From exim@www1.ietf.org Thu Apr 1 00:27:18 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA05297 for ; Thu, 1 Apr 2004 00:27:18 -0500 (EST) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B8uj6-00072G-7I for asrg-archive@odin.ietf.org; Thu, 01 Apr 2004 00:26:52 -0500 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i315Qq2Z027040 for asrg-archive@odin.ietf.org; Thu, 1 Apr 2004 00:26:52 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B8uj6-000723-2W for asrg-web-archive@optimus.ietf.org; Thu, 01 Apr 2004 00:26:52 -0500 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA05254 for ; Thu, 1 Apr 2004 00:26:48 -0500 (EST) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1B8uj3-0001HR-00 for asrg-web-archive@ietf.org; Thu, 01 Apr 2004 00:26:49 -0500 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1B8ui7-0001AS-00 for asrg-web-archive@ietf.org; Thu, 01 Apr 2004 00:25:51 -0500 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1B8uh7-00010H-00 for asrg-web-archive@ietf.org; Thu, 01 Apr 2004 00:24:49 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B8ugW-0006FG-MD; Thu, 01 Apr 2004 00:24:12 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B8syf-0006rU-3C for asrg@optimus.ietf.org; Wed, 31 Mar 2004 22:34:49 -0500 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA29612 for ; Wed, 31 Mar 2004 22:34:44 -0500 (EST) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1B8syb-00029k-00 for asrg@ietf.org; Wed, 31 Mar 2004 22:34:45 -0500 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1B8sxd-00026x-00 for asrg@ietf.org; Wed, 31 Mar 2004 22:33:45 -0500 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1B8swj-000254-00 for asrg@ietf.org; Wed, 31 Mar 2004 22:32:49 -0500 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1B8swj-0006E8-00 for asrg@ietf.org; Wed, 31 Mar 2004 22:32:49 -0500 Received: from [66.114.67.39] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1B8swi-0005Fm-00 for asrg@ietf.org; Wed, 31 Mar 2004 22:32:49 -0500 Message-ID: <406B8D5F.4030707@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 2a. BCP - new BCP draft on SUBMIT Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 31 Mar 2004 22:32:47 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit New draft posted to the ID archive: http://www.ietf.org/internet-drafts/draft-hutzler-spamops-00.txt Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 2 10:30:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14045 for ; Fri, 2 Apr 2004 10:30:22 -0500 (EST) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9NbF-00055Q-JW for asrg-archive@odin.ietf.org; Fri, 02 Apr 2004 07:16:41 -0500 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i32CGfrB019552 for asrg-archive@odin.ietf.org; Fri, 2 Apr 2004 07:16:41 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9KDM-0003Uk-Cs for asrg-web-archive@optimus.ietf.org; Fri, 02 Apr 2004 03:39:48 -0500 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29163 for ; Fri, 2 Apr 2004 03:39:46 -0500 (EST) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1B9KDK-0003OG-00 for asrg-web-archive@ietf.org; Fri, 02 Apr 2004 03:39:46 -0500 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1B9KCU-0003FA-00 for asrg-web-archive@ietf.org; Fri, 02 Apr 2004 03:38:54 -0500 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1B9KBd-00033g-00 for asrg-web-archive@ietf.org; Fri, 02 Apr 2004 03:38:02 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9FMa-00054W-RV; Thu, 01 Apr 2004 22:29:00 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9AEc-0007zv-7D for asrg@optimus.ietf.org; Thu, 01 Apr 2004 17:00:26 -0500 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03918 for ; Thu, 1 Apr 2004 17:00:22 -0500 (EST) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1B9AEa-0000ci-00 for asrg@ietf.org; Thu, 01 Apr 2004 17:00:24 -0500 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1B9ADc-0000YM-00 for asrg@ietf.org; Thu, 01 Apr 2004 16:59:24 -0500 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1B9ADA-0000Tq-00 for asrg@ietf.org; Thu, 01 Apr 2004 16:58:56 -0500 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1B9ADA-00053a-00 for asrg@ietf.org; Thu, 01 Apr 2004 16:58:56 -0500 Received: from [66.114.67.39] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1B9ADA-0004k2-00 for asrg@ietf.org; Thu, 01 Apr 2004 16:58:56 -0500 Message-ID: <406C909B.1080805@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 0. General - Subgroups update Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 01 Apr 2004 16:58:51 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit There are currently two active subgroups in the ASRG: SMTP-VERIFY and FILTERING. The others have not yet gathered a critical mass of participants. Anyone who wants to join any subgroup should contact the ASRG chairs . The SMTP Session Verification subgroup (SMTP-VERIFY) after the MARID BOF has been focusing on the issues of trust, reputation and accreditation with an eye towards possible models, protocols and formats for exchanging trust information between different parties. More information can be found at their webpage (http://asrg.sp.am/subgroups/smtp_verify.shtml). LMAP discussions have been moved from the SMTP-VERIFY subgroup to the MARID list (http://www.imc.org/ietf-mxcomp/). The IETF folks have proposed that the the LMAP discussion document and associated proposals be published as RFCs, we are waiting for a formal IESG request on that. The Filtering standards subgroup (FILTERING) has been discussing the issues of MTA/MUA communications among filters such as feedback from the MUA to train an MTA-based filter, and ability for an MTA-based filter to tell the MUA later that prior messages were spam. Currently discussion has focused on requirements for a standard filtering header. More information can be found on their webpage (http://asrg.sp.am/subgroups/filtering.shtml) and wiki (http://www.shaftek.org/wiki/wiki.pl?Filtering_Standards). There are still a bunch of subgroups that are dormant and can use some participants. A list of them can be found at the ASRG homepage (http://asrg.sp.am/about/subgroups.shtml). Sincerely, Yakov Shafranovich Co-Chair, ASRG _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 3 21:04:43 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA15090 for ; Sat, 3 Apr 2004 21:04:42 -0500 (EST) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9wzf-0001fF-D1 for asrg-archive@odin.ietf.org; Sat, 03 Apr 2004 21:04:15 -0500 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3424FcH006393 for asrg-archive@odin.ietf.org; Sat, 3 Apr 2004 21:04:15 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9wze-0001f2-Mo for asrg-web-archive@optimus.ietf.org; Sat, 03 Apr 2004 21:04:14 -0500 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA15084 for ; Sat, 3 Apr 2004 21:04:11 -0500 (EST) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1B9wzc-0006xs-00 for asrg-web-archive@ietf.org; Sat, 03 Apr 2004 21:04:12 -0500 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1B9wyg-0006sP-00 for asrg-web-archive@ietf.org; Sat, 03 Apr 2004 21:03:15 -0500 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1B9wyK-0006ms-00 for asrg-web-archive@ietf.org; Sat, 03 Apr 2004 21:02:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9wxV-0001Cl-Lc; Sat, 03 Apr 2004 21:02:01 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1B9wts-0000bJ-Ea for asrg@optimus.ietf.org; Sat, 03 Apr 2004 20:58:16 -0500 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA14983 for ; Sat, 3 Apr 2004 20:58:13 -0500 (EST) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1B9wtq-0006Mj-00 for asrg@ietf.org; Sat, 03 Apr 2004 20:58:14 -0500 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1B9wst-0006Gs-00 for asrg@ietf.org; Sat, 03 Apr 2004 20:57:16 -0500 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1B9wsP-0006B5-00 for asrg@ietf.org; Sat, 03 Apr 2004 20:56:45 -0500 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1B9wsP-000250-00 for asrg@ietf.org; Sat, 03 Apr 2004 20:56:45 -0500 Received: from [66.114.67.39] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1B9wsP-0000nx-00 for asrg@ietf.org; Sat, 03 Apr 2004 20:56:45 -0500 Message-ID: <406F6B5E.4030608@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 3b. SMTP Session Verification - MARID WG officially approved by the IETF Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 03 Apr 2004 20:56:46 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit The IESG has approved the MARID charter and it is now officially an IETF WG. I want to express a word of thanks to all ASRG members who helped make this happen. Copy of the announcement appears here: http://www.imc.org/ietf-mxcomp/mail-archive/msg00709.html Sincerely, Yakov Shafranovich Co-Chair, ASRG _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 6 05:18:44 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA25158 for ; Tue, 6 Apr 2004 05:18:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BAmin-0003dI-SG for asrg-archive@odin.ietf.org; Tue, 06 Apr 2004 05:18:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i369IHqe013964 for asrg-archive@odin.ietf.org; Tue, 6 Apr 2004 05:18:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BAmin-0003d9-NI for asrg-web-archive@optimus.ietf.org; Tue, 06 Apr 2004 05:18:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA25038 for ; Tue, 6 Apr 2004 05:18:13 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BAmik-0003OS-00 for asrg-web-archive@ietf.org; Tue, 06 Apr 2004 05:18:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BAmTC-0000ah-00 for asrg-web-archive@ietf.org; Tue, 06 Apr 2004 05:02:12 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BAltT-0004oF-00 for asrg-web-archive@ietf.org; Tue, 06 Apr 2004 04:25:16 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BAldi-0008Ea-8k for asrg-web-archive@ietf.org; Tue, 06 Apr 2004 04:08:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BAlcu-0001Vh-Ts; Tue, 06 Apr 2004 04:08:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BAlck-0001Rx-VP for asrg@optimus.ietf.org; Tue, 06 Apr 2004 04:07:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA17353 for ; Tue, 6 Apr 2004 04:07:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BAlci-00027D-00 for asrg@ietf.org; Tue, 06 Apr 2004 04:07:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BAl3l-0006ul-00 for asrg@ietf.org; Tue, 06 Apr 2004 03:31:50 -0400 Received: from out2.smtp.messagingengine.com ([66.111.4.26]) by ietf-mx with esmtp (Exim 4.12) id 1BAkwh-0005ku-00 for asrg@ietf.org; Tue, 06 Apr 2004 03:24:31 -0400 X-Sasl-enc: 9GSt4FGD97m6Ipp0AzJ4mw 1081236272 Received: from elvey.com (ns.nextbus.com [64.164.28.194]) by mail.messagingengine.com (Postfix) with ESMTP id 6AA46951353; Tue, 6 Apr 2004 03:24:31 -0400 (EDT) Message-ID: <40725B2A.5000107@elvey.com> From: Matthew Elvey User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 To: ASRG References: <406E08B2.6080301@proofpoint.com> <406F7488.40008@solidmatrix.com> In-Reply-To: <406F7488.40008@solidmatrix.com> X-Habeas-SWE-1: winter into spring X-Habeas-SWE-2: brightly anticipated X-Habeas-SWE-3: like Habeas SWE (tm) X-Habeas-SWE-4: Copyright 2002 Habeas (tm) X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-SWE-6: email in exchange for a license for this Habeas X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this X-Habeas-SWE-9: mark in spam to . Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] LMAP: RHSBLs better than what we have now? Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 06 Apr 2004 00:24:26 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=-7.9 required=5.0 tests=AWL,HABEAS_SWE autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Today, the only thing in an email that's pretty much guaranteed not to be forged is the source IP. If LMAP/MARID becomes widespread, domains (in HELO, 2821 FROM, 2822 From:, etc.) will be like IPs: They, together will be the only thing in an email that's pretty much guaranteed not to be forged. So the next logical question is: are RHSBLs better than what I'll term "IPBLs" (AKA traditional RBLs/ DNSBLs, i.e. the ones listed at sites like openrbl.org and moensted.dk)? Or have we just (to make a lame analogy) replaced a knife whose blade is sharp on the left with one that's sharp on the right, but we're fighting a tank. Why or why not? 1)Which is easier to run? use? 2)Which can provide greater opportunity to be more accurate? (Assuming spammers have already adapted to widespread RHSBL deployment and use.) This topic is important for ietf-mxcomp, but not what the Charter says should be discussed there right now, so I'm posting to the main list. We don't want to try everything and see what sticks; we want to develop a plan to achieve ultimate victory in the long term. (Unless we are part of the industry and don't want the problem resolved once and for all!) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 7 00:36:32 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA09572 for ; Wed, 7 Apr 2004 00:36:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB4nF-0000Qj-LF for asrg-archive@odin.ietf.org; Wed, 07 Apr 2004 00:36:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i374a5C3001612 for asrg-archive@odin.ietf.org; Wed, 7 Apr 2004 00:36:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB4nE-0000Pv-Qt for asrg-web-archive@optimus.ietf.org; Wed, 07 Apr 2004 00:36:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA09527 for ; Wed, 7 Apr 2004 00:36:00 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB4nC-0006RW-00 for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 00:36:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BB3wF-0007CJ-00 for asrg-web-archive@ietf.org; Tue, 06 Apr 2004 23:41:28 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BB2kh-0000i5-01 for asrg-web-archive@ietf.org; Tue, 06 Apr 2004 22:25:19 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BB2fZ-0004CH-MV for asrg-web-archive@ietf.org; Tue, 06 Apr 2004 22:20:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB2ec-0001Y4-30; Tue, 06 Apr 2004 22:19:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB2dr-0001S9-OS for asrg@optimus.ietf.org; Tue, 06 Apr 2004 22:18:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27671 for ; Tue, 6 Apr 2004 22:18:11 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB2do-0007dn-00 for asrg@ietf.org; Tue, 06 Apr 2004 22:18:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BB25L-000258-00 for asrg@ietf.org; Tue, 06 Apr 2004 21:42:41 -0400 Received: from joust.vosn.net ([209.151.81.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB0vZ-0002kj-00 for asrg@ietf.org; Tue, 06 Apr 2004 20:28:25 -0400 Received: from dsl-219.19.240.220.rns02-kent-syd.dsl.comindico.com.au ([220.240.19.219] helo=dle5) by joust.vosn.net with esmtp (Exim 4.24) id 1BB0vl-0000um-Oj for asrg@ietf.org; Tue, 06 Apr 2004 18:28:38 -0600 From: "Joshua Leisk" To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C41C8B.0B293BA0" X-Mailer: Microsoft Office Outlook, Build 11.0.5510 Thread-Index: AcQcNxR+AX3Hig7SRN+HSt3wBw7e8QAABAWA X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300 Message-Id: X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - joust.vosn.net X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - intechcomm.net.au Subject: [Asrg] 'Registered Email' and 'Trust-E-mail' proposals for both spam and viruses Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 7 Apr 2004 10:28:16 +1000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.2 required=5.0 tests=HTML_60_70,HTML_MESSAGE, MISSING_OUTLOOK_NAME autolearn=no version=2.60 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01C41C8B.0B293BA0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit In January, I came up with a technically feasible solution to spam and email viruses, coined 'Registered-Email', the details of which, I have posted here: http://www.intechcomm.net.au As this requires a global change to the email system, it is fairly ambitious, although technically sound. Please read through the original post (at the address above) before reading further. Realising that any change to the existing email system, although sorely needed, is going to be nearly impossible, I have devised a fairly workable variation of the concept. This is an early draft, although I am hoping you will see merit in the ideas behind the concept, rather than dismissing individual aspects. Having said that, I would really welcome all comments, as this certainly will need refining: 'Trust-E-mail' - 'Trust-Based Mail Server Ranking' Introduction. The major hurdle faced by my 'Registered Email' concept is that it requires active participation of the sender and effectively a global change to SMTP. This variation of the 'registrar' component eliminates that problem. Table of Contents 1.DNS Scan - The Innovation 2.Ranking System 3.Penalties 4.Database Usage 5.Procedures for New Mail Servers 6.Bonds 1. DNS Scan - The Innovation This is performed to create an automated global white-list, for immediate mail server trust ranking and immediate SMTP virus prevention for receiving mail servers. This is done by creating an application that scans the DNS Rootservers daily for: Domain Name MX Records Domain Creation Date Using this information, a database is created, containing: Domain Name MX Records Domain Creation Date Trust Level / Rank Reset or 'Effective' Creation Date (for blacklist and spammers. For permanent barring, this could be set 1000 years in advance and the Rank set to "U" (see ranking system) Trusted DNS blacklists, eg Spamhaus, should be applied against the resultant initial database and the trust level / rank of blacklisted MX records should be set to "U" (see ranking system). 2. Ranking system consists of: "U" - Untrustworthy. Any domain that is less than 12 months old and has not applied for a "P" provisional or "B" bonded ranking. New servers should follow the steps detailed in section 5 if they don't want to be treated as untrustworthy by receiving mail servers. "P" - Provisional. Any domain that is more than 6 months old, but less than 12 months old, has not been the subject of verified Spam complaints and has been sponsored / vouched for by existing highly-ranked mail-servers (typically their ISP). "B" - Bonded. Any domain that is less than 12 months old, but has paid a security bond against spamming, does not relay mail from clients that are not using SASL / TLS / SPA and blocks outgoing emails with dangerous attachments. "N" - Neutral. Any domain that is more than 12 months old and has not been the subject of verified Spam complaints. "A" - Active. Any domain that is more than 12 months old, has not been the subject of verified Spam complaints and has been sponsored / vouched for by existing highly-ranked mail-servers (typically ISPs). "T" - Trusted. Any domain that is more than 12 months old, has paid a security bond against spamming, has not been the subject of verified Spam complaints and does not relay mail from clients that are not using SASL / TLS / SPA. OR Any domain that is more than 36 months old, has not been the subject of verified Spam complaints and does not relay mail from clients that are not using SASL / TLS / SPA. "E" - Elite. Any domain that is more than 3 years old, has paid a security bond against spamming and has not been the subject of verified Spam complaints and does not relay mail from clients that are not using SASL / TLS / SPA. 3. Penalties: Any mail server proven to send Spam will have its ranking lowered. 'Bonded' mail servers could forfeit all or part of the bond supplied. Severe breaches will result in a permanent "U" ranking being attributed. 4. Database Usage: Receiving mail servers should perform a reverse DNS lookup and verify an incoming mailserver is in the database. If not, the mail should be rejected, as the sending mailserver is a virus. If used, the spoof-prevention technique mentioned in my 'Registered-Email' concept notes will prevent mail servers on private networks from being spoofed by viruses also residing on the internal network. The mailserver can also choose to check the database and either reject, stamp or filter mail from the various ranked mailservers. Messages received from "U" should either be rejected with a non-delivery report sent stating why it was rejected, OR heavily stripped, stamped as 'untrustworthy' and cleaned. Messages received from "P" and "N" ranked mailservers should have dangerous file attachments and dangerous HTML tags and all ActiveX controls stripped. These messages should be filed separately from the remaining ranks. Messages received from "A","B", "T" or "E" ranked mailservers are trusted. 5. Procedures for New Mail Servers: New mail servers register their MX details in the DNS as usual and then choose to either: a. Forward all mail through their ISP, using SASL. Configure the mail server for SASL clients only and block outgoing emails with dangerous attachments. At 6 months, seek 'sponsorship' from another highly-ranked mail server owner (typically your ISP) and apply for a "P" provisional ranking. The mail server must also pass checks to verify SASL compliance and blocking of outgoing emails with dangerous attachments. This is typically for a home mail server or a small business. b. Apply for a "B" (Bonded) ranking. This is predominantly for larger businesses. 6. Bonds To qualify for a "B" ranking, the mail server owner must supply enough proof-of-ID, in person, to an authorised agent of the database owner. The mail server must also pass checks to verify SASL compliance and blocking of outgoing emails with dangerous attachments. After 12 months, the bond can be returned - to receive a "N" rating, or kept to receive a "T" rating. Likewise, at 36 months the bond can be returned to receive a "T" rating, or kept to receive an "E" rating. Summary This is an extremely easy-to-implement, automated 'whitelist' solution, similar to my 'Registered Email' concept, that will prevent viruses and the majority of Spam. Existing mailservers will already fall into the "U", "N", "A" and "T" ranks. This requires no active participation of the sender or end-recipient, although it will be rewarded, prevents SMTP virus replication and allows for 'home' and 'hobby' email servers. Thanks for your time. I welcome your comments and criticism. Regards, Joshua Leisk ------=_NextPart_000_0007_01C41C8B.0B293BA0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 

In January, I came up with a technically = feasible solution to spam and email viruses, coined = ‘Registered-Email’, the details of which, I have posted here:

 

http://www.intechcomm.net.au

 

As this requires a global change to the email = system, it is fairly ambitious, although technically = sound.

 

Please read through the original post (at the = address above) before reading further.

 

Realising that any change to the existing = email system, although sorely needed, is going to be nearly impossible, I have devised a fairly workable variation of the concept. =

 

This is an early draft, although I am hoping = you will see merit in the ideas behind the concept, rather than dismissing = individual aspects. Having said that, I would really welcome all comments, as this certainly will need refining:

 

 

 

‘Trust-E-mail’ -  ‘Trust-Based Mail Server = Ranking’

 

Intr= oduction.

 

The major hurdle faced = by my 'Registered Email' concept is that it requires active participation of = the sender and effectively a global change to SMTP. This variation of = the 'registrar' component eliminates that = problem.

 

Tabl= e of Contents

 

1.DNS Scan - The = Innovation

2.Ranking = System

3.Penalties<= /span>

4.Database = Usage

5.Procedures for New = Mail Servers

6.Bonds

 

1. DNS Scan - The Innovation

 

This is performed to = create an automated global white-list, for immediate mail server trust ranking = and immediate SMTP virus prevention for receiving mail servers. This is done = by creating an application that scans the DNS Rootservers daily = for:

            = Domain Name

MX Records

Doma= in Creation Date

 

Using this = information, a database is created, containing:

            = Domain Name

MX Records

Doma= in Creation Date

Trus= t Level / Rank

Rese= t or 'Effective' Creation Date (for blacklist and spammers. For permanent barring, this could be set 1000 years in advance and the Rank set to "U" (see ranking system)

 

Trusted DNS = blacklists, eg Spamhaus, should be applied against the resultant initial = database and the trust level / rank of blacklisted MX records should be set to "U" (see ranking system).

 

2. Ranking system consists of:

            =

"U" - Untrustworthy.

Any domain that is less than 12 months old and has not applied for a = "P" provisional or "B" bonded ranking. New servers should follow = the steps detailed in section 5 if they don't want to be treated as = untrustworthy by receiving mail servers.

"P" - = Provisional.

Any domain that is more than 6 months old, but less than 12 months old, has = not been the subject of verified Spam complaints and has been sponsored / = vouched for by existing highly-ranked mail-servers (typically their = ISP).

"B" - = Bonded.

Any domain that is less than 12 months old, but has paid a security bond = against spamming, does not relay mail from clients that are not using SASL / TLS = / SPA and blocks outgoing emails with dangerous = attachments.

"N" - = Neutral.

Any domain that is more than 12 months old and has not been the subject of = verified Spam complaints.

"A" - = Active.

Any domain that is more than 12 months old, has not been the subject of = verified Spam complaints and has been sponsored / vouched for by existing = highly-ranked mail-servers (typically ISPs).

"T" - = Trusted.

Any domain that is more than 12 months old, has paid a security bond against spamming, has not been the subject of verified Spam complaints and does = not relay mail from clients that are not using SASL / TLS / = SPA.

OR

Any domain that is more than 36 months old, has not been the subject of = verified Spam complaints and does not relay mail from clients that are not using = SASL / TLS / SPA.

"E" - Elite. =

Any domain that is more than 3 years old, has paid a security bond against = spamming and has not been the subject of verified Spam complaints and does not = relay mail from clients that are not using SASL / TLS / = SPA.

&nbs= p;

3. Penalties:

 

Any mail server proven = to send Spam will have its ranking lowered. 'Bonded' mail servers could = forfeit all or part of the bond supplied. Severe breaches will result in a permanent "U" ranking being attributed.

 

4. Database Usage:

 

Receiving mail servers = should perform a reverse DNS lookup and verify an incoming mailserver is in the database. If not, the mail should be rejected, as the sending mailserver = is a virus. If used, the spoof-prevention technique mentioned in my ‘Registered-Email’ concept notes will prevent mail servers = on private networks from being spoofed by viruses also residing on the = internal network.

The mailserver can = also choose to check the database and either reject, stamp or filter mail = from the various ranked mailservers. Messages received from "U" should = either be rejected with a non-delivery report sent stating why it was rejected, = OR heavily stripped, stamped as 'untrustworthy' and cleaned. Messages = received from "P" and "N" ranked mailservers should have = dangerous file attachments and dangerous HTML tags and all ActiveX controls stripped. These messages should be filed separately from = the remaining ranks. Messages received from = "A","B", "T" or "E" ranked mailservers are = trusted.

 

5. Procedures for New Mail Servers:

 

New mail servers = register their MX details in the DNS as usual and then choose to = either:

  1. Forward all mail through their ISP, = using SASL. Configure the mail server for SASL clients only and block = outgoing emails with dangerous attachments. At 6 months, seek 'sponsorship' = from another highly-ranked mail server owner (typically your ISP) and = apply for a "P" provisional ranking. The mail server must also pass = checks to verify SASL compliance and blocking of outgoing emails with = dangerous attachments. This is typically for a home mail server or a small = business.

&nbs= p;b. Apply for a "B" (Bonded) ranking.  This is predominantly for = larger businesses.

 

6. Bonds

 

To qualify for a "B" ranking, the mail server owner must supply enough = proof-of-ID, in person, to an authorised agent of the database owner. The mail server = must also pass checks to verify SASL compliance and blocking of outgoing emails = with dangerous attachments.

&nbs= p;

After 12 months, the = bond can be returned - to receive a "N" rating, or kept to receive a "T" rating. Likewise, at 36 months the bond can be returned to receive a "T" rating, or kept to receive an "E" = rating.

 

Summary

 

This is an extremely easy-to-implement, automated 'whitelist' solution, = similar to my 'Registered Email' concept, that will prevent viruses and the = majority of Spam. Existing mailservers will already fall into the = "U", "N", "A" and "T" ranks. This requires no = active participation of the sender or end-recipient, although it will be = rewarded, prevents SMTP virus replication and allows for 'home' and = 'hobby' email servers.

 

 

Thanks for your time. I welcome your comments = and criticism.

 

Regards,

 

 

Joshua Leisk

------=_NextPart_000_0007_01C41C8B.0B293BA0-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 7 03:11:27 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA19581 for ; Wed, 7 Apr 2004 03:11:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB7D9-0003Oq-RN for asrg-archive@odin.ietf.org; Wed, 07 Apr 2004 03:10:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i377Axj2013068 for asrg-archive@odin.ietf.org; Wed, 7 Apr 2004 03:10:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB7D9-0003Og-Eb for asrg-web-archive@optimus.ietf.org; Wed, 07 Apr 2004 03:10:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA19542 for ; Wed, 7 Apr 2004 03:10:56 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB7D5-0001DR-00 for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 03:10:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BB6CM-0000RS-00 for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 02:06:08 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BB550-00016g-00 for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 00:54:26 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BB4xG-00068I-0k for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 00:46:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB4wv-0003lB-HM; Wed, 07 Apr 2004 00:46:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB4we-0003f0-CP for asrg@optimus.ietf.org; Wed, 07 Apr 2004 00:45:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA11156 for ; Wed, 7 Apr 2004 00:45:39 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB4wW-00007Q-00 for asrg@ietf.org; Wed, 07 Apr 2004 00:45:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BB4GF-0001W7-00 for asrg@ietf.org; Wed, 07 Apr 2004 00:02:01 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BB2zw-0001nw-00 for asrg@ietf.org; Tue, 06 Apr 2004 22:41:04 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc11) with SMTP id <2004040702403001300sqqepe>; Wed, 7 Apr 2004 02:40:34 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Tue, 6 Apr 2004 21:38:50 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 06 Apr 2004 21:47:13 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] LMAP: RHSBLs better than what we have now? To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 06 Apr 2004 21:47:13 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.9 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > Today, the only thing in an email that's pretty much guaranteed not to be forged is the source IP. If LMAP/MARID becomes widespread, domains (in HELO, 2821 FROM, 2822 From:, etc.) will be like IPs: They, together will be the only thing in an email that's pretty much guaranteed not to be forged. I know that there is still all kinds of concern about trying to identify the sender of spam, with all kinds of convoluted approaches to trying to solve that problem, but ultimately that just IS NOT going to solve the real problem. What you're going to find, upon tracking back, is often going to be a proxy spambot that's been infected by a worm... with a clueless (or not) person operating it, and probably unaware that they're pumping spam out to the Net. So what do you do then, punish a fellow victim? What I think makes more sense is to instead "follow the money"... to locate the actual seller of the drugs, or the mortgage spammer, or whatever... and go after the Web hosting they're using, for example. Towards that end, it needs to be a lot easier to find out who the ACTUAL Web host is of the site the spam is promoting... not just the link to the (say) Geocities site which only just forwards to another rogue site elsewhere. If we're ever going to REALLY get a handle on this problem, I still believe that what matters more is: 1) putting the quash on unexpected attachments (especially if they are executables); it's much harder to infect a machine with a worm or virus if the only kinds of attachments that the recipient has authorized are JPG, GIF, and TXT types. :-) 2) likewise, making support for HTML-burdened E-mail (which can contain all kinds of malicious scripting, text-as-image, Web bugs, obscured URLs, ActiveX malware, spoofed links, and all the other nasty tricks that spammers use to deceive the targets of their spam) much less of a given. I believe that the most significant way to hugely improve both of these situations is the ability of the recipient to whitelist individual specific senders with SPECIFIC rights to: a) send them attachments (and subapprove based on the class of the attachments) b) send them HTML (and POSSIBLY subapprove based on categories of HTML tags allowed). The default without being whitelisted would be to only accept plain ASCII text, no attachments, no HTML. That means that plain ASCII text E-mail would be the only practical way to initially establish a communication with someone for the first time. After you had established a relationship with that person, you could then negotiate with them for the right to send them attachments, HTML-burdened mail, or whatever AT THE OPTION OF THE RECIPIENT. This solves the problem of (say) a Customer Service Department of (say) a consumer products company, who will need to receive unsolicited E-mails from maybe millions of individuals. It means that unsophisticated users MIGHT set up their systems so that Aunt Gertrude can send them JPGs of her poodle Fifi. They are unlikely to EVER (especially with a suitably dire-sounding dialog box warning them about enabling the capability) whitelist anybody to send them (say) PIF files...! The result anyhow will be that "almost nobody" will be authorized to send executable attachments, and few will be authorized to send HTML-burdened E-mail. Spammers as a result will resort to sending plain ASCII E-mails, but at least content-based filters don't have TOO hard a time dealing with those... the biggest problems for such filters are all the HTML-based tricks that spammers so love to use. Again, my solution doesn't require rethinking the whole world's Internet, POP3 or SMTP infrastructure. It doesn't eliminate viruses and worms 100%, but it will take a damned large hunk out of their collective hides, and do so faster and at a far lower cost (both money and inconvenience) than anything else I've seen tossed around. Most of this other stuff, SPF, or Microsoft's proposed "solution" for the problem, are going to change all kinds of stuff and break a lot of existing applications and systems, which ALMOST might be worth it IF they actually solved the problem. BUT THEY WON'T. (As for tracking IP addresses, presumably to allow blacklisting. note the recent story of one of the Nigerian spammers who was actually arrested because he was stupid enough to reuse a familiar haunt... and was hooked up in a NAT configuration from a local Internet cafe that offered a wireless connection. Now yes, it IS true that in that case they caught him due to finding his IP address, but there are enough wireless hot spots around that a clever and highly mobile spammer could play cat-and-mouse for a long time before being caught. Ultimately, what will do a lot more to quash both spam and worms/viruses, *I* think, would be if the sender realized that it was nearly impossible to get them through to anybody at the other end.) > We don't want to try everything and see what sticks; we want to develop a plan to achieve ultimate victory in the long term. (Unless we are part of the industry and don't want the problem resolved once and for all!) The nice thing about my approach is that there is almost no downside, and it can be implemented QUICKLY and with an immediate payback for each person doing so. The payback doesn't wait until "everyone goes along". What's more, it doesn't in any way PRECLUDE any of these more intrusive solutions should someone come up with a "good" one some day. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 7 05:08:15 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA29638 for ; Wed, 7 Apr 2004 05:08:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB92C-0006q0-9H for asrg-archive@odin.ietf.org; Wed, 07 Apr 2004 05:07:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3797mwq026285 for asrg-archive@odin.ietf.org; Wed, 7 Apr 2004 05:07:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB92C-0006ps-3H for asrg-web-archive@optimus.ietf.org; Wed, 07 Apr 2004 05:07:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA29571 for ; Wed, 7 Apr 2004 05:07:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB928-0006jC-00 for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 05:07:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BB84K-0006JQ-00 for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 04:05:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BB6hY-00057m-00 for asrg-web-archive@ietf.org; Wed, 07 Apr 2004 02:38:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB6hK-0003e7-Ia; Wed, 07 Apr 2004 02:38:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB6ga-0003QC-Et for asrg@optimus.ietf.org; Wed, 07 Apr 2004 02:37:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA16609 for ; Wed, 7 Apr 2004 02:37:17 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB6gW-0004un-00 for asrg@ietf.org; Wed, 07 Apr 2004 02:37:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BB5lp-0004JC-00 for asrg@ietf.org; Wed, 07 Apr 2004 01:38:43 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=nO0oYwn1SCRzWBNeeEgfLQRjadKM4Jozao169ljMpCi) by ietf-mx with esmtp (Exim 4.12) id 1BB4WV-0004D6-00 for asrg@ietf.org; Wed, 07 Apr 2004 00:18:47 -0400 Received: from localhost (localhost [[UNIX: localhost]]) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id AAA22398; Wed, 7 Apr 2004 00:18:41 -0400 (EDT) From: der Mouse Message-Id: <200404070418.AAA22398@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] 'Registered Email' and 'Trust-E-mail' proposals for both spam and viruses In-Reply-To: References: Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 6 Apr 2004 23:41:19 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > In January, I came up with a technically feasible solution to spam > and email viruses, [...] This looks to me like another FUSSP. Most briefly, it has severe scaling problems; if the stuff described is done per recipient site, it has catastrophic scaling problems, whereas if it's done through a central registry, it has central point of failure/trust/pressure problems. It also appears to have been designed by someone who understands neither email (for example, the confusing between MX hosts and outgoing mailservers, and the peculiar notion that all domains that send mail appear directly in something like a root server) nor the DNS (thinking the root servers hold MX records, thinking that the DNS anywhere holds creation dates). In more detail.... > This is performed to create an automated global white-list, for > immediate mail server trust ranking and immediate SMTP virus > prevention for receiving mail servers. This is done by creating an > application that scans the DNS Rootservers daily for: (a) Instant scaling problems. Every email site downloading the entire root zones daily? Or if a centralized site, why should everyone trust it, what will be done to protect it against technological and legal attacks? (b) You're assuming the DNS root servers are the appropriate place to check. This is true for approximately no domains. Even the gtld-servers.net machines are good only for .com/.net/.org, and only for second-level domains there. > Domain Name > MX Records > Domain Creation Date The DNS does not contain domain creation dates. The root servers do not have MX records for any significant number of domains. You have to ask the domains' servers themselves for that. This also assumes all email domains will be @ domains that appear directly in the roots. This is false (eg, my own mailhost, sparkle.rodents.montreal.qc.ca - only .ca appears in the roots; even if you go to the .ca roots, only rodents.montreal.qc.ca appears there). I also have trouble imagining why a receiving system cares about anyone else's MX records. Are you perhaps falling into the trap of thinking that MX records have anything to do with outgoing mail? > Using this information, a database is created, containing: > Domain Name > MX Records > Domain Creation Date > Trust Level / Rank > [...] More scaling problems. Every email site is going to recreate this ginormous database daily? Where will they store it? > Trusted DNS blacklists, eg Spamhaus, should be applied against the > resultant initial database Most DNS blacklists do not list domain names (which are all you have at this point, since you haven't described anything that involves any addresses), only addresses. More scaling problems - you're having every email site doing some huge number of queries (on the order of the number of domains) to at least a few DNSLs. Daily. If even a small fraction of the mailservers on the net were to do this, it would amount to a DDoS on the DNSLs. > "U" - Untrustworthy. > Any domain that is less than 12 months old and has not applied for So domains must exist for a year before anyone will let them send mail, unless they specifically negotiate an agreement of some kind with the recipient? This might help for a year; all it would do after that is mean that spammers need a lag time of a year between registering domains and using them. It would raise their costs slightly, but that's about it. On the other hand, it will severely cripple net.newcomers. Looks to me as though it causes trouble for the wrong people. > Any domain that [...] does not relay mail from clients that are not > using SASL / TLS / SPA and blocks outgoing emails with dangerous > attachments. Dangerous in whose opinion? How can you prove whether a mailserver (it's mailservers that relay mail, not domains) insists on sasl/tls/etc? (Don't forget, spamhauser _will_ lie about what their outgoing mailservers do if they think it will help them.) > Any domain that is less than 12 months old, but has paid a security > bond against spamming, Paid to whom? If this isn't per-recipient, why should anyone trust this entity? Especially those in other countries than it? > 3. Penalties: > Any mail server proven to send Spam will have its ranking lowered. Proven to whose satisfaction? > 'Bonded' mail servers could forfeit all or part of the bond supplied. Forfeit to whom? This system sounds as though it's either got a single central point of trust/failure, or it's nothing but a rather elaborate and resource-hungry form of individual whitelisting. > Severe breaches will result in a permanent "U" ranking being > attributed. Until the lawyers attack it. (If your system becomes successful enough to matter, this _will_ happen.) > This is an extremely easy-to-implement, automated 'whitelist' > solution, Doesn't sound easy to implement to me. You need some big legal defenses (or you will if it becomes at all effective), you need someone trusted enough to handle the bonds, you need to somehow get permission to DDoS the root nameservers plus whatever other servers you need to hit up to find the information you (think you) need, and above all you need buy-in from both senders and receivers. > This requires no active participation of the sender or end-recipient, Sounds to me as though it does; the sender has to apply for something or post a bond of some sort or some such, and the recipient has to check all this goop. > [...], and allows for 'home' and 'hobby' email servers. How? A number (such as me) will refuse outright on principle. Most of the others, any bond they can afford would be so small as to be ignorable as a cost-of-doing-business to a spamhaus of any size. Or are they supposed to just suffer for the first year, until they've been around long enough to be mistaken for spammer^W^W^Wallowed to send mail? /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 8 19:11:14 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06171 for ; Thu, 8 Apr 2004 19:11:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBifY-00044W-Mo for asrg-archive@odin.ietf.org; Thu, 08 Apr 2004 19:10:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i38NAmnH015648 for asrg-archive@odin.ietf.org; Thu, 8 Apr 2004 19:10:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBifX-00044J-10 for asrg-web-archive@optimus.ietf.org; Thu, 08 Apr 2004 19:10:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA05997 for ; Thu, 8 Apr 2004 19:10:42 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BBifS-000238-00 for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 19:10:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BBhrW-0004S2-00 for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 18:19:18 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BBfqj-00038j-00 for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 16:10:09 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BBfCk-00030i-UB for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 15:28:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBfBw-0002hn-FG; Thu, 08 Apr 2004 15:28:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BB2dm-0001R1-KF for asrg@optimus.ietf.org; Tue, 06 Apr 2004 22:18:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27661 for ; Tue, 6 Apr 2004 22:18:06 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BB2dj-0007cq-00 for asrg@ietf.org; Tue, 06 Apr 2004 22:18:07 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BB24z-00021k-00 for asrg@ietf.org; Tue, 06 Apr 2004 21:42:20 -0400 Received: from vqbn-link.syd.comindico.com.au ([203.221.180.26] helo=veritel.com.au) by ietf-mx with esmtp (Exim 4.12) id 1BB0uh-0002g9-00 for asrg@ietf.org; Tue, 06 Apr 2004 20:27:31 -0400 Received: (qmail 680 invoked from network); 7 Apr 2004 00:27:20 -0000 Received: from unknown (HELO dle5) (send@veritel.com.au@220.240.19.219) by 203.221.180.29 with SMTP; 7 Apr 2004 00:27:20 -0000 From: "Joshua Leisk" To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01C41C8A.E738CB20" X-Mailer: Microsoft Office Outlook, Build 11.0.5510 Thread-Index: AcQcNxR+AX3Hig7SRN+HSt3wBw7e8Q== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300 Message-Id: Subject: [Asrg] 'Registered Email' and 'Trust-E-mail' proposals for both spam and viruses Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 7 Apr 2004 10:27:17 +1000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.2 required=5.0 tests=HTML_60_70,HTML_MESSAGE, MISSING_OUTLOOK_NAME autolearn=no version=2.60 This is a multi-part message in MIME format. ------=_NextPart_000_0003_01C41C8A.E738CB20 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit In January, I came up with a technically feasible solution to spam and email viruses, coined 'Registered-Email', the details of which, I have posted here: http://www.intechcomm.net.au As this requires a global change to the email system, it is fairly ambitious, although technically sound. Please read through the original post (at the address above) before reading further. Realising that any change to the existing email system, although sorely needed, is going to be nearly impossible, I have devised a fairly workable variation of the concept. This is an early draft, although I am hoping you will see merit in the ideas behind the concept, rather than dismissing individual aspects. Having said that, I would really welcome all comments, as this certainly will need refining: 'Trust-E-mail' - 'Trust-Based Mail Server Ranking' Introduction. The major hurdle faced by my 'Registered Email' concept is that it requires active participation of the sender and effectively a global change to SMTP. This variation of the 'registrar' component eliminates that problem. Table of Contents 1.DNS Scan - The Innovation 2.Ranking System 3.Penalties 4.Database Usage 5.Procedures for New Mail Servers 6.Bonds 1. DNS Scan - The Innovation This is performed to create an automated global white-list, for immediate mail server trust ranking and immediate SMTP virus prevention for receiving mail servers. This is done by creating an application that scans the DNS Rootservers daily for: Domain Name MX Records Domain Creation Date Using this information, a database is created, containing: Domain Name MX Records Domain Creation Date Trust Level / Rank Reset or 'Effective' Creation Date (for blacklist and spammers. For permanent barring, this could be set 1000 years in advance and the Rank set to "U" (see ranking system) Trusted DNS blacklists, eg Spamhaus, should be applied against the resultant initial database and the trust level / rank of blacklisted MX records should be set to "U" (see ranking system). 2. Ranking system consists of: "U" - Untrustworthy. Any domain that is less than 12 months old and has not applied for a "P" provisional or "B" bonded ranking. New servers should follow the steps detailed in section 5 if they don't want to be treated as untrustworthy by receiving mail servers. "P" - Provisional. Any domain that is more than 6 months old, but less than 12 months old, has not been the subject of verified Spam complaints and has been sponsored / vouched for by existing highly-ranked mail-servers (typically their ISP). "B" - Bonded. Any domain that is less than 12 months old, but has paid a security bond against spamming, does not relay mail from clients that are not using SASL / TLS / SPA and blocks outgoing emails with dangerous attachments. "N" - Neutral. Any domain that is more than 12 months old and has not been the subject of verified Spam complaints. "A" - Active. Any domain that is more than 12 months old, has not been the subject of verified Spam complaints and has been sponsored / vouched for by existing highly-ranked mail-servers (typically ISPs). "T" - Trusted. Any domain that is more than 12 months old, has paid a security bond against spamming, has not been the subject of verified Spam complaints and does not relay mail from clients that are not using SASL / TLS / SPA. OR Any domain that is more than 36 months old, has not been the subject of verified Spam complaints and does not relay mail from clients that are not using SASL / TLS / SPA. "E" - Elite. Any domain that is more than 3 years old, has paid a security bond against spamming and has not been the subject of verified Spam complaints and does not relay mail from clients that are not using SASL / TLS / SPA. 3. Penalties: Any mail server proven to send Spam will have its ranking lowered. 'Bonded' mail servers could forfeit all or part of the bond supplied. Severe breaches will result in a permanent "U" ranking being attributed. 4. Database Usage: Receiving mail servers should perform a reverse DNS lookup and verify an incoming mailserver is in the database. If not, the mail should be rejected, as the sending mailserver is a virus. If used, the spoof-prevention technique mentioned in my 'Registered-Email' concept notes will prevent mail servers on private networks from being spoofed by viruses also residing on the internal network. The mailserver can also choose to check the database and either reject, stamp or filter mail from the various ranked mailservers. Messages received from "U" should either be rejected with a non-delivery report sent stating why it was rejected, OR heavily stripped, stamped as 'untrustworthy' and cleaned. Messages received from "P" and "N" ranked mailservers should have dangerous file attachments and dangerous HTML tags and all ActiveX controls stripped. These messages should be filed separately from the remaining ranks. Messages received from "A","B", "T" or "E" ranked mailservers are trusted. 5. Procedures for New Mail Servers: New mail servers register their MX details in the DNS as usual and then choose to either: a. Forward all mail through their ISP, using SASL. Configure the mail server for SASL clients only and block outgoing emails with dangerous attachments. At 6 months, seek 'sponsorship' from another highly-ranked mail server owner (typically your ISP) and apply for a "P" provisional ranking. The mail server must also pass checks to verify SASL compliance and blocking of outgoing emails with dangerous attachments. This is typically for a home mail server or a small business. b. Apply for a "B" (Bonded) ranking. This is predominantly for larger businesses. 6. Bonds To qualify for a "B" ranking, the mail server owner must supply enough proof-of-ID, in person, to an authorised agent of the database owner. The mail server must also pass checks to verify SASL compliance and blocking of outgoing emails with dangerous attachments. After 12 months, the bond can be returned - to receive a "N" rating, or kept to receive a "T" rating. Likewise, at 36 months the bond can be returned to receive a "T" rating, or kept to receive an "E" rating. Summary This is an extremely easy-to-implement, automated 'whitelist' solution, similar to my 'Registered Email' concept, that will prevent viruses and the majority of Spam. Existing mailservers will already fall into the "U", "N", "A" and "T" ranks. This requires no active participation of the sender or end-recipient, although it will be rewarded, prevents SMTP virus replication and allows for 'home' and 'hobby' email servers. Thanks for your time. I welcome your comments and criticism. Regards, Joshua Leisk ------=_NextPart_000_0003_01C41C8A.E738CB20 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

In January, I came up with a technically = feasible solution to spam and email viruses, coined = ‘Registered-Email’, the details of which, I have posted here:

 

http://www.intechcomm.net.au

 

As this requires a global change to the email = system, it is fairly ambitious, although technically = sound.

