a lot of emails, you need to buy/rent a mail server (or pay someone to send them for you). And you need to pay someone to look after that server. And if you start sending a really large amount of emails, you will have to handle abuse reports and scan outbound messages for spam and probably look into things like SPF and DKIM. All of which requires time and knowledge - and thus costs money.

So there is a strong correlation between money spent and delivery rates. Of course, if what you're sending is crap no one cares to receive, your delivery rates are likely going to be low, no matter how much you pay. And if what you're sending is something people really, really want to receive, you can probably get away with spending relatively little on your mail server. Which to me seems better than a causal relation between the money invested in the infrastructure and delivery rates.

With this implicit e-postage system in place, only a few per cent of spam makes it through to people's inboxes. False positive rates are very low.

I challenge you to find an example of something bad where catch rates are this high. Malware? Burglaries? Drug trafficking? Diseases? Those fighting them are jealous of the rates at which spam is caught.

Note that I'm not saying that the spam problem is solved, because it isn't and there is a lot of work to be done.

But if you come up with a completely new way to deal with the spam problem (whether it is something like e-postage, the failing of which has been discussed in great detail, or something completely new) you shouldn't just explain why it would work. You should also explain why it would work _better_ than what we currently have.

Martijn.

________________________________

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.

---

From: S Moonesamy <[email-masked]>
Date: Fri, 09 Nov 2012 11:37:32 -0800

Hello,

During the Monday Apps Area meeting there were comments about mail 
traffic on apps-discuss.  Nobody has complained about this thread 
yet.  I suggest following on the topic of "SPAM is IETF-s largest 
failure" on the [email-masked] mailing list.

Thanks,
S. Moonesamy

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 09 Nov 2012 19:53:33 -0500

On Thu 08/Nov/2012 13:22:35 -0500 Phillip Hallam-Baker wrote:
>
> Spam is essentially a problem of costs, the cost to the sender is much
> less than the benefit to the sender and the sender does not care about
> the cost they impose on the recipients. But introducing additional costs
> into the system does not eliminate the problem, it merely changes the
> type of spam.

Couldn't we find a better term than "costs", please?  That's a relic of
the industrial revolution era, and we may consider it obsolete.  (Also
recall some comments at the plenary).

-- 
I'll buy you a diamond ring my friend if it makes you feel alright
I'll get you anything my friend if it makes you feel alright
'Cause I don't care too much for money, money can't buy me love
                                    Lennon–McCartney, 1964