 

Please read through the original post (at the = address above) before reading further.

 

Realising that any change to the existing = email system, although sorely needed, is going to be nearly impossible, I have devised a fairly workable variation of the concept. =

 

This is an early draft, although I am hoping = you will see merit in the ideas behind the concept, rather than dismissing = individual aspects. Having said that, I would really welcome all comments, as this certainly will need refining:

 

 

 

‘Trust-E-mail’ -  ‘Trust-Based Mail = Server Ranking’

 

Intr= oduction.

 

The major hurdle faced = by my 'Registered Email' concept is that it requires active participation of = the sender and effectively a global change to SMTP. This variation of = the 'registrar' component eliminates that = problem.

 

Tabl= e of Contents

 

1.DN= S Scan - The Innovation

2.Ra= nking System

3.Pe= nalties

4.Da= tabase Usage

5.Pr= ocedures for New Mail = Servers

6.Bo= nds

 

1. DNS Scan - The Innovation

 

This is performed to = create an automated global white-list, for immediate mail server trust ranking = and immediate SMTP virus prevention for receiving mail servers. This is done = by creating an application that scans the DNS Rootservers daily for:

            = Domain Name

MX Records

Doma= in Creation Date

 

Using this = information, a database is created, containing:

            = Domain Name

MX Records

Doma= in Creation Date

Trus= t Level / Rank

Reset or 'Effective' Creation Date (for = blacklist and spammers. = For permanent barring, this could be set 1000 years in advance and the Rank = set to "U" (see ranking system)

 

Trusted DNS = blacklists, eg Spamhaus, should be applied against the resultant initial database and the trust level / = rank of blacklisted MX records should be set to "U" (see ranking = system).

 

2. Ranking system consists of:

            =

&quo= t;U" - Untrustworthy. =

Any domain that is less than 12 months old and has not applied for a = "P" provisional or "B" bonded ranking. New servers should follow = the steps detailed in section 5 if they don't want to be treated as = untrustworthy by receiving mail servers.

"P" - = Provisional.

Any domain that is more than 6 months old, but less than 12 months old, has = not been the subject of verified Spam complaints and has been sponsored / = vouched for by existing highly-ranked mail-servers (typically their = ISP).

"B" - = Bonded.

Any domain that is less than 12 months old, but has paid a security bond = against spamming, does not relay mail from clients that are not using SASL / TLS = / SPA and blocks outgoing emails with dangerous = attachments.

&quo= t;N" - Neutral. =

Any domain that is more than 12 months old and = has not been the subject of verified Spam complaints.

&quo= t;A" - Active.

Any domain that is more than 12 months old, has = not been the subject of verified Spam complaints and has been sponsored / vouched = for by existing highly-ranked mail-servers (typically = ISPs).

"T" - = Trusted.

Any domain that is more than 12 months old, has paid a security bond against spamming, has not been the subject of verified Spam complaints and does = not relay mail from clients that are not using SASL / TLS / = SPA.

OR

Any domain that is more than 36 months old, has = not been the subject of verified Spam complaints and does not relay mail from = clients that are not using SASL / TLS / SPA.

"E" - Elite. =

Any domain that is more than 3 years old, has = paid a security bond against spamming and has not been the subject of verified = Spam complaints and does not relay mail from clients that are not using SASL = / TLS / SPA.

&nbs= p;

3. Penalties:

 

Any mail server proven = to send Spam will have its ranking lowered. 'Bonded' mail servers could = forfeit all or part of the bond supplied. Severe breaches will result in a = permanent "U" ranking being attributed.

 

4. Database Usage:

 

Receiving mail servers = should perform a reverse DNS lookup and verify an incoming mailserver is in the database. If not, the mail should be rejected, as the sending = mailserver is a virus. If used, the = spoof-prevention technique mentioned in my ‘Registered-Email’ concept notes = will prevent mail servers on private networks from being spoofed by viruses = also residing on the internal network.

The mailserver can also choose to check the database and either reject, stamp or filter = mail from the various ranked mailservers. = Messages received from "U" should either be rejected with a = non-delivery report sent stating why it was rejected, OR heavily stripped, stamped as 'untrustworthy' and cleaned. Messages received from "P" and "N" ranked mailservers should have dangerous file attachments and dangerous HTML tags and all ActiveX controls stripped. These messages should be filed separately from = the remaining ranks. Messages received from = "A","B", "T" or "E" ranked mailservers are trusted.

 

5. Procedures for New Mail Servers:

 

New mail servers = register their MX details in the DNS as usual and then choose to = either:

  1. Forward all mail through their ISP, = using SASL. Configure the mail server for SASL clients only and block = outgoing emails with dangerous attachments. At 6 months, seek 'sponsorship' = from another highly-ranked mail server owner (typically your ISP) and = apply for a "P" provisional ranking. The mail server must also pass = checks to verify SASL compliance and blocking of outgoing emails with = dangerous attachments. This is typically for a home mail server or a small = business.

&nbs= p;b. Apply for a "B" (Bonded) ranking.  This is predominantly for = larger businesses.

 

6. Bonds

 

To qualify for a "B" ranking, the mail server owner must supply enough = proof-of-ID, in person, to an authorised agent of the = database owner. The mail server must also pass checks to verify SASL compliance and = blocking of outgoing emails with dangerous attachments. =

&nbs= p;

After 12 months, the = bond can be returned - to receive a "N" = rating, or kept to receive a "T" rating. Likewise, at 36 months the bond = can be returned to receive a "T" rating, or kept to receive an = "E" rating.

 

Summary

 

This is an extremely easy-to-implement, automated 'whitelist' solution, similar to my 'Registered Email' concept, that will prevent viruses and the majority of Spam. Existing mailservers will already fall into the = "U", "N", "A" and "T" ranks. This requires no = active participation of the sender or end-recipient, although it will be = rewarded, prevents SMTP virus replication and allows for 'home' and = 'hobby' email servers.

 

 

Thanks for your time. I welcome your comments = and criticism.

 

Regards,

 

 

Joshua Leisk

------=_NextPart_000_0003_01C41C8A.E738CB20-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 8 19:11:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06205 for ; Thu, 8 Apr 2004 19:11:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBifh-000454-7T for asrg-archive@odin.ietf.org; Thu, 08 Apr 2004 19:10:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i38NAvig015682 for asrg-archive@odin.ietf.org; Thu, 8 Apr 2004 19:10:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBifd-00044k-MY for asrg-web-archive@optimus.ietf.org; Thu, 08 Apr 2004 19:10:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06020 for ; Thu, 8 Apr 2004 19:10:49 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BBifZ-000245-00 for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 19:10:49 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BBhvi-000551-00 for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 18:23:28 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BBftC-0003nh-00 for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 16:12:42 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BBeYg-0005wy-Dq for asrg-web-archive@ietf.org; Thu, 08 Apr 2004 14:47:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBeXL-0003wm-Af; Thu, 08 Apr 2004 14:46:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBeWo-0003nQ-0h for asrg@optimus.ietf.org; Thu, 08 Apr 2004 14:45:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09455 for ; Thu, 8 Apr 2004 14:45:24 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BBeWh-0003Uk-00 for asrg@ietf.org; Thu, 08 Apr 2004 14:45:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BBbbo-0006jv-00 for asrg@ietf.org; Thu, 08 Apr 2004 11:38:29 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BBZSA-0006bk-00 for asrg@ietf.org; Thu, 08 Apr 2004 09:20:22 -0400 Received: from [192.168.0.7] (h00095b86f221.ne.client2.attbi.com[24.61.46.50]) by comcast.net (sccrmhc12) with SMTP id <20040408131946012002he62e>; Thu, 8 Apr 2004 13:19:46 +0000 X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this X-Habeas-Swe-3: like Habeas SWE (tm) X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-1: winter into spring Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-4-43967899; protocol="application/pkcs7-signature" Message-Id: <65C2095A-895F-11D8-A7CE-000393CAA6AA@pobox.com> X-Habeas-Swe-9: mark in spam to . X-Habeas-Swe-4: Copyright 2002 Habeas (tm) From: mathew X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant X-Habeas-Swe-2: brightly anticipated To: asrg@ietf.org X-Mailer: Apple Mail (2.613) Subject: [Asrg] [Press] Guardian, "Incredible Bulk" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 8 Apr 2004 09:19:42 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 --Apple-Mail-4-43967899 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit --Apple-Mail-4-43967899 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGEDCCAskw ggIyoAMCAQICAwtCvTANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDMxMjAzMTUwOTU3WhcNMDQxMjAyMTUwOTU3WjBAMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMR0wGwYJKoZIhvcNAQkBFg5tZXRhQHBvYm94LmNvbTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANA40G+RMi0LMG++Lz6J4LpIaXkydRxJoLjz 9EPfZGLn6dPBumvzLVWDaQrOshYuyViOW+oPk62xz6HBnarbOX3VoiFVyGCjqkZz+TToHDDlya/z D8l/WF92nvsEPFPKE6Fw/Lg13/g9zzBlxrjwW98bL6dI1tKvdokMH91++35sC0Yu5oZjuBF4ydUA 1n7pX2KgEDhRRP5b/RhQPrdpbZhO5fwzthiD0VlCG9zkloNJ8GOFxMFd2lpVpV1ISySCHYwEtA1n zxR7Kq4oRaMvAodHj8NHRPDjE+vyALzi0mCZ+JlQAyKr+Li5YvKZNRobyYBQGLLOyt31ZAj9vfSS g2cCAwEAAaMrMCkwGQYDVR0RBBIwEIEObWV0YUBwb2JveC5jb20wDAYDVR0TAQH/BAIwADANBgkq hkiG9w0BAQQFAAOBgQCVJDuVViVm9t4++qdMFmiF4yfAowCy3/bauIAcxAJXvd21LnorWF+49YJk jBZO74MDPrsYb5M9ybKMy04vxNuXXHM9TVLUWJjz5PUCcaNIj9DqGIW9eAPWj/Pvn6j5qSP8OcoK mwwrKcurmSi+sJqajLjET0wzsuvgRFNE4pkOyDCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEF BQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUg VG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24g U2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTEr MCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAw MDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3Vs dGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWlu ZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me 7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r 1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCB kTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3Rl LmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPq Cy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUa C4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx 0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz dWluZyBDQQIDC0K9MAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJ KoZIhvcNAQkFMQ8XDTA0MDQwODEzMTk0M1owIwYJKoZIhvcNAQkEMRYEFPvkH6PBHMICoybiWM+K HWMQBlaqMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBD b25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBAgMLQr0wegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgSXNzdWluZyBDQQIDC0K9MA0GCSqGSIb3DQEBAQUABIIBAMkED8/5Mw38Cl4hXKxu 7BHOC0SQLmjNYaQmUI6dt13PtLPBSpw1Mzoip7/9Box1ljQIezr4Oxdq/xGGQZoQ8RIhwgnd9ucH X4JolkKkodWfOjkxyiXggzkdX/n5b8hdzJThbF1JY7ryJL3XD1bLZkKvLEoQ8pMzGet2KxyzOWhy d5J+WD2gCsrHGcKwjc3IBeY3nUoOD24Wug4lAoLqz9pDmBXhYil/KzJ8//8z6hmgVwFmA/l80bNJ EDGAYUoKhn8oraDv74mq84Nv8STupJTdQIfBlVFLcDQOZgE7BGnAMh2LZH4bZTIqTsJG0zrpY+Ui lzFxX2Bca/tn+3SisHgAAAAAAAA= --Apple-Mail-4-43967899-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 9 01:30:08 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA28573 for ; Fri, 9 Apr 2004 01:30:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBoaC-000155-0p for asrg-archive@odin.ietf.org; Fri, 09 Apr 2004 01:29:40 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i395Te7K004155 for asrg-archive@odin.ietf.org; Fri, 9 Apr 2004 01:29:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBoaB-00014w-Tp for asrg-web-archive@optimus.ietf.org; Fri, 09 Apr 2004 01:29:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA28558 for ; Fri, 9 Apr 2004 01:29:38 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BBoa7-0001UQ-00 for asrg-web-archive@ietf.org; Fri, 09 Apr 2004 01:29:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BBoWu-0001GJ-00 for asrg-web-archive@ietf.org; Fri, 09 Apr 2004 01:26:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BBoTw-00012g-00 for asrg-web-archive@ietf.org; Fri, 09 Apr 2004 01:23:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBoTk-0000VB-R7; Fri, 09 Apr 2004 01:23:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BBiz3-0005sp-7N for asrg@optimus.ietf.org; Thu, 08 Apr 2004 19:30:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA08755 for ; Thu, 8 Apr 2004 19:30:55 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BBiz0-0004vE-00 for asrg@ietf.org; Thu, 08 Apr 2004 19:30:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BBhri-0004Tj-00 for asrg@ietf.org; Thu, 08 Apr 2004 18:19:20 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BBfql-00039v-00 for asrg@ietf.org; Thu, 08 Apr 2004 16:10:11 -0400 Received: from mout.perfora.net ([217.160.230.40]) by mx2.foretec.com with esmtp (Exim 4.24) id 1BBf9y-0002Wz-VQ for asrg@ietf.org; Thu, 08 Apr 2004 15:25:59 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BBf9q-00038t-00 for asrg@ietf.org; Thu, 08 Apr 2004 15:25:50 -0400 Received: from [66.114.67.39] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BBf9q-0002Aa-00 for asrg@ietf.org; Thu, 08 Apr 2004 15:25:50 -0400 Message-ID: <4075A73D.3010803@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 0. General - [Fwd: Microsoft submitting Caller ID as draft RFC] Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 08 Apr 2004 15:25:49 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit From the MARID list. -------- Original Message -------- Subject: Microsoft submitting Caller ID as draft RFC Date: Mon, 5 Apr 2004 23:58:51 -0700 From: Harry Katz I want to inform members of the MARID working group that Microsoft will shortly be submitting the Caller ID for E-mail specification to the IETF as an Informational RFC. We request that the Caller ID specification be considered an input document to the working group's deliberations. We expect to submit the draft to the IETF RFC Editor in the next 7-10 days. In the meantime a PDF version of the specification can be found at http://www.microsoft.com/callerid. Thanks, Harry Katz Program Manager Exchange Server Division Microsoft Corp. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 11 11:59:54 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27896 for ; Sun, 11 Apr 2004 11:59:54 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BChMl-0006EH-1G for asrg-archive@odin.ietf.org; Sun, 11 Apr 2004 11:59:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3BFxRUg023941 for asrg-archive@odin.ietf.org; Sun, 11 Apr 2004 11:59:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BChMf-0006E1-8H for asrg-web-archive@optimus.ietf.org; Sun, 11 Apr 2004 11:59:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27869 for ; Sun, 11 Apr 2004 11:59:18 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BChMd-00040X-00 for asrg-web-archive@ietf.org; Sun, 11 Apr 2004 11:59:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BChJh-0003fE-00 for asrg-web-archive@ietf.org; Sun, 11 Apr 2004 11:56:17 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BChHe-0003JM-00 for asrg-web-archive@ietf.org; Sun, 11 Apr 2004 11:54:10 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BChHe-0006vP-DN for asrg-web-archive@ietf.org; Sun, 11 Apr 2004 11:54:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BChGi-0005bl-EV; Sun, 11 Apr 2004 11:53:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BCVo0-0003cP-2t for asrg@optimus.ietf.org; Sat, 10 Apr 2004 23:38:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA28360 for ; Sat, 10 Apr 2004 23:38:45 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BCVnw-00079n-00 for asrg@ietf.org; Sat, 10 Apr 2004 23:38:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BCVma-0006vM-00 for asrg@ietf.org; Sat, 10 Apr 2004 23:37:20 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BCVlf-0006mm-00 for asrg@ietf.org; Sat, 10 Apr 2004 23:36:23 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BCVle-0002qV-00 for asrg@ietf.org; Sat, 10 Apr 2004 23:36:22 -0400 Received: from [66.114.67.39] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BCVle-0006VP-00 for asrg@ietf.org; Sat, 10 Apr 2004 23:36:22 -0400 Message-ID: <4078BD36.5090900@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 2b. SMTP Session Verification - New blacklist for spamvertised domains Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 10 Apr 2004 23:36:22 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit A new blacklists for spamvertized domains has been brought up. You can find it at: http://www.surbl.org/ Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 12 22:22:30 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01803 for ; Mon, 12 Apr 2004 22:22:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDDYq-00018r-2D for asrg-archive@odin.ietf.org; Mon, 12 Apr 2004 22:22:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3D2M4gd004389 for asrg-archive@odin.ietf.org; Mon, 12 Apr 2004 22:22:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDDYp-00018i-UW for asrg-web-archive@optimus.ietf.org; Mon, 12 Apr 2004 22:22:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01784 for ; Mon, 12 Apr 2004 22:21:59 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDDYl-0000vL-00 for asrg-web-archive@ietf.org; Mon, 12 Apr 2004 22:21:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDDX9-0000e6-00 for asrg-web-archive@ietf.org; Mon, 12 Apr 2004 22:20:20 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDDVZ-0000Me-00 for asrg-web-archive@ietf.org; Mon, 12 Apr 2004 22:18:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDDUv-0000jy-Nb; Mon, 12 Apr 2004 22:18:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDDUZ-0000jT-N4 for asrg@optimus.ietf.org; Mon, 12 Apr 2004 22:17:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01706 for ; Mon, 12 Apr 2004 22:17:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDDUV-0000LQ-00 for asrg@ietf.org; Mon, 12 Apr 2004 22:17:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDDTb-0000DA-00 for asrg@ietf.org; Mon, 12 Apr 2004 22:16:40 -0400 Received: from plounts.uits.indiana.edu ([129.79.1.73]) by ietf-mx with esmtp (Exim 4.12) id 1BDDSm-00004O-00 for asrg@ietf.org; Mon, 12 Apr 2004 22:15:48 -0400 Received: from logchain.uits.indiana.edu (logchain.uits.indiana.edu [129.79.1.77]) by plounts.uits.indiana.edu (8.12.10/8.12.10/IUPO) with ESMTP id i3D2FWxI006196 for ; Mon, 12 Apr 2004 21:15:32 -0500 (EST) Received: from [156.56.79.240] (iub-vpn-79-240.noc.indiana.edu [156.56.79.240]) (authenticated bits=0) by logchain.uits.indiana.edu (8.12.10/8.12.10/IUPO) with ESMTP id i3D2FO7c009975 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO) for ; Mon, 12 Apr 2004 21:15:29 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v613) To: asrg@ietf.org Message-Id: <12789912-8CE4-11D8-87FE-000393DC31DA@bloomington.in.us> Content-Type: multipart/alternative; boundary=Apple-Mail-1-430804720 From: Jim Witte X-Mailer: Apple Mail (2.613) Subject: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 12 Apr 2004 19:46:59 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL,HTML_MESSAGE autolearn=no version=2.60 --Apple-Mail-1-430804720 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit I mail-server I use regularly (Indiana University) has taken, in response to worms and other malware useing .pif. zip, exe, etc attachments to spread their damage, has taken the (IMO) rather drastic step of blocking almost *all* attachments (except for pdf, doc, and a few others), including MacOSX extensions (pbproj and saver) even though there are no viruses currently which try to use OSX extensions (and they wouldn't work either, as Windows would not try to run a xx.saver file as an executable). I would argue that if one wants to block EXE files - fine - but block them by looking for the base-64 encoded 'TVq' signature of EXE files (the 'MZ' signature when encoded). The current policy of blocking a great many different attachments, not only makes it more difficult for people who do want to send legitimate attachments (but not too much - I just remove the extension), if adopted on a large-scale (which I doubt it will be), such a "draconian" policy will push mal-ware-writers to move to other ways of sending their worms - Word macro viruses, Excel macro viruses, HTML with mal-ware JS and Java code, or whatever (there's almost always another hole to exploit). This same mail-server is going to shortly be implementing a system-wide spam filtering solution (probably based on SpamAssasin), which will as a matter of course be scanning all data coming through the relay. Since all data will be scanned already, scanning for EXE files or other known signatures of malware should not be terribly more computationally intensive. The solution proposed by 'gep2' would seem to address this, but it seems to me that it would have an incredible computation scaling problem (if filtering on a per-user basis is done on the receiving end), and/or require a global change to the email system (if a sending server would query a receiving server for every email). Jim > From: gep2@terabites.com > Date: Tue, 06 Apr 2004 21:47:13 -0500 > If we're ever going to REALLY get a handle on this problem, I still > believe that > what matters more is: > > 1) putting the quash on unexpected attachments (especially if they are > executables); [..] > 2) likewise, making support for HTML-burdened E-mail (which can > contain all [..] > I believe that the most significant way to hugely improve both of these > situations is the ability of the recipient to whitelist individual > specific > senders with SPECIFIC rights to: > a) send them attachments (and subapprove based on the class of the > attachments) > b) send them HTML (and POSSIBLY subapprove based on categories of > HTML tags > allowed). --Apple-Mail-1-430804720 Content-Type: text/enriched; charset=US-ASCII Content-Transfer-Encoding: 7bit I mail-server I use regularly (Indiana University) has taken, in response to worms and other malware useing .pif. zip, exe, etc attachments to spread their damage, has taken the (IMO) rather drastic step of blocking almost *all* attachments (except for pdf, doc, and a few others), including MacOSX extensions (pbproj and saver) even though there are no viruses currently which try to use OSX extensions (and they wouldn't work either, as Windows would not try to run a xx.saver file as an executable). I would argue that if one wants to block EXE files - fine - but block them by looking for the base-64 encoded 'TVq' signature of EXE files (the 'MZ' signature when encoded). The current policy of blocking a great many different attachments, not only makes it more difficult for people who do want to send legitimate attachments (but not too much - I just remove the extension), if adopted on a large-scale (which I doubt it will be), such a "draconian" policy will push mal-ware-writers to move to other ways of sending their worms - Word macro viruses, Excel macro viruses, HTML with mal-ware JS and Java code, or whatever (there's almost always another hole to exploit). This same mail-server is going to shortly be implementing a system-wide spam filtering solution (probably based on SpamAssasin), which will as a matter of course be scanning all data coming through the relay. Since all data will be scanned already, scanning for EXE files or other known signatures of malware should not be terribly more computationally intensive. The solution proposed by 'gep2' would seem to address this, but it seems to me that it would have an incredible computation scaling problem (if filtering on a per-user basis is done on the receiving end), and/or require a global change to the email system (if a sending server would query a receiving server for every email). Jim From: gep2@terabites.com Date: Tue, 06 Apr 2004 21:47:13 -05000000,6363,1212 If we're ever going to REALLY get a handle on this problem, I still believe that what matters more is: 1) putting the quash on unexpected attachments (especially if they are executables); [..] 2) likewise, making support for HTML-burdened E-mail (which can contain all [..]0000,6363,1212 I believe that the most significant way to hugely improve both of these situations is the ability of the recipient to whitelist individual specific senders with SPECIFIC rights to: a) send them attachments (and subapprove based on the class of the attachments) b) send them HTML (and POSSIBLY subapprove based on categories of HTML tags allowed). --Apple-Mail-1-430804720-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 13 01:57:17 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA07792 for ; Tue, 13 Apr 2004 01:57:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDGuf-0006Kv-2v for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 01:56:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3D5unrY024353 for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 01:56:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDGue-0006Ki-Ua for asrg-web-archive@optimus.ietf.org; Tue, 13 Apr 2004 01:56:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA07789 for ; Tue, 13 Apr 2004 01:56:46 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDGua-0004YY-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 01:56:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDGsG-0004U5-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 01:54:20 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDGrK-0004Pi-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 01:53:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDGqz-00062a-Bm; Tue, 13 Apr 2004 01:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDGqu-00062I-48 for asrg@optimus.ietf.org; Tue, 13 Apr 2004 01:52:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA07724 for ; Tue, 13 Apr 2004 01:52:52 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDGqn-0004Oy-00 for asrg@ietf.org; Tue, 13 Apr 2004 01:52:49 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDGnM-0004Iz-00 for asrg@ietf.org; Tue, 13 Apr 2004 01:49:17 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 1BDGko-00049h-00 for asrg@ietf.org; Tue, 13 Apr 2004 01:46:38 -0400 Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id i3D5joZ22209 for ; Tue, 13 Apr 2004 01:45:50 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id GXWN4K4H; Tue, 13 Apr 2004 01:45:51 -0400 Received: from americasm01.nt.com (abrw003e.ca.nortel.com [47.9.16.114]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id 22422XVR; Tue, 13 Apr 2004 01:45:49 -0400 Message-ID: <407B7E8B.8060304@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <12789912-8CE4-11D8-87FE-000393DC31DA@bloomington.in.us> In-Reply-To: <12789912-8CE4-11D8-87FE-000393DC31DA@bloomington.in.us> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 13 Apr 2004 01:45:47 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Jim Witte wrote: > I would argue that if one wants to block EXE files - fine - but block > them by looking for the base-64 encoded 'TVq' signature of EXE files > (the 'MZ' signature when encoded). The current policy of blocking a > great many different attachments, not only makes it more difficult for > people who do want to send legitimate attachments (but not too much - I > just remove the extension), if adopted on a large-scale (which I doubt > it will be), It's already implemented in a very large scale. .scr, .pif, etc. Many of those have no business in email anyway. Note also that while the TVq et.al. signatures are _very_ useful, they don't do the whole job. Ie: zip'd .exe. TVq (and the two other rotations of Base64'd "MZ") helps, but (a) you have to make the signature a lot longer than "TVq", and (b) zip file name lengths can push the (longer) signature over a Base64 line boundary, and filtering abruptly becomes a lot harder. Once you've decided to nuke .exes in all forms, about the only problematic attachment type that most people would be blocking would be wav files (because of Klez). It's the only attachment type we get FPs on. I should research whether the magic string check is sufficient. > such a "draconian" policy will push mal-ware-writers to > move to other ways of sending their worms - Word macro viruses, Excel > macro viruses, HTML with mal-ware JS and Java code, or whatever (there's > almost always another hole to exploit). That's a little like telling everyone to take off their bullet-proof vests because it'll just encourage poison gas. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 13 02:45:42 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA22968 for ; Tue, 13 Apr 2004 02:45:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDHes-0001Ou-9e for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 02:45:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3D6iY69005382 for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 02:44:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDHes-0001Oj-3M for asrg-web-archive@optimus.ietf.org; Tue, 13 Apr 2004 02:44:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA22835 for ; Tue, 13 Apr 2004 02:44:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDHen-0006m4-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 02:44:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDHd7-0006hG-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 02:42:46 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDHbX-0006c1-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 02:41:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDHbR-00011z-HR; Tue, 13 Apr 2004 02:41:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDHak-00010v-A5 for asrg@optimus.ietf.org; Tue, 13 Apr 2004 02:40:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA22508 for ; Tue, 13 Apr 2004 02:40:15 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDHae-0006YP-00 for asrg@ietf.org; Tue, 13 Apr 2004 02:40:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDHZ9-0006Ur-00 for asrg@ietf.org; Tue, 13 Apr 2004 02:38:40 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BDHY0-0006OO-00 for asrg@ietf.org; Tue, 13 Apr 2004 02:37:29 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id B2A2BA3B6C; Tue, 13 Apr 2004 16:06:38 +0930 (CST) Received: from rebel (ppp-005.cust203-87-115.ghr.chariot.net.au [203.87.115.5]) by mail.chariot.net.au (Postfix) with SMTP id 6C11C5F867; Tue, 13 Apr 2004 16:06:37 +0930 (CST) From: "Chris" To: "Chris Lewis" Cc: Subject: RE: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal In-Reply-To: <407B7E8B.8060304@americasm01.nt.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 13 Apr 2004 16:05:54 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > > such a "draconian" policy will push mal-ware-writers to > > move to other ways of sending their worms - Word macro viruses, Excel > > macro viruses, HTML with mal-ware JS and Java code, or whatever > (there's > > almost always another hole to exploit). thats why most viruses come zipped these days. and I am getting more than ever > > That's a little like telling everyone to take off their bullet-proof > vests because it'll just encourage poison gas. > wholesale blocking of attachments is a nuisance I often send things via email. for very legitimate reasons The problem could/should be solved by using a sandbox arrangement anything to do with the internet should be run in a sandbox so it cannot alter any part of the users computer. that is to say not only email but any other software that has the potential to run downloaded apps or scripts e.g. IM's P2P Browsers etc. I have often wondered how hard it would be to make a sandbox. does anyone know of any open source sandboxes? Regards Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Chris > Lewis > Sent: Tuesday, 13 April 2004 3:16 PM > Cc: asrg@ietf.org > Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for > SMTP? > > > Jim Witte wrote: > > > I would argue that if one wants to block EXE files - fine - but block > > them by looking for the base-64 encoded 'TVq' signature of EXE files > > (the 'MZ' signature when encoded). The current policy of blocking a > > great many different attachments, not only makes it more difficult for > > people who do want to send legitimate attachments (but not too much - I > > just remove the extension), if adopted on a large-scale (which I doubt > > it will be), > > It's already implemented in a very large scale. .scr, .pif, etc. Many > of those have no business in email anyway. > > Note also that while the TVq et.al. signatures are _very_ useful, they > don't do the whole job. Ie: zip'd .exe. TVq (and the two other > rotations of Base64'd "MZ") helps, but (a) you have to make the > signature a lot longer than "TVq", and (b) zip file name lengths can > push the (longer) signature over a Base64 line boundary, and filtering > abruptly becomes a lot harder. > > Once you've decided to nuke .exes in all forms, about the only > problematic attachment type that most people would be blocking would be > wav files (because of Klez). It's the only attachment type we get FPs > on. I should research whether the magic string check is sufficient. > > > such a "draconian" policy will push mal-ware-writers to > > move to other ways of sending their worms - Word macro viruses, Excel > > macro viruses, HTML with mal-ware JS and Java code, or whatever > (there's > > almost always another hole to exploit). > > That's a little like telling everyone to take off their bullet-proof > vests because it'll just encourage poison gas. > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 13 07:55:41 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA07067 for ; Tue, 13 Apr 2004 07:55:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDMVU-0002Z9-0R for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 07:55:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3DBtBJR009863 for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 07:55:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDMVT-0002Z0-SE for asrg-web-archive@optimus.ietf.org; Tue, 13 Apr 2004 07:55:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA07051 for ; Tue, 13 Apr 2004 07:55:10 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDMVS-0002qY-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 07:55:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDMUH-0002mu-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 07:53:58 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDMTi-0002jE-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 07:53:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDMTN-0002Dw-Ro; Tue, 13 Apr 2004 07:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDMTH-0002Df-P3 for asrg@optimus.ietf.org; Tue, 13 Apr 2004 07:52:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA06982 for ; Tue, 13 Apr 2004 07:52:52 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDMTE-0002i7-00 for asrg@ietf.org; Tue, 13 Apr 2004 07:52:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDMSK-0002e1-00 for asrg@ietf.org; Tue, 13 Apr 2004 07:51:57 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BDMRE-0002Wa-00 for asrg@ietf.org; Tue, 13 Apr 2004 07:50:48 -0400 Received: from fda.zemos.net ([68.38.12.241]) by comcast.net (rwcrmhc11) with ESMTP id <2004041311500001300fbt14e>; Tue, 13 Apr 2004 11:50:00 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id 21B7918680; Tue, 13 Apr 2004 07:49:59 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 30359-02; Tue, 13 Apr 2004 07:49:58 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id A1A311867F; Tue, 13 Apr 2004 07:49:58 -0400 (EDT) Message-ID: <407BD3E5.6090203@zemos.net> From: Philip Miller User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040401 Debian/1.6-4 X-Accept-Language: en, en-us MIME-Version: 1.0 To: Chris Cc: asrg@ietf.org References: <407B7E8B.8060304@americasm01.nt.com> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 13 Apr 2004 07:49:57 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Chris wrote: >[snip prior message] > The problem could/should be solved by using a sandbox arrangement > > anything to do with the internet should be run in a sandbox so it cannot > alter any part of the users computer. > > that is to say not only email but any other software that has the potential > to run downloaded apps or scripts > > e.g. IM's P2P Browsers etc. > > I have often wondered how hard it would be to make a sandbox. > > does anyone know of any open source sandboxes? User Mode Linux is about as strong as you'll get. The BSD's jail system, a more advanced chroot, is also very good. Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 13 10:26:01 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14455 for ; Tue, 13 Apr 2004 10:26:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDOr0-0000Q7-82 for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 10:25:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3DEPYdf001610 for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 10:25:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDOr0-0000Pt-20 for asrg-web-archive@optimus.ietf.org; Tue, 13 Apr 2004 10:25:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14412 for ; Tue, 13 Apr 2004 10:25:30 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDOqw-0005y4-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 10:25:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDOpU-0005sw-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 10:24:01 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDOok-0005oX-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 10:23:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDOoX-00006M-0m; Tue, 13 Apr 2004 10:23:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDOnw-00005x-Fw for asrg@optimus.ietf.org; Tue, 13 Apr 2004 10:22:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14332 for ; Tue, 13 Apr 2004 10:22:19 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDOns-0005lr-00 for asrg@ietf.org; Tue, 13 Apr 2004 10:22:20 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDOn6-0005hZ-00 for asrg@ietf.org; Tue, 13 Apr 2004 10:21:33 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BDOlN-0005Zi-00 for asrg@ietf.org; Tue, 13 Apr 2004 10:19:45 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id BD50416DF5 for ; Tue, 13 Apr 2004 10:23:58 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: Your message of "Mon, 12 Apr 2004 19:46:59 CDT." <12789912-8CE4-11D8-87FE-000393DC31DA@bloomington.in.us> Message-Id: <20040413142358.BD50416DF5@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 13 Apr 2004 10:23:58 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Jim Witte wrote: > I mail-server I use regularly (Indiana University) has taken, in > response to worms and other malware useing .pif. zip, exe, etc > attachments to spread their damage, has taken the (IMO) rather drastic > step of blocking almost *all* attachments ... Coincidentally, another list I'm on had a post from the admin of a local university, talking about spam. Here's what he said. (quote) I don't support any Windows systems, yet I seem to spend a huge amount of time dealing with problems relating to Windows non-security. During the fall/winter term we had to deal with 1) When students returned to Residence in September, at least half of their machines were infected. 2) Anemic Internet connectivity because our commercial traffic shaper would go bonkers trying to maintain state on connections initiated by network virus infected machines. 3) Overloaded Internet pipe due to coordinated DOS attack from trojan infected machines. It's amazing how much traffic an infected, recent model Intel machine with a switched 100Mbps connection can generate! 4) Infected Windows machines are now a major source of spam. After doubling the performance of our mail server in August we were astonished to find only a few months later that it was being pounded into the ground by the growing stream of spam related mail. 5) Spammers frequently use bogus @UNIVERSITY addresses on their mail and so all undeliverable messages are bounced to us. We are typically receiving over 1 million such bounce messages every day! Since the spam mail that is the source of this problem originates from thousands of infected machines there is no solution other than to throw more hardware at it. 6) When my desktop Windows machine at work was upgraded to Windows XP the machine was infected before the installation was finished. It took four full virus scans and three reboots before it was clean. (end quote) See #5. The deployment of RMX/SPF would make a huge difference to this site. The bounce messages from forged spam could be automatically scanned and discarded. This situation is not unique. Spam (and insecure Windows machines) constitute a clear and present danger to the net. I'm saddened to see my prediction of 3 years ago fulfilled: Everyone else's email systems will end up looking like mine; overloaded and useless due to the overwhelming flood of spam. Alan Dekok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 13 20:30:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA21515 for ; Tue, 13 Apr 2004 20:30:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDYGs-0000IV-BB for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 20:28:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3E0SscS001142 for asrg-archive@odin.ietf.org; Tue, 13 Apr 2004 20:28:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDYFD-00006Z-AY for asrg-web-archive@optimus.ietf.org; Tue, 13 Apr 2004 20:27:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA21380 for ; Tue, 13 Apr 2004 20:27:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDYFA-0005CH-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 20:27:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDYEP-00055u-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 20:26:21 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDYD8-000509-00 for asrg-web-archive@ietf.org; Tue, 13 Apr 2004 20:25:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDY7I-0007DX-GZ; Tue, 13 Apr 2004 20:19:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDY0A-0006WX-2G for asrg@optimus.ietf.org; Tue, 13 Apr 2004 20:11:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA21056 for ; Tue, 13 Apr 2004 20:11:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDY05-0003j1-00 for asrg@ietf.org; Tue, 13 Apr 2004 20:11:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDXyh-0003e8-00 for asrg@ietf.org; Tue, 13 Apr 2004 20:10:08 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BDXyJ-0003Ye-00 for asrg@ietf.org; Tue, 13 Apr 2004 20:09:44 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id 3C2FEA4938; Wed, 14 Apr 2004 09:39:03 +0930 (CST) Received: from rebel (ppp-135.cust203-87-122.ghr.chariot.net.au [203.87.122.135]) by mail.chariot.net.au (Postfix) with SMTP id 2A2E35F9B3; Wed, 14 Apr 2004 09:38:59 +0930 (CST) From: "Chris" To: "Philip Miller" , "Chris" Cc: Subject: RE: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal In-Reply-To: <407BD3E5.6090203@zemos.net> Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 14 Apr 2004 09:38:15 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sorry I should have been more specific > > I have often wondered how hard it would be to make a sandbox. > > > > does anyone know of any open source sandboxes? > > User Mode Linux is about as strong as you'll get. The BSD's jail > system, a > more advanced chroot, is also very good. I should have said... does anyone know of any open source sandboxes for windows? Windows being the major source of infections cause by a total lack of "useable" security. What security there is available being in effect rendered useless by its difficulty to implement. thus putting itself far beyond the average user. a good program that leads a user through the steps required might be helpful. but windows 98 etc are without any form of security and a sandbox is the better choice. The ones you mentioned above are probably good case studies to see what is needed in such a system. Regards Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of > Philip Miller > Sent: Tuesday, 13 April 2004 9:20 PM > To: Chris > Cc: asrg@ietf.org > Subject: [Asrg] Re: Usefulness of wholesale blocking of attachments for > SMTP? > > > Chris wrote: > >[snip prior message] > > The problem could/should be solved by using a sandbox arrangement > > > > anything to do with the internet should be run in a sandbox so it cannot > > alter any part of the users computer. > > > > that is to say not only email but any other software that has > the potential > > to run downloaded apps or scripts > > > > e.g. IM's P2P Browsers etc. > > > > I have often wondered how hard it would be to make a sandbox. > > > > does anyone know of any open source sandboxes? > > User Mode Linux is about as strong as you'll get. The BSD's jail > system, a > more advanced chroot, is also very good. > > Philip Miller > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 14 14:32:12 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA13332 for ; Wed, 14 Apr 2004 14:32:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDoyd-0002Ff-Rv for asrg-archive@odin.ietf.org; Wed, 14 Apr 2004 14:19:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3EIJBtB008650 for asrg-archive@odin.ietf.org; Wed, 14 Apr 2004 14:19:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDomQ-0006xh-Q6 for asrg-web-archive@optimus.ietf.org; Wed, 14 Apr 2004 14:06:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA11853 for ; Wed, 14 Apr 2004 14:06:31 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDomO-0004uT-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 14:06:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDolb-0004nl-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 14:05:44 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDokf-0004fq-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 14:04:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDoXO-0002NJ-7e; Wed, 14 Apr 2004 13:51:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDnbJ-00038C-RX for asrg@optimus.ietf.org; Wed, 14 Apr 2004 12:51:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA05409 for ; Wed, 14 Apr 2004 12:50:58 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDnbI-0006EQ-00 for asrg@ietf.org; Wed, 14 Apr 2004 12:51:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDnaM-0006Cs-00 for asrg@ietf.org; Wed, 14 Apr 2004 12:50:03 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BDnZd-0006Ba-00 for asrg@ietf.org; Wed, 14 Apr 2004 12:49:18 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BDnZe-0007mE-00 for asrg@ietf.org; Wed, 14 Apr 2004 12:49:18 -0400 Received: from [66.114.67.39] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BDnZd-0005JT-00 for asrg@ietf.org; Wed, 14 Apr 2004 12:49:17 -0400 Message-ID: <407D6B87.9040305@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id MAA05410 Subject: [Asrg] 2. Legal - FTC approves label for sexually-explicit spam Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 14 Apr 2004 12:49:11 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Original press release: http://www.ftc.gov/opa/2004/04/adultlabel.htm FTC Adopts Rule That Requires Notice That Spam Contains=20 Sexually-Explicit Material Starting May 19th 2004, spam that contains sexually oriented material=20 must include the warning =93SEXUALLY-EXPLICIT: =94 in the subject line or= =20 face fines for violations of federal law. The CAN-SPAM Act, passed by=20 Congress in 2003, directed the Federal Trade Commission to adopt a rule=20 requiring a mark or notice to be included in spam that contains sexually=20 oriented material. The purpose of the notice is to inform recipients=20 that a spam message contains sexually oriented material and to make it=20 easier to filter out messages they do not wish to receive. Establishing=20 the mark was one of several actions Congress directed the Commission to=20 undertake by enacting the CAN-SPAM Act, which was signed into law on=20 December 16, 2003. The CAN-SPAM Act required the Commission to prescribe=20 the mark or notice within 120 days after passage of the Act. .... _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 14 21:51:24 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10319 for ; Wed, 14 Apr 2004 21:51:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDw05-0007VL-Nr for asrg-archive@odin.ietf.org; Wed, 14 Apr 2004 21:49:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3F1n9ux028847 for asrg-archive@odin.ietf.org; Wed, 14 Apr 2004 21:49:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDvzm-0007Hw-Db for asrg-web-archive@optimus.ietf.org; Wed, 14 Apr 2004 21:48:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10245 for ; Wed, 14 Apr 2004 21:48:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDvzj-0005Nx-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 21:48:47 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDvyp-0005LL-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 21:47:52 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDvyE-0005IP-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 21:47:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDvv7-0005qH-Jz; Wed, 14 Apr 2004 21:44:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDsWk-0007Zo-Iz for asrg@optimus.ietf.org; Wed, 14 Apr 2004 18:06:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00944 for ; Wed, 14 Apr 2004 18:06:34 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDsWh-00012r-00 for asrg@ietf.org; Wed, 14 Apr 2004 18:06:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDsVq-0000yx-00 for asrg@ietf.org; Wed, 14 Apr 2004 18:05:43 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BDsUz-0000wI-00 for asrg@ietf.org; Wed, 14 Apr 2004 18:04:49 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3EM480L012817; Wed, 14 Apr 2004 18:04:08 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id SAA00859; Wed, 14 Apr 2004 18:04:08 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16509.46424.270408.870321@world.std.com> To: Yakov Shafranovich Cc: ASRG Subject: Re: [Asrg] 2. Legal - FTC approves label for sexually-explicit spam In-Reply-To: <407D6B87.9040305@solidmatrix.com> References: <407D6B87.9040305@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 14 Apr 2004 18:04:08 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >http://www.ftc.gov/opa/2004/04/adultlabel.htm > >FTC Adopts Rule That Requires Notice That Spam Contains >Sexually-Explicit Material Spam? SPAM? Isn't that like saying from here on packets of heroin must have a label "may cause drowsiness"? Are the people at the FTC really that clueless as to word a notice on their site like that? I hope Hormel sues the crap out of them. In fact, I hope they're all fired. SPAM implies a CRIMINAL behavior, if it's SPAM then it's in violation of CAN-SPAM, at the very least. Well, we all know (or should by now) that the only way spammers can operate is via criminal means, it's the basis of their entire business model. Morons. Seriously. Morons. Worse. Friends of criminals. That's it, the govt has yielded the whole goddamned net to criminals. I know Bush hates the internet but this is getting out of hand. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 14 23:45:48 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14899 for ; Wed, 14 Apr 2004 23:45:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDxnB-0001EI-LO for asrg-archive@odin.ietf.org; Wed, 14 Apr 2004 23:43:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3F3hvD3004718 for asrg-archive@odin.ietf.org; Wed, 14 Apr 2004 23:43:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDxm6-0000xt-QZ for asrg-web-archive@optimus.ietf.org; Wed, 14 Apr 2004 23:42:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14728 for ; Wed, 14 Apr 2004 23:42:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDxm4-0004p9-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 23:42:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDxlA-0004mB-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 23:41:53 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BDxkK-0004jD-00 for asrg-web-archive@ietf.org; Wed, 14 Apr 2004 23:41:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDxhR-00088R-AN; Wed, 14 Apr 2004 23:38:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BDxeM-00077F-Ej for asrg@optimus.ietf.org; Wed, 14 Apr 2004 23:34:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14344 for ; Wed, 14 Apr 2004 23:34:47 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BDxeK-0004At-00 for asrg@ietf.org; Wed, 14 Apr 2004 23:34:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BDxdZ-00047J-00 for asrg@ietf.org; Wed, 14 Apr 2004 23:34:01 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BDxcl-00042p-00 for asrg@ietf.org; Wed, 14 Apr 2004 23:33:11 -0400 Received: (qmail 5869 invoked by uid 100); 15 Apr 2004 03:33:07 -0000 Message-ID: <20040415033307.5868.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] 2. Legal - FTC approves label for sexually-explicit spam In-Reply-To: <16509.46424.270408.870321@world.std.com> Organization: I.E.C.C., Trumansburg NY USA Cc: bzs@world.std.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 15 Apr 2004 03:33:07 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 >Isn't that like saying from here on packets of heroin must have a >label "may cause drowsiness"? Yes. >Are the people at the FTC really that clueless as to word a notice on >their site like that? The FTC staff has clues out the wazoo. Unfortunately our Elected Legislators passed the CAN SPAM act in which one of the inane sections tells the FTC to define a tag for porn spam, and FTC employees do not remain employed by failing to do what their bosses tell them to. >That's it, the govt has yielded the whole goddamned net to criminals. >I know Bush hates the internet but this is getting out of hand. Based on my conversation with him at a spyware hearing last month, I'd place a lot of responsibility on Senator Burns who still thinks that CAN SPAM is a fine piece of legislation. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 15 10:53:31 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA28507 for ; Thu, 15 Apr 2004 10:53:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE85D-0003Qd-9A for asrg-archive@odin.ietf.org; Thu, 15 Apr 2004 10:43:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3FEhFd0013179 for asrg-archive@odin.ietf.org; Thu, 15 Apr 2004 10:43:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE7zQ-0001Gs-Ac for asrg-web-archive@optimus.ietf.org; Thu, 15 Apr 2004 10:37:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA27692 for ; Thu, 15 Apr 2004 10:37:12 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BE7zN-0000ef-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 10:37:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BE7yY-0000aD-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 10:36:23 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BE7xn-0000V6-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 10:35:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE7rS-00062t-DL; Thu, 15 Apr 2004 10:29:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE7gC-0001JU-Kv for asrg@optimus.ietf.org; Thu, 15 Apr 2004 10:17:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA26304 for ; Thu, 15 Apr 2004 10:17:21 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BE7gA-0006bH-00 for asrg@ietf.org; Thu, 15 Apr 2004 10:17:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BE7fL-0006Uy-00 for asrg@ietf.org; Thu, 15 Apr 2004 10:16:32 -0400 Received: from cp4.myhostdns.org ([64.5.40.24]) by ietf-mx with esmtp (Exim 4.12) id 1BE7ea-0006Ov-00 for asrg@ietf.org; Thu, 15 Apr 2004 10:15:44 -0400 Received: from adsl-216-62-200-102.dsl.austtx.swbell.net ([216.62.200.102] helo=[172.16.1.35]) by cp4.myhostdns.org with asmtp (Exim 4.24) id 1BE7eT-0005Is-Cf for asrg@ietf.org; Thu, 15 Apr 2004 09:15:37 -0500 Message-Id: <59C07D42-8EE7-11D8-80C9-000393CAA6AA@pobox.com> X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-3: like Habeas SWE (tm) Subject: Re: [Asrg] 2. Legal - FTC approves label for sexually-explicit spam X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this From: mathew X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-2: brightly anticipated In-Reply-To: <20040415033307.5868.qmail@xuxa.iecc.com> References: <20040415033307.5868.qmail@xuxa.iecc.com> To: asrg@ietf.org X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-2-652115125; protocol="application/pkcs7-signature" X-Habeas-Swe-1: winter into spring X-Habeas-Swe-9: mark in spam to . X-Mailer: Apple Mail (2.613) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cp4.myhostdns.org X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12] X-AntiAbuse: Sender Address Domain - pobox.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 15 Apr 2004 09:15:29 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 --Apple-Mail-2-652115125 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit I can guess the answer, but does anyone have any statistics showing spammers actually beginning to comply with the CAN-SPAM act? mathew -- --Apple-Mail-2-652115125 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGEDCCAskw ggIyoAMCAQICAwwEFTANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDQwMzI4MjA1ODExWhcNMDUwMzI4MjA1ODExWjBAMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMR0wGwYJKoZIhvcNAQkBFg5tZXRhQHBvYm94LmNvbTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOXun6xaDS5SyU0KswTKlW/Fdfknsyfk64UT B6Lb0AyYlNPoNGsgFtBRRQru1WYXmdUsyru8cvp0u9aqjslP6BFv13VF3XBWhDGctnO1gUkuaWNi G58zUvADdOJen8jL1SyzXF4gpY8dxk4gNwp8a1NqN5NBQwfrHSOdWtdqNudJCF7dwCGJBgyoN3I9 v1WtVRZIeNn7S1AmwtbCPckcYwnBK28giolxm6eYS2FDHEFyM1PPuvuvBm0zShLhWNxQSRsUL9gd CWgyrcShStkwx9rinFo9Ens0/r7zcytPFL77t1p16mQ8O6J1ZGeF6t9yMJm5tDL+IfQbtJruSwF5 ERUCAwEAAaMrMCkwGQYDVR0RBBIwEIEObWV0YUBwb2JveC5jb20wDAYDVR0TAQH/BAIwADANBgkq hkiG9w0BAQQFAAOBgQAynR69x1axSiz4b32j6kRWj+jjQJFvl5zMvdnZpRWdyvL9gscwt2bro3TD cvEI9kELco0BzcLyftMV9rGjSOuiCpJRsWe0/uGB/YVhAuuTpBPoEQblQb4cwoE578of2pludQWB yg0Qn5aGXTS+uYsm34s94E3jObPTiGUIiukROzCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEF BQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUg VG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24g U2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTEr MCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAw MDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3Vs dGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWlu ZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me 7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r 1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCB kTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3Rl LmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPq Cy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUa C4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx 0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz dWluZyBDQQIDDAQVMAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJ KoZIhvcNAQkFMQ8XDTA0MDQxNTE0MTUzMFowIwYJKoZIhvcNAQkEMRYEFEKG2NeVp5yWa8ueKxjr K8dp37sEMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBD b25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBAgMMBBUwegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgSXNzdWluZyBDQQIDDAQVMA0GCSqGSIb3DQEBAQUABIIBAJeoTlpf8DiuEjotL/3s ccWWh89/WkqGlSswX9JcyM84BJIU34/PvdC8QUMoBi2LpLHoOv1bf35QuoOVQ7anIS+thhLOOETp DzPTJ4BxLEZBNxTD/tW25unD1/2IXEH5A2zeNrqWpY0Mq+H8ZYkRZHkkK7MAaUjB+vaqIDTjB5GU Vy20DIxOykPa88i+Ry4CwZH9KYNpEyAo0EGtqGHJC+30T4PAo5rzIhRSR4ABZVgq5UC32MLoXV3/ olk8OxulZlJbcRacWmhtF1voZSbBmQsPJXERk/4/NCj/xsfew9zE9x7QIfMpvTjnNhw11U01WXz2 s39bZFPgmyfIYYkfVWYAAAAAAAA= --Apple-Mail-2-652115125-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 15 11:33:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00867 for ; Thu, 15 Apr 2004 11:33:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE8lP-0002K8-Oz for asrg-archive@odin.ietf.org; Thu, 15 Apr 2004 11:26:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3FFQp8Y008932 for asrg-archive@odin.ietf.org; Thu, 15 Apr 2004 11:26:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE8c3-00083F-Ek for asrg-web-archive@optimus.ietf.org; Thu, 15 Apr 2004 11:17:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29948 for ; Thu, 15 Apr 2004 11:17:09 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BE8c2-0004vW-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 11:17:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BE8b3-0004oO-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 11:16:10 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BE8a9-0004hC-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 11:15:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE8Ff-0007Pw-Q3; Thu, 15 Apr 2004 10:54:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE87L-0004Ba-EU for asrg@optimus.ietf.org; Thu, 15 Apr 2004 10:45:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA28162 for ; Thu, 15 Apr 2004 10:45:23 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BE87I-0001Lt-00 for asrg@ietf.org; Thu, 15 Apr 2004 10:45:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BE86X-0001GR-00 for asrg@ietf.org; Thu, 15 Apr 2004 10:44:37 -0400 Received: from cp4.myhostdns.org ([64.5.40.24]) by ietf-mx with esmtp (Exim 4.12) id 1BE85k-00019y-00 for asrg@ietf.org; Thu, 15 Apr 2004 10:43:48 -0400 Received: from adsl-216-62-200-102.dsl.austtx.swbell.net ([216.62.200.102] helo=[172.16.1.35]) by cp4.myhostdns.org with asmtp (Exim 4.24) id 1BE85f-0006ll-Ec for asrg@ietf.org; Thu, 15 Apr 2004 09:43:43 -0500 Message-Id: <43DDB437-8EEB-11D8-80C9-000393CAA6AA@pobox.com> X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-3: like Habeas SWE (tm) Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this From: mathew X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-2: brightly anticipated In-Reply-To: <407B7E8B.8060304@americasm01.nt.com> References: <12789912-8CE4-11D8-87FE-000393DC31DA@bloomington.in.us> <407B7E8B.8060304@americasm01.nt.com> To: asrg@ietf.org X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) Content-Type: text/plain; charset=US-ASCII; format=flowed X-Habeas-Swe-1: winter into spring Content-Transfer-Encoding: 7bit X-Habeas-Swe-9: mark in spam to . X-Mailer: Apple Mail (2.613) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cp4.myhostdns.org X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12] X-AntiAbuse: Sender Address Domain - pobox.com Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 15 Apr 2004 09:43:31 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Apr 13, 2004, at 00:45, Chris Lewis wrote: > It's already implemented in a very large scale. .scr, .pif, etc. > Many of those have no business in email anyway. Indeed. As someone who has no Windows systems at all, at home or at work, I automatically bounce anything from the Internet that has any kind of Windows or Microsoft file attachment--including .exe, .pif, .scr, .doc, .xls, and anything that has a character set of "WINDOWS-1252". I also bounce anything claiming to be from MSDN, Microsoft or MSN, because nobody I know uses addresses there. I think ultimately Microsoft's failure to deal with their systems' insecurity might start having a negative effect on their business as Windows systems are locked out of more and more areas of the net. I'm quite prepared to bounce .zip files too, though at the moment my mail host's virus checker is successfully stripping all those. Nevertheless, bounces caused by Windows viruses are the #1 problem in my inbox now. The commercial spam thing is largely under control; it's the millions of bounces from viruses joe-jobbing me that are hard to deal with. Is there an active proposal to require that bounce messages include a standard header with the message-ID of the message being bounced? mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 15 12:06:12 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA02053 for ; Thu, 15 Apr 2004 12:06:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE9Bn-0002Mo-Ok for asrg-archive@odin.ietf.org; Thu, 15 Apr 2004 11:54:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3FFs70g009093 for asrg-archive@odin.ietf.org; Thu, 15 Apr 2004 11:54:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE95B-0000LK-JL for asrg-web-archive@optimus.ietf.org; Thu, 15 Apr 2004 11:47:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA01333 for ; Thu, 15 Apr 2004 11:47:14 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BE95A-00008A-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 11:47:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BE94H-00002K-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 11:46:21 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BE93O-0007lW-00 for asrg-web-archive@ietf.org; Thu, 15 Apr 2004 11:45:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE8rP-00049u-6E; Thu, 15 Apr 2004 11:33:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BE8lr-0002aG-65 for asrg@optimus.ietf.org; Thu, 15 Apr 2004 11:27:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00509 for ; Thu, 15 Apr 2004 11:27:16 -0400 (EDT) Received: from ietf-mx ([132.151.6.1]) by ietf-mx with esmtp (Exim 4.12) id 1BE8lp-0005ys-00 for asrg@ietf.org; Thu, 15 Apr 2004 11:27:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BE8ky-0005s3-00 for asrg@ietf.org; Thu, 15 Apr 2004 11:26:24 -0400 Received: from bolt.sonic.net ([208.201.242.18] ident=root) by ietf-mx with esmtp (Exim 4.12) id 1BE8k2-0005jt-00 for asrg@ietf.org; Thu, 15 Apr 2004 11:25:26 -0400 Received: from satellite.vo.cnchost.com (IDENT:root@localhost [127.0.0.1]) by bolt.sonic.net (8.12.10/8.12.1) with ESMTP id i3FFPMOL004351 for ; Thu, 15 Apr 2004 08:25:23 -0700 Message-Id: <6.0.0.10.0.20040415080834.04d134f8@127.0.0.1> X-Sender: jcdill%vo.cnchost.com@127.0.0.1 (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.10 (Beta) To: asrg@ietf.org From: JC Dill Subject: Re: [Asrg] 2. Legal - FTC approves label for sexually-explicit spam In-Reply-To: <59C07D42-8EE7-11D8-80C9-000393CAA6AA@pobox.com> References: <20040415033307.5868.qmail@xuxa.iecc.com> <20040415033307.5868.qmail@xuxa.iecc.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 15 Apr 2004 08:12:51 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 At 07:15 AM 4/15/2004, mathew wrote: >I can guess the answer, but does anyone have any statistics showing >spammers actually beginning to comply with the CAN-SPAM act? Ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha ha! To answer your question, "no". In fact, I have seen a huge increase in spam in the past few months, and the percentage of spam that even attempts to comply with the I-CAN-SPAM act is well under 1%. I haven't bothered to do the stats, I just notice when I look at the glurge that makes it thru my filters that every now and then (once a month or so, out of the 10s of thousands of spams I get each month) I get an email that doesn't have forged headers, has what appears to be valid opt-out instructions, etc. jc _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 16 18:36:27 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16781 for ; Fri, 16 Apr 2004 18:36:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEbot-0004W7-3I for asrg-archive@odin.ietf.org; Fri, 16 Apr 2004 18:28:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3GMSNuO017347 for asrg-archive@odin.ietf.org; Fri, 16 Apr 2004 18:28:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEbhJ-0002g7-C5 for asrg-web-archive@optimus.ietf.org; Fri, 16 Apr 2004 18:20:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15718 for ; Fri, 16 Apr 2004 18:20:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEbhG-0006LC-AU for asrg-web-archive@ietf.org; Fri, 16 Apr 2004 18:20:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEbgT-0006If-00 for asrg-web-archive@ietf.org; Fri, 16 Apr 2004 18:19:42 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BEbfk-0006Fb-00 for asrg-web-archive@ietf.org; Fri, 16 Apr 2004 18:18:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEbVD-0004T4-9R; Fri, 16 Apr 2004 18:08:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEbMs-0006y6-QJ for asrg@optimus.ietf.org; Fri, 16 Apr 2004 17:59:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12828 for ; Fri, 16 Apr 2004 17:59:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEbMq-0004kK-6R for asrg@ietf.org; Fri, 16 Apr 2004 17:59:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEbLt-0004id-00 for asrg@ietf.org; Fri, 16 Apr 2004 17:58:26 -0400 Received: from ms-smtp-02-qfe0.socal.rr.com ([66.75.162.134] helo=ms-smtp-02-eri0.socal.rr.com) by ietf-mx with esmtp (Exim 4.12) id 1BEbLD-0004hH-00 for asrg@ietf.org; Fri, 16 Apr 2004 17:57:43 -0400 Received: from opendoors.com (dt0f6n52.san.rr.com [24.94.24.82]) by ms-smtp-02-eri0.socal.rr.com (8.12.10/8.12.7) with ESMTP id i3GLvZ9A017216 for ; Fri, 16 Apr 2004 14:57:36 -0700 (PDT) Message-ID: <4080584F.10503@opendoors.com> From: Lane Sharman Reply-To: lane@opendoors.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040413142358.BD50416DF5@mail.nitros9.org> Content-Type: multipart/alternative; boundary="------------000601090602070901020908" X-Virus-Scanned: Symantec AntiVirus Scan Engine Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 16 Apr 2004 15:03:59 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.4 required=5.0 tests=AWL,HTML_MESSAGE, HTML_TITLE_EMPTY autolearn=no version=2.60 --------------000601090602070901020908 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hi Alan: A couple of years ago, the writing was on the wall about the writing on the net was clear. Currently, I offer a POP and SMTP solution. The latter is a good heat-shield for an SMTP server. Basically, the smtp server instead of a port firewall value of 25/* is now 25/{single class c}. The problem has become so large that we have to maintain approximately 1000 servers to protect our clients. What interests me is point of origin detection, identification and blocking. In other words, what addition to the SMTP protocol would make it possible to identify, for example, "unstamped email being sent out in bulk mode". Statistically, isn't it possible to identify an instance of a bulk email event on the net? Anyway, I am doing my share to block spam as close to the point of origin as possible but I am still not happy. Just today, I was at a friends office and my outgoing email was blocked because cliff.concentric.net is now on a spam list. Lane Sharman Alan DeKok wrote: >Jim Witte wrote: > > >> I mail-server I use regularly (Indiana University) has taken, in >>response to worms and other malware useing .pif. zip, exe, etc >>attachments to spread their damage, has taken the (IMO) rather drastic >>step of blocking almost *all* attachments ... >> >> > > Coincidentally, another list I'm on had a post from the admin of a >local university, talking about spam. Here's what he said. > >(quote) > I don't support any Windows systems, yet I seem to spend a huge amount >of time dealing with problems relating to Windows non-security. During the >fall/winter term we had to deal with > > 1) When students returned to Residence in September, at least half of > their machines were infected. > 2) Anemic Internet connectivity because our commercial traffic shaper > would go bonkers trying to maintain state on connections initiated by > network virus infected machines. > 3) Overloaded Internet pipe due to coordinated DOS attack from trojan > infected machines. It's amazing how much traffic an infected, recent > model Intel machine with a switched 100Mbps connection can generate! > 4) Infected Windows machines are now a major source of spam. After > doubling the performance of our mail server in August we were > astonished to find only a few months later that it was being pounded > into the ground by the growing stream of spam related mail. > 5) Spammers frequently use bogus @UNIVERSITY addresses on their mail > and so all undeliverable messages are bounced to us. We are typically > receiving over 1 million such bounce messages every day! Since the > spam mail that is the source of this problem originates from thousands > of infected machines there is no solution other than to throw more > hardware at it. > 6) When my desktop Windows machine at work was upgraded to Windows XP > the machine was infected before the installation was finished. It > took four full virus scans and three reboots before it was clean. >(end quote) > > See #5. The deployment of RMX/SPF would make a huge difference to >this site. The bounce messages from forged spam could be >automatically scanned and discarded. > > This situation is not unique. Spam (and insecure Windows machines) >constitute a clear and present danger to the net. I'm saddened to see >my prediction of 3 years ago fulfilled: Everyone else's email systems >will end up looking like mine; overloaded and useless due to the >overwhelming flood of spam. > > Alan Dekok. > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg > > > -- Lane Sharman Providing Private and SPAM-Free Email http://www.opendoors.com 858-755-2868 --------------000601090602070901020908 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hi Alan:

A couple of years ago, the writing was on the wall about the writing on the net was clear.

Currently, I offer a POP and SMTP solution. The latter is a good heat-shield for an SMTP server. Basically, the smtp server instead of a port firewall value of 25/* is now 25/{single class c}. The problem has become so large that we have to maintain approximately 1000 servers to protect our clients.

What interests me is point of origin detection, identification and blocking. In other words, what addition to the SMTP protocol would make it possible to identify, for example, "unstamped email being sent out in bulk mode". Statistically, isn't it possible to identify an instance of a bulk email event on the net?

Anyway, I am doing my share to block spam as close to the point of origin as possible but I am still not happy. Just today, I was at a friends office and my outgoing email was blocked because cliff.concentric.net is now on a spam list.

Lane Sharman



Alan DeKok wrote:
Jim Witte <jswitte@bloomington.in.us> wrote:
  
   I mail-server I use regularly (Indiana University) has taken, in 
response to worms and other malware useing .pif. zip, exe, etc 
attachments to spread their damage, has taken the (IMO) rather drastic 
step of blocking almost *all* attachments ...
    

  Coincidentally, another list I'm on had a post from the admin of a
local university, talking about spam.  Here's what he said.

(quote)
   I don't support any Windows systems, yet I seem to spend a huge amount
of time dealing with problems relating to Windows non-security.  During the
fall/winter term we had to deal with

   1) When students returned to Residence in September, at least half of
      their machines were infected.
   2) Anemic Internet connectivity because our commercial traffic shaper
      would go bonkers trying to maintain state on connections initiated by
      network virus infected machines.
   3) Overloaded Internet pipe due to coordinated DOS attack from trojan
      infected machines.  It's amazing how much traffic an infected, recent
      model Intel machine with a switched 100Mbps connection can generate!
   4) Infected Windows machines are now a major source of spam.  After
      doubling the performance of our mail server in August we were
      astonished to find only a few months later that it was being pounded
      into the ground by the growing stream of spam related mail.
   5) Spammers frequently use bogus @UNIVERSITY addresses on their mail
      and so all undeliverable messages are bounced to us.  We are typically
      receiving over 1 million such bounce messages every day!  Since the
      spam mail that is the source of this problem originates from thousands
      of infected machines there is no solution other than to throw more
      hardware at it.
   6) When my desktop Windows machine at work was upgraded to Windows XP
      the machine was infected before the installation was finished.  It
      took four full virus scans and three reboots before it was clean.
(end quote)

  See #5.  The deployment of RMX/SPF would make a huge difference to
this site.  The bounce messages from forged spam could be
automatically scanned and discarded.

  This situation is not unique.  Spam (and insecure Windows machines)
constitute a clear and present danger to the net.  I'm saddened to see
my prediction of 3 years ago fulfilled: Everyone else's email systems
will end up looking like mine; overloaded and useless due to the
overwhelming flood of spam.

  Alan Dekok.

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg

  

-- 
Lane Sharman
Providing Private and SPAM-Free Email
http://www.opendoors.com
858-755-2868

--------------000601090602070901020908-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 17 01:25:53 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA06936 for ; Sat, 17 Apr 2004 01:25:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEiJ3-0001Wi-RH for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 01:23:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3H5Nvxm005868 for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 01:23:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEiCy-0008QH-6C for asrg-web-archive@optimus.ietf.org; Sat, 17 Apr 2004 01:17:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA06521 for ; Sat, 17 Apr 2004 01:17:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEiCv-0003OW-Bu for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 01:17:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEiBy-0003Jx-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 01:16:39 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BEiAy-0003El-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 01:15:36 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEi6X-0006Jt-IB; Sat, 17 Apr 2004 01:11:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEi4E-0005JK-66 for asrg@optimus.ietf.org; Sat, 17 Apr 2004 01:08:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA06126 for ; Sat, 17 Apr 2004 01:08:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEi4B-0002iq-4L for asrg@ietf.org; Sat, 17 Apr 2004 01:08:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEi3C-0002dg-00 for asrg@ietf.org; Sat, 17 Apr 2004 01:07:34 -0400 Received: from ms-smtp-02-qfe0.socal.rr.com ([66.75.162.134] helo=ms-smtp-02-eri0.socal.rr.com) by ietf-mx with esmtp (Exim 4.12) id 1BEi2F-0002ZA-00 for asrg@ietf.org; Sat, 17 Apr 2004 01:06:35 -0400 Received: from opendoors.com (dt0f6n52.san.rr.com [24.94.24.82]) by ms-smtp-02-eri0.socal.rr.com (8.12.10/8.12.7) with ESMTP id i3H56X9A017216 for ; Fri, 16 Apr 2004 22:06:33 -0700 (PDT) Message-ID: <4080BCD9.3000105@opendoors.com> From: Lane Sharman Reply-To: lane@opendoors.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 16 Apr 2004 22:12:57 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Hi Yakov, It seems to me that there would be some of the following in a bulk email solution. Because, for sure, there are a lot of legit bulk emailers. a) an accreditation process which would include certification of a legit sender. The sender has to present himself/herself before a physical post office for example. b) a bulk stamp purchase agreement is executed and paid for by the originator. c) a set of designated relay servers would be designated to "affix the stamp" on behalf of the originator, the bulk sender. d) any relay could verify that a stamp instance as valid with a remote lookup; forgeries would be thwarted because the stamp expires and other characteristics. -Lane Yakov Shafranovich wrote: > Lane Sharman wrote: > >> What interests me is point of origin detection, identification and >> blocking. In other words, what addition to the SMTP protocol would >> make it possible to identify, for example, "unstamped email being >> sent out in bulk mode". Statistically, isn't it possible to identify >> an instance of a bulk email event on the net? > > > DCC (http://www.rhyolite.com/anti-spam/dcc/) tries to detect bulk > emails as do some other projects. This is not something that requires > addition to SMTP and is an separate protocol. > > Of course we must remember that bulk email is not necessarily bad. > There are many instances of legit bulk email (e.g. acceptance letters > from a college, bank statement notifications, etc.). So knowing that a > specific email is bulk is only half the problem, once you know it is > bulk there needs to be a determination as to whether it is legit or not. > > This is what Project Lumus, TEOS and some other mechanisms try to do - > whitelist or accredit legit bulk emailers. Of course, a single unified > framework of standard for the entire Internet on exchanging > accreditation and reputation data is something that might solve this > as well, so far there hasn't been sufficient interest in that area > (the SMTP-VERIFY subgroup was looking into it as some point). > > Yakov > -- Lane Sharman Providing Private and SPAM-Free Email http://www.opendoors.com 858-755-2868 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 17 02:27:31 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA22754 for ; Sat, 17 Apr 2004 02:27:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEj8X-0005No-Az for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 02:17:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3H6H941020688 for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 02:17:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEj7B-00047k-Ol for asrg-web-archive@optimus.ietf.org; Sat, 17 Apr 2004 02:15:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA21750 for ; Sat, 17 Apr 2004 02:15:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEj78-0007YS-93 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 02:15:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEj6C-0007Uo-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 02:14:45 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BEj5o-0007Qt-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 02:14:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEixo-0006mq-QL; Sat, 17 Apr 2004 02:06:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEiok-00022q-4a for asrg@optimus.ietf.org; Sat, 17 Apr 2004 01:56:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA08285 for ; Sat, 17 Apr 2004 01:56:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEiog-0006Dn-Ml for asrg@ietf.org; Sat, 17 Apr 2004 01:56:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEinn-0006Ap-00 for asrg@ietf.org; Sat, 17 Apr 2004 01:55:44 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BEinL-00067I-00 for asrg@ietf.org; Sat, 17 Apr 2004 01:55:15 -0400 Received: (qmail 27929 invoked by uid 100); 17 Apr 2004 05:55:11 -0000 Message-ID: <20040417055511.27928.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <4080BCD9.3000105@opendoors.com> Organization: I.E.C.C., Trumansburg NY USA Cc: lane@opendoors.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 17 Apr 2004 05:55:11 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.9 required=5.0 tests=AWL,DOMAIN_BODY autolearn=no version=2.60 >a) an accreditation process which would include certification of a legit >sender. The sender has to present himself/herself before a physical post >office for example. Right. There's a bunch of possibile reputation systems here, from ISIPP's IADB o the proposed .mail domain >b) a bulk stamp purchase agreement is executed and paid for by the >originator. >c) a set of designated relay servers would be designated to "affix the >stamp" on behalf of the originator, the bulk sender. >d) any relay could verify that a stamp instance as valid with a remote >lookup; forgeries would be thwarted because the stamp expires and other >characteristics. You're conflating two unrelated things here. Authenticating senders is a fine idea. That's what proposals such as SPF and Domain Keys do, with no stamps needed. E-postage is a horrible idea because it introduces more problems than it is supposed to solve. See my white paper at http://www.taugh.com for a longer discussion of the insoluble problems with e-postage. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 17 11:57:29 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA16398 for ; Sat, 17 Apr 2004 11:57:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEsAx-000804-TQ for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 11:56:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3HFuFlp030743 for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 11:56:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BErzc-0005El-EA for asrg-web-archive@optimus.ietf.org; Sat, 17 Apr 2004 11:44:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15972 for ; Sat, 17 Apr 2004 11:44:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BErzb-000105-DD for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 11:44:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEryj-0000n2-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 11:43:38 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BErxa-0000aN-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 11:42:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BErqP-0001cS-HL; Sat, 17 Apr 2004 11:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BErlb-0000G3-9y for asrg@optimus.ietf.org; Sat, 17 Apr 2004 11:30:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA15342 for ; Sat, 17 Apr 2004 11:30:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BErla-0006bd-9f for asrg@ietf.org; Sat, 17 Apr 2004 11:30:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BErkc-0006Ta-00 for asrg@ietf.org; Sat, 17 Apr 2004 11:29:03 -0400 Received: from ms-smtp-03-qfe0.socal.rr.com ([66.75.162.135] helo=ms-smtp-03-eri0.socal.rr.com) by ietf-mx with esmtp (Exim 4.12) id 1BErk0-0006MC-00 for asrg@ietf.org; Sat, 17 Apr 2004 11:28:24 -0400 Received: from opendoors.com (dt0f6n52.san.rr.com [24.94.24.82]) by ms-smtp-03-eri0.socal.rr.com (8.12.10/8.12.7) with ESMTP id i3HFSK4Q019363; Sat, 17 Apr 2004 08:28:21 -0700 (PDT) Message-ID: <40814E95.2070509@opendoors.com> From: Lane Sharman Reply-To: lane@opendoors.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 X-Accept-Language: en-us, en MIME-Version: 1.0 To: John Levine CC: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040417055511.27928.qmail@xuxa.iecc.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: Symantec AntiVirus Scan Engine Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 17 Apr 2004 08:34:45 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit John Levine wrote: >E-postage is a horrible idea because it introduces more problems than >it is supposed to solve. See my white paper at http://www.taugh.com >for a longer discussion of the insoluble problems with e-postage. > Thanks for the link. I will digest this over the next few days and possibly reply offline. > > -- Lane Sharman Providing Private and SPAM-Free Email http://www.opendoors.com 858-755-2868 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 17 12:56:20 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA18635 for ; Sat, 17 Apr 2004 12:56:20 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEt2H-0006Ra-MR for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 12:51:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3HGpLOX024767 for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 12:51:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEsvG-0005VE-CQ for asrg-web-archive@optimus.ietf.org; Sat, 17 Apr 2004 12:44:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17927 for ; Sat, 17 Apr 2004 12:44:02 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEsvE-0001Wy-Q7 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 12:44:04 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEsuP-0001OR-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 12:43:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BEstV-0001Fl-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 12:42:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEsnQ-0002ps-TS; Sat, 17 Apr 2004 12:36:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEse0-0000E9-Rq for asrg@optimus.ietf.org; Sat, 17 Apr 2004 12:26:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA17412 for ; Sat, 17 Apr 2004 12:26:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEsdz-0006rA-Bs for asrg@ietf.org; Sat, 17 Apr 2004 12:26:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEscu-0006ib-00 for asrg@ietf.org; Sat, 17 Apr 2004 12:25:09 -0400 Received: from b.mail.sonic.net ([64.142.19.5]) by ietf-mx with esmtp (Exim 4.12) id 1BEscR-0006ZK-00 for asrg@ietf.org; Sat, 17 Apr 2004 12:24:39 -0400 Received: from [192.168.0.247] (adsl-64-165-36-235.dsl.snfc21.pacbell.net [64.165.36.235]) (authenticated bits=0) by b.mail.sonic.net (8.12.11/8.12.11) with ESMTP id i3HGMe5C007534 for ; Sat, 17 Apr 2004 09:24:08 -0700 Mime-Version: 1.0 (Apple Message framework v613) Content-Transfer-Encoding: 7bit Message-Id: Content-Type: text/plain; charset=US-ASCII; format=flowed To: asrg@ietf.org From: "Anne P. Mitchell, Esq." X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Subject: [Asrg] IDDB: Companion Domains Database to IADB (and IADB Update) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 17 Apr 2004 09:24:08 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit All, We have not yet announced, but have made available, the IDDB - ISIPP Domains Database. This is a companion database to IDDB, and allows queriers to do a query by domain name; if the domain name is listed, it will return a list of IP addresses from which the domain is properly allowed to mail, along with the listee's IADB registration number for cross reference. Obviously, the resulting IP addresses can than be plugged into an IADB query to get the IADB data about the sender's status, opt-in policies, etc.. This is _not_ intended as a replacement for SPF, MS Caller ID for Email, Domain Keys, etc.. Rather it is simply a companion database to IADB, which we are offering at the request of both senders and receivers who wanted this ability. IADB is also growing, now offering additional information (the newest is the data code which means "the only email which comes from this IP address is mailing list email, and that mailing list email is entirely confirmed (double) opt-in"), and providing such information to ISPs, spam filters, and other queriers for more than 325million pieces of email per month. The full list if current information provided by an IADB lookup is at http://www.isipp.com/iadbquery.php Querying IDDB, as with IADB, is free (and always will be), and can be done by filling out a short form at http://www.isipp.com/iadb_query_sign_up.php We hope that you will get good use out of IDDB as well as IADB, and I want to thank those of you already supporting it. Anne _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 17 23:10:27 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12474 for ; Sat, 17 Apr 2004 23:10:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BF2ZY-0006ia-Vd for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 23:02:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3I32KfU025820 for asrg-archive@odin.ietf.org; Sat, 17 Apr 2004 23:02:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BF2PW-0003Jb-3g for asrg-web-archive@optimus.ietf.org; Sat, 17 Apr 2004 22:51:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11049 for ; Sat, 17 Apr 2004 22:51:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BF2PS-0006Ds-MT for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 22:51:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BF2Mw-0005ZX-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 22:49:19 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BF2LN-0005A7-00 for asrg-web-archive@ietf.org; Sat, 17 Apr 2004 22:47:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BF1qN-0006lF-FH; Sat, 17 Apr 2004 22:15:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BEbtq-0006qN-S4 for asrg@optimus.ietf.org; Fri, 16 Apr 2004 18:33:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16682 for ; Fri, 16 Apr 2004 18:33:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BEbtn-0007M5-Ql for asrg@ietf.org; Fri, 16 Apr 2004 18:33:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BEbtA-0007Jq-00 for asrg@ietf.org; Fri, 16 Apr 2004 18:32:48 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BEbsa-0007Fq-00 for asrg@ietf.org; Fri, 16 Apr 2004 18:32:12 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BEbsY-00053p-00; Fri, 16 Apr 2004 18:32:10 -0400 Received: from [66.114.67.39] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BEbsX-0005Q2-00; Fri, 16 Apr 2004 18:32:10 -0400 Message-ID: <40805EE5.7060403@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: lane@opendoors.com CC: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> In-Reply-To: <4080584F.10503@opendoors.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 16 Apr 2004 18:32:05 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Lane Sharman wrote: > What interests me is point of origin detection, identification and > blocking. In other words, what addition to the SMTP protocol would make > it possible to identify, for example, "unstamped email being sent out in > bulk mode". Statistically, isn't it possible to identify an instance of > a bulk email event on the net? DCC (http://www.rhyolite.com/anti-spam/dcc/) tries to detect bulk emails as do some other projects. This is not something that requires addition to SMTP and is an separate protocol. Of course we must remember that bulk email is not necessarily bad. There are many instances of legit bulk email (e.g. acceptance letters from a college, bank statement notifications, etc.). So knowing that a specific email is bulk is only half the problem, once you know it is bulk there needs to be a determination as to whether it is legit or not. This is what Project Lumus, TEOS and some other mechanisms try to do - whitelist or accredit legit bulk emailers. Of course, a single unified framework of standard for the entire Internet on exchanging accreditation and reputation data is something that might solve this as well, so far there hasn't been sufficient interest in that area (the SMTP-VERIFY subgroup was looking into it as some point). Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 18 12:17:38 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA28871 for ; Sun, 18 Apr 2004 12:17:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFExV-0007UE-Uu for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 12:15:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3IGFriY028778 for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 12:15:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFEl5-0003xq-Pt for asrg-web-archive@optimus.ietf.org; Sun, 18 Apr 2004 12:03:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA28161 for ; Sun, 18 Apr 2004 12:03:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFEl4-0002Xu-C1 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 12:03:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFEk4-0002K7-00 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 12:02:02 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFEj4-00022w-00 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 12:00:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFEbO-0000bT-Vk; Sun, 18 Apr 2004 11:53:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFES3-0006uY-7g for asrg@optimus.ietf.org; Sun, 18 Apr 2004 11:43:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27258 for ; Sun, 18 Apr 2004 11:43:20 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFES2-00061G-0q for asrg@ietf.org; Sun, 18 Apr 2004 11:43:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFER0-0005ms-00 for asrg@ietf.org; Sun, 18 Apr 2004 11:42:19 -0400 Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx with esmtp (Exim 4.12) id 1BFEQ6-0005LZ-00 for asrg@ietf.org; Sun, 18 Apr 2004 11:41:22 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc12) with SMTP id <2004041815404901400r8rbte>; Sun, 18 Apr 2004 15:40:51 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sun, 18 Apr 2004 10:39:58 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sun, 18 Apr 2004 10:49:02 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 18 Apr 2004 10:49:02 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=3.0 required=5.0 tests=AWL,DOMAIN_BODY,NO_REAL_NAME, RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I'm going to combine my comments regarding several related posts on this thread. > What interests me is point of origin detection, identification and blocking. Fine, except that it doesn't really solve the spam problem. If spammers have to use "real" return addresses (with valid SPF and certificates and all the rest) on their spam E-mail, they will. It is only out of "being nice" that they currently generate bogus return addresses, largely to avoid harassing "real" users with undeliverable bounces and complaints. Once you identify the "real" machine where the transmission occurred, more likely than not it will turn out to be a zombie-infected spambot. So you get to throw bricks at a fellow victim. Fat lot of help that does! > In other words, what addition to the SMTP protocol would make it possible to identify, for example, "unstamped email being sent out in bulk mode". What does that achieve? All it does it require spammers to send STAMPED spam. As for "bulk mode", if you have recruited/infected enough zombie machines, you don't even have to send it out in bulk mode. Anything that a legitimate sending computer can send via SMTP (or any variant you choose to define) can be sent by an infected zombie spambot computer via SMTP (or the defined variant). You have changed things (I guess that makes SOME people feel better) but you haven't really solved the problem. The problem isn't really the spam mail itself (although I agree that it comes at some cost) as much as it is the fact that it (a) chews up inbox space, (b) wastes bandwidth, and (c) annoys the recipient. Suitably clever content filters (once it's not possible to evade them by HTML-based tricks) can get rid of much of the spam, thus preventing many/most cases of (c). Inbox space and bandwidth waste are greatly reduced by spammers learning that sending bulky attachments or (also bulky) HTML-burdened E-mail is the kiss of death on the spam they send out. This helps (at least) with (a) and (c). The best way ultimately to put a serious dent in spam (and worms/viruses) is for it to be perceived as largely futile. And if 99.99% of the junk (or more) never even gets delivered to a human being, this has got to help achieve that. > Statistically, isn't it possible to identify an instance of a bulk email event on the net? Perhaps it is, although it's hard to define "a bulk email event". What if NO TWO of the "bulk" e-mail messages are identical? What if they "originate" at a multitude of zombie spambot machines? I think that ultimately it's probably better to detect unwanted E-mail by a variety of pattern matching heuristics (and I make use of a variety of these in my own personally written SPITBOL-based incoming E-mail filter) and simply reroute to a deadletter box (or just route to the bit bucket) messages which are clearly unwanted. More troubling, what do you do about spam which is NOT the result of "a bulk email event" but which is more individualized or somehow (perhaps slightly) more targeted than that? > Anyway, I am doing my share to block spam as close to the point of origin as possible but I am still not happy. Some of it is truly quite difficult to identify in an overall, anticipatory kind of way. But the great majority of it can be identified without TOO great a difficulty. One frustration is the increasing spammer use of "one-shot" disposable domain names, that presently each individual recipient must block separately. There needs to be a good way for a cooperative effort here, such that the first folks to detect a spam mailing can rapidly alert others which domain names are involved. Then those domain names can be added to filters in use by other users. Rather than making mail filters poll a central site (these have in the past been victimized by DDOS attacks), maybe one approach here might be to set up a Yahoogroup that could be used to rapidly distribute these "disreputable domain names" and IP addresses along with a utility which would add them to the recipients' HOSTS files (and from there, to their incoming mail filters). > Just today, I was at a friends office and my outgoing email was blocked because cliff.concentric.net is now on a spam list. Yes, and that's one of the problems with SPF, "authenticated users", certificates and other such schemes. Ultimately it's not very helpful to throw rocks at fellow victims. [snip] >> I mail-server I use regularly (Indiana University) has taken, in >>response to worms and other malware useing .pif. zip, exe, etc >>attachments to spread their damage, has taken the (IMO) rather drastic >>step of blocking almost *all* attachments ... That's sort of the approach of Microsoft's new version of Outlook, where they allow blocking by attachment extension. That's better than nothing, but it needs to be SOMEWHAT finer: it needs to allow the recipient to enable specific attachment types (and certain classes of HTML markup) to be received from specific approved-and-trusted senders. >> Coincidentally, another list I'm on had a post from the admin of a >local university, talking about spam. Here's what he said. > >(quote) > I don't support any Windows systems, yet I seem to spend a huge amount >of time dealing with problems relating to Windows non-security. During the >fall/winter term we had to deal with > > 1) When students returned to Residence in September, at least half of > their machines were infected. One of my colleagues recently dealt with a client whose system was "having assorted problems". Upon installing Spybot-Search-and-Destroy over TWO HUNDRED instances of spyware were found on the unwitting user's computer. There were additional Spyware programs that SPYBOT S&D did NOT find, besides. Microsoft has definitely gotten the message about security, and although they're not moving as quickly as (or necessarily in the direction that) I'd like, they're making some big strides. It's hard to rapidly turn such a huge ship. > 2) Anemic Internet connectivity because our commercial traffic shaper > would go bonkers trying to maintain state on connections initiated by > network virus infected machines. > 3) Overloaded Internet pipe due to coordinated DOS attack from trojan > infected machines. It's amazing how much traffic an infected, recent > model Intel machine with a switched 100Mbps connection can generate! Right, and once you have HUNDREDS of those...!! Again, the solution to this is NOT just antivirus/antiworm programs that detect specific known ones. All viruses and worms are at their most prolific BEFORE *any* A-V program detects them. The fact is that MOST users do NOT have a legitimate need (or even DESIRE) to receive executable programs as E-mail attachments (and those who maybe don't know better should be warned by a suitably dire-sounding warning message in the dialog box before they can be wheedled by a convincing-sounding E-mail into enabling that). Once viruses can't use E-mail for delivering attachments... You don't want what Outlook (now or soon) offers: either .exe attachments or not. Too many users will VERY RARELY need them, so enable them... :-( You want it so they must be enabled for (only!) SPECIFIC INDIVIDUAL senders. This creates a delivery window that's small enough that a broadcast virus or worm will have a very tough time navigating their way through it. > 4) Infected Windows machines are now a major source of spam. After > doubling the performance of our mail server in August we were > astonished to find only a few months later that it was being pounded > into the ground by the growing stream of spam related mail. Right, and that's precisely why SPF, certificates, DNS modifications, and sender authentication schemes are ALL doomed to fail... because nothing at all prevents spambot zombies from sending their junk using the unwitting owner's legitimate sending credentials. Windows machines aren't particularly more susceptible to this than Macs or Linux boxes are, other than their ubiquity makes them a more appealing target for hackers and spammers to target. If everybody were running Linux instead, then we'd see all the same stuff happening on Linux. > 5) Spammers frequently use bogus @UNIVERSITY addresses on their mail > and so all undeliverable messages are bounced to us. We are typically > receiving over 1 million such bounce messages every day! Right. That's part of why schemes that add yet more "authentication" traffic (challenge/response, DNS queries, etc etc) to the net as a way of dealing with spam are counterproductive. Bouncing spam messages back to supposed senders (whether the return address is bogus or not) is also as a rule singularly unhelpful. > Since the > spam mail that is the source of this problem originates from thousands > of infected machines there is no solution other than to throw more > hardware at it. Even if you can identify where it "really" came from. But that's also why we will never get very far controlling the spam problem unless and until we also make it harder for viruses and worms to infect machines. My proposals regarding HTML and attachments and whitelisting them in a finely-grained way from approved senders provide a unified mechanism which goes a LONG way towards solving BOTH problems using one coherent, single-ended, easy-to-implement, recipient-controlled, immediate-gratification, high-payback common approach. Again, the virus/worm problem isn't only just a throw-rocks-at-Microsoft problem (well, at least not for the traditional reasons) but would still happen in Linux or Mac boxes as well, if they were so ubiquitous as to present an appealing target for hackers. > 6) When my desktop Windows machine at work was upgraded to Windows XP > the machine was infected before the installation was finished. It > took four full virus scans and three reboots before it was clean. >(end quote) > > See #5. The deployment of RMX/SPF would make a huge difference to >this site. The bounce messages from forged spam could be >automatically scanned and discarded. It SOUNDS like it would, but ultimately it doesn't help very much. First, not all mail that passes SPF tests can be guaranteed to not be spam (due to zombie spambots that could send with appropriate credentials). Second, mail that FAILS SPF tests can not be guaranteed TO be spam (vanity domains, traveling salespeople, mail from Internet cafes, Yahoogroups and other mailing lists, etc etc etc) The fact is that you can't really say that "spam has forged From: addresses". Some of it does, today, even most of it maybe, but if you and everyone else block the mail that does you can COUNT on the fact that tomorrow, spammers won't do that anymore. I don't think that forcing them to make that change is particularly helpful, either for spam recipients or for the victims whose E-mail addresses suddenly get flooded with complaints for spam they didn't knowingly send. (How would it help your university (or the people involved!) if those million bogus messages a day, instead of falling on the floor or being bounced by your mail servers, all went into legitimate student or staff Inboxes instead? Think about that for a while.) > This situation is not unique. Spam (and insecure Windows machines) >constitute a clear and present danger to the net. Of course. Let's just make sure that the solution(s) that we propose are not worse than the problem they're designed to solve. > I'm saddened to see >my prediction of 3 years ago fulfilled: Everyone else's email systems >will end up looking like mine; overloaded and useless due to the >overwhelming flood of spam. We all agree that there's a problem. We just disagree (apparently) on what will and what won't fix it, and will or won't cause MORE of a problem in the process of doing so. > --------------000601090602070901020908 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit > {!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> {meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"> One of the things that has been SINGULARLY unhelpful toward addressing the problem of overloaded mail servers is this plague of HTML-burdened "alternative" copies of E-mail messages. It is rare indeed that these provide genuinely valuable additional content; instead they usually are loaded with gratuitous graphic gizmos, Web bugs, possibly malicious scripting, misrepresented clickable links, and text-as-image designed to evade content filters. While I'll accept that some folks can argue that their needs for HTML-burdened E-mail is legitimate, certainly a lot of it is not. Mail with HTML-burdened attachments is typically 3x-5x larger than it would be as plain ASCII text. If HTML-burdened attachments were removed from non-whitelisted senders' E-mail (and this would catch at least most of today's spam) then such mail would be 70-85% smaller in volume than it is today. I'm NOT suggesting that "all HTML-burdened E-mail is spam" (although MUCH of it coming from unknown/untrusted senders is!). True, spammers will respond to the "sending HTML is the kiss of death" realization by sending their E-mail spam as plain ASCII text (which then is easier for filters to identify) but in ANY case, the size of the remaining plain-text mails is far smaller. Like 75-85% smaller. Win-win. > It seems to me that there would be some of the following in a bulk email solution. Because, for sure, there are a lot of legit bulk emailers. > a) an accreditation process which would include certification of a legit sender. The sender has to present himself/herself before a physical post office for example. I don't want to see any solutions that result in some "authority" deciding what one can and cannot send. That's just begging for censorship, and we've got quite enough of that already. We need to have the freedom to send basically anything, INCLUDING mail criticizing the government or other censoring body. > b) a bulk stamp purchase agreement is executed and paid for by the originator. Postage schemes for E-mail is repugnant. It's just a way to turn it into a profit center for those who control it. When WATS lines were first proposed, a big part of the argument in favor was that 85-95% of the cost of a long distance phone call was the cost of billing you for it. WATS (800-) lines were supposed to disconnect all that extra overhead, thus justifying the huge price reduction. (Of course, that's not the way it worked out and it's most all still incrementally billed, but one can still believe the original "it's the cost of billing you for it" argument). US-based phone companies have wanted for decades to bill individually for local calls (the way most phone companies in other countries do) but thankfully, we've managed to beat that back so far. Let's not lose that (HUGELY important!) war in the E-mail space. > c) a set of designated relay servers would be designated to "affix the stamp" on behalf of the originator, the bulk sender. d) any relay could verify that a stamp instance as valid with a remote lookup; This "remote lookup" just adds more network overhead (and thus cost) to the cost of carrying ALL traffic, including the legit stuff. [snip] > Of course we must remember that bulk email is not necessarily bad. > There are many instances of legit bulk email (e.g. acceptance letters > from a college, bank statement notifications, etc.). So knowing that a > specific email is bulk is only half the problem, once you know it is > bulk there needs to be a determination as to whether it is legit or not. Of course, spam could be NOT "bulk" mail too. Ultimately, you want to test for and identify SPAM. "bulk or not" might provide a (maybe minor) input to that function, but is NOT enough to identify (or identify as NOT) spam. One can certainly envision a spambot worm that would periodically drop personalized one-of-a-kind spams into the infected machine's Outlook "outgoing mail" folder, possibly even complete with the owner's sig file, SPF or other From: address authentication, certificate even, and everything. That's NOT going to look, most likely, like "bulk" mail, but it CERTAINLY is still spam. > This is what Project Lumus, TEOS and some other mechanisms try to do - > whitelist or accredit legit bulk emailers. That's almost as repugnant as making sure that all the radio stations and news papers in a given market hew the same political philosophy. I don't want to see "solutions" that result in some agency (whether public or private) deciding whether a given person or company's political opinion can be distributed to a wide audience or not. > Of course, a single unified > framework of standard for the entire Internet on exchanging > accreditation and reputation data is something that might solve this > as well, so far there hasn't been sufficient interest in that area > (the SMTP-VERIFY subgroup was looking into it as some point). Again, the problem is that an "accredited" machine belonging to a trusted user can easily be taken over by a zombie spambot and used to pump out spam. We want to identify and stop spam and worms, REGARDLESS of who sends them or why. [snip] >>a) an accreditation process which would include certification of a legit >sender. The sender has to present himself/herself before a physical post >office for example. > Right. There's a bunch of possibile reputation systems here, from ISIPP's IADB o the proposed .mail domain Again, it doesn't ultimately solve the problem. You're creating a bureaucracy (which ultimately will become a too-powerful big profit center, just like NetworkSolutions/Verisign became for DNS) that eventually will become belligerant and hard to rein back in. > You're conflating two unrelated things here. Authenticating senders is a fine idea. That's what proposals such as SPF and Domain Keys do, with no stamps needed. It only SOUNDS like a good idea, until you realize that in the end analysis, IT DOESN'T SOLVE THE REAL PROBLEM. And in the process, it creates a number of problems for legitimate users. > E-postage is a horrible idea because it introduces more problems than it is supposed to solve. This is true of MANY of the solutions we've talked about here. > See my white paper at http://www.taugh.com for a longer discussion of the insoluble problems with e-postage. I agree that E-postage is a repugnant idea, and CERTAINLY DESERVES to be a non-starter. We need to get a huge wooden stake and drive it through the heart of that one, to KEEP it dead permanently. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 18 15:14:57 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA07307 for ; Sun, 18 Apr 2004 15:14:57 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFHe8-000203-2c for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 15:08:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3IJ84SV007682 for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 15:08:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFHdT-0001Bs-3F for asrg-web-archive@optimus.ietf.org; Sun, 18 Apr 2004 15:07:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA06061 for ; Sun, 18 Apr 2004 15:07:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFHdQ-0002OP-5m for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 15:07:20 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFHcP-00023D-00 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 15:06:18 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BFHbY-0001pr-01 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 15:05:24 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BFHYa-0008GC-O1 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 15:02:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFHUP-0000sl-KK; Sun, 18 Apr 2004 14:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFHSk-0000O2-CY for asrg@optimus.ietf.org; Sun, 18 Apr 2004 14:56:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05366 for ; Sun, 18 Apr 2004 14:56:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFHSh-0007mq-KH for asrg@ietf.org; Sun, 18 Apr 2004 14:56:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFHRn-0007aP-00 for asrg@ietf.org; Sun, 18 Apr 2004 14:55:20 -0400 Received: from smtp02.mrf.mail.rcn.net ([207.172.4.61]) by ietf-mx with esmtp (Exim 4.12) id 1BFHRG-0007NV-00 for asrg@ietf.org; Sun, 18 Apr 2004 14:54:46 -0400 Received: from 209-6-102-148.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([209.6.102.148] helo=localhost) by smtp02.mrf.mail.rcn.net with smtp (Exim 3.35 #4) id 1BFHRG-0000YL-00 for asrg@ietf.org; Sun, 18 Apr 2004 14:54:46 -0400 From: "Dr. Jeffrey Race" To: "asrg@ietf.org" Reply-To: "Dr. Jeffrey Race" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 18 Apr 2004 14:54:47 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=TO_ADDRESS_EQ_REAL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Violently snipped; see interleaved comments On Sun, 18 Apr 2004 10:49:02 -0500, gep2@terabites.com wrote: >I'm going to combine my comments regarding several related posts on this thread. >snip >Once you identify the "real" machine where the transmission occurred, more >likely than not it will turn out to be a zombie-infected spambot. So you get to >throw bricks at a fellow victim. No, not a fellow victim; a negligent abuse-enabler > >snip >Perhaps it is, although it's hard to define "a bulk email event". This discussion on-point > >Rather than making mail filters poll a central site (these have in the past been >victimized by DDOS attacks), maybe one approach here might be to set up a >Yahoogroup that could be used to rapidly distribute these "disreputable domain >names" and IP addresses along with a utility which would add them to the >recipients' HOSTS files (and from there, to their incoming mail filters). > >> Just today, I was at a friends office and my outgoing email was blocked >because cliff.concentric.net is now on a spam list. > >Yes, and that's one of the problems with SPF, "authenticated users", >certificates and other such schemes. Ultimately it's not very helpful to throw >rocks at fellow victims. > >[snip] > >>> I mail-server I use regularly (Indiana University) has taken, in >>>response to worms and other malware useing .pif. zip, exe, etc >>>attachments to spread their damage, has taken the (IMO) rather drastic >>>step of blocking almost *all* attachments ... > >That's sort of the approach of Microsoft's new version of Outlook, where they >allow blocking by attachment extension. That's better than nothing, but it >needs to be SOMEWHAT finer: it needs to allow the recipient to enable specific >attachment types (and certain classes of HTML markup) to be received from >specific approved-and-trusted senders. > >>> Coincidentally, another list I'm on had a post from the admin of a >>local university, talking about spam. Here's what he said. >> >>(quote) >> I don't support any Windows systems, yet I seem to spend a huge amount >>of time dealing with problems relating to Windows non-security. During the >>fall/winter term we had to deal with >> >> 1) When students returned to Residence in September, at least half of >> their machines were infected. > >One of my colleagues recently dealt with a client whose system was "having >assorted problems". Upon installing Spybot-Search-and-Destroy over TWO HUNDRED >instances of spyware were found on the unwitting user's computer. There were >additional Spyware programs that SPYBOT S&D did NOT find, besides. You have to use Bazooka and Adaware besides.>One of the things that has been SINGULARLY unhelpful toward addressing the >problem of overloaded mail servers is this plague of HTML-burdened "alternative" >copies of E-mail messages. It is rare indeed that these provide genuinely >valuable additional content; instead they usually are loaded with gratuitous >graphic gizmos, Web bugs, possibly malicious scripting, misrepresented clickable >links, and text-as-image designed to evade content filters. While I'll accept >that some folks can argue that their needs for HTML-burdened E-mail is >legitimate, certainly a lot of it is not. Mail with HTML-burdened attachments >is typically 3x-5x larger than it would be as plain ASCII text. > >If HTML-burdened attachments were removed from non-whitelisted senders' E-mail >(and this would catch at least most of today's spam) then such mail would be >70-85% smaller in volume than it is today. This is all documented. It needs to be a new standard. Feel free to point offenders to (or send it to them) > >I don't want to see any solutions that result in some "authority" deciding what >one can and cannot send. Right, only community consensus should be applied. It is doable. The whole discussion needs to be recast from "make the victims pay by coming up with solutions (filtering etc)" to "make the offenders pay". The only way to do that is to refuse mail from spam-enablers. It fixes the problem immediately. Again: ; Sun, 18 Apr 2004 15:57:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFINn-0001GR-5W for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 15:55:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3IJtFXZ004854 for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 15:55:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFIID-00087l-5S for asrg-web-archive@optimus.ietf.org; Sun, 18 Apr 2004 15:49:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08947 for ; Sun, 18 Apr 2004 15:49:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFIIB-00049M-Kb for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 15:49:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFIHH-0003v9-00 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 15:48:32 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFIGl-0003h7-00 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 15:47:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFI87-0005GU-FD; Sun, 18 Apr 2004 15:39:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFI6N-000465-Pu for asrg@optimus.ietf.org; Sun, 18 Apr 2004 15:37:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08599 for ; Sun, 18 Apr 2004 15:37:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFI6M-0001Wi-80 for asrg@ietf.org; Sun, 18 Apr 2004 15:37:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFI5Y-0001KB-00 for asrg@ietf.org; Sun, 18 Apr 2004 15:36:25 -0400 Received: from [66.98.212.93] (helo=tin.nixcartel.org) by ietf-mx with esmtp (Exim 4.12) id 1BFI4h-00017Z-00 for asrg@ietf.org; Sun, 18 Apr 2004 15:35:31 -0400 Received: from dvb.homelinux.org (unknown [202.88.170.34]) by tin.nixcartel.org (Postfix) with ESMTP id B74C81AC07B for ; Sun, 18 Apr 2004 14:38:01 -0500 (CDT) Received: by dvb.homelinux.org (Postfix, from userid 500) id C311F34022; Mon, 19 Apr 2004 01:04:59 +0530 (IST) From: Devdas Bhagat To: ASRG Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) Message-ID: <20040419010459.A14856@evita.devdas.geek> Reply-To: ASRG References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from jrace@attglobal.net on Sun, Apr 18, 2004 at 02:54:47PM -0400 X-Message-Flag: Friends protect friends from Microsoft Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 01:04:59 +0530 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On 18/04/04 14:54 -0400, Dr. Jeffrey Race wrote: > > > >Rather than making mail filters poll a central site (these have in the past been > >victimized by DDOS attacks), maybe one approach here might be to set up a > >Yahoogroup that could be used to rapidly distribute these "disreputable domain > >names" and IP addresses along with a utility which would add them to the > >recipients' HOSTS files (and from there, to their incoming mail filters). This approach has been proposed previously on net.admin.net-abuse.email. You will need a way to verify that the data is correct. Suggestions were PGP/GPG signing the message. Quite a few DNSBLs already allow access to the raw zonefiles via rsync. It should be fairly easy to convert that data into a format usable by the local DNS server. [reformatted line wrap] > You have to use Bazooka and Adaware besides. > > One of the things that has been SINGULARLY unhelpful toward addressing the > > problem of overloaded mail servers is this plague of HTML-burdened > > "alternative" copies of E-mail messages. It is rare indeed that these > > provide genuinely valuable additional content; instead they usually are > > loaded with gratuitous graphic gizmos, Web bugs, possibly malicious > > scripting, misrepresented clickable links, and text-as-image designed > > to evade content filters. While I'll accept that some folks can argue > > that their needs for HTML-burdened E-mail is legitimate, certainly a > > lot of it is not. Mail with HTML-burdened attachments > > is typically 3x-5x larger than it would be as plain ASCII text. > > > > If HTML-burdened attachments were removed from non-whitelisted senders' > > E-mail (and this would catch at least most of today's spam) then such > > mail would be 70-85% smaller in volume than it is today. Isn't modifying mail in transit bad? > This is all documented. It needs to be a new standard. Feel free to > point offenders to > (or send it to them) > > > > > > I don't want to see any solutions that result in some "authority" deciding > > what one can and cannot send. > > Right, only community consensus should be applied. It is doable. > > The whole discussion needs to be recast from "make the victims pay by > coming up with solutions (filtering etc)" to "make the offenders pay". > The only way to do that is to refuse mail from spam-enablers. It fixes > the problem immediately. Again: > Spam would stop worldwide within DAYS if most of us, instead of whining > and coming up with impractical technical or legal 'solutions', would > agree to do on the Internet what society does in every other field > of human activity: ensure that actions have consequences. It is THAT > SIMPLE. (Any parent knows.) Consequences to whom? Sender identification methods attempt to identify the sender so that appropriate measures can be taken against the sender. Blocking based on DNSBLs stops supposedly spam supporting senders. For most users, the need is to stop the spam without blocking legitimate mail from the same host. This is what drives the concept of filtering over using a DNSBL. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 18 17:15:40 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13559 for ; Sun, 18 Apr 2004 17:15:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFJb5-00060B-Rc for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 17:13:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ILD3xm023066 for asrg-archive@odin.ietf.org; Sun, 18 Apr 2004 17:13:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFJak-0005jk-DG for asrg-web-archive@optimus.ietf.org; Sun, 18 Apr 2004 17:12:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13303 for ; Sun, 18 Apr 2004 17:12:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFJai-0007l4-6q for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 17:12:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFJZe-0007Uu-00 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 17:11:34 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFJYn-0007GF-00 for asrg-web-archive@ietf.org; Sun, 18 Apr 2004 17:10:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFJQS-0002VQ-JD; Sun, 18 Apr 2004 17:02:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFJNG-0000z4-5q for asrg@optimus.ietf.org; Sun, 18 Apr 2004 16:58:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA12357 for ; Sun, 18 Apr 2004 16:58:43 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFJND-0004J5-SD for asrg@ietf.org; Sun, 18 Apr 2004 16:58:43 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFJM8-00043Y-00 for asrg@ietf.org; Sun, 18 Apr 2004 16:57:37 -0400 Received: from mail5.dslextreme.com ([66.51.199.81]) by ietf-mx with smtp (Exim 4.12) id 1BFJLX-0003mx-00 for asrg@ietf.org; Sun, 18 Apr 2004 16:57:00 -0400 Received: (qmail 29620 invoked from network); 18 Apr 2004 20:56:28 -0000 Received: from unknown (HELO kit) (jmargolin@66.42.13.27) by 192.168.8.93 with SMTP; Sun, 18 Apr 2004 20:56:28 +0000 Message-ID: <001a01c42588$230f4600$1b0d2a42@kit> From: "Jed Margolin" To: References: Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-AntiVirus: scanned for viruses by AMaViS 0.2.1 (http://amavis.org/) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 18 Apr 2004 13:59:51 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit ----- Original Message ----- From: To: Sent: Sunday, April 18, 2004 8:49 AM Subject: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) > I'm going to combine my comments regarding several related posts on this thread. . . . . > The best way ultimately to put a serious dent in spam (and worms/viruses) is for > it to be perceived as largely futile. And if 99.99% of the junk (or more) never > even gets delivered to a human being, this has got to help achieve that. . . . I suspect that many spammers are the people who buy what appears to be spam-in-a-box software packages offered in late-night infomercials. If the legal system can't go after the people who are selling the spam-in-a-box products, perhaps under the category of Truth in Advertising the TV stations who air the infomercials can be required to add warning announcements to the effect that, "The following product is used for sending unsolicited commercial email, commonly known as spam." Jed Margolin _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 14:51:04 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00888 for ; Mon, 19 Apr 2004 14:51:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFdhf-0002Ln-DD for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 14:41:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JIfBPr009031 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 14:41:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFddz-0001hA-Ny for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 14:37:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA00269 for ; Mon, 19 Apr 2004 14:37:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFddw-0002V2-UP for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 14:37:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFdcy-0002HX-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 14:36:22 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFdcX-00024M-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 14:35:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFdVt-00005Z-0M; Mon, 19 Apr 2004 14:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFdQE-0007Yy-KU for asrg@optimus.ietf.org; Mon, 19 Apr 2004 14:23:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA29358 for ; Mon, 19 Apr 2004 14:23:07 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFdQC-0006vf-0Y for asrg@ietf.org; Mon, 19 Apr 2004 14:23:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFdPD-0006eu-00 for asrg@ietf.org; Mon, 19 Apr 2004 14:22:09 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BFdOB-0006Dm-00 for asrg@ietf.org; Mon, 19 Apr 2004 14:21:03 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc11) with SMTP id <2004041918203101300fgm73e>; Mon, 19 Apr 2004 18:20:32 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Mon, 19 Apr 2004 13:20:22 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Mon, 19 Apr 2004 13:29:30 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (various) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 13:29:30 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.1 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Again, I'll respond to several comments together (and with a lot of snipping). >> Once you identify the "real" machine where the transmission occurred, more >likely than not it will turn out to be a zombie-infected spambot. So you get to throw bricks at a fellow victim. > No, not a fellow victim; a negligent abuse-enabler Perhaps, but they're still victims too. The fact of the matter is that there are a lot of technically VERY clueless folks out there, and unless you've come up with some kind of magic pill they can take which suddenly makes them technically savvy, there are going to CONTINUE to be clueless types out there. We need to simply make it very much harder for viruses and worms to infect those people's machines. Closing the attachment transmission window (especially for executable-type attachments) to just a sliver of what it is today will certainly help a great deal. SPF and other such schemes is unlikely to help very much at all, because those machines which DO get infected can send viruses, worms, and spam using their authenticated SMTP. It's outrageous and irresponsible that nearly everyone's mail clients freely accept and allow people to receive and click on things like PIF files, which are virtually NEVER used for anything good. .EXE files are likewise almost never legitimately needed in E-mail, and those who DO need it usually know why, and from whom they need to be able to receive such stuff. We will NEVER solve the spam problem if we don't get a major handle on the virus and worm problem, and A-V software is NOT the ultimate solution because it basically all works on the "blacklist" principle (i.e. "if we don't know about it (yet) then it's probably okay." While A-V software is a valuable component, and certainly helpful in disinfecting a machine once it's been infected, hopefully we can come up with a solution that's better than just go around forever swatting flies. Let's close the window!! SPF, challenge-response, and other such infrastructure-disrupting schemes basically don't achieve that because they are based on an unrealistic base assumption: that spam necessarily uses bogus return addresses, and/or is sent by "known bad" machines belonging to spamhauses. The first of those can be changed literally overnight, and the second hasn't been true for quite a long time already. >snip >>Perhaps it is, although it's hard to define "a bulk email event". > This discussion on-point >>Rather than making mail filters poll a central site (these have in the past been >victimized by DDOS attacks), maybe one approach here might be to set up a >Yahoogroup that could be used to rapidly distribute these "disreputable domain >names" and IP addresses along with a utility which would add them to the >recipients' HOSTS files (and from there, to their incoming mail filters). I will point out that this is again just a component, since it is another "20/20 hindsight" approach much like A-V software solutions. At most it inconveniences spammers in that they must burn through a neverending stream of disposable domain names and IP addresses; unfortunately, they HAVE figured that out and long-term this only will serve (if we can get the propagation delay short enough for the "bad list" updates) to dramatically reduce the useful lifetime (perhaps to just a few hours) of these disposable domain names and IP addresses. >>> Just today, I was at a friends office and my outgoing email was blocked >because cliff.concentric.net is now on a spam list. >>Yes, and that's one of the problems with SPF, "authenticated users", >certificates and other such schemes. Ultimately it's not very helpful to throw >rocks at fellow victims. >[snip] >>>> I mail-server I use regularly (Indiana University) has taken, in >>>response to worms and other malware useing .pif. zip, exe, etc >>>attachments to spread their damage, has taken the (IMO) rather drastic >>>step of blocking almost *all* attachments ... >>That's sort of the approach of Microsoft's new version of Outlook, where they >allow blocking by attachment extension. That's better than nothing, but it >needs to be SOMEWHAT finer: it needs to allow the recipient to enable specific >attachment types (and certain classes of HTML markup) to be received from >specific approved-and-trusted senders. >>>> Coincidentally, another list I'm on had a post from the admin of a >>local university, talking about spam. Here's what he said. >> >>(quote) >> I don't support any Windows systems, yet I seem to spend a huge amount >>of time dealing with problems relating to Windows non-security. During the >>fall/winter term we had to deal with >> >> 1) When students returned to Residence in September, at least half of >> their machines were infected. >> One of my colleagues recently dealt with a client whose system was "having >assorted problems". Upon installing Spybot-Search-and-Destroy over TWO HUNDRED >instances of spyware were found on the unwitting user's computer. There were >additional Spyware programs that SPYBOT S&D did NOT find, besides. > You have to use Bazooka and Adaware besides. I wasn't aware of Bazooka, thanks for the tip. >>>One of the things that has been SINGULARLY unhelpful toward addressing the >problem of overloaded mail servers is this plague of HTML-burdened "alternative" >copies of E-mail messages. It is rare indeed that these provide genuinely >valuable additional content; instead they usually are loaded with gratuitous >graphic gizmos, Web bugs, possibly malicious scripting, misrepresented clickable >links, and text-as-image designed to evade content filters. While I'll accept >that some folks can argue that their needs for HTML-burdened E-mail is >legitimate, certainly a lot of it is not. Mail with HTML-burdened attachments >is typically 3x-5x larger than it would be as plain ASCII text. > >If HTML-burdened attachments were removed from non-whitelisted senders' E-mail >(and this would catch at least most of today's spam) then such mail would be >70-85% smaller in volume than it is today. > This is all documented. It needs to be a new standard. Feel free to point offenders to (or send it to them) I've typically in the past sent a similar reply to those sending me HTML-burdened E-mail messages, and I think I have a similar discussion of the topic at my personal Web site too... ah yes, here it is: http://personal.terabites.com/htmlmail.html I've stopped sending out the rant to HTML-burdened mail senders, for the most part, since I've configured my own incoming mail filter to simply strip out the HTML-burdened alternative attachments, and the great majority of the HTML tags (if any) in the main body of the E-mail messages. Some senders are simply belligerant, some just don't care, and many are just ignorant. It's just easier and more pragmatic to handle things at the recipient end, which gives the recipient the control at the level of their own systems. Regarding the camblab document, I think it's quite outrageous that you have to individually configure specific folks to send them non-HTML-burdened E-mail; it seems that by default, all these mail clients seem to want to deceive folks into sending HTML-burdened mail, even when they don't have any idea that they are, or what the implications are. The DEFAULT should be plain ASCII text, and anything else should require special handling. (And likewise, plain ASCII text should be the only kind of E-mail that comes in unless the specific sender is whitelisted to be able to send anything else). AOL, of course, is one of the big offenders. And their users are almost by definition clueless enough that one despairs of educating them to be more aware and responsible. Perhaps pressure can be put on AOL itself to change its defaults; if enough people refused non-whitelisted HTML-burdened E-mail then maybe AOL would get the message. >> I don't want to see any solutions that result in some "authority" deciding what one can and cannot send. > Right, only community consensus should be applied. It is doable. I hope so. > The whole discussion needs to be recast from "make the victims pay by coming up with solutions (filtering etc)" to "make the offenders pay". The problem is that then you have to define "who are the offenders" and ultimately the best judge of that is the individual recipients. Ultimately the best weapon that recipients have is to en masse simply refuse to accept or read mail which doesn't meet their conditions for acceptance. As the savvy types that we in this group supposedly are, we should be able to help provide guidance for creating tools (and/or create them) which will prove workable, and which gives recipients a feeling of control again. The worst thing is for them to continue the feeling of victimized helplessness and frustration that so many of them feel today. Just about unique among the approaches I've noticed being discussed here, my solution: 1) puts the control in the hands of the recipient 2) almost totally closes the window for recipients to receive attachments containing viruses and worms 3) sets responsible default behavior so clueless types are likely to be much safer than they are today 4) is single-ended and could be implemented TODAY, it doesn't require any worldwide consensus 5) doesn't require any major changes in sender infrastructure 6) doesn't increase E-mail overhead costs associated with individual messages 7) fully supports mailing lists, discussion groups, and other important E-mail mechanisms 8) provides major incentives to return to plain ASCII text E-mail, especially for unsolicited messages, which would cut the bulk of such mail by something like 3/4! > The only way to do that is to refuse mail from spam-enablers. It fixes the problem immediately. Again: Spam would stop worldwide within DAYS if most of us, instead of whining and coming up with impractical technical or legal 'solutions', would agree to do on the Internet what society does in every other field of human activity: ensure that actions have consequences. It is THAT SIMPLE. (Any parent knows.) The problem is that there are way too many users who are clueless, and who are simply never going to learn to behave more defensively online. Coming down too hard will drive them offline (they'll just give up) and it's not clear that that's ultimately either the way to educate them (hopefully, some of them at least) nor that it's better from the standpoint of the future of our society to have them stay offline. >> Rather than making mail filters poll a central site (these have in the past been > >victimized by DDOS attacks), maybe one approach here might be to set up a > >Yahoogroup that could be used to rapidly distribute these "disreputable domain > >names" and IP addresses along with a utility which would add them to the > >recipients' HOSTS files (and from there, to their incoming mail filters). > This approach has been proposed previously on net.admin.net-abuse.email. You will need a way to verify that the data is correct. That's true, and clearly one doesn't want to have malicious types adding legitimate domains like google.com or yahoo.com to the "bogus" blacklist. More serious is the problem of people with a tendency to add legitimate domains which have been victimized as the counterfeit "From" address on spams. :-( > Suggestions were PGP/GPG signing the message. The problems with all such approaches I've seen is that a spambot zombie can send mail using all the authentication/certificates/etc that had been established by the legitimate owner of the machine. I think it's ultimately far better to be able to identify spam mail by what is in THAT mail message, and limiting the amount of "damage" and "deceptions" that such mail can employ... rather than trying to reach some kind of "blanket" thing saying that certain people "of course" are (globally!) good. That just makes those "trusted" people a more attractive target for turning their machine into a zombie. > Quite a few DNSBLs already allow access to the raw zonefiles via rsync. It should be fairly easy to convert that data into a format usable by the local DNS server. I'd like to see a solution which does not require additional network overhead for every E-mail sent/received. Although I'm not convinced of its great value as a longer-term thing, since some spammers are finding their way around it, one strategy that's still fairly effective today is to block E-mails as spam if they contain links or URLs that point at spam-promoted Web sites. I don't know how long that will last as a useful discriminator. > > [reformatted line wrap] >>> You have to use Bazooka and Adaware besides. > > One of the things that has been SINGULARLY unhelpful toward addressing the > > problem of overloaded mail servers is this plague of HTML-burdened > > "alternative" copies of E-mail messages. It is rare indeed that these > > provide genuinely valuable additional content; instead they usually are > > loaded with gratuitous graphic gizmos, Web bugs, possibly malicious > > scripting, misrepresented clickable links, and text-as-image designed > > to evade content filters. While I'll accept that some folks can argue > > that their needs for HTML-burdened E-mail is legitimate, certainly a > > lot of it is not. Mail with HTML-burdened attachments > > is typically 3x-5x larger than it would be as plain ASCII text. > > > > If HTML-burdened attachments were removed from non-whitelisted senders' > > E-mail (and this would catch at least most of today's spam) then such > > mail would be 70-85% smaller in volume than it is today. > Isn't modifying mail in transit bad? If it were done without the consent of the recipient, yes. In my case, my policy is that I simply don't want the wasteful bulk of HTML-burdened alternative text attachments in incoming E-mails. Lots of folks send those, and many don't seem willing to stop doing so. It's nearly impossible (and certainly unrealistic, at best) to expect AOL users (as a prime example) to go to the substantial hassle of turning off HTML individually on each E-mail message they send. It's simply more realistic for me to t-can all that unwanted junk as soon as my systems get their hands on the incoming E-mail messages. If the senders don't want my systems to futz with the mail they're sending me, then it's real simple.... send it to me in a reasonable format to start with! Now, I will agree that my mail filters go a LOT further in processing incoming E-mails than most others I've seen... for example, I actually strip out things like "free E-mail ads" and too-familiar gratuitous junk taglines too. Admittedly this changes the content of the E-mail message, and this would confuse things like encryption-based content integrity schemes and such. That's a price that I'm personally willing to pay... >>> This is all documented. It needs to be a new standard. Feel free to > point offenders to > (or send it to them) > > > > > > I don't want to see any solutions that result in some "authority" deciding > > what one can and cannot send. > > Right, only community consensus should be applied. It is doable. > > The whole discussion needs to be recast from "make the victims pay by > coming up with solutions (filtering etc)" to "make the offenders pay". > The only way to do that is to refuse mail from spam-enablers. It fixes > the problem immediately. Again: I do agree with this point. However, the business community does not want to agree to that standard. They would rather pay for a lot of spam rather than possibly lose a single email. And until businesses understand that blocking the spam enablers makes sense, this is not going to happen. I don't think you can truly control mail getting INTO the Internet... there's simply far too many ways to put mail into the system. What you CAN achieve, I believe, is to simply make sending unwanted mail futile, by ensuring that little or none of it reaches its intended destination. Yes, it's true that there will probably always be "Internet vandals" who get their rocks off by loading the system just to show that they can do that, but I think that's really a separate issue and probably requires a different solution that we can talk about another day. >> Spam would stop worldwide within DAYS if most of us, instead of whining > and coming up with impractical technical or legal 'solutions', would > agree to do on the Internet what society does in every other field > of human activity: ensure that actions have consequences. It is THAT > SIMPLE. (Any parent knows.) > Consequences to whom? Sender identification methods attempt to identify the sender so that appropriate measures can be taken against the sender. Blocking based on DNSBLs stops supposedly spam supporting senders. Again, I think that ultimately it achieves little to punish your fellow victims. The great majority of the systems today sending spam are NOT doing so as the result of a conscious approval and awareness on the part of those responsible for the system(s) involved. I agree totally that it would be a better state of affairs if everyone attached to the Internet were competent and savvy, but that's simply not realistic, nor will it be anytime soon. > For most users, the need is to stop the spam without blocking legitimate mail from the same host. This is what drives the concept of filtering over using a DNSBL. ...and filtering is confounded by things like HTML, which supports things like text-as-image, obscured URLs, scripts that perform encryption/decryption of message text, possibly malicious ActiveX, and things of that genre. This is a problem that will never be solved, IMHO, until we get a handle on HTML and attachments. And, surprisingly I think, once we adopt an enlightened and resonsible attitude regarding those two features of E-mail messages, (and combined with a good content filter on what's left), a surprisingly large amount of the problem simply vanishes! [snip] >> The best way ultimately to put a serious dent in spam (and worms/viruses) is for it to be perceived as largely futile. And if 99.99% of the junk (or more) never even gets delivered to a human being, this has got to help achieve that. > I suspect that many spammers are the people who buy what appears to be spam-in-a-box software packages offered in late-night infomercials. Those are the relatively clueless spammers, I think. I'm far more concerned about the really devious and belligerant ones. Some of those (like Spamford Wallace) have been driven out of the business (hopefully) by legal measures, but it seems there are plenty more that have risen up to take his place. :-( > If the legal system can't go after the people who are selling the spam-in-a-box products, perhaps under the category of Truth in Advertising the TV stations who air the infomercials can be required to add warning announcements to the effect that, "The following product is used for sending unsolicited commercial email, commonly known as spam." Sure, although I believe those who send spam are generally quite cognizant of what they're doing. And they just don't care. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 16:15:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA06993 for ; Mon, 19 Apr 2004 16:15:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFf7o-0003El-Up for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 16:12:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JKCGM7012438 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 16:12:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFf13-0001ef-G8 for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 16:05:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA06391 for ; Mon, 19 Apr 2004 16:05:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFf11-0000ZN-Rv for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 16:05:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFf03-0000LB-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 16:04:15 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFezB-00006l-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 16:03:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFeoI-0007qk-MX; Mon, 19 Apr 2004 15:52:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFeey-0005y3-TE for asrg@optimus.ietf.org; Mon, 19 Apr 2004 15:42:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA05017 for ; Mon, 19 Apr 2004 15:42:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFeex-0002jg-AG for asrg@ietf.org; Mon, 19 Apr 2004 15:42:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFee1-0002V0-00 for asrg@ietf.org; Mon, 19 Apr 2004 15:41:29 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 1BFedV-0002Ef-00 for asrg@ietf.org; Mon, 19 Apr 2004 15:40:57 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id i3JJeKl22792 for ; Mon, 19 Apr 2004 15:40:20 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JCT8H9DR; Mon, 19 Apr 2004 15:40:20 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.65]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JC3JLXSY; Mon, 19 Apr 2004 15:40:20 -0400 Message-ID: <40842B23.4020605@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (various) References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 15:40:19 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit gep2@terabites.com wrote: > Again, I'll respond to several comments together (and with a lot of snipping). > > >>>Once you identify the "real" machine where the transmission occurred, more >>likely than not it will turn out to be a zombie-infected spambot. So you get > to throw bricks at a fellow victim. >>No, not a fellow victim; a negligent abuse-enabler > Perhaps, but they're still victims too. True. But victim or not, I _cannot_ afford to let a provably insecure source continue to spew malware or spam at our users. If there are real users on that machine, our inline rejection notices will tell them how to get their problem fixed. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 16:52:02 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09286 for ; Mon, 19 Apr 2004 16:52:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFfa4-0001tf-D3 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 16:41:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JKfSqW007285 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 16:41:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFfV6-0000NA-Qt for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 16:36:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA08351 for ; Mon, 19 Apr 2004 16:36:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFfV4-0000ZN-UL for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 16:36:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFfUI-0000ME-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 16:35:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFfTo-00008G-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 16:35:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFfP0-0007UB-SY; Mon, 19 Apr 2004 16:30:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFfGj-0004op-6Z for asrg@optimus.ietf.org; Mon, 19 Apr 2004 16:21:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA07315 for ; Mon, 19 Apr 2004 16:21:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFfGh-0004aB-Cp for asrg@ietf.org; Mon, 19 Apr 2004 16:21:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFfFl-0004M9-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:20:30 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BFfFA-00047Q-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:19:53 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id 4E96E170FA for ; Mon, 19 Apr 2004 16:24:24 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: Your message of "Fri, 16 Apr 2004 18:32:05 EDT." <40805EE5.7060403@solidmatrix.com> Message-Id: <20040419202424.4E96E170FA@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 16:24:24 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Yakov Shafranovich wrote: > DCC (http://www.rhyolite.com/anti-spam/dcc/) tries to detect bulk emails > as do some other projects. This is not something that requires addition > to SMTP and is an separate protocol. Let's be aware, though, that many content filtering schemes and black-lists have been caught adding entries to the list which do NOT meet the publicly stated criteria. To put it another way, if you don't know what the criteria are, the system is oben to abuse by insiders. Alan Dekok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 17:27:05 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA11657 for ; Mon, 19 Apr 2004 17:27:05 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFgF2-0003uf-Nn for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 17:23:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JLNmD9015037 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 17:23:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFg5z-0001yM-C1 for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 17:14:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA10618 for ; Mon, 19 Apr 2004 17:14:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFg5x-0002B2-0l for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 17:14:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFg56-0001vO-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 17:13:33 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFg4U-0001gc-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 17:12:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFfq5-0004qH-6r; Mon, 19 Apr 2004 16:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFfli-0003oR-Ar for asrg@optimus.ietf.org; Mon, 19 Apr 2004 16:53:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09436 for ; Mon, 19 Apr 2004 16:53:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFflg-0004s6-4F for asrg@ietf.org; Mon, 19 Apr 2004 16:53:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFfke-0004c8-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:52:25 -0400 Received: from zcars0m9.nortelnetworks.com ([47.129.242.157]) by ietf-mx with esmtp (Exim 4.12) id 1BFfjh-00048j-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:51:25 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars0m9.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id i3JKomk10215 for ; Mon, 19 Apr 2004 16:50:48 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JCT82A1S; Mon, 19 Apr 2004 16:50:48 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.65]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JC3JLXWM; Mon, 19 Apr 2004 16:50:49 -0400 Message-ID: <40843BA8.3070106@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040419202424.4E96E170FA@mail.nitros9.org> In-Reply-To: <20040419202424.4E96E170FA@mail.nitros9.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 16:50:48 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Alan DeKok wrote: > Yakov Shafranovich wrote: >>DCC (http://www.rhyolite.com/anti-spam/dcc/) tries to detect bulk emails >>as do some other projects. This is not something that requires addition >>to SMTP and is an separate protocol. > Let's be aware, though, that many content filtering schemes and > black-lists have been caught adding entries to the list which do NOT > meet the publicly stated criteria. That's a bit of a non-sequitor. DCC and it's detection system is 100% automated. It doesn't work by "adding entries" to a list. Or, at least, you can't subvert it by "adding entries", because you'd have to predict in advance what the hash signature was. > To put it another way, if you don't know what the criteria are, the > system is oben to abuse by insiders. DCC source is freely available, so the algorithms and procedures are well known (to those who bother to look). Doesn't stop the DCC owner from fudging the query system, but that's possible with _any_ anti-spam solution that relies on anyone else for decisions. Subversion is a risk with _all_ anti-spam solutions except those you write yourself. And perhaps not even those ;-) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 18:14:31 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15438 for ; Mon, 19 Apr 2004 18:14:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFgsr-0005zl-8o for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 18:04:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JM4v97023040 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 18:04:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFgnZ-0002Qs-Jv for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 17:59:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA13580 for ; Mon, 19 Apr 2004 17:59:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFgnW-0005ha-SF for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 17:59:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFgmR-0005Sv-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 17:58:19 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFglW-0005E8-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 17:57:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFghJ-0001FG-9r; Mon, 19 Apr 2004 17:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFgaq-0008WS-4a for asrg@optimus.ietf.org; Mon, 19 Apr 2004 17:46:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12607 for ; Mon, 19 Apr 2004 17:46:16 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFgan-0002CP-IY for asrg@ietf.org; Mon, 19 Apr 2004 17:46:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFgZt-0001xl-00 for asrg@ietf.org; Mon, 19 Apr 2004 17:45:22 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BFgZ6-0001jx-00 for asrg@ietf.org; Mon, 19 Apr 2004 17:44:32 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id F2D7716CC3 for ; Mon, 19 Apr 2004 17:49:13 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: Your message of "Mon, 19 Apr 2004 16:50:48 EDT." <40843BA8.3070106@americasm01.nt.com> Message-Id: <20040419214914.F2D7716CC3@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 17:49:13 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 "Chris Lewis" wrote: > > Let's be aware, though, that many content filtering schemes and > > black-lists have been caught adding entries to the list which do NOT > > meet the publicly stated criteria. > > That's a bit of a non-sequitor. DCC and it's detection system is 100% > automated. It doesn't work by "adding entries" to a list. At one point last year, Hadmut tried emailing Vernon off-list to continue an on-list conversation. The message was rejected, and appeared to have been submitted to the DCC. Vernon then admitted on this list that he was blocking Hadmut's off-list messages, and submitting that information to the DCC. That's censorship, not anti-spam filtering. On the subject of blacklists, I don't think I have to re-iterate the political wars between blacklist maintainers, who cross-list each other. > DCC source is freely available, so the algorithms and procedures are > well known (to those who bother to look). Yes, but only the checksums are distributed, not the reasons why a message resulted in a checksum being distributed. It's run on trust: You have to trust that other members of the system don't abuse it. This trust problem is the same for any distributed system. > Doesn't stop the DCC owner from fudging the query system, but that's > possible with _any_ anti-spam solution that relies on anyone else for > decisions. Subversion is a risk with _all_ anti-spam solutions except > those you write yourself. And perhaps not even those ;-) I agree. Systems like spamassassin are slightly better from the trust perspective. but may catch less spam than the DCC. Spamassassin distributes the rules to each user, who then can configure it to tell him which rules were matched. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 19:24:27 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20635 for ; Mon, 19 Apr 2004 19:24:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFi2R-0005U6-UF for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:18:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JNIt9U021070 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:18:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFhy5-000360-Tc for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 19:14:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA19945 for ; Mon, 19 Apr 2004 19:14:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFhy4-0002Gb-CK for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:14:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFhxA-00022e-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:13:28 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFhwJ-0001p7-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:12:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFhm5-0008EV-6T; Mon, 19 Apr 2004 19:02:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFbqe-0003xi-5t for asrg@optimus.ietf.org; Mon, 19 Apr 2004 12:42:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA22711 for ; Mon, 19 Apr 2004 12:42:16 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFbqc-0005VJ-HG for asrg@ietf.org; Mon, 19 Apr 2004 12:42:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFbpj-0005GU-00 for asrg@ietf.org; Mon, 19 Apr 2004 12:41:24 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BFbou-00051h-00 for asrg@ietf.org; Mon, 19 Apr 2004 12:40:32 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFbot-0000rY-00 for asrg@ietf.org; Mon, 19 Apr 2004 12:40:31 -0400 Received: from [68.246.184.80] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFbos-0005Ym-00 for asrg@ietf.org; Mon, 19 Apr 2004 12:40:31 -0400 Message-ID: <408400F7.9050202@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) References: <20040419010459.A14856@evita.devdas.geek> In-Reply-To: <20040419010459.A14856@evita.devdas.geek> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 12:40:23 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Devdas Bhagat wrote: > On 18/04/04 14:54 -0400, Dr. Jeffrey Race wrote: > > >>>Rather than making mail filters poll a central site (these have in the past been >>>victimized by DDOS attacks), maybe one approach here might be to set up a >>>Yahoogroup that could be used to rapidly distribute these "disreputable domain >>>names" and IP addresses along with a utility which would add them to the >>>recipients' HOSTS files (and from there, to their incoming mail filters). > > > This approach has been proposed previously on net.admin.net-abuse.email. > You will need a way to verify that the data is correct. Suggestions were > PGP/GPG signing the message. > Quite a few DNSBLs already allow access to the raw zonefiles via rsync. > It should be fairly easy to convert that data into a format usable by > the local DNS server. > There has been talk about many DNSBL operators about a P2P distribution system or perhaps even using an existing P2P system such as FreeNet. Lack of commong protocols is a bit of a problem. > >>Spam would stop worldwide within DAYS if most of us, instead of whining >>and coming up with impractical technical or legal 'solutions', would >>agree to do on the Internet what society does in every other field >>of human activity: ensure that actions have consequences. It is THAT >>SIMPLE. (Any parent knows.) > > Consequences to whom? Sender identification methods attempt to identify > the sender so that appropriate measures can be taken against the sender. > Blocking based on DNSBLs stops supposedly spam supporting senders. > > For most users, the need is to stop the spam without blocking legitimate > mail from the same host. This is what drives the concept of filtering > over using a DNSBL. > Collateral damage is an issue. Another issue is the fact that blocking is not communicated to the sender in many cases but the messages are swallowed silently. As for community-based systems, rule of the mob is not always good. I am not saying this approach is bad, rather it has issues that must be worked out. If all of these issues are taken into account, such system may very well do a lot of good. For example, if there are standards for communications among ISPs and networks for both blocking and abuse reporting, this can improve things a lot. If the issue of colleteral damage is taken into account, it can help. If DNSBLs are run properly and accountable to the community, it will increase their accuracy. If community based systems can account for a possibility of someone subverting the system ("rule of the mob") they can become more widespread. At this time it seems that senders and receivers will be asked to exchange credentials when sending email and matched against their reputation in third party databases. This can benefit from standards. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 19:26:35 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20801 for ; Mon, 19 Apr 2004 19:26:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFi2h-0005bK-9s for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:19:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JNJBKn021526 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:19:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFi1A-0004XP-B1 for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 19:17:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20093 for ; Mon, 19 Apr 2004 19:17:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFi18-000317-OQ for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:17:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFi0K-0002lx-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:16:45 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFhzk-0002WN-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:16:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFhm5-0008Ed-L7; Mon, 19 Apr 2004 19:02:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFf5r-0002mQ-Ul for asrg@optimus.ietf.org; Mon, 19 Apr 2004 16:10:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA06580 for ; Mon, 19 Apr 2004 16:10:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFf5q-0001iS-89 for asrg@ietf.org; Mon, 19 Apr 2004 16:10:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFf4w-0001VE-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:09:19 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BFf4E-0001IG-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:08:34 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3JK6aG3016626; Mon, 19 Apr 2004 16:06:36 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id QAA18313; Mon, 19 Apr 2004 16:06:35 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16516.12619.744345.929026@world.std.com> To: lane@opendoors.com Cc: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <4080BCD9.3000105@opendoors.com> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 16:06:35 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit My opinion: This sort of summary (repeated below) lays out very well how much we're heading straight towards a sort of regulatory heat death. Who is going to "certify"? On what grounds? How corruptible are they going to be? Who gets to clarify and modify standards. The point is that I'm not usually one of these free-market nuts, but in this case I think anything but assessing some sort of charge is total madness and doomed to failure. Ten years of going round and round trying to come up with some way to beat what appears to nearly be a law of physics has convinced me of that. That is, it's almost as if we're talking about how inconvenient gravity is, crashes planes, makes things heavy increasing energy consumption etc, so we should form an IRTG group and vote for better regulation of gravity. You'd just be creating a target of opportunity for the highest bidder, basically, some sort of corruptible, content-oriented regulatory bureaucracy which has to operate in an international arena. Personally I think this group would probably have done their job if they could unanimously or near-unanimously or at least with some amount of force of conviction just tell the public we've studied the matter and basically we're trying to do the impossible which is regulate a free, valuable resource by some unworkable set of rules either implemented via software or some unnamed vehicle of human fiat (i.e., regulation, legislation, big men with sticks...) As such, the only chance of beginning to tackle the spam problem requires some sort of postage, simple charging, to simply make resource usage reflect costs. For everyone. Analogous to paper postal systems with, perhaps, some creative twists to reflect the low cost of common usage, preferably thrown back to the ISPs et al. Any other approach, upon some examination, seems to be an exercise in trying to re-create, this time successfully, what 75 years of the Soviet Union and other Marxist countries failed to accomplish (I really don't mean to come off like some kind of right-wing ranter but for the purpose of discussion and short-hand symbols the metaphor seemed apt but I wouldn't suggest repeating it in a press release!) -b On April 16, 2004 at 22:12 lane@opendoors.com (Lane Sharman) wrote: > Hi Yakov, > > It seems to me that there would be some of the following in a bulk email > solution. Because, for sure, there are a lot of legit bulk emailers. > > a) an accreditation process which would include certification of a legit > sender. The sender has to present himself/herself before a physical post > office for example. > b) a bulk stamp purchase agreement is executed and paid for by the > originator. > c) a set of designated relay servers would be designated to "affix the > stamp" on behalf of the originator, the bulk sender. > d) any relay could verify that a stamp instance as valid with a remote > lookup; forgeries would be thwarted because the stamp expires and other > characteristics. > > -Lane > > > > > > Yakov Shafranovich wrote: > > > Lane Sharman wrote: > > > >> What interests me is point of origin detection, identification and > >> blocking. In other words, what addition to the SMTP protocol would > >> make it possible to identify, for example, "unstamped email being > >> sent out in bulk mode". Statistically, isn't it possible to identify > >> an instance of a bulk email event on the net? > > > > > > DCC (http://www.rhyolite.com/anti-spam/dcc/) tries to detect bulk > > emails as do some other projects. This is not something that requires > > addition to SMTP and is an separate protocol. > > > > Of course we must remember that bulk email is not necessarily bad. > > There are many instances of legit bulk email (e.g. acceptance letters > > from a college, bank statement notifications, etc.). So knowing that a > > specific email is bulk is only half the problem, once you know it is > > bulk there needs to be a determination as to whether it is legit or not. > > > > This is what Project Lumus, TEOS and some other mechanisms try to do - > > whitelist or accredit legit bulk emailers. Of course, a single unified > > framework of standard for the entire Internet on exchanging > > accreditation and reputation data is something that might solve this > > as well, so far there hasn't been sufficient interest in that area > > (the SMTP-VERIFY subgroup was looking into it as some point). > > > > Yakov > > > > -- > Lane Sharman > Providing Private and SPAM-Free Email > http://www.opendoors.com > 858-755-2868 > > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 19:26:43 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20828 for ; Mon, 19 Apr 2004 19:26:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFi4Z-0005vm-5r for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:21:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JNL7h8022792 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:21:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFi1z-00059z-Bs for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 19:18:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20119 for ; Mon, 19 Apr 2004 19:18:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFi1x-0003H1-MI for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:18:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFi14-00030W-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:17:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFi0E-0002lG-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:16:38 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFhm6-0008En-3z; Mon, 19 Apr 2004 19:02:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFfpP-0004iJ-Al for asrg@optimus.ietf.org; Mon, 19 Apr 2004 16:57:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA09726 for ; Mon, 19 Apr 2004 16:57:16 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFfpN-0005s1-4P for asrg@ietf.org; Mon, 19 Apr 2004 16:57:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFfoN-0005cS-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:56:16 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BFfnM-0005Jh-00 for asrg@ietf.org; Mon, 19 Apr 2004 16:55:12 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3JKsXG3025162; Mon, 19 Apr 2004 16:54:33 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id QAA01277; Mon, 19 Apr 2004 16:54:33 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16516.15496.971964.662601@world.std.com> To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <40814E95.2070509@opendoors.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 16:54:32 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit My reactions to e-postage paper: http://www.taugh.com 1. Citing the failure in the 1980s of MCIMail et al is a strawman. That was a very different time and their charges were outrageous and presumed they had a certain type of monopoly that their customers would have to pay to use. That is, e-mail was rare at the time outside of the research/acadmic world, so MCIMail reflected the pricing of a special purpose business service not a universal model. This would be like studying car phone services prior to 1980 (I believe the first car phones were introduced in the 1930's) to draw conclusions about current-day mobile phone service. It was all just too exotic and rare at the time to draw any meaningful conclusions vis a vis the relative ubiquity and technology advancements of today. 2. Hashcash is just psychotic for so many reasons let's drop that one right here and never mention it again. We should call it the sphinxification of e-mail (but first, answer me a riddle...) Better left in ancient mythologies than built into modern e-mail systems. 3. The whole micropayments issue is a straw man. Other systems can be described which don't require "micropayments". The problem is you're way too hung up on spam from the point of view the end-users, which, as dramatic and annoying as it is, is of course the least economically portentous way to look at all this just due to the sheer numbers and nano-value of individual transactions, hence the straw man The solution to a problem where some sort of micropayment system seems inappropriate is to aggregate the problem, not declare it intractable! You settle at the ISP level who in turn can do whatever they want with that cost factor: Pass it on to customers directly by adding $.27 for 203 msgs this month (whatever) to their bill, not a big deal really, or add $1 to the base cost and consider it a cost of doing business (perhaps up to some limit if they're wise.) Why don't we just argue, e.g., about whether the IETF should bless unlimited versus pay per minute versus some service included then pay for overage internet dial-up services? Howsabout the whole damned phone system? Isn't that essentially a "micropayments" system in many aspects? Don't people feel a little silly arguing that the entire phone system as currently constituted among several billion people world-wide represents a charging/payment model which is easily (in a few pages of this paper, apparently) ``proven'' to be completely untenable because someone, somewhere might defraud it etc? Now perhaps you're going to drop back to things you dislike about, e.g., long-distance phone charges or how there have been trends towards flat-rate systems etc. SPARE US! The claim was that charging per phone call, metaphorically, or per e-mail, literally, was on the surface impossible and unworkable etc. yet for the past, I dunno, 75 years, such a system has been in place and in use by the majority of the world's population and remains one of the most viable industries on the planet. But this paper seeks to disprove that the bumblebee cannot possibly fly!? How much more arrogant can one get? To completely ignore the entire world-wide phone system because it's inconvenient to the point being professed? This is intellectual slovenliness akin to the Augean Stables! HOWEVER, this group shouldn't care about any such exact details or whether they reflect on some sort of universally accepted indisputable moral goodness right down to possible paper cuts end-users might get paying their bills and subsequent deaths from gangrene. Only that a "game", in the game-theoretic sense, is created which can play itself out and seems inherently tractable and likely to gain some acceptance (no one loves paying for anything but that can hardly be offered as a proof positive that toll booths, taxes, phone systems, etc cannot possibly be made to work!) 4. Counterfeiting et al wouldn't be such a problem if there were some sort of economic value involved. It'd be a simple theft of service or similar. The problem right now is that e-mail has been created as a system with basically zero claim of transaction value and in fact it has about zero value right now. So, under the current system, who exactly is supposed to get excited and spend millions or billions of dollars to defend this non-value? No one. THERE'S NO MONEY IN IT, directly. And, frankly, little money in it marginally. So of course there's little interest or expense invested in things like counterfeiting. 5. Therefore, the true costs are unknown. Sure, and the true costs of spam are unknown, etc. I don't think that's a good disproof, it would apply equally to just about any proposal, it's nearly content-free. 6. Anyhow, since I consider micropayments a straw man there's no need to deal with the idea that users hate micropayments except to point out that the average person hates a lot of things like long-distance charges or bridge tolls or parking meters but that hardly argues that these are therefore impossible or even undesirable! In fact I think that's the entire lesson to be learned from the current spam situation. Devise a system that is utopian for everyman and look what happens! As I've said elsewhere, in years past I often wondered why the Boston (and other but I live in Boston) transit systems aren't just free. How much trouble must it be to collect the $1 etc, what good would come out of free transit, people would leave the their cars home or at the periphery of the city, etc., etc., etc. Well, after dealing with spam THE SCALES HAVE FALLEN FROM MINE EYES! That said, I will also add that regardless of whether there is some sort of e-postage I'd strongly recommend to ISPs, as an ISP myself, that they NOT manage that charging in a way that causes their customers to hate them. That would not be good for business. Sheesh! Seriously, it's been ten years, a lot of really smart people have come up with absolutely nothing, technically, that even works a tiny little bit. It's time to go for an e-postage system that simply reflects the resources being used. And don't ask me what about "white hat" bulk e-mailers, I DON'T CARE, the post office won't deliver their stuff for free, there's a reason for that, why would this new regime be able to do any different? -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 19:45:56 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21757 for ; Mon, 19 Apr 2004 19:45:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFiRF-0003Cd-6x for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:44:33 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3JNiXw2012305 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 19:44:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFiQ8-0002qj-3S for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 19:43:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21556 for ; Mon, 19 Apr 2004 19:43:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFiQ6-0001l9-9U for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:43:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFiP7-0001V9-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:42:22 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFiO9-0001GF-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 19:41:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFiG5-00007j-7Y; Mon, 19 Apr 2004 19:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFi1x-00059u-Sf for asrg@optimus.ietf.org; Mon, 19 Apr 2004 19:18:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20116 for ; Mon, 19 Apr 2004 19:18:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFi1w-0003Gm-AQ for asrg@ietf.org; Mon, 19 Apr 2004 19:18:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFi0x-0002zj-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:17:24 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BFi06-0002jq-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:16:30 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFi05-0001oH-00; Mon, 19 Apr 2004 19:16:29 -0400 Received: from [68.246.39.135] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFi02-0004dC-00; Mon, 19 Apr 2004 19:16:27 -0400 Message-ID: <40845DBB.5070402@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: gep2@terabites.com CC: asrg@ietf.org Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (various) References: In-Reply-To: X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 19:16:11 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit gep2@terabites.com wrote: >>No, not a fellow victim; a negligent abuse-enabler > > > Perhaps, but they're still victims too. The fact of the matter is that there > are a lot of technically VERY clueless folks out there, and unless you've come > up with some kind of magic pill they can take which suddenly makes them > technically savvy, there are going to CONTINUE to be clueless types out there. > > We need to simply make it very much harder for viruses and worms to infect those > people's machines. Closing the attachment transmission window (especially for > executable-type attachments) to just a sliver of what it is today will certainly > help a great deal. SPF and other such schemes is unlikely to help very much at > all, because those machines which DO get infected can send viruses, worms, and > spam using their authenticated SMTP. It's outrageous and irresponsible that > nearly everyone's mail clients freely accept and allow people to receive and > click on things like PIF files, which are virtually NEVER used for anything > good. .EXE files are likewise almost never legitimately needed in E-mail, and > those who DO need it usually know why, and from whom they need to be able to > receive such stuff. > > We will NEVER solve the spam problem if we don't get a major handle on the virus > and worm problem, and A-V software is NOT the ultimate solution because it > basically all works on the "blacklist" principle (i.e. "if we don't know about > it (yet) then it's probably okay." While A-V software is a valuable component, > and certainly helpful in disinfecting a machine once it's been infected, > hopefully we can come up with a solution that's better than just go around > forever swatting flies. Let's close the window!! > I am not sure if it can be closed. The latest viruses are being sent around in ZIP files encrypted with a password which people still manage to open and encryption bypasses virus scanning on gateway level. Unless we throw out the baby with the bathwater - forbid all attachments, virus writers will always find a way around whatever semi-blocking technique we come up with. Same for HTML - unless all HTML is forbidden, I do not see how any benefit can come from it. But forbidding HTML will close many existing use cases which many companies and people do every day. The biggest problem with this approach is that while it might work in theory, in practice I do not think we can convince any sizable majority of Internet users to accept it. This is the main problem with any proposal - aside from the idea itself, it must also be marketed and be convincing enough to be acceptable. However, if you want to take a shot at it and write up a BCP document as a short Internet draft, go ahead. There is definatly a good use of some attachment blocking such as .EXE files. >>>I don't want to see any solutions that result in some "authority" deciding > > what one can and cannot send. > > >>Right, only community consensus should be applied. It is doable. > > > I hope so. > We must account for a possibility of a community system being subverted. Any system that does not account for that will be no better than an authority. There was a couple research papers floating around that try to address the same problem in P2P networks - the problem is solvable if it is taken into account. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 20:11:34 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA23038 for ; Mon, 19 Apr 2004 20:11:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFioi-0000ps-2i for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 20:08:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K08mTA003206 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 20:08:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFikk-0007ox-Cj for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 20:04:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA22658 for ; Mon, 19 Apr 2004 20:04:40 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFiki-0006wy-Hk for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:04:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFijn-0006hw-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:03:44 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFijH-0006Rx-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:03:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFicL-0005ds-61; Mon, 19 Apr 2004 19:56:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFiEU-00089t-Uv for asrg@optimus.ietf.org; Mon, 19 Apr 2004 19:31:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21080 for ; Mon, 19 Apr 2004 19:31:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFiET-0006dZ-96 for asrg@ietf.org; Mon, 19 Apr 2004 19:31:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFiDT-0006OM-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:30:20 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BFiCR-00060j-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:29:15 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFiCN-0002d4-00; Mon, 19 Apr 2004 19:29:11 -0400 Received: from [68.246.39.135] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFiCM-00053c-00; Mon, 19 Apr 2004 19:29:11 -0400 Message-ID: <408460BB.40404@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: Barry Shein CC: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> In-Reply-To: <16516.15496.971964.662601@world.std.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 19:28:59 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > My reactions to e-postage paper: > > http://www.taugh.com > ... > Sheesh! > > Seriously, it's been ten years, a lot of really smart people have come > up with absolutely nothing, technically, that even works a tiny little > bit. > > It's time to go for an e-postage system that simply reflects the > resources being used. My single concern with e-postage is that in the real world bulk mailers do not break into post offices and dump their mail in, nor do they bribe people to go to the post office and put mail in for them. Because the Internet serves as a pervasive communications medium, it is very easy to steal or assume someone else's identity - much easier than any phone or real world postal system. Of course stolen phone and credit cards have always been an issue, but there are laws in place and sufficient disincentive exists to discourage it. That is not true in the digital world - stealing accounts is very easy because everyone is connected and many people don't know how to secure their computers. I am refering to the issue of hijacked computers. With an e-postage system nothing stops a spammer from stealing Aunt Mary's computer via a virus and sending out spam with her e-postage account. Who is going to pay in that case? The usual response to that example is that her e-postage account will run out. This is basically the same as rate limiting and can be done today without resorting to e-postage. But rate limiting is not always possible such as when an ISP rents out the underlying connectivity from a third party. There was also a suggestion in one of the subgroups to write up a BCP describing how to do rate limiting. In any case, while I am not a big fan of e-postage, there are people including some group members (David Nicol, etc.) who are working on e-postage systems. If there is a sufficient interest in the industry and the community at large, and workable systems exist that require interoperability, the IETF can step in and set standards for that. Otherwise, I do not see what the ASRG or the IETF can do for or against e-postage - it is simply not within the scope of standards at this point. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 20:17:43 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA23388 for ; Mon, 19 Apr 2004 20:17:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFipT-00014q-ID for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 20:09:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K09Zhw004136 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 20:09:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFinY-0000PB-Bx for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 20:07:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA22817 for ; Mon, 19 Apr 2004 20:07:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFinW-0007hE-DI for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:07:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFimb-0007SB-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:06:38 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFilv-0007D4-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:05:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFij9-0007Qp-Ti; Mon, 19 Apr 2004 20:03:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFibq-0005Xw-O0 for asrg@optimus.ietf.org; Mon, 19 Apr 2004 19:55:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22184 for ; Mon, 19 Apr 2004 19:55:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFibo-0004n6-Kl for asrg@ietf.org; Mon, 19 Apr 2004 19:55:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFias-0004ZO-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:54:31 -0400 Received: from smtp02.mrf.mail.rcn.net ([207.172.4.61]) by ietf-mx with esmtp (Exim 4.12) id 1BFia0-0004LQ-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:53:36 -0400 Received: from 209-6-102-148.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com ([209.6.102.148] helo=localhost) by smtp02.mrf.mail.rcn.net with smtp (Exim 3.35 #4) id 1BFia1-00012a-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:53:37 -0400 From: "Dr. Jeffrey Race" To: "ASRG" Reply-To: "Dr. Jeffrey Race" Priority: Normal X-Mailer: PMMail 1.96a For OS/2 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 19:53:37 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit See interleaved comments On Mon, 19 Apr 2004 12:40:23 -0400, Yakov Shafranovich wrote: >> For most users, the need is to stop the spam without blocking legitimate >> mail from the same host. This is what drives the concept of filtering >> over using a DNSBL. >Collateral damage is an issue. Collateral damage is the OBJECTIVE. It is the only thing that gains the attention of the abuse-enablers. This is proven beyond doubt. >Another issue is the fact that blocking >is not communicated to the sender in many cases but the messages are >swallowed silently. That is an RFC violation. >As for community-based systems, rule of the mob is not always good. No 'mob' is involved, but users who do not agree to have their systems polluted. Procedures are clear and public in the document I drafted. > >I am not saying this approach is bad, rather it has issues that must be >worked out. If all of these issues are taken into account, such system >may very well do a lot of good. > >For example, if there are standards for communications among ISPs and >networks for both blocking and abuse reporting, There is ia standard; it is in the RFC pertaining to mandatory role accounts. Jeffrey Race _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 20:41:30 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24509 for ; Mon, 19 Apr 2004 20:41:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFjI8-0007zW-Nc for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 20:39:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K0dCuH030713 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 20:39:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFjGf-0007Iu-VR for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 20:37:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24301 for ; Mon, 19 Apr 2004 20:37:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFjGd-0007P2-Ni for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:37:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFjFc-00078m-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:36:38 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFjFD-0006te-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 20:36:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFj5N-0004og-KP; Mon, 19 Apr 2004 20:26:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFiYv-0004uV-NN for asrg@optimus.ietf.org; Mon, 19 Apr 2004 19:52:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22081 for ; Mon, 19 Apr 2004 19:52:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFiYt-00045O-PT for asrg@ietf.org; Mon, 19 Apr 2004 19:52:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFiXz-0003qt-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:51:31 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BFiXJ-0003cs-00 for asrg@ietf.org; Mon, 19 Apr 2004 19:50:49 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFiXG-0004P2-00; Mon, 19 Apr 2004 19:50:46 -0400 Received: from [68.246.39.135] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFiXF-0005oH-00; Mon, 19 Apr 2004 19:50:46 -0400 Message-ID: <408465CB.3090500@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: Barry Shein CC: lane@opendoors.com, asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> In-Reply-To: <16516.12619.744345.929026@world.std.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 19:50:35 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > > Personally I think this group would probably have done their job if > they could unanimously or near-unanimously or at least with some > amount of force of conviction just tell the public we've studied the > matter and basically we're trying to do the impossible which is > regulate a free, valuable resource by some unworkable set of rules > either implemented via software or some unnamed vehicle of human fiat > (i.e., regulation, legislation, big men with sticks...) > Some time ago I wrote an unpublished draft on this specific topic (http://www.shaftek.org/asrg/draft-irtf-asrg-ietf-role-in-fighting-spam-00.txt). In particular, my opinion expressed at that time was: "Unlike the belief of many parties, both inside and outside the IETF, the role of the IETF in addressing the spam problem is limited. Being that the problem is fundamentally non-technical in nature, there aren't many technical solutions possible to solve it. Even technical solutions that address different aspects of the spam problem are not necessarily relevant to the IETF's core mission as a standards organization unless these solutions involve changes to existing standards or creation of new standards. While the IETF has historically provided a forum for discussion of many issues related to the Internet, and facilitated various technical efforts, its primary missions remains to be a standards organization and not the body responsible for solving every single problem on the Internet." Examples of standards work that can help with the spam problem somewhat are standards to let ISPs talk to each other easier and in more automated ways including abuse reporting standards and notifications of blocking; BCPs; etc. There are many other examples of things we can do but trying to solve the spam problem is not something that is possible in this group alone. However, we can still do standards work that can address parts of the problem. > As such, the only chance of beginning to tackle the spam problem > requires some sort of postage, simple charging, to simply make > resource usage reflect costs. For everyone. Analogous to paper postal > systems with, perhaps, some creative twists to reflect the low cost of > common usage, preferably thrown back to the ISPs et al. People do not hack phones or fax machines in the real world - it is simply not possible with the same ease as it is in the digital world. Another issue is convincing people to switch - the unlimited/free pricing scheme has been embedded into the psyche of Internet users to such extend, that it will very hard to convince people to switch. Even if you float the "no spam" flag, the first few pieces of spam arriving in their inbox, be it paid or hijacked, will break that idea very quickly. ISPs also have to be convinced to spend money on supporting and participating in the e-postage infrastructure. Given the low profit margins they are getting today and the uncertain benefit that will be gained via e-postage, they will not run towards the idea so fast. This is why people have suggested to add some benefit to the mix such as "registered" mail, etc. However, there are some people including group members that are working on the idea. If standards are required for e-postage interoperability at some point, the IETF can develop them. But to get to that point requires a workable e-postage system with many technical issues addressed, support from the ISP and IT communities, and users who are willing to pay for it and use it. I would suggest that those who are interested in the idea put their heads together to address the technical issues, and start poking the industry to see if there is interest. So far, I am not aware of a single group that is working on e-postage, possibly because of lack of support in the industry and the community. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 22:57:25 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00475 for ; Mon, 19 Apr 2004 22:57:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlMw-0005Ix-Eg for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:52:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K2qIHx020382 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:52:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlIP-0003hu-7M for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 22:47:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00061 for ; Mon, 19 Apr 2004 22:47:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFlIL-0000eE-NN for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:47:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFlHU-0000QD-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:46:41 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFlH5-0000Be-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:46:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlCz-0001tp-A2; Mon, 19 Apr 2004 22:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFjU0-0002Eq-Sf for asrg@optimus.ietf.org; Mon, 19 Apr 2004 20:51:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24898 for ; Mon, 19 Apr 2004 20:51:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFjTy-0002zl-Ib for asrg@ietf.org; Mon, 19 Apr 2004 20:51:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFjSz-0002lI-00 for asrg@ietf.org; Mon, 19 Apr 2004 20:50:25 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BFjRv-0002Oc-00 for asrg@ietf.org; Mon, 19 Apr 2004 20:49:19 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFjRv-00032c-00; Mon, 19 Apr 2004 20:49:19 -0400 Received: from [68.246.39.135] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFjRt-0007kx-00; Mon, 19 Apr 2004 20:49:19 -0400 Message-ID: <40847384.3080108@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: "Dr. Jeffrey Race" CC: ASRG Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) References: In-Reply-To: X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id UAA24899 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 20:49:08 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Dr. Jeffrey Race wrote: >=20 > On Mon, 19 Apr 2004 12:40:23 -0400, Yakov Shafranovich wrote: >=20 >>>For most users, the need is to stop the spam without blocking legitima= te >>>mail from the same host. This is what drives the concept of filtering >>>over using a DNSBL. >> >>Collateral damage is an issue. >=20 >=20 > Collateral damage is the OBJECTIVE. It is the only thing > that gains the attention of the abuse-enablers. This is proven > beyond doubt.=20 >=20 The road is littered with corpses of users who are unable to send mail=20 due to their upstream's upstream provider being blocked. There are=20 numerous cases where blocking a specific ISP or network has done more=20 bad than good. In any case, just like beauty collateral damage is in the eye of the=20 beholder. I just don't think that most ISPs will agree to do anything=20 that may cause their users to complain about being unable to email their=20 grandmother. While for some of us the collateral damage is acceptable,=20 in practice businesses will be hesitant to do anything that may cause it. This is the same reason why the top six ISPs do not use blacklists=20 en-masse but rather rely on their own internal blacklists supplemented=20 by third parties. >=20 >>Another issue is the fact that blocking=20 >>is not communicated to the sender in many cases but the messages are=20 >>swallowed silently. >=20 >=20 > That is an RFC violation. >=20 If the mail is filtered after SMTP level and bounce address is suspected=20 to be false, some may argue that it is not. There is some work on a BCP=20 on that (Keith Moore?). But in any case, the fact that a standard exist does not mean it is=20 used. Perhaps, we should look into how to better enforce existing RFCs. >=20 >>As for community-based systems, rule of the mob is not always good. >=20 >=20 > No 'mob' is involved, but users who do not agree to have their > systems polluted. Procedures are clear and public in the document I > drafted. >=20 Quis custodiet ipsos custodes=94 =96 =93Who will watch the watchers=94? Laws are useless unless they are enforced, same for standards. Who will=20 make sure that the procedures you drafted are actually used in a correct=20 fashion? What happens if people start blocking ISPs and networks without=20 a good enough reason like some blacklist operators have done? Additionally, what happens if a portion of the community colludes=20 against a specific network or operator? Why would this approach be any=20 better than the existing practice of blacklists? >=20 >>I am not saying this approach is bad, rather it has issues that must be= =20 >>worked out. If all of these issues are taken into account, such system=20 >>may very well do a lot of good. >> >>For example, if there are standards for communications among ISPs and=20 >>networks for both blocking and abuse reporting,=20 >=20 >=20 > There is ia standard; it is in the RFC pertaining to mandatory role > accounts. I assume you are referring to RFCs 2821 and 2142. They define the=20 postmaster@ and abuse@ addresses. However, it seems that in many cases=20 ISPs want to have additional mailboxes or simply do not honor the RFC,=20 which is why systems like abuse.net are used. However, knowing where to send something is half the puzzle - it still=20 costs. If some automated solutions can be introduced that would allow=20 ISP's abuse desk systems communicate among themselves, that would reduce=20 their costs and allow for better handling of abuse reports. As for blocking, there are not existing standards aside from RFC 2821=20 that cover it, and blocking is not being communicated until the SMTP=20 transaction takes place, or if the filtering is done post SMTP, it may=20 never communicated. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 22:57:25 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00479 for ; Mon, 19 Apr 2004 22:57:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlN9-0005Jj-Fp for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:52:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K2qVfC020434 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:52:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlKW-00047N-Je for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 22:49:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00129 for ; Mon, 19 Apr 2004 22:49:44 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFlKT-00018S-1R for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:49:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFlJQ-0000tc-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:48:41 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFlIu-0000f7-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:48:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlCz-0001tx-PJ; Mon, 19 Apr 2004 22:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFkPI-0007Aw-7C for asrg@optimus.ietf.org; Mon, 19 Apr 2004 21:50:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA27411 for ; Mon, 19 Apr 2004 21:50:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFkPF-0001q1-BK for asrg@ietf.org; Mon, 19 Apr 2004 21:50:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFkOI-0001af-00 for asrg@ietf.org; Mon, 19 Apr 2004 21:49:39 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BFkNZ-0001Lm-00 for asrg@ietf.org; Mon, 19 Apr 2004 21:48:53 -0400 Received: from world.std.com (tlw@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3K1mpLS020873; Mon, 19 Apr 2004 21:48:51 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id VAA05319; Mon, 19 Apr 2004 21:48:51 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16516.33155.107195.576411@world.std.com> To: Yakov Shafranovich Cc: Barry Shein , asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <408460BB.40404@solidmatrix.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <408460BB.40404@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 21:48:51 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 19, 2004 at 19:28 research@solidmatrix.com (Yakov Shafranovich) wrote: > My single concern with e-postage is that in the real world bulk mailers > do not break into post offices and dump their mail in, nor do they bribe > people to go to the post office and put mail in for them. Because the Weaknesses such as these do not necessarily suggest an alternative solution, other than perhaps doing nothing because nothing was perfect. > Internet serves as a pervasive communications medium, it is very easy to > steal or assume someone else's identity - much easier than any phone or > real world postal system. Of course stolen phone and credit cards have > always been an issue, but there are laws in place and sufficient > disincentive exists to discourage it. That is not true in the digital > world - stealing accounts is very easy because everyone is connected and > many people don't know how to secure their computers. I think one result would be that this sort of thing would become a commercial crime with actual, measurable value, like toll fraud, rather than the vagaries of time wasted or hassle/embarrassment/etc. A widely deployed e-postage system would begin to create an economics around spam fighting, something it sorely lacks now. > I am refering to the issue of hijacked computers. With an e-postage > system nothing stops a spammer from stealing Aunt Mary's computer via a > virus and sending out spam with her e-postage account. Who is going to > pay in that case? The usual response to that example is that her > e-postage account will run out. This is basically the same as rate > limiting and can be done today without resorting to e-postage. But rate > limiting is not always possible such as when an ISP rents out the > underlying connectivity from a third party. There was also a suggestion > in one of the subgroups to write up a BCP describing how to do rate > limiting. Similar answer. Right now if a spammer hijacks Aunt Mary's computer and uses it to spew spam well, that's too bad, but so what (as far as Ms Mary is concerned)? Other than some embarrassment etc. Obviously one would hope that ISPs et al, someone in the loop, would help and help forgive particularly in the beginning. But as time goes on perhaps, finally, Aunt Mary will cease to find not securing her computer just a source of funny stories to tell at work about how some jerk used it to send 1M spams over the weekend until she figured out what was the problem. Yes, you have to assert some sort of appropriate value and tangible loss, trying to be humane, in order for the public to take it seriously, which may well be software vendors and ISPs taking it seriously first (``sorry, we sense your system is not at a sufficient patch level to send email safely, please contact our customer support...'') Who makes things right if Aunt Mary leaves her keys in the ignition of her car and takes it out for a joy ride? Well, insurance cos etc a little, but the cost and hassle is sufficient that, unlike getting your computer hijacked, she's probably pretty careful with her keys wherever this is even a small possibility. Anyhow, my point is, it's push/pull. If we keep saying it has to be free and painless to be a victim then interest in avoiding being a victim will be limited accordingly. > In any case, while I am not a big fan of e-postage, there are people > including some group members (David Nicol, etc.) who are working on > e-postage systems. If there is a sufficient interest in the industry and > the community at large, and workable systems exist that require > interoperability, the IETF can step in and set standards for that. > Otherwise, I do not see what the ASRG or the IETF can do for or against > e-postage - it is simply not within the scope of standards at this point. > Eventually there has to be some agreement on what the most tenable solution is, or admission of failure to find anything worth anyone's time pursuing. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 22:57:55 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00571 for ; Mon, 19 Apr 2004 22:57:55 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlNB-0005Kc-5t for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:52:33 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K2qXiT020490 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:52:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlMK-0004yJ-B9 for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 22:51:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00233 for ; Mon, 19 Apr 2004 22:51:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFlMG-0001cs-Se for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:51:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFlLO-0001OV-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:50:43 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFlL3-00019f-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:50:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlD0-0001u5-6p; Mon, 19 Apr 2004 22:42:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFkYw-0000Us-Rl for asrg@optimus.ietf.org; Mon, 19 Apr 2004 22:00:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA27895 for ; Mon, 19 Apr 2004 22:00:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFkYt-0004Ju-Oq for asrg@ietf.org; Mon, 19 Apr 2004 22:00:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFkY2-00045S-00 for asrg@ietf.org; Mon, 19 Apr 2004 21:59:43 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BFkXY-0003qh-00 for asrg@ietf.org; Mon, 19 Apr 2004 21:59:12 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3K1wia9014919; Mon, 19 Apr 2004 21:58:44 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id VAA08622; Mon, 19 Apr 2004 21:58:44 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16516.33747.879072.731362@world.std.com> To: Yakov Shafranovich Cc: Barry Shein , asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <408460BB.40404@solidmatrix.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <408460BB.40404@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 21:58:43 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit My major concern vis a vis e-postage is that everywhere we turn, from so-called public opinion to rarified technical groups such as this to journalistic exercises etc we see nothing but the tragedy of the commons which is basically no one would "vote" for e-postage because they'd rather have it free, period. And everything else said on the subject, by most, is just working backwards from that pre-conceived result. Fiddling while Rome burns. If you think groups like this have a possibly unreasonable problem with e-postage talk to computer/network trade magazine people. They're making big bucks off all this free e-mail sending out alerts and ads and newsletters (all with paid content) to their subscriber base (which may include tens if not hundreds of thousands of former subscribers.) Just wait until some of these proposals try to see the light of day in a press gluttonizing on the status quo... I've personally had trade mag editors call me for advice about what to do about upwards of 25-35%, and rising, of their e-mailings being blocked by ISPs et al. I said, howsabout paying someone who has to carry your traffic to which they snort, mutter how it's all opt-in (the words "opt-in" now mean "you get whatever you want for free") and abruptly end the call. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 23:06:34 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01065 for ; Mon, 19 Apr 2004 23:06:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlSp-0007KG-Pw for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:58:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K2wN31028156 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 22:58:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlOO-0005Sv-60 for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 22:53:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00298 for ; Mon, 19 Apr 2004 22:53:44 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFlOK-0002AQ-MN for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:53:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFlNJ-0001t4-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:52:42 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFlML-0001dR-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 22:51:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlD0-0001uD-Kl; Mon, 19 Apr 2004 22:42:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFknS-00044z-89 for asrg@optimus.ietf.org; Mon, 19 Apr 2004 22:15:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA28661 for ; Mon, 19 Apr 2004 22:15:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFknP-0000ML-5X for asrg@ietf.org; Mon, 19 Apr 2004 22:15:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFkmT-000085-00 for asrg@ietf.org; Mon, 19 Apr 2004 22:14:37 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BFkm7-0007h8-00 for asrg@ietf.org; Mon, 19 Apr 2004 22:14:15 -0400 Received: from world.std.com (tlw@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3K2EFLS020268; Mon, 19 Apr 2004 22:14:15 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id WAA10146; Mon, 19 Apr 2004 22:14:14 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16516.34678.371575.137422@world.std.com> To: Yakov Shafranovich Cc: Barry Shein , lane@opendoors.com, asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <408465CB.3090500@solidmatrix.com> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 22:14:14 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 19, 2004 at 19:50 research@solidmatrix.com (Yakov Shafranovich) wrote: > > As such, the only chance of beginning to tackle the spam problem > > requires some sort of postage, simple charging, to simply make > > resource usage reflect costs. For everyone. Analogous to paper postal > > systems with, perhaps, some creative twists to reflect the low cost of > > common usage, preferably thrown back to the ISPs et al. > > People do not hack phones or fax machines in the real world - it is > simply not possible with the same ease as it is in the digital world. Perhaps you are too young to remember blueboxing? Small boxes built from a few parts available at any Radio Shack or similar which could be used to completely by-pass long-distance tolls, in their more sophisticated versions could even be used to put long distance charges onto others, typically companies' 800 lines, if you knew the right incantations. These boxes went around college dorms, for starters, like wildfire, and this was in a day when having a boyfriend or girlfriend back home could easily cost you hundreds of dollars per month in toll charges, it was much more expensive than today so the appeal was enormous. They were a big disaster for the phone system, millions if not billions of dollars were lost, people were arrested and the system eventually redesigned and a much changed system deployed on a rather rapid schedule. But one difference was that there was real, measurable money involved. Another is that the phone system is somewhat more mature than the internet. > Another issue is convincing people to switch - the unlimited/free > pricing scheme has been embedded into the psyche of Internet users to > such extend, that it will very hard to convince people to switch. Even > if you float the "no spam" flag, the first few pieces of spam arriving > in their inbox, be it paid or hijacked, will break that idea very quickly. What convinced people to pay for long-distance calling or for toll booths on highways? I think your sense of consent is touching but not acknowledging how such resource charging comes into being. Given the opportunity the public would probably "vote" for free broadband cable etc. Why not?! And no doubt, as you imply, make the big pouty face at any suggestion otherwise. But that's the point, the reality of economics has to penetrate somehow. My suspicion is that the way things are going either something is done, or the RBOCs (and equivalent, PTTs etc) will own e-mail, everyone else having gone broke on spam etc, and we'll be paying 15c/message just like SMS. I bet your phone co won't give a lot of creedance to the big pouty face about being charged for email. Maybe I'm the only one, but I just don't think people realize how close we are to the whole thing collapsing like that. And the RBOCs etc not only can taste that victory, they consider it their natural destiny. Anyhow, it's something to consider as one fritters away time because every suggestion is just not quite perfect. I think the expression is: Rearranging deck chairs on the Titanic. > ISPs also have to be convinced to spend money on supporting and > participating in the e-postage infrastructure. Given the low profit > margins they are getting today and the uncertain benefit that will be > gained via e-postage, they will not run towards the idea so fast. This > is why people have suggested to add some benefit to the mix such as > "registered" mail, etc. Well, as an ISP it's interesting to hear you speak on my behalf. I think the possibility of conforming resource demands (and consequent costs) to resource usage would have a certain appeal. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 23:20:50 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01790 for ; Mon, 19 Apr 2004 23:20:50 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlhK-0002uR-M4 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 23:13:22 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K3DMBu011177 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 23:13:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFleC-0002Jf-Iy for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 23:10:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01243 for ; Mon, 19 Apr 2004 23:10:04 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFle8-0006DB-Bn for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 23:10:04 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFlcj-0005vu-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 23:08:39 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFlbM-0005TP-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 23:07:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlTS-0007Sl-4t; Mon, 19 Apr 2004 22:59:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlRD-0006Gk-Dx for asrg@optimus.ietf.org; Mon, 19 Apr 2004 22:56:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00461 for ; Mon, 19 Apr 2004 22:56:39 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFlR9-0002vy-NF for asrg@ietf.org; Mon, 19 Apr 2004 22:56:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFlQE-0002gq-00 for asrg@ietf.org; Mon, 19 Apr 2004 22:55:43 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BFlPG-0002D2-00 for asrg@ietf.org; Mon, 19 Apr 2004 22:54:42 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc11) with SMTP id <2004042002541201300fh3ole>; Tue, 20 Apr 2004 02:54:12 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Mon, 19 Apr 2004 21:52:26 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Mon, 19 Apr 2004 22:01:35 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (various) To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 22:01:35 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.1 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> We need to simply make it very much harder for viruses and worms to infect those > people's machines. Closing the attachment transmission window (especially for > executable-type attachments) to just a sliver of what it is today will certainly > help a great deal. SPF and other such schemes is unlikely to help very much at > all, because those machines which DO get infected can send viruses, worms, and > spam using their authenticated SMTP. It's outrageous and irresponsible that > nearly everyone's mail clients freely accept and allow people to receive and > click on things like PIF files, which are virtually NEVER used for anything > good. .EXE files are likewise almost never legitimately needed in E-mail, and > those who DO need it usually know why, and from whom they need to be able to > receive such stuff. > > We will NEVER solve the spam problem if we don't get a major handle on the virus > and worm problem, and A-V software is NOT the ultimate solution because it > basically all works on the "blacklist" principle (i.e. "if we don't know about > it (yet) then it's probably okay." While A-V software is a valuable component, > and certainly helpful in disinfecting a machine once it's been infected, > hopefully we can come up with a solution that's better than just go around > forever swatting flies. Let's close the window!! > > I am not sure if it can be closed. I'm not sure we can close it 100%, but I don't know that we HAVE to. > The latest viruses are being sent around in ZIP files encrypted with a password Right, and that password sent (!) as an IMAGE file attachment. Just to make sure that an A-V program can't readily decrypt the password and verify the ZIP file's contents. Again, the solution isn't to blacklist the stuff that we KNOW is bad. The better solution at this point is to WHITELIST the stuff that at least has a good CHANCE of being good (or, at least, not dangerous!) > ...which people still manage to open and encryption bypasses virus scanning on gateway level. Right. A-V programs will NOT solve this problem. > Unless we throw out the baby with the bathwater - forbid all attachments, virus writers will always find a way around whatever semi-blocking technique we come up with. The solution does NOT require that we outlaw all attachments. What it DOES point to is that recipients should open the "permission window" to those trusted senders for the types of attachments that they are trusted to send. By default, an unknown sender would be not allowed to send ANY kind of attachments at all. They would have to send plain ASCII text, no attachments, no HTML, if they hoped to have their mail delivered. If they felt the need to send HTML or attachments, AND if the recipient concurred and trusted them, the recipient could enable the sender's permissions so that they could send the "trusted" classes of stuff to that recipient. > Same for HTML - unless all HTML is forbidden, I do not see how any benefit can come from it. OK, let's explain. The use of HTML in E-mail messages would be subject to similar permissions. By default, an unknown/untrusted sender would not be allowed to use ANY HTML in their messages. Whitelisted senders could send various types of HTML based upon what the recipient trusted them to send. It could be as simple as a relatively unsophisticated sender just sending simple formatting stuff (bold, italic, underline, maybe fonts, etc) or it could be stuff such as embedded or overlaid (background) images, scripting, ActiveX, or other truly more advanced (and more potentially malicious) stuff. Some corporate types really want to include very elaborate stuff in E-mail messages... interactive spreadsheets, SQL queries, OLAP cubes, etc., but certainly dear old Aunt Margaret doesn't expect her older sister Martha to send her sophisticated stuff like that from her room at the nursing home! There's _no_ point in enabling those kinds of things for everyone (including bogus folks) by default. > But forbidding HTML will close many existing use cases which many companies and people do every day. That's why you want to enable those capabilities, SELECTIVELY, for those who you want to allow to use them. The important thing is that you do NOT need to enable these more dangerous things GLOBALLY, and there is NO need whatsoever to accept them from people you don't know (yet). It's really a question of setting up your 'selectivity window' (just as in a very selective radio tuner) so that you get the signals you want, and block everything else. > The biggest problem with this approach is that while it might work in theory, in practice I do not think we can convince any sizable majority of Internet users to accept it. If it makes a huge difference in (their!) spam and virus/worm volume, I think they will be DELIGHTED to cooperate. But another KEY point... they DON'T HAVE TO all become convinced. This kind of scheme can be implemented for those who wish to use it, and they will derive FULL benefit from it, even if nobody else adopts it. This is a MAJOR distinction compared to stuff like SPF, which only really works if (someday, maybe) most people are willing to subject themselves to it. Another key aspect of my proposal is that it's pretty easy to understand. An ISP (or for that matter, corporate IT department) who adopted it on behalf of their customers wouldn't have an impossible job trying to get people to understand it. It can be implemented in a way that would make it quite easy to understand what it does, and how to control it to achieve the level of restrictions that each user deemed appropriate. > This is the main problem with any proposal - aside from the idea itself, it must also be marketed and be convincing enough to be acceptable. My idea could be implemented even just within a given E-mail client software (or as a local E-mail proxy-type antispam system) so you don't HAVE to convince the whole world to adopt it. It works FROM DAY ONE for those who install it. > However, if you want to take a shot at it and write up a BCP document as a short Internet draft, go ahead. There is definatly a good use of some attachment blocking such as .EXE files. It's important to understand that my scheme DOES NOT REQUIRE any kind of "official standard" (and in fact, there are advantages to there NOT being a single implementation of the concept net-wide). The way it's implemented can actually be a nice "product differentiation" feature of application software vendors offering E-mail clients or antispam filtering products. This is actually another good advantage of my approach. >>>>I don't want to see any solutions that result in some "authority" deciding what one can and cannot send. >>>Right, only community consensus should be applied. It is doable. >> I hope so. > We must account for a possibility of a community system being subverted. Spammers and hackers will CERTAINLY try to do that. If nothing else, they will attempt to get the gullible recipient to willingly deactivate their protection. I've seen spams containing detailed instructions on how to deactivate "no-scripting" restrictions in Outlook...! Rather like the "Aggie Virus" that tells you to manually delete all the files on your C: drive and then forward the E-mail to all your friends...! The dialog box to acknowledge such a configuration change needs to include suitably dire-sounding warnings to dissuade the unwary from being terminally gullible. > Any system that does not account for that will be no better than an authority. There was a couple research papers floating around that try to address the same problem in P2P networks - the problem is solvable if it is taken into account. The more I look at and consider my concept, the more convinced I am that it is THE principal key to solving this problem, and doing so in a way that is long-term viable. And the more I look at things like SPF, the more convinced I am that they are simply WRONG-headed... they just do NOT solve the real problem, and meanwhile cause new problems that might be even more intractable. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 19 23:45:33 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA03508 for ; Mon, 19 Apr 2004 23:45:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFm6X-00009A-1K for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 23:39:25 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K3dOuh000560 for asrg-archive@odin.ietf.org; Mon, 19 Apr 2004 23:39:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFm1t-0007PP-6f for asrg-web-archive@optimus.ietf.org; Mon, 19 Apr 2004 23:34:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA02805 for ; Mon, 19 Apr 2004 23:34:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFm1r-0004iN-2l for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 23:34:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFm0w-0004SJ-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 23:33:39 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFm05-0004Cp-00 for asrg-web-archive@ietf.org; Mon, 19 Apr 2004 23:32:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFlta-0005Rw-0v; Mon, 19 Apr 2004 23:26:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFljb-0003BW-W1 for asrg@optimus.ietf.org; Mon, 19 Apr 2004 23:15:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA01525 for ; Mon, 19 Apr 2004 23:15:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFljZ-0007Yn-Ry for asrg@ietf.org; Mon, 19 Apr 2004 23:15:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFlig-0007G5-00 for asrg@ietf.org; Mon, 19 Apr 2004 23:14:46 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BFlge-0006nC-00 for asrg@ietf.org; Mon, 19 Apr 2004 23:12:40 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFlgd-0004d3-00; Mon, 19 Apr 2004 23:12:39 -0400 Received: from [68.246.116.124] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFlgc-0005Ew-00; Mon, 19 Apr 2004 23:12:39 -0400 Message-ID: <40849519.8020601@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: gep2@terabites.com CC: asrg@ietf.org Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (various) References: In-Reply-To: X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 23:12:25 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit gep2@terabites.com wrote: >>However, if you want to take a shot at it and write up a BCP document as > a short Internet draft, go ahead. There is definatly a good use of some > attachment blocking such as .EXE files. > > It's important to understand that my scheme DOES NOT REQUIRE any kind of > "official standard" (and in fact, there are advantages to there NOT being a > single implementation of the concept net-wide). The way it's implemented can > actually be a nice "product differentiation" feature of application software > vendors offering E-mail clients or antispam filtering products. This is > actually another good advantage of my approach. I wasn't calling for an "official standard" only a document :) If you are convinced that your idea is good, than write it up and promote it! Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 00:33:36 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06081 for ; Tue, 20 Apr 2004 00:33:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmsb-0002ti-0V for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 00:29:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K4T44t011126 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 00:29:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmjY-0000p9-Bt for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 00:19:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA05445 for ; Tue, 20 Apr 2004 00:19:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFmjV-0000wm-Tx for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 00:19:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFmij-0000hO-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 00:18:54 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFmhx-0000Rd-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 00:18:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmd3-0007Mo-Dc; Tue, 20 Apr 2004 00:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFluJ-0005T8-0n for asrg@optimus.ietf.org; Mon, 19 Apr 2004 23:26:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA02402 for ; Mon, 19 Apr 2004 23:26:44 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFluH-0002gV-1V for asrg@ietf.org; Mon, 19 Apr 2004 23:26:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFltR-0002RK-00 for asrg@ietf.org; Mon, 19 Apr 2004 23:25:54 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BFlsl-0002Bd-00 for asrg@ietf.org; Mon, 19 Apr 2004 23:25:11 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFlsi-0006iK-00; Mon, 19 Apr 2004 23:25:08 -0400 Received: from [68.246.116.124] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFlsg-0005dV-00; Mon, 19 Apr 2004 23:25:07 -0400 Message-ID: <40849808.3090005@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: Barry Shein CC: asrg@ietf.org References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> In-Reply-To: <16516.34678.371575.137422@world.std.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 19 Apr 2004 23:24:56 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit [was Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP?] Barry Shein wrote: > On April 19, 2004 at 19:50 research@solidmatrix.com (Yakov Shafranovich) wrote: > > > As such, the only chance of beginning to tackle the spam problem > > > requires some sort of postage, simple charging, to simply make > > > resource usage reflect costs. For everyone. Analogous to paper postal > > > systems with, perhaps, some creative twists to reflect the low cost of > > > common usage, preferably thrown back to the ISPs et al. > > > > People do not hack phones or fax machines in the real world - it is > > simply not possible with the same ease as it is in the digital world. > > Perhaps you are too young to remember blueboxing? > ... Touche, I forgot about the multi-flavored boxes, the Anarchy Cookbox and my BBS days come to mind :) > > Another issue is convincing people to switch - the unlimited/free > > pricing scheme has been embedded into the psyche of Internet users to > > such extend, that it will very hard to convince people to switch. Even > > if you float the "no spam" flag, the first few pieces of spam arriving > > in their inbox, be it paid or hijacked, will break that idea very quickly. > > What convinced people to pay for long-distance calling or for toll > booths on highways? > > I think your sense of consent is touching but not acknowledging how > such resource charging comes into being. > > Given the opportunity the public would probably "vote" for free > broadband cable etc. Why not?! And no doubt, as you imply, make the > big pouty face at any suggestion otherwise. > > But that's the point, the reality of economics has to penetrate > somehow. > > My suspicion is that the way things are going either something is > done, or the RBOCs (and equivalent, PTTs etc) will own e-mail, > everyone else having gone broke on spam etc, and we'll be paying > 15c/message just like SMS. > > I bet your phone co won't give a lot of creedance to the big pouty > face about being charged for email. > > Maybe I'm the only one, but I just don't think people realize how > close we are to the whole thing collapsing like that. And the RBOCs > etc not only can taste that victory, they consider it their natural > destiny. > > Anyhow, it's something to consider as one fritters away time because > every suggestion is just not quite perfect. > > I think the expression is: Rearranging deck chairs on the Titanic. > With the current state of affairs I simply do not see how any kind of e-postage system would take off at all within a reasonable span of time even once all of the technical issues have been addressed. The same goes for any proposal calling for a major infrastructure overhaul - there simply isn't enough monetary or non-monetary incentive for network operators, software providers and governments to make a major change of that scale. It may very well be that the system may collapse due to that (which I personally do not think will happen). However, lets step aside for a second. You are advocating e-postage, and there are some group members as well as others in the industry that are doing the same. Practically speaking, would do you suggest? There have been technical problems raised by several members which have to be addressed in detail. Some of them may not be addressable until there is working code. There is at least one group member (David Nicol) who is working on a e-postage system (pay2send.com). There is also BondedSender which is close to real e-postage. Would it be viable for all of the parties interested in e-postage to get together and start working together including addressing the issues raised and testing code, instead of just discussing the idea? > > ISPs also have to be convinced to spend money on supporting and > > participating in the e-postage infrastructure. Given the low profit > > margins they are getting today and the uncertain benefit that will be > > gained via e-postage, they will not run towards the idea so fast. This > > is why people have suggested to add some benefit to the mix such as > > "registered" mail, etc. > > Well, as an ISP it's interesting to hear you speak on my behalf. > > I think the possibility of conforming resource demands (and consequent > costs) to resource usage would have a certain appeal. > Obviously I am not refering to you :) I was refering to other ISPs - I have not seen interest in e-postage from a sizable proportion of the ISP community. Of course Microsoft is interested in it as per Bill Gates's speech but they are also a software provider, so their interest may have a different motivation. Yakov _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 00:33:39 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06100 for ; Tue, 20 Apr 2004 00:33:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmt6-0002wB-GO for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 00:29:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K4Ta0Q011287 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 00:29:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmoQ-0001j5-Ul for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 00:24:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA05697 for ; Tue, 20 Apr 2004 00:24:43 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFmoO-0002Bf-BU for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 00:24:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFmnQ-0001xG-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 00:23:45 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFmmz-0001ij-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 00:23:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmgy-00008l-RS; Tue, 20 Apr 2004 00:17:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmat-0006yF-OD for asrg@optimus.ietf.org; Tue, 20 Apr 2004 00:10:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA04951 for ; Tue, 20 Apr 2004 00:10:44 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFmar-0006QU-At for asrg@ietf.org; Tue, 20 Apr 2004 00:10:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFmZp-0006BT-00 for asrg@ietf.org; Tue, 20 Apr 2004 00:09:42 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BFmYv-0005id-00 for asrg@ietf.org; Tue, 20 Apr 2004 00:08:45 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id 323E2A3D8F; Tue, 20 Apr 2004 13:38:13 +0930 (CST) Received: from rebel (unknown [210.48.137.144]) by mail.chariot.net.au (Postfix) with SMTP id 4A789609CF; Tue, 20 Apr 2004 13:38:11 +0930 (CST) From: "Chris" To: "Dr. Jeffrey Race" , Subject: RE: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 13:37:30 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > >Once you identify the "real" machine where the transmission > occurred, more > >likely than not it will turn out to be a zombie-infected > spambot. So you get to > >throw bricks at a fellow victim. > > No, not a fellow victim; a negligent abuse-enabler > No Not "a negligent abuse-enabler" Simply a user of Microsoft windows But don't be fooled if M$ fixes their game, nix derivatives will fall foul of such problems. spammers and hackers always take the path of least resistance which is currently windows. Regards Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Dr. > Jeffrey Race > Sent: Monday, 19 April 2004 4:25 AM > To: asrg@ietf.org > Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments > for SMTP? (Lane Sharman et al) > > > Violently snipped; see interleaved comments > > On Sun, 18 Apr 2004 10:49:02 -0500, gep2@terabites.com wrote: > >I'm going to combine my comments regarding several related posts > on this thread. > >snip > >Once you identify the "real" machine where the transmission > occurred, more > >likely than not it will turn out to be a zombie-infected > spambot. So you get to > >throw bricks at a fellow victim. > > No, not a fellow victim; a negligent abuse-enabler > > > > > >snip > >Perhaps it is, although it's hard to define "a bulk email event". > > This discussion on-point > > > > >Rather than making mail filters poll a central site (these have > in the past been > >victimized by DDOS attacks), maybe one approach here might be to > set up a > >Yahoogroup that could be used to rapidly distribute these > "disreputable domain > >names" and IP addresses along with a utility which would add them to the > >recipients' HOSTS files (and from there, to their incoming mail filters). > > > >> Just today, I was at a friends office and my outgoing email > was blocked > >because cliff.concentric.net is now on a spam list. > > > >Yes, and that's one of the problems with SPF, "authenticated users", > >certificates and other such schemes. Ultimately it's not very > helpful to throw > >rocks at fellow victims. > > > >[snip] > > > >>> I mail-server I use regularly (Indiana University) has taken, in > >>>response to worms and other malware useing .pif. zip, exe, etc > >>>attachments to spread their damage, has taken the (IMO) rather drastic > >>>step of blocking almost *all* attachments ... > > > >That's sort of the approach of Microsoft's new version of > Outlook, where they > >allow blocking by attachment extension. That's better than > nothing, but it > >needs to be SOMEWHAT finer: it needs to allow the recipient to > enable specific > >attachment types (and certain classes of HTML markup) to be > received from > >specific approved-and-trusted senders. > > > >>> Coincidentally, another list I'm on had a post from the admin of a > >>local university, talking about spam. Here's what he said. > >> > >>(quote) > >> I don't support any Windows systems, yet I seem to spend a > huge amount > >>of time dealing with problems relating to Windows non-security. > During the > >>fall/winter term we had to deal with > >> > >> 1) When students returned to Residence in September, at least half of > >> their machines were infected. > > > >One of my colleagues recently dealt with a client whose system > was "having > >assorted problems". Upon installing Spybot-Search-and-Destroy > over TWO HUNDRED > >instances of spyware were found on the unwitting user's > computer. There were > >additional Spyware programs that SPYBOT S&D did NOT find, besides. > > You have to use Bazooka and Adaware besides.>One of the things > that has been > SINGULARLY unhelpful toward addressing the > >problem of overloaded mail servers is this plague of > HTML-burdened "alternative" > >copies of E-mail messages. It is rare indeed that these provide > genuinely > >valuable additional content; instead they usually are loaded > with gratuitous > >graphic gizmos, Web bugs, possibly malicious scripting, > misrepresented clickable > >links, and text-as-image designed to evade content filters. > While I'll accept > >that some folks can argue that their needs for HTML-burdened E-mail is > >legitimate, certainly a lot of it is not. Mail with > HTML-burdened attachments > >is typically 3x-5x larger than it would be as plain ASCII text. > > > >If HTML-burdened attachments were removed from non-whitelisted > senders' E-mail > >(and this would catch at least most of today's spam) then such > mail would be > >70-85% smaller in volume than it is today. > > This is all documented. It needs to be a new standard. Feel free to > point offenders to > (or send it to them) > > > > > >I don't want to see any solutions that result in some > "authority" deciding what > >one can and cannot send. > > Right, only community consensus should be applied. It is doable. > > The whole discussion needs to be recast from "make the victims pay by > coming up with solutions (filtering etc)" to "make the offenders pay". > The only way to do that is to refuse mail from spam-enablers. It fixes > the problem immediately. Again: > > Spam would stop worldwide within DAYS if most of us, instead of whining > and coming up with impractical technical or legal 'solutions', would > agree to do on the Internet what society does in every other field > of human activity: ensure that actions have consequences. It is THAT > SIMPLE. (Any parent knows.) > > Jeffrey Race > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 03:53:58 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29597 for ; Tue, 20 Apr 2004 03:53:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFpwR-00062S-Km for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 03:45:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3K7jFwQ023208 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 03:45:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFpsL-00059a-PX for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 03:41:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29079 for ; Tue, 20 Apr 2004 03:41:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFpsJ-00069s-8l for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 03:40:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFprT-0005tl-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 03:40:07 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFpqq-0005cN-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 03:39:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFpcv-0000sI-Bf; Tue, 20 Apr 2004 03:25:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFpXl-0008Ei-UT for asrg@optimus.ietf.org; Tue, 20 Apr 2004 03:19:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA28252 for ; Tue, 20 Apr 2004 03:19:44 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFpXj-0000nT-Ml for asrg@ietf.org; Tue, 20 Apr 2004 03:19:43 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFpWj-0000XA-00 for asrg@ietf.org; Tue, 20 Apr 2004 03:18:41 -0400 Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx with esmtp (Exim 4.12) id 1BFpVo-000020-00 for asrg@ietf.org; Tue, 20 Apr 2004 03:17:44 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc13) with SMTP id <2004042007171401500r875ve>; Tue, 20 Apr 2004 07:17:15 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Tue, 20 Apr 2004 02:16:48 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Tue, 20 Apr 2004 02:25:58 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (various) To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 02:25:58 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.0 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>>However, if you want to take a shot at it and write up a BCP document as > a short Internet draft, go ahead. There is definatly a good use of some > attachment blocking such as .EXE files. >> It's important to understand that my scheme DOES NOT REQUIRE any kind of > "official standard" (and in fact, there are advantages to there NOT being a > single implementation of the concept net-wide). The way it's implemented can > actually be a nice "product differentiation" feature of application software > vendors offering E-mail clients or antispam filtering products. This is > actually another good advantage of my approach. > I wasn't calling for an "official standard" only a document :) What kind of formalities do I need to adhere to to produce such "a document"? > If you are convinced that your idea is good, I am!!! > than write it up and promote it! I've been discussing it at various places, besides just here, including a sequence of commentary on Ziff-Davis' PC Magazine discussion forum in a thread called "Stopping Spam". There are about 46 messages in that thread so far, fairly worth reading I think. It includes a lot of discussion about SPF-type and other SMTP-authentication approaches. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 07:33:35 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10257 for ; Tue, 20 Apr 2004 07:33:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtTW-00050B-Qx for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 07:31:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KBVcAY019227 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 07:31:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtNy-00044d-Kl for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 07:25:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10005 for ; Tue, 20 Apr 2004 07:25:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFtNy-0003s9-2w for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:25:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFtMy-0003c2-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:24:53 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFtLv-0003B6-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:23:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtIY-0002nw-A3; Tue, 20 Apr 2004 07:20:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtD2-0001Q3-5M for asrg@optimus.ietf.org; Tue, 20 Apr 2004 07:14:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA09247 for ; Tue, 20 Apr 2004 07:14:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFtD1-0000Sc-JU for asrg@ietf.org; Tue, 20 Apr 2004 07:14:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFtB7-0007n6-00 for asrg@ietf.org; Tue, 20 Apr 2004 07:12:38 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=wT6dtcGtWev22RYSn6vAu7TMCZJRk9e69ImwP1DnBjX) by ietf-mx with esmtp (Exim 4.12) id 1BFt95-00076L-00 for asrg@ietf.org; Tue, 20 Apr 2004 07:10:31 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id HAA10505; Tue, 20 Apr 2004 07:10:31 -0400 (EDT) From: der Mouse Message-Id: <200404201110.HAA10505@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <408460BB.40404@solidmatrix.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <408460BB.40404@solidmatrix.com> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 07:05:53 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > I am refering to the issue of hijacked computers. With an e-postage > system nothing stops a spammer from stealing Aunt Mary's computer via > a virus and sending out spam with her e-postage account. Who is > going to pay in that case? Aunt Mary. There _has_ to be a nontrivial cost to running a grossly insecure system, or it will continue to be near-universally done. Same as if Aunt Mary doesn't lock her car and someone swipes it for a joyride; Aunt Mary pays (in various ways, not all monetary, and not necessarily equal any damage done, but she pays). /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 07:45:01 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10831 for ; Tue, 20 Apr 2004 07:45:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtce-0008K1-Hu for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 07:41:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KBf4rI031983 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 07:41:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtba-0007rp-Rx for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 07:39:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10662 for ; Tue, 20 Apr 2004 07:39:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFtba-0007gV-92 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:39:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFtab-0007Ql-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:38:58 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFtZm-0007Bv-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:38:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtUr-0005Wg-Jb; Tue, 20 Apr 2004 07:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtPw-0004Qq-Ko for asrg@optimus.ietf.org; Tue, 20 Apr 2004 07:27:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10107 for ; Tue, 20 Apr 2004 07:27:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFtPw-0004QP-0l for asrg@ietf.org; Tue, 20 Apr 2004 07:27:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFtP9-0004B5-00 for asrg@ietf.org; Tue, 20 Apr 2004 07:27:08 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=4dbCcGAoZ3T4vrMNEu2OoQO6uaMtvTRmum8ndAYwgil) by ietf-mx with esmtp (Exim 4.12) id 1BFtOJ-0003ux-00 for asrg@ietf.org; Tue, 20 Apr 2004 07:26:15 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id HAA10563; Tue, 20 Apr 2004 07:26:14 -0400 (EDT) From: der Mouse Message-Id: <200404201126.HAA10563@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <16516.34678.371575.137422@world.std.com> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 07:11:23 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit [bzs, mostly just being bzs, but a few points seem worth replying to] > What convinced people to pay for long-distance calling or for toll > booths on highways? Because the company owning the long-distance network refused to let it be used without payment. Because the governments building the highways decided to impose the toll booths. More generally, because the owner of the infrastructure demanded the payment before letting it be used that way. The same mechanism is paying for email right now. (Whether the fee structure in use - which, for most people, makes email _incrementally_ free - is appropriate is a separate issue.) > My suspicion is that the way things are going either something is > done, or the RBOCs (and equivalent, PTTs etc) will own e-mail, > everyone else having gone broke on spam etc, and we'll be paying > 15c/message just like SMS. You're forgetting the major difference that makes your analogy invalid: with email the underlying infrastructure (the Internet) is used for _many_ other things, whereas the highways, the long-distance networks, did not have many other concurrent uses in place. It is not the Internet that is in danger of imminent collapse, only email. (I'm actually not sure even email is, but I'm letting you have that, arguendo.) The telcos won't "own" email unless they lock down the Internet links and require that only traffic they can identify is carried, and demand payment for email. > Maybe I'm the only one, but I just don't think people realize how > close we are to the whole thing collapsing like that. I don't think "the whole thing" is in any danger of imminent collapse. At least not unless your "whole thing" is the "anyone to anyone, anything, anytime" email system - and in that case, it's already dead. > Anyhow, it's something to consider as one fritters away time because > every suggestion is just not quite perfect. > I think the expression is: Rearranging deck chairs on the Titanic. Indeed. So what are _you_ doing about it? Or are you joining us in rearranging the deck chairs while criticizing us for it? > I think the possibility of conforming resource demands (and > consequent costs) to resource usage would have a certain appeal. It does. Unfortunately, in forms like e-postage (even going so far as to grant its possibility) it has the even bigger (at least for me) negative appeal of breaking most of the things that make email so valuable to me. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 07:57:21 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11309 for ; Tue, 20 Apr 2004 07:57:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtl3-0001o1-9M for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 07:49:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KBnjc1006933 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 07:49:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtjH-0001HW-67 for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 07:47:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10932 for ; Tue, 20 Apr 2004 07:47:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFtjG-00020o-EV for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:47:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFtiH-0001kQ-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:46:54 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFthG-0001Mw-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 07:45:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtdZ-0008Lv-Vf; Tue, 20 Apr 2004 07:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFtZk-0007QF-CW for asrg@optimus.ietf.org; Tue, 20 Apr 2004 07:38:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10623 for ; Tue, 20 Apr 2004 07:38:03 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFtZj-0007Bk-LO for asrg@ietf.org; Tue, 20 Apr 2004 07:38:03 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFtYp-0006wI-00 for asrg@ietf.org; Tue, 20 Apr 2004 07:37:08 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=AchJPJJZxwAHW38Z9zAFMy6rpR9q2TZBxve9a1m7kaV) by ietf-mx with esmtp (Exim 4.12) id 1BFtYQ-0006gI-00 for asrg@ietf.org; Tue, 20 Apr 2004 07:36:42 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id HAA10639; Tue, 20 Apr 2004 07:36:41 -0400 (EDT) From: der Mouse Message-Id: <200404201136.HAA10639@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) In-Reply-To: References: Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 07:28:37 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > No Not "a negligent abuse-enabler" > Simply a user of Microsoft windows What's the difference? That's rather flip, but I'm basically serious: except for a very few people who are good enough to lock down their Windows - so few as to be statistically ignorable - I see the second set as a subset of the first. Running software from a company with a long history of producing grossly insecure software, in a security-critical function (like the operating system!), on a known-hostile net, _is_ being a negligent abuse-enabler. > But don't be fooled if M$ fixes their game, nix derivatives will fall > foul of such problems. Less so, I believe. It is significantly harder, if onjly because the Unix world is much less monocultural. > spammers and hackers always take the path of least resistance which > is currently windows. Spammers generally do, yes. Hackers often don't; it's fairly common for a hacker faced with an uninteresting problem to generalize it enough to make it interesting, solve the new (and significantly harder) problem, and thereby solve the original problem as a special case. This is hardly the path of least resistance. Also, many hackers have a rather compelling sense of aesthetics, and want a solution that they consider aesthetic, even if it is a good deal more work. For example, this is why I'm writing my own ssh implementation. (This aspect of the hacker personality may be somewhat off-topic, though, as its only relevance to spam I can see involves building anti-spam software.) /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 10:04:08 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19011 for ; Tue, 20 Apr 2004 10:04:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFviV-0002HM-2G for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 09:55:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KDtFFj008756 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 09:55:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFvZe-00009i-Ax for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 09:46:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA17681 for ; Tue, 20 Apr 2004 09:46:03 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFvZc-0004P0-Ez for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 09:46:04 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFvYb-000479-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 09:45:01 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFvXc-0003q8-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 09:44:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFvJB-0000rZ-3G; Tue, 20 Apr 2004 09:29:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFmaw-0006yj-La for asrg@optimus.ietf.org; Tue, 20 Apr 2004 00:10:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA04966 for ; Tue, 20 Apr 2004 00:10:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFmau-0006Qp-7T for asrg@ietf.org; Tue, 20 Apr 2004 00:10:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFmZt-0006C0-00 for asrg@ietf.org; Tue, 20 Apr 2004 00:09:45 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BFmZX-0005xH-00 for asrg@ietf.org; Tue, 20 Apr 2004 00:09:23 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BFmZY-0000rO-00 for asrg@ietf.org; Tue, 20 Apr 2004 00:09:24 -0400 Received: from [68.246.116.124] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BFmZX-0006jz-00 for asrg@ietf.org; Tue, 20 Apr 2004 00:09:24 -0400 Message-ID: <4084A26B.7020904@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 2b. SMTP-VERIFY - Request to publish LMAP proposals Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 00:09:15 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit As per MARID charter, the IRTF chair and the chairs of the ASRG received a request from the IESG to submit the LMAP proposals and the LMAP discussion document to the RFC Editor for publication. We are planning on submitting the proposals as experimental RFCs and the LMAP discussion document as informational RFC. The following proposals will be submitted: MTAMARK - draft-stumpf-dns-mtamark-01.txt DRIP - draft-brand-drip-02.txt RMX - draft-danisch-dns-rr-smtp-03.txt DMP - draft-fecyk-dmp-01.txt SPF - draft-mengwong-spf-00.txt FSV - draft-levine-fsv-00.txt Comments on this should be sent to the main ASRG list. Sincerely, Yakov Shafranovich Co-Chair, ASRG _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 10:04:41 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19119 for ; Tue, 20 Apr 2004 10:04:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFvl4-0005aF-Mc for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 09:57:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KDvsVx021461 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 09:57:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFvZk-0000A8-ED for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 09:46:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA17705 for ; Tue, 20 Apr 2004 09:46:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFvZi-0004Pp-H9 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 09:46:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFvYn-00048l-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 09:45:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFvXu-0003rt-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 09:44:18 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFvJB-0000rh-HQ; Tue, 20 Apr 2004 09:29:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFq8e-0000h3-NU for asrg@optimus.ietf.org; Tue, 20 Apr 2004 03:57:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA29760 for ; Tue, 20 Apr 2004 03:57:51 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFq8c-0002la-2j for asrg@ietf.org; Tue, 20 Apr 2004 03:57:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFq7c-0002W5-00 for asrg@ietf.org; Tue, 20 Apr 2004 03:56:49 -0400 Received: from tom.iecc.com ([208.31.42.38]) by ietf-mx with esmtp (Exim 4.12) id 1BFq7O-0002HI-00 for asrg@ietf.org; Tue, 20 Apr 2004 03:56:35 -0400 Received: (qmail 9450 invoked from network); 20 Apr 2004 07:56:35 -0000 Received: (ofmipd 127.0.0.1); 20 Apr 2004 07:56:13 -0000 Message-ID: From: "John R Levine" To: "Barry Shein" Cc: "asrg@ietf.org" In-Reply-To: <16516.15496.971964.662601@world.std.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [Asrg] Re: the e-postage argument Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 20 Apr 2004 03:56:34 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Hi. It's me, Mr. epostage-can't-work. I need to keep rewriting my epostage paper to make the fundamental points clearer. The three big issues are transaction costs, settlements, and identity. Another is that no postage scheme in the history of mankind has existed to deter use rather than to pay delivery costs, but let's skip that one and decide to innovate. The transaction cost issue is the simplest: any kind of e-postage system is going to need a transaction per message to check the stamps. Spammers are going to put bogus e-postage on their mail, and the only way to see if an e-stamp is valid is to check with the issuer. Even if you use a crypto signature scheme to see if the stamp is real, you still need to ask issuer if it's already been used somewhere else. I have yet to see a faintly plausible plan that would build and pay for a transaction system big enough to handle the world's e-mail. I'm not talking about settlements here, just whether the stamp is OK. The biggest transaction system to date is the one for Master Card and Visa, and it's both too small and too expensive by several orders of magnitude each. > You settle at the ISP level ... Settlements: You run an ISP, you tell us. There are something like 5000 ISPs in the U.S. and probably at least that many outside the U.S. Are you going to send out 5000 checks every month for your settlements? (Or net it out with each, so it's on average only 2500.) How are you going to keep track of whether the other ISPs have paid up, and if they don't, what will you do about it? You can't wave these issues away, these are the nuts and bolts that make a payment system work or not, and if you don't shut down the deadbeats, the e-postage stops being real money. If the ISPs do the settlements on behalf of their customers, the ISPs are acting as banks, with all of the fraud and default problems that regular banks have, and which they spend a lot of money to handle. Real banks handle the clearing problem with centralized clearing systems they all join, Mastercard/Visa for credit cards, NYCE, Cirrus, and PLUS for ATM transactions, and the Federal Reserve for checks. These all cost a lot more per transaction than any likely e-postage system will collect, and are designed in a world where the vast majority of transactions are OK and you handle the bad ones as exceptions, which doesn't impress me as a good model for an environment where spam is 80% of all mail and growing. Even worse, what about the ISPs that aren't in the US? How do you send 50 cents to each of five ISPs in Bangladesh? Credit cards? Identity: lots of people have pointed out the zombie problem, that spammers will hijack Aunt Betsy's computer and charge the postage to her. The response I usually hear from epostage enthusiasts is that Aunt Betsy won't let the zombies on her PC once she's had to pay a few hundred bucks in spam epostage. Based on my observation of the real world, that's not gonna happen. Every month you see the predictable story about some loser whose PC got misconfigured or got a Moldavian dialer installed or something, and was shocked to get a thousand dollar phone bill. Do they actually pay the thousand bucks? Never. They negotiate it down, stiff the phone company, or something. ISPs would be stuck in a no-win situation where their customers will hate them if they try to collect, and their e-mail peers will hate them if they don't. > Howsabout the whole damned phone system? Isn't that essentially a > "micropayments" system in many aspects? In some, yes, in others, no. It differs from e-mail in that it's a closed system, with relatively few players, rather stringent barriers to entry and really complicated financial settlements that start with the difference between "bill and keep" and "reciprocal compensation" and get worse from there, with the ITU, an impenetrable government meta-bureacracy, in the middle. > Don't people feel a little silly arguing that the entire phone system > as currently constituted among several billion people world-wide > represents a charging/payment model which is easily (in a few pages of > this paper, apparently) ``proven'' to be completely untenable because > someone, somewhere might defraud it etc? You must have read some other paper than the one I wrote, because I never said or implied that. Here's a thought experiment: imagine that you run a store in some part of the wild west, and 90% of the cash that people offer you to pay for stuff is bogus. How are you going to handle transactions? How long will you spend examining each coin? Will you refuse to do business with anyone who's offered you bogus money? What about people who've gotten it in change somewhere else and didn't notice? This is the environment e-postage has to face, not a little fraud, but vastly more bogus transactions (at least attempted ones) than real ones. I don't know of any financial system that works in an environment like that. > It's time to go for an e-postage system that simply reflects the > resources being used. OK, so build one. I don't know how to build one where the transaction costs aren't 10 times greater than the costs that the transactions are supposed to cover, despite a decade of micropayment research, but maybe we've overlooked something. I think we all agree that it's not going to sit on top of SMTP mail, so someone should take a tip from the phone system, build a closed system that you can only get into by spending a hundred grand and being approved by the club that runs it, and give the end users a nice point and click program that runs on Redmond Crudware yet isn't going to be instantly subverted through the weekly egregious system security hole. People will rush to use it. Right? Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY "I dropped the toothpaste", said Tom, crestfallenly. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 11:08:42 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24226 for ; Tue, 20 Apr 2004 11:08:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFwlE-0002RE-Eb for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 11:02:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KF28eH009368 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 11:02:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFwhW-00013H-Gc for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 10:58:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA23459 for ; Tue, 20 Apr 2004 10:58:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFwhU-0001fX-1T for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 10:58:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFwgY-0001Om-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 10:57:18 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFwfr-00018C-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 10:56:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFwPy-0003sm-Ka; Tue, 20 Apr 2004 10:40:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFwM4-0001rt-Ef for asrg@optimus.ietf.org; Tue, 20 Apr 2004 10:36:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA22056 for ; Tue, 20 Apr 2004 10:36:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFwM1-0003J3-W7 for asrg@ietf.org; Tue, 20 Apr 2004 10:36:06 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFwL6-00033C-00 for asrg@ietf.org; Tue, 20 Apr 2004 10:35:09 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BFwKH-0002nl-00 for asrg@ietf.org; Tue, 20 Apr 2004 10:34:17 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id 88137170D4 for ; Tue, 20 Apr 2004 10:38:59 -0400 (EDT) From: "Alan DeKok" To: ASRG Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) In-Reply-To: Your message of "Mon, 19 Apr 2004 20:49:08 EDT." <40847384.3080108@solidmatrix.com> Message-Id: <20040420143859.88137170D4@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 10:38:59 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Yakov Shafranovich wrote: > Laws are useless unless they are enforced, same for standards. Who will > make sure that the procedures you drafted are actually used in a correct > fashion? Everybody else. There's no need for a central organization if everybody, individually, decides to enforce the standards. See the deployment of a new protocol: All that's required is software for people to use, and people willing to use it. > What happens if people start blocking ISPs and networks without a > good enough reason like some blacklist operators have done? Anyone can block traffic to/from their site for their own reasons. > Additionally, what happens if a portion of the community colludes > against a specific network or operator? As in the Usenet Death Penalty? What happens is that the operator fixes their problems. > > There is ia standard; it is in the RFC pertaining to mandatory role > > accounts. > > I assume you are referring to RFCs 2821 and 2142. They define the > postmaster@ and abuse@ addresses. However, it seems that in many cases > ISPs want to have additional mailboxes or simply do not honor the RFC, > which is why systems like abuse.net are used. So why are those sites still on the net? The answer is clear: there is no penalty for violating RFC's, for abusing the net, or for attacking other net users. Therefore there is no negative feedback to minimize these activities. Every engineer should know that systems without negative feedback generally devolve into chaos, and die. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 13:09:10 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04823 for ; Tue, 20 Apr 2004 13:09:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFyTH-0007At-Lv for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 12:51:43 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KGphlO027574 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 12:51:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFxyq-0000C9-Br for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 12:20:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01024 for ; Tue, 20 Apr 2004 12:20:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFxyo-0003rv-WB for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 12:20:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFxxl-0003Yz-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 12:19:10 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFxwg-0003Aa-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 12:18:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFxeK-0007Us-HT; Tue, 20 Apr 2004 11:59:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFwqQ-0004aw-AH for asrg@optimus.ietf.org; Tue, 20 Apr 2004 11:07:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA24173 for ; Tue, 20 Apr 2004 11:07:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFwqN-0004H7-Mf for asrg@ietf.org; Tue, 20 Apr 2004 11:07:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFwpM-0003yv-00 for asrg@ietf.org; Tue, 20 Apr 2004 11:06:24 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BFwop-0003gy-00 for asrg@ietf.org; Tue, 20 Apr 2004 11:05:51 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id BA106170FD for ; Tue, 20 Apr 2004 11:10:33 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: Your message of "Mon, 19 Apr 2004 22:14:14 EDT." <16516.34678.371575.137422@world.std.com> Message-Id: <20040420151033.BA106170FD@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 11:10:33 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Barry Shein wrote: > But one difference was that there was real, measurable money involved. Which meant that the maintainers of the phone system had an incentive to change the system. > Another is that the phone system is somewhat more mature than the > internet. The "maturation" of the phone system involved separating control & data paths. Captain Crunch whistles can be blown into a handset until your face turns red, and nothing will happen. It's difficult to change the Internet now, to separate control & data paths. As if the billions of dollars required isn't enough, the underlying philosophy of "end-to-end" communication means that any such attempt will be strongly opposed. Think of the Internet as a phone system where almost anyone can hook up a switch, where blue boxes come standard with most payphones, and where most payphones have a button labelled "press here to dial without inserting a quarter". No one should be surprised that the resulting system is a mess of abuse and fraud. > Given the opportunity the public would probably "vote" for free > broadband cable etc. Why not?! It's called "free bread and circuses". It goes back to the Roman days. In contrast, the phone systems could be upgraded not only for the reasons stated above, but also because they were owned by the phone company, there were relatively few switches, and the switch<->payphone protocol didn't have to be changed when the switches were upgraded. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 14:00:51 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08619 for ; Tue, 20 Apr 2004 14:00:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFzUO-0008Fc-Kn for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 13:56:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KHuuqN031704 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 13:56:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFzG0-0003lp-UE for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 13:42:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07492 for ; Tue, 20 Apr 2004 13:42:02 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFzFy-0003Ez-SB for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 13:42:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFzF2-0003Cg-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 13:41:05 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BFzE4-00038t-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 13:40:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFz1Q-0005I9-Hs; Tue, 20 Apr 2004 13:27:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFyk8-0006JM-O3 for asrg@optimus.ietf.org; Tue, 20 Apr 2004 13:09:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04810 for ; Tue, 20 Apr 2004 13:09:07 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFyk6-0000ys-LC for asrg@ietf.org; Tue, 20 Apr 2004 13:09:06 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFyjI-0000wX-00 for asrg@ietf.org; Tue, 20 Apr 2004 13:08:17 -0400 Received: from [131.107.8.3] (helo=exchange.microsoft.com) by ietf-mx with esmtp (Exim 4.12) id 1BFyif-0000qX-00 for asrg@ietf.org; Tue, 20 Apr 2004 13:07:37 -0400 Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.1069); Tue, 20 Apr 2004 10:07:06 -0700 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Tue, 20 Apr 2004 10:07:05 -0700 Received: from DF-CHOPPER.mercury.corp.microsoft.com ([10.197.0.104]) by DF-BEG.mercury.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6713); Tue, 20 Apr 2004 10:07:06 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] Re: the e-postage argument Message-ID: <27C4E14288DB344FBA10705D57A9BB0401A4A496@DF-CHOPPER.mercury.corp.microsoft.com> Thread-Topic: [Asrg] Re: the e-postage argument Thread-Index: AcQm3aprEobfgXrYRSaY3HKvpyQtHQAG9d7A From: "Bob Atkinson" To: "John R Levine" , "Barry Shein" Cc: X-OriginalArrivalTime: 20 Apr 2004 17:07:06.0204 (UTC) FILETIME=[E876F9C0:01C426F9] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 10:09:10 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable An implicit assumption in this discussion is that in the ePostage model money must flow from sender to receiver. While that is an attractive model for many reasons, there are other models in which rather than in-band per message, the money instead flows out of band up front, and presumably more in bulk, though likely not to message recipients. In such designs, many of the constraints articulated below are alleviated. Indeed, if you think about it, this is more directly analogous to the gummed-paper physical postage stamps we all know and love. I'm not here expressing a preference for these systems, only pointing out that the design surface is larger than was being discussed. Bob -----Original Message----- From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of John R Levine Sent: Tuesday, April 20, 2004 12:57 AM To: Barry Shein Cc: asrg@ietf.org Subject: [Asrg] Re: the e-postage argument Hi. It's me, Mr. epostage-can't-work. I need to keep rewriting my epostage paper to make the fundamental points clearer. The three big issues are transaction costs, settlements, and identity. Another is that no postage scheme in the history of mankind has existed to deter use rather than to pay delivery costs, but let's skip that one and decide to innovate. The transaction cost issue is the simplest: any kind of e-postage system is going to need a transaction per message to check the stamps. Spammers are going to put bogus e-postage on their mail, and the only way to see if an e-stamp is valid is to check with the issuer. Even if you use a crypto signature scheme to see if the stamp is real, you still need to ask issuer if it's already been used somewhere else. I have yet to see a faintly plausible plan that would build and pay for a transaction system big enough to handle the world's e-mail. I'm not talking about settlements here, just whether the stamp is OK. The biggest transaction system to date is the one for Master Card and Visa, and it's both too small and too expensive by several orders of magnitude each. > You settle at the ISP level ... Settlements: You run an ISP, you tell us. There are something like 5000 ISPs in the U.S. and probably at least that many outside the U.S. Are you going to send out 5000 checks every month for your settlements? (Or net it out with each, so it's on average only 2500.) How are you going to keep track of whether the other ISPs have paid up, and if they don't, what will you do about it? You can't wave these issues away, these are the nuts and bolts that make a payment system work or not, and if you don't shut down the deadbeats, the e-postage stops being real money. If the ISPs do the settlements on behalf of their customers, the ISPs are acting as banks, with all of the fraud and default problems that regular banks have, and which they spend a lot of money to handle. Real banks handle the clearing problem with centralized clearing systems they all join, Mastercard/Visa for credit cards, NYCE, Cirrus, and PLUS for ATM transactions, and the Federal Reserve for checks. These all cost a lot more per transaction than any likely e-postage system will collect, and are designed in a world where the vast majority of transactions are OK and you handle the bad ones as exceptions, which doesn't impress me as a good model for an environment where spam is 80% of all mail and growing. Even worse, what about the ISPs that aren't in the US? How do you send 50 cents to each of five ISPs in Bangladesh? Credit cards? Identity: lots of people have pointed out the zombie problem, that spammers will hijack Aunt Betsy's computer and charge the postage to her. The response I usually hear from epostage enthusiasts is that Aunt Betsy won't let the zombies on her PC once she's had to pay a few hundred bucks in spam epostage. Based on my observation of the real world, that's not gonna happen. Every month you see the predictable story about some loser whose PC got misconfigured or got a Moldavian dialer installed or something, and was shocked to get a thousand dollar phone bill. Do they actually pay the thousand bucks? Never. They negotiate it down, stiff the phone company, or something. ISPs would be stuck in a no-win situation where their customers will hate them if they try to collect, and their e-mail peers will hate them if they don't. > Howsabout the whole damned phone system? Isn't that essentially a > "micropayments" system in many aspects? In some, yes, in others, no. It differs from e-mail in that it's a closed system, with relatively few players, rather stringent barriers to entry and really complicated financial settlements that start with the difference between "bill and keep" and "reciprocal compensation" and get worse from there, with the ITU, an impenetrable government meta-bureacracy, in the middle. > Don't people feel a little silly arguing that the entire phone system > as currently constituted among several billion people world-wide > represents a charging/payment model which is easily (in a few pages of > this paper, apparently) ``proven'' to be completely untenable because > someone, somewhere might defraud it etc? You must have read some other paper than the one I wrote, because I never said or implied that. Here's a thought experiment: imagine that you run a store in some part of the wild west, and 90% of the cash that people offer you to pay for stuff is bogus. How are you going to handle transactions? How long will you spend examining each coin? Will you refuse to do business with anyone who's offered you bogus money? What about people who've gotten it in change somewhere else and didn't notice? This is the environment e-postage has to face, not a little fraud, but vastly more bogus transactions (at least attempted ones) than real ones. I don't know of any financial system that works in an environment like that. > It's time to go for an e-postage system that simply reflects the > resources being used. OK, so build one. I don't know how to build one where the transaction costs aren't 10 times greater than the costs that the transactions are supposed to cover, despite a decade of micropayment research, but maybe we've overlooked something. I think we all agree that it's not going to sit on top of SMTP mail, so someone should take a tip from the phone system, build a closed system that you can only get into by spending a hundred grand and being approved by the club that runs it, and give the end users a nice point and click program that runs on Redmond Crudware yet isn't going to be instantly subverted through the weekly egregious system security hole. People will rush to use it. Right? Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY "I dropped the toothpaste", said Tom, crestfallenly. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 15:14:26 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14800 for ; Tue, 20 Apr 2004 15:14:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG0Tj-0008HJ-Hs for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 15:00:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KJ0JSH031793 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 15:00:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG0Om-0005lr-3U for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 14:55:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12531 for ; Tue, 20 Apr 2004 14:55:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG0Oj-0000Sn-8o for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 14:55:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG0Nn-0000OZ-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 14:54:12 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG0Ms-0000KA-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 14:53:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG09A-0008M1-9d; Tue, 20 Apr 2004 14:39:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG01e-0005W4-CA for asrg@optimus.ietf.org; Tue, 20 Apr 2004 14:31:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10503 for ; Tue, 20 Apr 2004 14:31:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG01b-0006Jb-Nq for asrg@ietf.org; Tue, 20 Apr 2004 14:31:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG00k-0006G7-00 for asrg@ietf.org; Tue, 20 Apr 2004 14:30:23 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 1BG008-0006A8-00 for asrg@ietf.org; Tue, 20 Apr 2004 14:29:44 -0400 Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id i3KITCR13798 for ; Tue, 20 Apr 2004 14:29:12 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JCWP55L8; Tue, 20 Apr 2004 14:29:13 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.65]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JC3JLYT7; Tue, 20 Apr 2004 14:29:12 -0400 Message-ID: <40856BF7.2020007@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040419214914.F2D7716CC3@mail.nitros9.org> In-Reply-To: <20040419214914.F2D7716CC3@mail.nitros9.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 14:29:11 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Alan DeKok wrote: > "Chris Lewis" wrote: > >>> Let's be aware, though, that many content filtering schemes and >>>black-lists have been caught adding entries to the list which do NOT >>>meet the publicly stated criteria. >> >>That's a bit of a non-sequitor. DCC and it's detection system is 100% >>automated. It doesn't work by "adding entries" to a list. > At one point last year, Hadmut tried emailing Vernon off-list to > continue an on-list conversation. The message was rejected, and > appeared to have been submitted to the DCC. Vernon then admitted on > this list that he was blocking Hadmut's off-list messages, and > submitting that information to the DCC. > That's censorship, not anti-spam filtering. No. DCC doesn't work like you think it does. Vernon is using more than just the DCC for blocking - he's got lots of lists (domains etc) which are run for his personal email independently of DCC. "Submitting something to the DCC" is like submitting something to Bayes training. It's only bulk (and blocked) if the signatures match others (in DCC) or if the training is "strong enough to matter" (in Bayes). One-to-one email isn't going to trip DCC, and unlikely to trip Bayes. > On the subject of blacklists, I don't think I have to re-iterate the > political wars between blacklist maintainers, who cross-list each > other. The only deliberate one I know of was when one blacklist was acting abusively (unrestricted relay scanning) generating lots of complaints, the other listed it for acting abusively, and the first well, retaliated - it was acting abusively in the first place, right? The first blacklist was subsequently proven in a court of law to be acting abusively. And isn't running any more. He just whines a lot after having fled the country. I don't really think one corner case can be generalized into a blanket statement. But more importantly, it's not interesting from the ASRG perspective. > I agree. Systems like spamassassin are slightly better from the > trust perspective. but may catch less spam than the DCC. Spamassassin > distributes the rules to each user, who then can configure it to tell > him which rules were matched. My point is that your point that such systems are "originator-subvertible" is an uninteresting one from a broader perspective such as what ASRG is tasked with. _Everything_ is subvertible at that level. _Any_ spam solution that you implement has to be evaluated from a perspective of how much you trust the "supplier". Even if you're the supplier (in a corporate sense) where the spam meister may have a different viewpoint of what spam _is_, relative to say, the CEO. I don't think maundering ( ;-) on about that sort of thing is useful for ASRG. ASRG should be more concerned with making sure that once the user of the filter has decided to _use_ a given technology that he actually gets what the supplier provides, and is given enough information to make reasonable choices. As long as the DNSBL user is adequately informed, it ain't any of our business how capriciously the DNSBL is operated. Truth in advertising is the key. Not bans against capriciousness. Say, Yakov, you still waiting on Matt for DNSBL BCP publication? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 15:52:49 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18338 for ; Tue, 20 Apr 2004 15:52:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG1FC-0004bI-1R for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 15:49:22 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KJnM8j017675 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 15:49:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG10a-0007C3-96 for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 15:34:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA16653 for ; Tue, 20 Apr 2004 15:34:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG10Y-0003ez-Uu for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 15:34:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG0zi-0003bl-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 15:33:23 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG0zI-0003YA-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 15:32:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG0qf-00022k-3H; Tue, 20 Apr 2004 15:24:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BFyuh-0002Zo-Ra for asrg@optimus.ietf.org; Tue, 20 Apr 2004 13:20:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05683 for ; Tue, 20 Apr 2004 13:20:02 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BFyuf-0001gP-TC for asrg@ietf.org; Tue, 20 Apr 2004 13:20:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BFytk-0001d0-00 for asrg@ietf.org; Tue, 20 Apr 2004 13:19:05 -0400 Received: from tom.iecc.com ([208.31.42.38]) by ietf-mx with esmtp (Exim 4.12) id 1BFysr-0001Ye-00 for asrg@ietf.org; Tue, 20 Apr 2004 13:18:09 -0400 Received: (qmail 5633 invoked from network); 20 Apr 2004 17:18:08 -0000 Received: (ofmipd 127.0.0.1); 20 Apr 2004 17:17:46 -0000 Message-ID: From: "John R Levine" To: "Bob Atkinson" Cc: "Barry Shein" , "asrg@ietf.org" Subject: Re: [taugh.com-johnl] RE: [Asrg] Re: the e-postage argument In-Reply-To: <27C4E14288DB344FBA10705D57A9BB0401A4A496@DF-CHOPPER.mercury.corp.microsoft.com> References: <27C4E14288DB344FBA10705D57A9BB0401A4A496@DF-CHOPPER.mercury.corp.microsoft.com> Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 20 Apr 2004 13:18:08 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 > An implicit assumption in this discussion is that in the ePostage model > money must flow from sender to receiver. That could alleviate the settlement issues, but the transaction cost and identity issues aren't affected. > Indeed, if you think about it, this is more directly analogous to the > gummed-paper physical postage stamps we all know and love. I've never heard much support for a model where we all have to buy stamps from one central post office or a small number of post offices. In the paper stamp model, the price of the stamps actually pays for delivering the mail. In the e-postage model, I've never understood what the stamps are supposed to pay for beyond acting to deter senders, particularly if they don't go to the recipient to defray the cost of handling incoming mail. In the phone system, which Barry cited as a model, there is a complex and often contentious system of settlements and compensation to calculate how much the recipient network gets paid to handle incoming calls. I think it supports the point in my paper that any system with real money is going to have its own mountain of rules, fraud, lawsuits, and so forth that is likely to be much worse to deal with than whatever it was supposed to solve. If it sounds like I'm saying we should throw up our hands and give up, I'm not, but there's an old saw that for any complex problem there's a solution that's simple, elegant and wrong, and if the problem is spam, e-postage is that solution. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 18:11:01 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01433 for ; Tue, 20 Apr 2004 18:11:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG34k-0000aB-Iv for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 17:46:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KLkgwx002232 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 17:46:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG2Lq-0000qP-Kt for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 17:00:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA24431 for ; Tue, 20 Apr 2004 17:00:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG2Lo-0005GK-IC for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 17:00:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG2Ky-0005C0-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 16:59:24 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG2KA-000581-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 16:58:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG1Qj-00014X-6Z; Tue, 20 Apr 2004 16:01:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG1HH-0005sg-LJ for asrg@optimus.ietf.org; Tue, 20 Apr 2004 15:51:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18168 for ; Tue, 20 Apr 2004 15:51:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG1HG-0005DY-2p for asrg@ietf.org; Tue, 20 Apr 2004 15:51:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG1GX-00057g-00 for asrg@ietf.org; Tue, 20 Apr 2004 15:50:45 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BG1Fg-0004yZ-00 for asrg@ietf.org; Tue, 20 Apr 2004 15:49:52 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id E82E4170D4 for ; Tue, 20 Apr 2004 15:54:35 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: Your message of "Tue, 20 Apr 2004 14:29:11 EDT." <40856BF7.2020007@americasm01.nt.com> Message-Id: <20040420195435.E82E4170D4@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 15:54:35 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 "Chris Lewis" wrote: > No. DCC doesn't work like you think it does. I will admit I have little idea how DCC works. My opinion of the events is based on the message posted to ASRG by Hadmut: http://www1.ietf.org/mail-archive/working-groups/asrg/current/msg04365.html > One-to-one email isn't going to trip DCC, and unlikely to trip Bayes. Maybe it won't trip DCC, but individuals appear to be free to submit non-spam messages they dislike to DCC. This makes it more likely that others will end up blocking similar messages, due to one individuals desire to censor. > Even if you're the supplier (in a corporate sense) where the spam > meister may have a different viewpoint of what spam _is_, relative to > say, the CEO. I don't think maundering ( ;-) on about that sort of > thing is useful for ASRG. ASRG should be more concerned with making > sure that once the user of the filter has decided to _use_ a given > technology that he actually gets what the supplier provides, and is > given enough information to make reasonable choices. I agree. When we design systems, we *know* they're going to be arbitrary and capricious. So the solution isn't to ban that behavior. The solution is to make users of the system accountable. This limits the negative impact of the political-layer flaws. My focus, therefore, has been on systems which enable people to claim accountability, and to be verified to be accountable by others. > As long as the DNSBL user is adequately informed, it ain't any of our > business how capriciously the DNSBL is operated. Truth in advertising > is the key. Not bans against capriciousness. Exactly. Look at cbl.abuseat.org. There's *no* information as to how an IP gets listed, other than "trust us". It's arbitrary and capricous, but immediately responsive to complaints (as the designers obviously understand these issues.) So my concern with content filtering systems is that unless it's possible to tell *who* submitted some data, users of the system end up using rules for which no one is accountable. That can be an avenue for abuse. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 18:59:36 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05505 for ; Tue, 20 Apr 2004 18:59:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG4Bm-0003tS-HC for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 18:58:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KMw2wH014961 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 18:58:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG3ul-0004B7-Pr for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 18:40:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04439 for ; Tue, 20 Apr 2004 18:40:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG3ui-0000sf-Ol for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 18:40:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG3ts-0000om-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 18:39:32 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG3tD-0000kl-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 18:38:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG3jj-0006rj-BF; Tue, 20 Apr 2004 18:29:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG3Xf-0007EN-Ii for asrg@optimus.ietf.org; Tue, 20 Apr 2004 18:16:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA02383 for ; Tue, 20 Apr 2004 18:16:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG3Xc-0006Nz-JN for asrg@ietf.org; Tue, 20 Apr 2004 18:16:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG3Vl-00064d-00 for asrg@ietf.org; Tue, 20 Apr 2004 18:14:38 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BG3Ua-0005qD-00 for asrg@ietf.org; Tue, 20 Apr 2004 18:13:24 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id D234A48A38 for ; Tue, 20 Apr 2004 18:13:24 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3KMDOE03389; Tue, 20 Apr 2004 18:13:24 -0400 (EDT) Message-Id: <200404202213.i3KMDOE03389@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <20040420195435.E82E4170D4@mail.nitros9.org> (aland@ox.org) Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040420195435.E82E4170D4@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 18:13:24 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 > I will admit I have little idea how DCC works. The idea is that _every_ message gets submitted (once). DCC reports the number of copies it has received. For a message sent a single time, this doesn't matter at all; nobody ever checks it again. For a message with a few recipients, it might be found, but only a few copies, so it doesn't matter. For spam, there will be a lot of copies seen, so it gets rejected. (This latter is also why legitimate subscribed-to mailinglists must be whitelisted, since DCC only knows about volume.) >> One-to-one email isn't going to trip DCC, and unlikely to trip Bayes. > > Maybe it won't trip DCC, but individuals appear to be free to submit > non-spam messages they dislike to DCC. _All_ messages received are supposed to be submitted. (If you wait until a person sees the message, a lot of spam will be accepted in the meantime.) Besides, suppose I submitted a non-spam message that I didn't like; what effect would it have? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 19:46:24 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07746 for ; Tue, 20 Apr 2004 19:46:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG4ki-0003Hd-3I for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 19:34:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3KNY8eR012615 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 19:34:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG4bR-0006SQ-L7 for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 19:24:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06509 for ; Tue, 20 Apr 2004 19:24:32 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG4bQ-0003s8-3s for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 19:24:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG4aZ-0003n1-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 19:23:40 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG4a1-0003hP-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 19:23:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG4Dh-0005D5-NW; Tue, 20 Apr 2004 19:00:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG4B7-0002Ef-WA for asrg@optimus.ietf.org; Tue, 20 Apr 2004 18:57:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05385 for ; Tue, 20 Apr 2004 18:57:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG4B4-00021d-Qr for asrg@ietf.org; Tue, 20 Apr 2004 18:57:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG4A8-0001yg-00 for asrg@ietf.org; Tue, 20 Apr 2004 18:56:20 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BG49v-0001vk-00 for asrg@ietf.org; Tue, 20 Apr 2004 18:56:08 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id 67476170D4 for ; Tue, 20 Apr 2004 19:00:50 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: Your message of "Tue, 20 Apr 2004 18:13:24 EDT." <200404202213.i3KMDOE03389@panix5.panix.com> Message-Id: <20040420230050.67476170D4@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 19:00:50 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Seth Breidbart wrote: > _All_ messages received are supposed to be submitted. (If you wait > until a person sees the message, a lot of spam will be accepted in the > meantime.) OK. I would have preferred to have this explanation during the original discussion, but having it now is better than nothing. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 20:24:11 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA10205 for ; Tue, 20 Apr 2004 20:24:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG5HM-0002kD-Et for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 20:07:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3L07qXu010533 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 20:07:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG5Cz-0008RB-Vj for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 20:03:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA08970 for ; Tue, 20 Apr 2004 20:03:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG5Cy-0007E2-2o for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 20:03:20 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG5CE-0007Ai-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 20:02:34 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG5Bp-00076Q-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 20:02:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG53z-00048m-Hk; Tue, 20 Apr 2004 19:54:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG4xb-00006a-4V for asrg@optimus.ietf.org; Tue, 20 Apr 2004 19:47:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA07873 for ; Tue, 20 Apr 2004 19:47:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG4xZ-0005sC-B8 for asrg@ietf.org; Tue, 20 Apr 2004 19:47:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG4we-0005mp-00 for asrg@ietf.org; Tue, 20 Apr 2004 19:46:28 -0400 Received: from plounts.uits.indiana.edu ([129.79.1.73]) by ietf-mx with esmtp (Exim 4.12) id 1BG4va-0005dA-00 for asrg@ietf.org; Tue, 20 Apr 2004 19:45:22 -0400 Received: from logchain.uits.indiana.edu (logchain.uits.indiana.edu [129.79.1.77]) by plounts.uits.indiana.edu (8.12.10/8.12.10/IUPO) with ESMTP id i3KNj8xI012644 for ; Tue, 20 Apr 2004 18:45:08 -0500 (EST) Received: from [156.56.74.58] (iub-vpn-74-58.noc.indiana.edu [156.56.74.58]) (authenticated bits=0) by logchain.uits.indiana.edu (8.12.10/8.12.10/IUPO) with ESMTP id i3KNj47c005852 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO) for ; Tue, 20 Apr 2004 18:45:08 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v613) In-Reply-To: <20040420160006.29408.33433.Mailman@www1.ietf.org> References: <20040420160006.29408.33433.Mailman@www1.ietf.org> Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Jim Witte To: asrg@ietf.org X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: E-postage problems... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 18:45:04 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> Howsabout the whole damned phone system? Isn't that essentially a >> "micropayments" system in many aspects? > In some, yes, in others, no. It differs from e-mail in that it's a > closed > system, with relatively few players, rather stringent barriers to entry One big difference I see is that with the phone system, you can only make one call at a time. With email, you can (continuing with the phone/email analogy), make thousands of calls at a time. Yes, you have "boiler-room" situations that generate "phone spam", but the cost to the boiler-room operator is high, and they have to pay people to staff them (or go illegal..) And on the receiving end, there is a limit to how many junk-calls I can receive (24 hours in a day, and I'm going to cancel my phone service or complain to my Congressperson long before that limit is reached). With email, there is a similar limit (size of my inbox), but that is still enough for a couple hundred spam messages. (I'm not sure that last argument really holds water, but maybe it does) Jim Witte jswitte@bloomington.in.us Indiana University CS _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 23:02:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA18092 for ; Tue, 20 Apr 2004 23:02:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG7x4-0007nd-SG for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 22:59:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3L2x6Gn029975 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 22:59:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG7pi-0004Jm-6q for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 22:51:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA17558 for ; Tue, 20 Apr 2004 22:51:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG7pe-0006YM-Sg for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 22:51:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG7ol-0006S7-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 22:50:32 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG7np-0006Lg-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 22:49:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG7cj-0008IZ-8J; Tue, 20 Apr 2004 22:38:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG7ZD-00052e-Q7 for asrg@optimus.ietf.org; Tue, 20 Apr 2004 22:34:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA16891 for ; Tue, 20 Apr 2004 22:34:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG7ZA-00056a-GB for asrg@ietf.org; Tue, 20 Apr 2004 22:34:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG7YO-00052e-00 for asrg@ietf.org; Tue, 20 Apr 2004 22:33:37 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BG7Xp-0004yD-00 for asrg@ietf.org; Tue, 20 Apr 2004 22:33:02 -0400 Received: from world.std.com (pnh@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3L2W4xA008933; Tue, 20 Apr 2004 22:32:04 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id WAA09105; Tue, 20 Apr 2004 22:32:04 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16517.56612.196778.643255@world.std.com> To: Yakov Shafranovich Cc: Barry Shein , asrg@ietf.org In-Reply-To: <40849808.3090005@solidmatrix.com> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> <40849808.3090005@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 22:32:04 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 19, 2004 at 23:24 research@solidmatrix.com (Yakov Shafranovich) wrote: > With the current state of affairs I simply do not see how any kind of > e-postage system would take off at all within a reasonable span of time > even once all of the technical issues have been addressed. The same goes Isn't this the canned, applies to anything, response? It's been nearly ten years and no one has come up with anything, perhaps it's time to put the "that would take too long to be accepted" on the back burner and discuss other aspects? > for any proposal calling for a major infrastructure overhaul - there > simply isn't enough monetary or non-monetary incentive for network > operators, software providers and governments to make a major change of > that scale. It may very well be that the system may collapse due to that > (which I personally do not think will happen). It (e-postage) doesn't require much any infrastructure overhaul. Maybe some ways of imagining it being implemented do, but maybe the goal should be to say well, if we do it that way it'd require a major infrastructure haul, can we do it some other way. In brief how about: A) Each ISP creates stamps according to some accepted method, probably some cryptographic approach. Think SSL certificates or some similar precedent. B) They attach a stamp to mail according to some policy such as e-mail originating from their customers. C) Stamps can be allocated according to any policy they choose, at least at first. For example, give each customer 1,000 stamps per month and charge for excess, whatever, that's a marketing decision. D) However, other ISPs can choose to transit or not email with particular stamps. E) Unstamped mail could be accepted for a while and then ISPs can choose to reject it. Ok, maybe it needs work. But it's hardly off-the-wall, and it doesn't require major infrastructure nor would take years and years. If a few major players said this is the way we're going, here's some software to do this, and we'd be off and running. I don't propose that as a worked-out solution, only as an example that one can approach the problem more positively, and to point out that ready-made, all-purpose blow-offs like "it would take too long" really don't improve the quality of discussion, except perhaps when posed as questions rather than assertions. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 20 23:45:40 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20203 for ; Tue, 20 Apr 2004 23:45:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG8R0-00045A-An for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 23:30:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3L3U2XW015685 for asrg-archive@odin.ietf.org; Tue, 20 Apr 2004 23:30:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG8PV-0003Fm-9b for asrg-web-archive@optimus.ietf.org; Tue, 20 Apr 2004 23:28:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA19557 for ; Tue, 20 Apr 2004 23:28:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG8PT-0002AR-A2 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 23:28:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG8Oc-00025R-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 23:27:35 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BG8O0-00020p-00 for asrg-web-archive@ietf.org; Tue, 20 Apr 2004 23:26:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG8DX-0006ne-CD; Tue, 20 Apr 2004 23:16:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG89N-0004uF-Jp for asrg@optimus.ietf.org; Tue, 20 Apr 2004 23:11:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA18467 for ; Tue, 20 Apr 2004 23:11:45 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG89J-0000WY-L3 for asrg@ietf.org; Tue, 20 Apr 2004 23:11:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG86o-0000IT-00 for asrg@ietf.org; Tue, 20 Apr 2004 23:09:14 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BG84j-00005Z-00 for asrg@ietf.org; Tue, 20 Apr 2004 23:07:01 -0400 Received: from world.std.com (pnh@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3L36exA022195; Tue, 20 Apr 2004 23:06:41 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id XAA24951; Tue, 20 Apr 2004 23:06:40 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16517.58688.435810.99883@world.std.com> To: "John R Levine" Cc: "Barry Shein" , "asrg@ietf.org" In-Reply-To: References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: the e-postage argument Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 20 Apr 2004 23:06:40 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 20, 2004 at 03:56 johnl@taugh.com (John R Levine) wrote: > Hi. It's me, Mr. epostage-can't-work. > > I need to keep rewriting my epostage paper to make the fundamental points > clearer. The three big issues are transaction costs, settlements, and > identity. Some critical thought as to why a particular model which supports an objection might just be a bad model would be useful also. Straw men and all that. Another is that no postage scheme in the history of mankind has > existed to deter use rather than to pay delivery costs, but let's skip > that one and decide to innovate. Really? So you figure if paper postage were free it wouldn't have the effect of increasing volume? Or is that an unconscious or accidental result? There's something about willfulness in that assertion which has me confused. > The transaction cost issue is the simplest: any kind of e-postage system > is going to need a transaction per message to check the stamps. Spammers > are going to put bogus e-postage on their mail, and the only way to see if > an e-stamp is valid is to check with the issuer. Even if you use a crypto > signature scheme to see if the stamp is real, you still need to ask issuer > if it's already been used somewhere else. I have yet to see a faintly > plausible plan that would build and pay for a transaction system big > enough to handle the world's e-mail. I'm not talking about settlements > here, just whether the stamp is OK. The biggest transaction system to > date is the one for Master Card and Visa, and it's both too small and too > expensive by several orders of magnitude each. Again, you're describing a particular model which is easy for you to object to, a straw man. How come SSL certificates in HTTPS transactions can work? Aren't they reasonably analogous? > > You settle at the ISP level ... > > Settlements: You run an ISP, you tell us. There are something like 5000 > ISPs in the U.S. and probably at least that many outside the U.S. Are you > going to send out 5000 checks every month for your settlements? (Or net Sounds like a great job for a service organization, if that's the way it's done at all. Send in your numbers, they can generate the n-way settlements and send out a single bill or check to each client. That doesn't sound too hard. > it out with each, so it's on average only 2500.) How are you going to > keep track of whether the other ISPs have paid up, and if they don't, what > will you do about it? You can't wave these issues away, these are the > nuts and bolts that make a payment system work or not, and if you don't > shut down the deadbeats, the e-postage stops being real money. So you shut them down, refuse their mail, cancel their stampmaking ability (revoke their certificate.) But why in the world would you be worried about collections issues in a forum like this, except inasmuch as you think you can use it to raise another objection. It makes wonder how in the heck can ISPs like me possibly charge customers to connect to other ISP's customers web sites etc? Why don't the settlements etc drive us to drink? How can we collect? Well, it's not really a problem, is it. Maybe there are no settlements, who told you there have to be settlements? Again, you're arguing with a model which you made up (or chose) because it's easy to argue with. > If the ISPs do the settlements on behalf of their customers, the ISPs are > acting as banks, with all of the fraud and default problems that regular > banks have, and which they spend a lot of money to handle. Real banks So now banks can't work? > handle the clearing problem with centralized clearing systems they all > join, Mastercard/Visa for credit cards, NYCE, Cirrus, and PLUS for ATM > transactions, and the Federal Reserve for checks. These all cost a lot > more per transaction than any likely e-postage system will collect, and > are designed in a world where the vast majority of transactions are OK and > you handle the bad ones as exceptions, which doesn't impress me as a good > model for an environment where spam is 80% of all mail and growing. Well, then it wouldn't be wise to design it like that, would it? > Even worse, what about the ISPs that aren't in the US? How do you send > 50 cents to each of five ISPs in Bangladesh? Credit cards? You're just inventing this awful model and running with it as far as you can aren't you? > Identity: lots of people have pointed out the zombie problem, that > spammers will hijack Aunt Betsy's computer and charge the postage to her. > The response I usually hear from epostage enthusiasts is that Aunt Betsy > won't let the zombies on her PC once she's had to pay a few hundred bucks > in spam epostage. Based on my observation of the real world, that's not > gonna happen. Every month you see the predictable story about some loser > whose PC got misconfigured or got a Moldavian dialer installed or > something, and was shocked to get a thousand dollar phone bill. Do they > actually pay the thousand bucks? Never. They negotiate it down, stiff > the phone company, or something. ISPs would be stuck in a no-win > situation where their customers will hate them if they try to collect, and > their e-mail peers will hate them if they don't. Hmm, it seems to me what you're saying is that the phone companies have already developed a completely workable model for handling these hard cases which the ISPs might consider adopting. Where's the objection, other than their tone. You're right, as an ISP I strive to not have my customers hate me, so I guess that other model would be better, some forgiveness and education. > > > Howsabout the whole damned phone system? Isn't that essentially a > > "micropayments" system in many aspects? > > In some, yes, in others, no. It differs from e-mail in that it's a closed > system, with relatively few players, rather stringent barriers to entry > and really complicated financial settlements that start with the > difference between "bill and keep" and "reciprocal compensation" and get > worse from there, with the ITU, an impenetrable government > meta-bureacracy, in the middle. But it works, within reason, right? So what exactly is your point? That you personally find it too complicated? > > Don't people feel a little silly arguing that the entire phone system > > as currently constituted among several billion people world-wide > > represents a charging/payment model which is easily (in a few pages of > > this paper, apparently) ``proven'' to be completely untenable because > > someone, somewhere might defraud it etc? > > You must have read some other paper than the one I wrote, because I never > said or implied that. Well, you did say that charging per usage can't work. > Here's a thought experiment: imagine that you run a store in some part of > the wild west, and 90% of the cash that people offer you to pay for stuff Wait, people did run stores in the wild west, didn't they? > is bogus. How are you going to handle transactions? How long will you And I think that's the context from which came the familiar American expression "Don't take any wooden nickels!" Didn't everyone have an uncle who'd say that all the time when you were a kid? > spend examining each coin? Will you refuse to do business with anyone > who's offered you bogus money? What about people who've gotten it in Sure, wouldn't you refuse bogus money? Don't take any wooden nickels! > change somewhere else and didn't notice? This is the environment > e-postage has to face, not a little fraud, but vastly more bogus > transactions (at least attempted ones) than real ones. I don't know of > any financial system that works in an environment like that. Only when you get to set up the straw man. > > It's time to go for an e-postage system that simply reflects the > > resources being used. > > OK, so build one. I don't know how to build one where the transaction > costs aren't 10 times greater than the costs that the transactions are On this we agree. > supposed to cover, despite a decade of micropayment research, but maybe Yeah well I'd avoid micropayments because they don't solve the problem, as you've pointed out. > we've overlooked something. I think we all agree that it's not going to > sit on top of SMTP mail, so someone should take a tip from the phone > system, build a closed system that you can only get into by spending a > hundred grand and being approved by the club that runs it, and give the > end users a nice point and click program that runs on Redmond Crudware yet > isn't going to be instantly subverted through the weekly egregious system > security hole. People will rush to use it. Right? I dunno, what's your take, that people don't use Microsoft software? At any rate, this is just more straw men. Why don't you be a little more honest: You don't like the idea of e-postage probably because it sounds like maybe you'd have to pay for something you don't have to pay for now, and your reasoning works backwards from that desired conclusion. Tragedy of the commons and all that. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 04:45:31 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA04432 for ; Wed, 21 Apr 2004 04:45:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGDKm-0006GT-OK for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 04:43:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3L8huFq024081 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 04:43:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGDIi-0005QK-Jf for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 04:41:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA04311 for ; Wed, 21 Apr 2004 04:41:45 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGDIf-0004yx-MX for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 04:41:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGDHo-0004se-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 04:40:53 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGDHP-0004lc-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 04:40:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGDDD-00030E-8E; Wed, 21 Apr 2004 04:36:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGD6w-00007x-Nu for asrg@optimus.ietf.org; Wed, 21 Apr 2004 04:29:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA03582 for ; Wed, 21 Apr 2004 04:29:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGD6t-0003TK-Si for asrg@ietf.org; Wed, 21 Apr 2004 04:29:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGD5x-0003MS-00 for asrg@ietf.org; Wed, 21 Apr 2004 04:28:38 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=Tdbp57HjSKupMPc72wPhmFnB3hdammzdmqphXwqGmt6) by ietf-mx with esmtp (Exim 4.12) id 1BGD4z-0003FM-00 for asrg@ietf.org; Wed, 21 Apr 2004 04:27:37 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id EAA19602; Wed, 21 Apr 2004 04:27:36 -0400 (EDT) From: der Mouse Message-Id: <200404210827.EAA19602@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Re: Usefulness of wholesale blocking of attachments for SMTP? (Lane Sharman et al) In-Reply-To: <20040420143859.88137170D4@mail.nitros9.org> References: <20040420143859.88137170D4@mail.nitros9.org> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 04:22:23 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit >> Laws are useless unless they are enforced, same for standards. > Everybody else. There's no need for a central organization if > everybody, individually, decides to enforce the standards. True as far as it goes. Unfortunately, for it to be useful with respect to spam, the standard must be unilaterally enforceable, that is, enforceable by those who wish to support it even in the presence of those who wish to subvert it. >> Additionally, what happens if a portion of the community colludes >> against a specific network or operator? > As in the Usenet Death Penalty? What happens is that the operator > fixes their problems. Or, perhaps more likely in the case of spam, sues some perceived point of focus. >> [I]t seems that in many cases ISPs want to have additional mailboxes >> or simply do not honor the RFC, [...] > So why are those sites still on the net? > The answer is clear: there is no penalty for violating RFC's, for > abusing the net, or for attacking other net users. Therefore there > is no negative feedback to minimize these activities. Fortunately, this is not quite true. There is negative feedback; it just is relatively weak in the short and medium term. The current spam problem is a transient which will eventually be damped out by the negative feedback; it's just that that will happen only in the long term (years, probably many of them). What I, and the antispammers I self-identify with, are fighting for, is email that's usable in the short and medium term. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 06:14:37 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA08691 for ; Wed, 21 Apr 2004 06:14:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGEit-00050A-Fx for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 06:12:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LACtCd019221 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 06:12:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGEhm-0004KZ-2t for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 06:11:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA08633 for ; Wed, 21 Apr 2004 06:11:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGEhi-0000OB-8e for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 06:11:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGEgq-0000Hu-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 06:10:49 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGEgI-0000BF-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 06:10:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGEZJ-00010V-QM; Wed, 21 Apr 2004 06:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGEY5-0000LI-1t for asrg@optimus.ietf.org; Wed, 21 Apr 2004 06:01:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA08096 for ; Wed, 21 Apr 2004 06:01:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGEY1-0006tU-7S for asrg@ietf.org; Wed, 21 Apr 2004 06:01:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGEX6-0006mY-00 for asrg@ietf.org; Wed, 21 Apr 2004 06:00:45 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BGEWJ-0006gC-00 for asrg@ietf.org; Wed, 21 Apr 2004 05:59:55 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Wed, 21 Apr 2004 10:03:20 +0100 From: "Tom Thomson" To: "Barry Shein" Cc: Subject: RE: [Asrg] Re: the e-postage argument Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 In-Reply-To: <16517.58688.435810.99883@world.std.com> X-OriginalArrivalTime: 21 Apr 2004 09:03:20.0890 (UTC) FILETIME=[7E7149A0:01C4277F] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 10:57:22 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: [snip] > The transaction cost issue is the simplest: any kind of e-postage system > is going to need a transaction per message to check the stamps. Spammers > are going to put bogus e-postage on their mail, and the only way to see if > an e-stamp is valid is to check with the issuer. Even if you use a crypto > signature scheme to see if the stamp is real, you still need to ask issuer > if it's already been used somewhere else. I have yet to see a faintly > plausible plan that would build and pay for a transaction system big > enough to handle the world's e-mail. I'm not talking about settlements > here, just whether the stamp is OK. The biggest transaction system to > date is the one for Master Card and Visa, and it's both too small and too > expensive by several orders of magnitude each. Again, you're describing a particular model which is easy for you to object to, a straw man. How come SSL certificates in HTTPS transactions can work? Aren't they reasonably analogous? HTTPS transactions aren't remotely analogous to postage. You don't have to check whether that certificate has been used before (using a certificate many times is normal, but a stamp can only be used once). However, a "pay for what you post" model (as opposed to a "stamp" model, which is just one particular type of "pay for what you post" model) can be quite simple, and can be fairly analogous to HTTP. Basically have the ISP sign a digest of each outgoing message (signing a digest covers the re-use issue quite nicely, unless the spammers are clever enough to generate digest collisions). That means that every outgoing message has to be routed through the ISP, and the ISP meeds to verify who is sending it (so he knows who to bill) so the real cost of email will be increased and the email system will cease to be end-to-end. For most users, all outgping email is already routed through the ISP's outgoing mail servers, so the extra costs they cause are limited to the cost of generating the digest and signing it. For most emails, outgpoing email is not routed through the ISP's servers, so there is also the additional cost of accepting, storing, and forwarding the email. A charging model which allows say 50 emails per day free will probably leave email free to the average consumer (and there's nothing to stop massmarket ISPs adopting a range of charging models, in the way that mobile phone operators have - pay a higher subscription and get more free outgoing emails, or a lower subscription and get fewer). There are some problems with mailing lists, since they add headers, unless the digest is only of the mail body and doesn't include the RFC 822 headers, unless eachmessage is payed for twice (once when sent to the list server, again when relayed by the list server). We have to think about the effect on organisations like the ACM and the BCS (which provide permanet address capabilities for their members through adress mapping realys) as well. There is no need to introduce inter-ISP payments for handling each-other's email traffic distinct from any payments already used for providing bandwidth and/or handling general internet traffic. The european postal union certainly deosn't have such transfer payments between its members, why should an email system? In order for the charges to have a deterrent effect on spammers, they have to be high. Much higher than the extra costs incurred by the ISPs. It's not going to deter spammers if we merely double the cost of an email, we have to raise the cost to a level where their operation is no longer profitable. This is where the trouble starts. The costs have to be high enough that it's worth going to the trouble of settting up your own ISP to avoid them, even if you are a legitimate business that doesn't use significant amounts of bulk email. That's what spammers will do - set up their own ISPs. This could perhaps be avoided by bringing in those transfer payments - and now we have all the complexity that Levine was complaining about, and it's probably neccessary to introduce a central clearing house - or rather a hierarchy of clearing houses, as in the banking system. Since these clearing houses will be dealing with the transfer of serious amounts of money, they will be subject to government regulation (regulations to prevent money-laundering, regulations to prevent fraud, regulations for this that and the other) and the email system will be tied up in a vast bureaucracy. The vast bureaucracy may not be too great a price to pay to eliminate spam. Government control of our email (through government regulation of the clearing houses) may not be too great a price to pay. After all, the alternative to getting a handle on spam may be to do without email at all. Personally, I'd prefer to carry on searching for a better solution. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 06:53:12 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA10614 for ; Wed, 21 Apr 2004 06:53:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGFGk-0008Ri-MY for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 06:47:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LAlsj2032462 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 06:47:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGF76-0005Ds-CZ for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 06:37:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA09648 for ; Wed, 21 Apr 2004 06:37:52 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGF72-0003TK-Dj for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 06:37:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGF68-0003L5-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 06:36:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGF5N-0003D2-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 06:36:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGF3J-0003au-IS; Wed, 21 Apr 2004 06:34:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGEyE-0001ai-9N for asrg@optimus.ietf.org; Wed, 21 Apr 2004 06:28:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA09168 for ; Wed, 21 Apr 2004 06:28:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGEyA-0002KX-Bw for asrg@ietf.org; Wed, 21 Apr 2004 06:28:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGExG-0002Dr-00 for asrg@ietf.org; Wed, 21 Apr 2004 06:27:47 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=bfUCNTfHWGY4nXUzU4DgwE65eg09GC7BGCGck9QqsgY) by ietf-mx with esmtp (Exim 4.12) id 1BGEwf-00027C-00 for asrg@ietf.org; Wed, 21 Apr 2004 06:27:09 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id GAA20156; Wed, 21 Apr 2004 06:27:00 -0400 (EDT) From: der Mouse Message-Id: <200404211027.GAA20156@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Re: the e-postage argument In-Reply-To: <27C4E14288DB344FBA10705D57A9BB0401A4A496@DF-CHOPPER.mercury.corp.microsoft.com> References: <27C4E14288DB344FBA10705D57A9BB0401A4A496@DF-CHOPPER.mercury.corp.microsoft.com> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 06:23:33 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > An implicit assumption in this discussion is that in the ePostage > model money must flow from sender to receiver. Well, yes. The basic problem with spam is the imposition of cost on unwilling recipients; I see little point in epostage that pays some other party, as then the recipient has still lost; it's just that someone else has benefited instead. I fail to see how this improves matters significantly. If what you're after is a deterrent effect, call it what it is, a fine, and make the amount more appropriate to a fine! > While that is an attractive model for many reasons, there are other > models in which rather than in-band per message, the money instead > flows out of band up front, and presumably more in bulk, though > likely not to message recipients. In such designs, many of the > constraints articulated below are alleviated. > Indeed, if you think about it, this is more directly analogous to the > gummed-paper physical postage stamps we all know and love. Yes, though there most of the cost the stamp is paying is incurred by the entity who sold the stamp, rather than the recipient. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 07:45:29 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA13648 for ; Wed, 21 Apr 2004 07:45:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGG4d-0001hP-9o for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 07:39:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LBdRvW006527 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 07:39:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGG1A-0008ND-Ie for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 07:35:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA13081 for ; Wed, 21 Apr 2004 07:35:51 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGG19-0003bM-UH for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 07:35:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGG0I-0003Tg-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 07:34:59 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGFzq-0003Lo-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 07:34:30 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGFpj-0004js-S2; Wed, 21 Apr 2004 07:24:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGFnW-0003Ty-PI for asrg@optimus.ietf.org; Wed, 21 Apr 2004 07:21:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA12551 for ; Wed, 21 Apr 2004 07:21:45 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGFnW-0001o2-1f for asrg@ietf.org; Wed, 21 Apr 2004 07:21:46 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGFmc-0001hP-00 for asrg@ietf.org; Wed, 21 Apr 2004 07:20:50 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=DwEwwrZtm13dDWav5tkLM0xY8lQa7K4OPxFLN7qMNBC) by ietf-mx with esmtp (Exim 4.12) id 1BGFm6-0001ae-00 for asrg@ietf.org; Wed, 21 Apr 2004 07:20:18 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id HAA20395; Wed, 21 Apr 2004 07:20:17 -0400 (EDT) From: der Mouse Message-Id: <200404211120.HAA20395@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Re: E-postage In-Reply-To: <16517.56612.196778.643255@world.std.com> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> <40849808.3090005@solidmatrix.com> <16517.56612.196778.643255@world.std.com> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 07:14:42 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > In brief how about: > A) Each ISP creates stamps according to some accepted method, > probably some cryptographic approach. Think SSL certificates or > some similar precedent. How do you stop spammers from acting as ISPs and issuing stamps to themselves for free, without also cutting out individual and other very small sites (like two-person SOHOs) running their own mailservers? All this looks like to me is whitelisting based on signatures (and all that really has over whitelisting based on outgoing mailhost is that it works through multiple hops), and does nothing at all to help people decide which signatures to whitelist (which is the hard part of such whitelisting, because it's the part that has major scaling issues). If you have only a few stamp issuers, it becomes a slightly odd flavour of sender certification, and rather weak sender certification at that. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 08:10:59 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA15462 for ; Wed, 21 Apr 2004 08:10:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGGRU-0001gK-T2 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 08:03:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LC349e006457 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 08:03:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGGOm-0000Er-RJ for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 08:00:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14886 for ; Wed, 21 Apr 2004 08:00:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGGOl-0007PN-VE for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 08:00:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGGMx-00076Q-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 07:58:25 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGGKx-0006Zz-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 07:56:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGGEr-0005kb-Jk; Wed, 21 Apr 2004 07:50:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGGBk-0004Z8-Pw for asrg@optimus.ietf.org; Wed, 21 Apr 2004 07:46:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA13723 for ; Wed, 21 Apr 2004 07:46:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGGBk-0005Eo-3e for asrg@ietf.org; Wed, 21 Apr 2004 07:46:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGGAh-00053i-00 for asrg@ietf.org; Wed, 21 Apr 2004 07:45:44 -0400 Received: from mail1.nber.org ([207.113.108.7]) by ietf-mx with esmtp (Exim 4.12) id 1BGG9m-0004uF-00 for asrg@ietf.org; Wed, 21 Apr 2004 07:44:46 -0400 Received: from mail1 (root@localhost) by mail1.nber.org (8.12.8/8.12.8) with SMTP id i3LBikal026411 for ; Wed, 21 Apr 2004 07:44:46 -0400 Received: from nber1.nber.org (nber1.nber.org [207.113.108.252]) by mail1.nber.org (8.12.8/8.12.8) with ESMTP id i3LBijab026393; Wed, 21 Apr 2004 07:44:45 -0400 From: Daniel Feenberg To: Barry Shein cc: Yakov Shafranovich , asrg@ietf.org Subject: Re: [Asrg] Re: E-postage In-Reply-To: <16517.56612.196778.643255@world.std.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 07:44:42 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Paid email is unlikely to come about because of a joint agreement among ISPs or lawmakers. But it might easily come about (without settlements) in the following way. Somewhere some ISP will decide to allocate abuse desk costs among the divisions. The dial-up manager will then change his policy from unlimited free email for each account, to perhaps "1,000 free messages per month". His marketing person will advise him that to the average dolt, "1,000" seems like MORE than "unlimited", since the average person is not too good with numbers. Once this limitation is imposed, his share of the abuse desk will drop to near zero, and he may even collect a few bucks for additional message (perhaps at $1/1000). Then the T1 division, seeing this, will decide that for new accounts only 100,000 messages on port 25 go with each T1 each month, and any more need to be paid for, at perhaps $1/10,000 messages. This is also a success, and within a year the abuse desk can be reduced to a part timer. Other ISPs will follow suit, but what about ISPs that don't have an abuse desk expense? Won't spammers just end up with them? Yes, and they will end up on blacklists. That is a fine equilibrium. No settlements, no public spirit, just better accounting. (And an MTA that can keep some records). On Tue, 20 Apr 2004, Barry Shein wrote: > > On April 19, 2004 at 23:24 research@solidmatrix.com (Yakov Shafranovich) wrote: > > With the current state of affairs I simply do not see how any kind of > > e-postage system would take off at all within a reasonable span of time > > even once all of the technical issues have been addressed. The same goes > > Isn't this the canned, applies to anything, response? > > It's been nearly ten years and no one has come up with anything, > perhaps it's time to put the "that would take too long to be accepted" > on the back burner and discuss other aspects? > > > for any proposal calling for a major infrastructure overhaul - there > > simply isn't enough monetary or non-monetary incentive for network > > operators, software providers and governments to make a major change of > > that scale. It may very well be that the system may collapse due to that > > (which I personally do not think will happen). > > It (e-postage) doesn't require much any infrastructure overhaul. > > Maybe some ways of imagining it being implemented do, but maybe the > goal should be to say well, if we do it that way it'd require a major > infrastructure haul, can we do it some other way. > > In brief how about: > > A) Each ISP creates stamps according to some accepted method, > probably some cryptographic approach. Think SSL certificates or > some similar precedent. > > B) They attach a stamp to mail according to some policy such > as e-mail originating from their customers. > > C) Stamps can be allocated according to any policy they choose, at > least at first. For example, give each customer 1,000 stamps per > month and charge for excess, whatever, that's a marketing decision. > > D) However, other ISPs can choose to transit or not email with > particular stamps. > > E) Unstamped mail could be accepted for a while and then ISPs can > choose to reject it. > > Ok, maybe it needs work. But it's hardly off-the-wall, and it doesn't > require major infrastructure nor would take years and years. If a few > major players said this is the way we're going, here's some software > to do this, and we'd be off and running. > > I don't propose that as a worked-out solution, only as an example that > one can approach the problem more positively, and to point out that > ready-made, all-purpose blow-offs like "it would take too long" really > don't improve the quality of discussion, except perhaps when posed as > questions rather than assertions. > > > _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 10:02:58 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21885 for ; Wed, 21 Apr 2004 10:02:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGI8P-0003zZ-Ui for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 09:51:30 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LDpTWB015338 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 09:51:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGI7a-0003Y3-Qb for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 09:50:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA20889 for ; Wed, 21 Apr 2004 09:50:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGI7Y-0001Mx-Vd for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 09:50:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGI5y-00010e-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 09:48:58 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BGI5D-0000rb-02 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 09:48:11 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BGI3M-0007p9-L8 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 09:46:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGHwP-0006xi-AS; Wed, 21 Apr 2004 09:39:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGHqh-0003jk-52 for asrg@optimus.ietf.org; Wed, 21 Apr 2004 09:33:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA20095 for ; Wed, 21 Apr 2004 09:33:08 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGHqf-0006JH-BP for asrg@ietf.org; Wed, 21 Apr 2004 09:33:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGHph-00068g-00 for asrg@ietf.org; Wed, 21 Apr 2004 09:32:10 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BGHpF-0005yO-00 for asrg@ietf.org; Wed, 21 Apr 2004 09:31:41 -0400 Received: (qmail 18658 invoked by uid 100); 21 Apr 2004 13:31:34 -0000 Message-ID: <20040421133134.18657.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Re: not E-postage In-Reply-To: <16517.56612.196778.643255@world.std.com> Organization: I.E.C.C., Trumansburg NY USA Cc: bzs@world.std.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 21 Apr 2004 13:31:34 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >In brief how about: > > A) Each ISP creates stamps according to some accepted method, > probably some cryptographic approach. Think SSL certificates or > some similar precedent. > > B) They attach a stamp to mail according to some policy such > as e-mail originating from their customers. > > C) Stamps can be allocated according to any policy they choose, at > least at first. For example, give each customer 1,000 stamps per > month and charge for excess, whatever, that's a marketing decision. > > D) However, other ISPs can choose to transit or not email with > particular stamps. > > E) Unstamped mail could be accepted for a while and then ISPs can > choose to reject it. This is a fine plan. In fact, it already has a name -- it's domain keys (with an implementation tweak that ISPs rate limit their retail customers' mail, which is a reasonable idea on its own). Each domain signs its own mail, the keys to check the signatures are in the DNS, and recipients can do whatever they want with mail signatures. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 19:45:22 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01531 for ; Wed, 21 Apr 2004 19:45:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRKP-000081-0K for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:40:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LNeSSU000488 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:40:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGR7F-0001CD-Du for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 19:26:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00116 for ; Wed, 21 Apr 2004 19:26:52 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGR7D-00068l-Or for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:26:51 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGR6I-0005tw-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:25:56 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGR5R-0005dH-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:25:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGQoz-0007pL-N1; Wed, 21 Apr 2004 19:08:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGDLa-0006KX-Mm for asrg@optimus.ietf.org; Wed, 21 Apr 2004 04:44:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA04421 for ; Wed, 21 Apr 2004 04:44:43 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGDLX-0005Jl-N5 for asrg@ietf.org; Wed, 21 Apr 2004 04:44:43 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGDKf-0005DF-00 for asrg@ietf.org; Wed, 21 Apr 2004 04:43:50 -0400 Received: from vqbn-link.syd.comindico.com.au ([203.221.180.26] helo=veritel.com.au) by ietf-mx with esmtp (Exim 4.12) id 1BGDKJ-00056b-00 for asrg@ietf.org; Wed, 21 Apr 2004 04:43:27 -0400 Received: (qmail 23031 invoked from network); 21 Apr 2004 08:43:20 -0000 Received: from unknown (HELO dle5) (send@veritel.com.au@220.240.19.195) by 29.180.221.203.comindico.com.au with SMTP; 21 Apr 2004 08:43:20 -0000 From: "Joshua Leisk" To: Subject: RE: [Asrg] 'Registered Email' and 'Trust-E-mail' proposals for both spam and viruses MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2727.1300 Thread-Index: AcQnduCKt0YfmawVSYSUDlGiJ9oPowABbOIw Message-Id: Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 18:43:23 +1000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL,MISSING_OUTLOOK_NAME autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Hi der Mouse, I have responded to your helpful questions and comments. Please read anything I have commented with "(JL)". This idea was hatched as a stepping-stone phase to my 'registered mail' concept.. ( http://www.intechcomm.net.au ). Cheers, Joshua -----Original Message----- From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org] On Behalf Of der Mouse Sent: Wednesday, 7 April 2004 1:41 PM To: asrg@ietf.org Subject: Re: [Asrg] 'Registered Email' and 'Trust-E-mail' proposals for both spam and viruses > In January, I came up with a technically feasible solution to spam > and email viruses, [...] This looks to me like another FUSSP. Most briefly, it has severe scaling problems; if the stuff described is done per recipient site, it has catastrophic scaling problems, whereas if it's done through a central registry, it has central point of failure/trust/pressure problems. It also appears to have been designed by someone who understands neither email (for example, the confusing between MX hosts and outgoing mailservers, and the peculiar notion that all domains that send mail appear directly in something like a root server) nor the DNS (thinking the root servers hold MX records, thinking that the DNS anywhere holds creation dates). (JL) Why not use the DNS as the database? Either create a new rootserver or TLD? Also, I realise that the MX hosts are the receiving mailservers for a domain name, however most organisations use a mailserver for both sending and receiving, not just relaying. I should have clarified scanning the rootservers and the resultant whois information, I didn't expect anyone to be picky about the exact info, more the concept. In more detail.... > This is performed to create an automated global white-list, for > immediate mail server trust ranking and immediate SMTP virus > prevention for receiving mail servers. This is done by creating an > application that scans the DNS Rootservers daily for: (a) Instant scaling problems. Every email site downloading the entire root zones daily? Or if a centralized site, why should everyone trust it, what will be done to protect it against technological and legal attacks? (JL) Centralized. Why should anyone trust anybody else's anti-spam products (eg. Symantec, Brightmail)? Being that the scan can be performed from a dynamic IP address, technology attacks are easy to avoid. Legal attacks will be interesting. Existing DNSBL manage to avoid them for the most part, so I don't see the difference.. (b) You're assuming the DNS root servers are the appropriate place to check. This is true for approximately no domains. Even the gtld-servers.net machines are good only for .com/.net/.org, and only for second-level domains there. (JL) Well the bot will need to crawl through the whole DNS system, from the top down, hence starting at the rootservers. This is much the same as Google or any of the other search engines. > Domain Name > MX Records > Domain Creation Date The DNS does not contain domain creation dates. The root servers do not have MX records for any significant number of domains. You have to ask the domains' servers themselves for that. This also assumes all email domains will be @ domains that appear directly in the roots. This is false (eg, my own mailhost, sparkle.rodents.montreal.qc.ca - only .ca appears in the roots; even if you go to the .ca roots, only rodents.montreal.qc.ca appears there). I also have trouble imagining why a receiving system cares about anyone else's MX records. Are you perhaps falling into the trap of thinking that MX records have anything to do with outgoing mail? (JL) Not in all instances, but most of them. Any mail server that is capable of receiving should also be capable of sending. I am only trying to establish age and reputation. > Using this information, a database is created, containing: > Domain Name > MX Records > Domain Creation Date > Trust Level / Rank > [...] More scaling problems. Every email site is going to recreate this ginormous database daily? Where will they store it? (JL) If the DNS is used to seed the info, it's not a big deal. > Trusted DNS blacklists, eg Spamhaus, should be applied against the > resultant initial database Most DNS blacklists do not list domain names (which are all you have at this point, since you haven't described anything that involves any addresses), only addresses. More scaling problems - you're having every email site doing some huge number of queries (on the order of the number of domains) to at least a few DNSLs. Daily. If even a small fraction of the mailservers on the net were to do this, it would amount to a DDoS on the DNSLs. (JL) Again, not if the DNS system is used as the database. > "U" - Untrustworthy. > Any domain that is less than 12 months old and has not applied for So domains must exist for a year before anyone will let them send mail, unless they specifically negotiate an agreement of some kind with the recipient? This might help for a year; all it would do after that is mean that spammers need a lag time of a year between registering domains and using them. It would raise their costs slightly, but that's about it. On the other hand, it will severely cripple net.newcomers. Looks to me as though it causes trouble for the wrong people. (JL) They can still forward mail through their ISP mailserver. > Any domain that [...] does not relay mail from clients that are not > using SASL / TLS / SPA and blocks outgoing emails with dangerous > attachments. Dangerous in whose opinion? How can you prove whether a mailserver (it's mailservers that relay mail, not domains) insists on sasl/tls/etc? (Don't forget, spamhauser _will_ lie about what their outgoing mailservers do if they think it will help them.) (JL) SASL is only for the mailserver's protection, not the outside world's. > Any domain that is less than 12 months old, but has paid a security > bond against spamming, Paid to whom? If this isn't per-recipient, why should anyone trust this entity? Especially those in other countries than it? (JL) This is the bit that needs discussion. > 3. Penalties: > Any mail server proven to send Spam will have its ranking lowered. Proven to whose satisfaction? (JL) Whoever is managing the database, or a 3rd party watchdog. > 'Bonded' mail servers could forfeit all or part of the bond supplied. Forfeit to whom? This system sounds as though it's either got a single central point of trust/failure, or it's nothing but a rather elaborate and resource-hungry form of individual whitelisting. (JL) Yes, a global whitelist... hasn't been done yet. > Severe breaches will result in a permanent "U" ranking being > attributed. Until the lawyers attack it. (If your system becomes successful enough to matter, this _will_ happen.) > This is an extremely easy-to-implement, automated 'whitelist' > solution, Doesn't sound easy to implement to me. You need some big legal defenses (or you will if it becomes at all effective), you need someone trusted enough to handle the bonds, you need to somehow get permission to DDoS the root nameservers plus whatever other servers you need to hit up to find the information you (think you) need, and above all you need buy-in from both senders and receivers. > This requires no active participation of the sender or end-recipient, Sounds to me as though it does; the sender has to apply for something or post a bond of some sort or some such, and the recipient has to check all this goop. (JL) Which means it needs recipient changes only... At the discretion of the mail server owner/ admin rather than a global change. > [...], and allows for 'home' and 'hobby' email servers. How? A number (such as me) will refuse outright on principle. Most of the others, any bond they can afford would be so small as to be ignorable as a cost-of-doing-business to a spamhaus of any size. Or are they supposed to just suffer for the first year, until they've been around long enough to be mistaken for spammer^W^W^Wallowed to send mail? (JL) Nah, just need to relay through their mailserver. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 19:45:49 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01579 for ; Wed, 21 Apr 2004 19:45:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRKP-00008O-7A for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:40:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LNeT39000507 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:40:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGR7H-0001Dj-Uw for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 19:26:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00121 for ; Wed, 21 Apr 2004 19:26:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGR7G-000696-Fz for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:26:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGR6K-0005u5-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:25:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGR5R-0005dI-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:25:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGQoy-0007p5-So; Wed, 21 Apr 2004 19:08:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BG9LW-00038x-Vk for asrg@optimus.ietf.org; Wed, 21 Apr 2004 00:28:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22506 for ; Wed, 21 Apr 2004 00:28:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BG9LU-00000E-Bs for asrg@ietf.org; Wed, 21 Apr 2004 00:28:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BG9KW-0007jG-00 for asrg@ietf.org; Wed, 21 Apr 2004 00:27:24 -0400 Received: from tom.iecc.com ([208.31.42.38]) by ietf-mx with esmtp (Exim 4.12) id 1BG9JY-0007ZM-00 for asrg@ietf.org; Wed, 21 Apr 2004 00:26:24 -0400 Received: (qmail 14260 invoked from network); 21 Apr 2004 04:26:21 -0000 Received: (ofmipd 127.0.0.1); 21 Apr 2004 04:25:59 -0000 Message-ID: From: "John R Levine" To: "Barry Shein" Cc: "asrg@ietf.org" In-Reply-To: <16517.58688.435810.99883@world.std.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <16517.58688.435810.99883@world.std.com> Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [Asrg] Re: Re: the e-postage argument Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 21 Apr 2004 00:26:19 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 > Some critical thought as to why a particular model which supports an > objection might just be a bad model would be useful also. Straw men > and all that. I entirely agree. But there are bad models all around. I also understand that a lot of the details of any e-postage system are not interesting to you or to a lot of other people (frequently including me), but boring isn't the same as easy or cheap. When I write someone a check, I don't care about the details of how the check gets from his bank back to my bank (or the check's picture more likely these days) or how the money goes out of my account at my bank through some bank version of cyberspace into his bank and his account, and all the other things that happen if there isn't money in my account to pay the check. But someone had to work it out, and there are large, expensive, complex back office systems making it all happen. Since an e-postage transaction does basically the same things as any other financial transaction, if you're going to claim that it's not like all the other kinds of transactions, you really have to do more than wave your hands. Even the simplest kind of transactions, where you hand me a quarter to buy a paper, have to be backed up by a credible issuer of the quarters and some way I can turn the quarter into money that's useful for something else. > Maybe there are no settlements, who told you there have to be > settlements? You did. You said that we need an e-postage system to rebalance the costs of e-mail. Settlements are the way that the money gets from the senders to the recipients who bear the costs. In the absence of settlements, only the senders' ISPs or maybe the banks who sell them the stamps make any money. I gather from the rest of your message that you have a model of e-postage that doesn't do settlements, doesn't have double spending problems, and will work fine in the face of floods of mail with fake postage. Don't leave us in suspense. Tell us about it. If you know how to prevent double spending of stamps without checking with the issuer, I know a whole lot of micropayment researchers who'd like to talk to you, since that's a problem that they've been thinking about for at least a decade. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY "I dropped the toothpaste", said Tom, crestfallenly. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 19:45:50 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01596 for ; Wed, 21 Apr 2004 19:45:50 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRKQ-00009W-5j for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:40:30 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LNeUYa000586 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:40:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGR8h-0002Bp-Jj for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 19:28:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00189 for ; Wed, 21 Apr 2004 19:28:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGR8f-0006X4-TY for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:28:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGR7c-0006JK-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:27:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGR6p-00065V-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:26:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGQp0-0007pb-BG; Wed, 21 Apr 2004 19:08:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGDvf-0003HG-Ui for asrg@optimus.ietf.org; Wed, 21 Apr 2004 05:22:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA06089 for ; Wed, 21 Apr 2004 05:21:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGDva-0001oF-HB for asrg@ietf.org; Wed, 21 Apr 2004 05:21:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGDug-0001g0-00 for asrg@ietf.org; Wed, 21 Apr 2004 05:21:03 -0400 Received: from mail22.messagelabs.com ([62.231.131.211]) by ietf-mx with smtp (Exim 4.12) id 1BGDtm-0001Ow-00 for asrg@ietf.org; Wed, 21 Apr 2004 05:20:06 -0400 X-VirusChecked: Checked X-Env-Sender: msergeant@messagelabs.com X-Msg-Ref: server-3.tower-22.messagelabs.com!1082539172!7680571 X-StarScan-Version: 5.2.10; banners=messagelabs.com,-,- X-Originating-IP: [212.125.75.70] Received: (qmail 29630 invoked from network); 21 Apr 2004 09:19:32 -0000 Received: from smtp-1.star.net.uk (212.125.75.70) by server-3.tower-22.messagelabs.com with SMTP; 21 Apr 2004 09:19:32 -0000 Received: (qmail 10924 invoked from network); 21 Apr 2004 09:17:41 -0000 Received: from unknown (HELO matt-dev.int.star.co.uk) (195.216.14.9) by smtp-1.star.net.uk with SMTP; 21 Apr 2004 09:17:41 -0000 Received: (qmail 26641 invoked from network); 20 Apr 2004 09:07:34 -0000 Received: from unknown (HELO ?10.2.100.139?) (10.2.100.139) by matt?dev.int.star.co.uk with SMTP; 20 Apr 2004 09:07:34 -0000 In-Reply-To: <40856BF7.2020007@americasm01.nt.com> References: <20040419214914.F2D7716CC3@mail.nitros9.org> <40856BF7.2020007@americasm01.nt.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Matt Sergeant Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? To: "Chris Lewis" X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 10:19:29 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On 20 Apr 2004, at 19:29, Chris Lewis wrote: > Say, Yakov, you still waiting on Matt for DNSBL BCP publication? Yes he is. I got back from a two week holiday on Monday so I'm still in catchup mode, but I intend to get back to Yakov today with a couple of minor edits. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 19:46:44 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01774 for ; Wed, 21 Apr 2004 19:46:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRL9-0000ha-QQ for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:41:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3LNfFgv002692 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 19:41:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRAk-00036o-9Z for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 19:30:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA00326 for ; Wed, 21 Apr 2004 19:30:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGRAi-0006xj-PE for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:30:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGR9n-0006ka-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:29:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGR8p-0006YR-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 19:28:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGQp0-0007pk-V1; Wed, 21 Apr 2004 19:08:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGE8s-0007z3-6e for asrg@optimus.ietf.org; Wed, 21 Apr 2004 05:35:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA06856 for ; Wed, 21 Apr 2004 05:35:38 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGE8o-0003gl-P5 for asrg@ietf.org; Wed, 21 Apr 2004 05:35:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGE7r-0003aP-00 for asrg@ietf.org; Wed, 21 Apr 2004 05:34:39 -0400 Received: from mail22.messagelabs.com ([62.231.131.211]) by ietf-mx with smtp (Exim 4.12) id 1BGE6v-0003Nx-00 for asrg@ietf.org; Wed, 21 Apr 2004 05:33:42 -0400 X-VirusChecked: Checked X-Env-Sender: msergeant@messagelabs.com X-Msg-Ref: server-17.tower-22.messagelabs.com!1082539992!7744506 X-StarScan-Version: 5.2.10; banners=messagelabs.com,-,- X-Originating-IP: [212.125.75.70] Received: (qmail 20644 invoked from network); 21 Apr 2004 09:33:12 -0000 Received: from smtp-1.star.net.uk (212.125.75.70) by server-17.tower-22.messagelabs.com with SMTP; 21 Apr 2004 09:33:12 -0000 Received: (qmail 18261 invoked from network); 21 Apr 2004 09:31:22 -0000 Received: from unknown (HELO matt-dev.int.star.co.uk) (195.216.14.9) by smtp-1.star.net.uk with SMTP; 21 Apr 2004 09:31:22 -0000 Received: (qmail 26691 invoked from network); 20 Apr 2004 09:21:14 -0000 Received: from unknown (HELO ?10.2.100.139?) (10.2.100.139) by matt?dev.int.star.co.uk with SMTP; 20 Apr 2004 09:21:14 -0000 In-Reply-To: <16517.56612.196778.643255@world.std.com> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> <40849808.3090005@solidmatrix.com> <16517.56612.196778.643255@world.std.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, Yakov Shafranovich From: Matt Sergeant Subject: Re: [Asrg] Re: E-postage To: Barry Shein X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 10:33:10 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On 21 Apr 2004, at 03:32, Barry Shein wrote: > A) Each ISP creates stamps according to some accepted method, > probably some cryptographic approach. Think SSL certificates or > some similar precedent. > > B) They attach a stamp to mail according to some policy such > as e-mail originating from their customers. > > C) Stamps can be allocated according to any policy they choose, at > least at first. For example, give each customer 1,000 stamps per > month and charge for excess, whatever, that's a marketing decision. > > D) However, other ISPs can choose to transit or not email with > particular stamps. > > E) Unstamped mail could be accepted for a while and then ISPs can > choose to reject it. Stamps buy you nothing in this scenario. ISPs are already free to reject mail from ISPs they don't like, and throttle their customers to only be able to send N mails per day. But they don't do it (some throttle, but hardly any reject based on ISP, unless that ISP happens to be a spammer masquerading as an ISP). As an ISP perhaps you can answer why they don't do it? Matt. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 20:22:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04082 for ; Wed, 21 Apr 2004 20:22:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRtE-0001O8-PW for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 20:16:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3M0GSq3005328 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 20:16:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRmS-0005kP-V8 for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 20:09:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA02967 for ; Wed, 21 Apr 2004 20:09:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGRmQ-00078Y-RE for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:09:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGRlf-0006x2-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:08:39 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGRkv-0006kL-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:07:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRRg-0004X4-HV; Wed, 21 Apr 2004 19:48:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRN5-0001Zi-Jw for asrg@optimus.ietf.org; Wed, 21 Apr 2004 19:43:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01328 for ; Wed, 21 Apr 2004 19:43:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGRN3-0001qM-Rl for asrg@ietf.org; Wed, 21 Apr 2004 19:43:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGRM9-0001e9-00 for asrg@ietf.org; Wed, 21 Apr 2004 19:42:18 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BGRLE-0001Rn-00 for asrg@ietf.org; Wed, 21 Apr 2004 19:41:20 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3LNfLd1006575; Wed, 21 Apr 2004 19:41:21 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id TAA08840; Wed, 21 Apr 2004 19:41:20 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16519.1696.565755.592545@world.std.com> To: John Levine Cc: asrg@ietf.org, bzs@world.std.com Subject: Re: [Asrg] Re: not E-postage In-Reply-To: <20040421133134.18657.qmail@xuxa.iecc.com> References: <16517.56612.196778.643255@world.std.com> <20040421133134.18657.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 19:41:20 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 21, 2004 at 13:31 asrg@johnlevine.com (John Levine) wrote: > This is a fine plan. In fact, it already has a name -- it's domain > keys (with an implementation tweak that ISPs rate limit their retail > customers' mail, which is a reasonable idea on its own). Each domain > signs its own mail, the keys to check the signatures are in the DNS, > and recipients can do whatever they want with mail signatures. The critical thing to add is metering all around. -b _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 20:33:38 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05115 for ; Wed, 21 Apr 2004 20:33:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRzM-0004lo-5B for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 20:22:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3M0MmDB018330 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 20:22:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRwR-0002zf-Hi for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 20:19:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03919 for ; Wed, 21 Apr 2004 20:19:45 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGRwP-0001jR-GN for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:19:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGRva-0001VF-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:18:55 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGRug-0001Fg-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:17:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRp1-0007pC-Vj; Wed, 21 Apr 2004 20:12:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGReX-0000j2-CI for asrg@optimus.ietf.org; Wed, 21 Apr 2004 20:01:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA02460 for ; Wed, 21 Apr 2004 20:01:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGReV-0005Ro-C2 for asrg@ietf.org; Wed, 21 Apr 2004 20:01:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGRdW-0005GW-00 for asrg@ietf.org; Wed, 21 Apr 2004 20:00:14 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BGRcV-0004za-00 for asrg@ietf.org; Wed, 21 Apr 2004 19:59:11 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3LNx8pV015331; Wed, 21 Apr 2004 19:59:08 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id TAA28782; Wed, 21 Apr 2004 19:59:07 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16519.2763.423965.408437@world.std.com> To: Matt Sergeant Cc: Barry Shein , asrg@ietf.org, Yakov Shafranovich Subject: Re: [Asrg] Re: E-postage In-Reply-To: References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> <40849808.3090005@solidmatrix.com> <16517.56612.196778.643255@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 19:59:07 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 21, 2004 at 10:33 msergeant@messagelabs.com (Matt Sergeant) wrote: > Stamps buy you nothing in this scenario. ISPs are already free to > reject mail from ISPs they don't like, and throttle their customers to > only be able to send N mails per day. This adds objectivity to the process, you're sending me mail with invalid stamps so I dropped it all (either due to counterfeiting or revocation.) That's a lot better than "I think you host spammers". > But they don't do it (some throttle, but hardly any reject based on > ISP, unless that ISP happens to be a spammer masquerading as an ISP). > As an ISP perhaps you can answer why they don't do it? Well, I won't completely agree that hardly any reject based on ISP, it's not often advertised. But SPEWS for example approached this, so one could check who used SPEWS. That said, one concern is collateral damage and the other is lack of objectivity so one tends to act cautiously before it becomes an all-out shooting war. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 20:40:47 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05461 for ; Wed, 21 Apr 2004 20:40:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGS9A-0008JE-Th for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 20:32:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3M0WucT031935 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 20:32:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRz0-0004fH-1I for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 20:22:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA04115 for ; Wed, 21 Apr 2004 20:22:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGRyx-0002Mv-Vr for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:22:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGRxt-00027W-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:21:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGRwq-0001oA-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 20:20:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRp3-0007pc-4K; Wed, 21 Apr 2004 20:12:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGRfW-0000yc-V4 for asrg@optimus.ietf.org; Wed, 21 Apr 2004 20:02:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA02519 for ; Wed, 21 Apr 2004 20:02:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGRfV-0005dD-0X for asrg@ietf.org; Wed, 21 Apr 2004 20:02:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGReZ-0005SP-00 for asrg@ietf.org; Wed, 21 Apr 2004 20:01:20 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BGRdd-0005HJ-00 for asrg@ietf.org; Wed, 21 Apr 2004 20:00:21 -0400 Received: from world.std.com (chungf@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3M00Ld3024041; Wed, 21 Apr 2004 20:00:21 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id TAA11199; Wed, 21 Apr 2004 19:53:38 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16519.2434.438330.554428@world.std.com> To: der Mouse Cc: asrg@ietf.org Subject: Re: [Asrg] Re: E-postage In-Reply-To: <200404211120.HAA20395@Sparkle.Rodents.Montreal.QC.CA> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> <40849808.3090005@solidmatrix.com> <16517.56612.196778.643255@world.std.com> <200404211120.HAA20395@Sparkle.Rodents.Montreal.QC.CA> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 19:53:38 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 21, 2004 at 07:14 mouse@Rodents.Montreal.QC.CA (der Mouse) wrote: > > In brief how about: > > > A) Each ISP creates stamps according to some accepted method, > > probably some cryptographic approach. Think SSL certificates or > > some similar precedent. > > How do you stop spammers from acting as ISPs and issuing stamps to > themselves for free, without also cutting out individual and other very > small sites (like two-person SOHOs) running their own mailservers? You wouldn't honor them. Small sites would probably get any such credentials from their provider, something like a postage meter. > All this looks like to me is whitelisting based on signatures (and all > that really has over whitelisting based on outgoing mailhost is that it > works through multiple hops), and does nothing at all to help people > decide which signatures to whitelist (which is the hard part of such > whitelisting, because it's the part that has major scaling issues). If > you have only a few stamp issuers, it becomes a slightly odd flavour of > sender certification, and rather weak sender certification at that. More like the latter, or at least to the degree that SSL certs might be, and the objection is? The critical aspect is to get the metering working, to let parties begin to know, as a regular part of doing business, what's going on. Remember that old adage about "Mechanism, Not Policy"? Part of the problem with the e-postage discussion is that people are trying to imagine every aspect of policy to see if they still like the idea. That's very hard and, for those so inclined, easily leads to objections: So, Mr Ford, you're going to manufacture and sell everyone one of these automobiles! And where exactly are they going to drive them? What roads would they use? The current roads seem inadequate for motor-driven vehicles. And what's to become of our thriving horse and buggy industry? Civilization has done just fine for 10,000 years without these noisy things, why should we be interested? Policy should probably be developed as a consensual act among ISPs and others. Mechanism should be discussed here. Although I agree that some discussion of policy etc is very useful just for plausibility and impact, but the limitations of such discussions have to be kept in mind. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 21:42:35 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09112 for ; Wed, 21 Apr 2004 21:42:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGT5Q-0001aD-BL for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 21:33:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3M1X8K4006080 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 21:33:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGT0w-0000PL-Np for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 21:28:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA08249 for ; Wed, 21 Apr 2004 21:28:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGT0u-0000Hu-1X for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:28:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGSzt-00003l-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:27:26 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGSym-0007ZA-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:26:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGSvg-0005Ro-KF; Wed, 21 Apr 2004 21:23:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGSpB-0002ek-FJ for asrg@optimus.ietf.org; Wed, 21 Apr 2004 21:16:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA07620 for ; Wed, 21 Apr 2004 21:16:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGSp8-0005a9-P5 for asrg@ietf.org; Wed, 21 Apr 2004 21:16:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGSoB-0005No-00 for asrg@ietf.org; Wed, 21 Apr 2004 21:15:20 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BGSnJ-00052A-00 for asrg@ietf.org; Wed, 21 Apr 2004 21:14:25 -0400 Received: from [192.168.0.3] (h00095b86f221.ne.client2.attbi.com[24.128.50.188]) by comcast.net (sccrmhc12) with SMTP id <2004042201135301200p2q0ve>; Thu, 22 Apr 2004 01:13:54 +0000 Message-Id: <4DBC7314-93FA-11D8-9A39-00039380F1B6@pobox.com> X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-3: like Habeas SWE (tm) Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this From: mathew X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-2: brightly anticipated In-Reply-To: <408460BB.40404@solidmatrix.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <408460BB.40404@solidmatrix.com> To: asrg@ietf.org X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-3--937472429; protocol="application/pkcs7-signature" X-Habeas-Swe-1: winter into spring X-Habeas-Swe-9: mark in spam to . X-Mailer: Apple Mail (2.613) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 21:13:46 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.2 required=5.0 tests=OFFERS_ETC autolearn=no version=2.60 --Apple-Mail-3--937472429 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit On Apr 19, 2004, at 19:28, Yakov Shafranovich wrote: > My single concern with e-postage is that in the real world bulk > mailers do not break into post offices and dump their mail in, nor do > they bribe people to go to the post office and put mail in for them. They would, if screwing with the USPS wasn't a felony that gets you jail time. You'll notice that casual phone phreaking dropped off real fast once Kevin Mitnick and a bunch of other hackers were sent to federal prison. > - stealing accounts is very easy because everyone is connected and > many people don't know how to secure their computers. If it started costing them a few hundred dollars a month to remain ignorant, I bet they'd learn real fast or get off the net. And frankly, I don't care which, because the buffoons we're talking about are the ones bombarding me with megabytes of spam and viruses. > I am refering to the issue of hijacked computers. With an e-postage > system nothing stops a spammer from stealing Aunt Mary's computer via > a virus and sending out spam with her e-postage account. Who is going > to pay in that case? The usual response to that example is that her > e-postage account will run out. This is basically the same as rate > limiting and can be done today without resorting to e-postage. But > rate limiting is not always possible such as when an ISP rents out the > underlying connectivity from a third party. There was also a > suggestion in one of the subgroups to write up a BCP describing how to > do rate limiting. Your logic here seems to be "having a limited supply of funds to be used for e-postage is a bit like rate limiting, and rate limiting is sometimes difficult, hence limiting e-postage funds is difficult". Needless to say, that doesn't follow at all. A dolphin is a bit like a fish, and fish can't breathe air, therefore dolphins can't breathe air. People do this kind of money-based spending limiting all the time. They set up debit accounts they can use on the net with minimal balances, so that if the account gets hacked the thief can only steal a small amount. They buy Starbucks cards and phone cards with $20 of coffee or telephone calls in, so if a thief steals the easily-stolen and anonymous card, they're only out $20. They get the credit card company to lower their credit lines. Hell, if theft via computer hijacking without the user noticing really turns out to be that much of a problem, we can sell e-postage on $10 plastic cards at the corner store, and computers could be fitted with a $20 card reader. No need to have an associated account that can be drained. If you swipe the card and the postage all vanishes, you know you've been 0wN3d and call the cops. The technology is cheap and easy. > Otherwise, I do not see what the ASRG or the IETF can do for or > against e-postage - it is simply not within the scope of standards at > this point. Well, it might be useful to set out some requirements. Or is that not within the IETF's remit? (Serious question.) > Another issue is convincing people to switch - the unlimited/free > pricing scheme has been embedded into the psyche of Internet users to > such extend, that it will very hard to convince people to switch. That's why I think one important requirement is that the receiver be allowed to waive or refund the postage fee at his discretion. Basically, what I want to see is that if you want to mail me, you have to put offer me a nickel as a show of good faith that your mail isn't spam. Obviously if your mail isn't spam, I don't have to take the nickel; and if I'm an ass and take it anyway, you're only out a nickel. > ISPs also have to be convinced to spend money on supporting and > participating in the e-postage infrastructure. There are several options here. One is that we could let them swipe a fraction of the e-postage; or rather, add it on to the top. So if I charge 5 cents and my ISP charges 1 cent, you have to risk 6 cents, and will typically have to pay 1 cent--unless you're a spammer, in which case you lose the entire 6 cents. Sure, some ISPs will price-gouge. The result will be that they'll lose customers, because nobody will want to e-mail their customers. Competition should do the rest. Another option is that the ISP could take a fraction of the cash that would otherwise be credited to each user's account at the end of the month. So if a month's worth of e-mail would result in my getting $10 from commercial junk mailers and spending $4 on sending mail myself, the net would be $6 in my favor, and the ISP would get (say) 5% of that. Again, market forces would punish ISPs who attempted to gouge. The end result would work almost exactly like the Amazon tip jar or eBay, both of which seem to be doing just fine. And that's without even considering the potential savings from not having huge quantities of spam flowing through their servers. As soon as there's an e-postage system like I discuss above (*) running in parallel with the current e-mail system, I for one will use it and encourage all my friends to do so. I'll also tell people who have trouble getting past my spam filters to use it, and if they refuse and get bitten by the filter, that's their problem and it has a <5 cent solution. And after a while I'd probably whitelist all my family and friends, and tell everyone else to use the e-postage system. So while I share some of Barry's skepticism about people being willing to go for e-postage, and about the vitriol and lies we'll hear from the press about it, ultimately I'm not sure that matters. If it works, it'll spread virally. > Would it be viable for all of the parties interested in e-postage to > get together and start working together including addressing the > issues raised and testing code, instead of just discussing the idea? Well, I'd be happy to make suggestions, test stuff, and maybe even help with documentation, but I only intermittently have spare time. Still, if there's a list I can join, I'm willing to pull out the outliner and come up with a first cut at what *I* think some of the requirements need to be. > Of course Microsoft is interested in it as per Bill Gates's speech but > they are also a software provider, so their interest may have a > different motivation. I don't think Microsoft is interested in e-postage as we discuss it; I think they're interested in a system where Microsoft gets a couple of cents every time you send an e-mail to or from a Windows system. I'll go without e-mail before I'll pay a penny to Microsoft, and I believe there are enough like-minded people that a pay-Microsoft-for-email system would fail as badly as Microsoft Passport has failed. mathew [ (*) In particular, with the "refund" functionality. ] --Apple-Mail-3--937472429 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGEDCCAskw ggIyoAMCAQICAwwEFTANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDQwMzI4MjA1ODExWhcNMDUwMzI4MjA1ODExWjBAMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMR0wGwYJKoZIhvcNAQkBFg5tZXRhQHBvYm94LmNvbTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOXun6xaDS5SyU0KswTKlW/Fdfknsyfk64UT B6Lb0AyYlNPoNGsgFtBRRQru1WYXmdUsyru8cvp0u9aqjslP6BFv13VF3XBWhDGctnO1gUkuaWNi G58zUvADdOJen8jL1SyzXF4gpY8dxk4gNwp8a1NqN5NBQwfrHSOdWtdqNudJCF7dwCGJBgyoN3I9 v1WtVRZIeNn7S1AmwtbCPckcYwnBK28giolxm6eYS2FDHEFyM1PPuvuvBm0zShLhWNxQSRsUL9gd CWgyrcShStkwx9rinFo9Ens0/r7zcytPFL77t1p16mQ8O6J1ZGeF6t9yMJm5tDL+IfQbtJruSwF5 ERUCAwEAAaMrMCkwGQYDVR0RBBIwEIEObWV0YUBwb2JveC5jb20wDAYDVR0TAQH/BAIwADANBgkq hkiG9w0BAQQFAAOBgQAynR69x1axSiz4b32j6kRWj+jjQJFvl5zMvdnZpRWdyvL9gscwt2bro3TD cvEI9kELco0BzcLyftMV9rGjSOuiCpJRsWe0/uGB/YVhAuuTpBPoEQblQb4cwoE578of2pludQWB yg0Qn5aGXTS+uYsm34s94E3jObPTiGUIiukROzCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEF BQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUg VG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24g U2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTEr MCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAw MDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3Vs dGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWlu ZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me 7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r 1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCB kTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3Rl LmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPq Cy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUa C4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx 0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz dWluZyBDQQIDDAQVMAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJ KoZIhvcNAQkFMQ8XDTA0MDQyMjAxMTM0NlowIwYJKoZIhvcNAQkEMRYEFH73RliHtgZ8DtogeXLn VxlEqU+OMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBD b25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBAgMMBBUwegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgSXNzdWluZyBDQQIDDAQVMA0GCSqGSIb3DQEBAQUABIIBADQVsdlngxZumJYeO7Gb bttBK8oW5F9XjFKikLugUyOs0K7RibP2C81pp2hxt7OWCTpn1ROxZxSVHdMvyYYhxn5RmUSry+hK 1ntkaV+6w+SfEPuAjHY+vcX5Zb3IOta+Y6emLZXIAb+ZuBR4fhwu9HVEXvhvTm9ZJlL8lO65affd fi8GZNen9LZUqfHIdb/HTakXpGayPJITK8jVNiqVSLKVN3P00Q1ksiAFce5lCI9pnZKEqDV5+NjY 1F8ZWAS4mRRZEzyiOG92xdUbtufsyEDUXxIT2D7NhFrFRcs6aW3IeQ+pq6xMZ6toC8xkHXdP95Fr VcGUKnyrjHCQeYb7DVEAAAAAAAA= --Apple-Mail-3--937472429-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 21:44:24 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09240 for ; Wed, 21 Apr 2004 21:44:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGTEt-0006SY-Kk for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 21:42:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3M1gtTd024826 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 21:42:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGTAb-0004CT-6K for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 21:38:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA08937 for ; Wed, 21 Apr 2004 21:38:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGTAY-0002Mi-Dc for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:38:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGT9e-0002BC-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:37:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGT8n-0001zZ-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:36:37 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGT3M-0001Fr-Qq; Wed, 21 Apr 2004 21:31:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGSw6-0005pI-J2 for asrg@optimus.ietf.org; Wed, 21 Apr 2004 21:23:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA07920 for ; Wed, 21 Apr 2004 21:23:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGSw3-0006w0-Tb for asrg@ietf.org; Wed, 21 Apr 2004 21:23:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGSvE-0006jk-00 for asrg@ietf.org; Wed, 21 Apr 2004 21:22:36 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BGSuj-0006Y5-00 for asrg@ietf.org; Wed, 21 Apr 2004 21:22:05 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 0584B48F6D for ; Wed, 21 Apr 2004 21:21:56 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3M1Lu022626; Wed, 21 Apr 2004 21:21:56 -0400 (EDT) Message-Id: <200404220121.i3M1Lu022626@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: Subject: Re: [Asrg] Re: the e-postage argument References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 21:21:56 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 "Tom Thomson" wrote: (He didn't quote properly, so it isn't clear what he wrote.) > How come SSL certificates in HTTPS transactions can work? Aren't they > reasonably analogous? No; anybody can generate one. Somebody who wanted billions of valid ones could just spend a little CPU time. > For most users, all outgping email is already routed through the > ISP's outgoing mail servers, so the extra costs they cause are > limited to the cost of generating the digest and signing it. For > most emails, outgpoing email is not routed through the ISP's > servers, so there is also the additional cost of accepting, storing, > and forwarding the email. The reason for the discrepancy is probably just spam. > A charging model which allows say 50 emails per day free will > probably leave email free to the average consumer What stops spammers from using ISPs that allow unlimited email, or inventing their own "ISPs"? > There is no need to introduce inter-ISP payments for handling > each-other's email traffic distinct from any payments already used > for providing bandwidth and/or handling general internet traffic. Somebody who hosts a website generally doesn't much care how much somebody else's customers look at that website (and somebody with customers doesn't care what websites they look at or how much). But the whole problem here is that people _do_ care about how much email gets received. > The european postal union certainly deosn't have such transfer > payments between its members, why should an email system? If it doesn't, what stops a spammer from joining? > The vast bureaucracy may not be too great a price to pay to > eliminate spam. Government control of our email (through government > regulation of the clearing houses) may not be too great a price to > pay. It is for something that won't work. (When has a government provided anything else?) Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 21 22:05:44 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA10120 for ; Wed, 21 Apr 2004 22:05:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGTWs-0006YF-AL for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 22:01:30 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3M21UNZ025179 for asrg-archive@odin.ietf.org; Wed, 21 Apr 2004 22:01:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGTVq-0005zt-I1 for asrg-web-archive@optimus.ietf.org; Wed, 21 Apr 2004 22:00:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA09889 for ; Wed, 21 Apr 2004 22:00:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGTVn-0006bG-JJ for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 22:00:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGTUu-0006Qq-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:59:29 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGTUR-0006G5-00 for asrg-web-archive@ietf.org; Wed, 21 Apr 2004 21:58:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGTOg-0002KJ-MJ; Wed, 21 Apr 2004 21:53:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGTIS-0008PD-BR for asrg@optimus.ietf.org; Wed, 21 Apr 2004 21:46:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09352 for ; Wed, 21 Apr 2004 21:46:32 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGTIP-0003we-5n for asrg@ietf.org; Wed, 21 Apr 2004 21:46:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGTHT-0003kM-00 for asrg@ietf.org; Wed, 21 Apr 2004 21:45:37 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BGTGi-0003Uc-00 for asrg@ietf.org; Wed, 21 Apr 2004 21:44:48 -0400 Received: from [192.168.0.3] (h00095b86f221.ne.client2.attbi.com[24.128.50.188]) by comcast.net (sccrmhc12) with SMTP id <2004042201441401200p420ge>; Thu, 22 Apr 2004 01:44:14 +0000 Message-Id: <8E756C7E-93FE-11D8-9A39-00039380F1B6@pobox.com> X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-3: like Habeas SWE (tm) Subject: Re: [Asrg] Re: the e-postage argument X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this From: mathew X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-2: brightly anticipated In-Reply-To: References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> To: asrg@ietf.org X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-4--935645855; protocol="application/pkcs7-signature" X-Habeas-Swe-1: winter into spring X-Habeas-Swe-9: mark in spam to . X-Mailer: Apple Mail (2.613) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 21 Apr 2004 21:44:12 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 --Apple-Mail-4--935645855 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit On Apr 20, 2004, at 3:56, John R Levine wrote: > I need to keep rewriting my epostage paper to make the fundamental > points > clearer. The three big issues are transaction costs, settlements, and > identity. Another is that no postage scheme in the history of mankind > has > existed to deter use rather than to pay delivery costs, but let's skip > that one and decide to innovate. That last point is merely taking a narrow view of what constitutes a "cost". Ultimately, the purpose of communication is delivering a message from brain A to brain B. The cognitive cost of doing so is part of the total cost, and something which has a definite monetary equivalent value--if it didn't, good writing wouldn't be worth anything. In other words, the fact that e-mail has to get through the spam noise is part of its cost of delivery. > The transaction cost issue is the simplest: any kind of e-postage > system > is going to need a transaction per message to check the stamps. > Spammers > are going to put bogus e-postage on their mail, and the only way to > see if > an e-stamp is valid is to check with the issuer. Even if you use a > crypto > signature scheme to see if the stamp is real, you still need to ask > issuer > if it's already been used somewhere else. No you don't. Public key crypto is your friend. If the digital postage cash is minted by one of a number of known sources, you can make an initial test for validity by simply checking the signature against the list of public keys of recognized mints. It's fundamentally no different to the way your browser verifies an SSL connection by checking the certificate presented by the remote site. There are some issues around what you do if a mint's private key gets compromised, but they're solveable. > I have yet to see a faintly plausible plan that would build and pay > for a transaction system big enough to handle the world's e-mail. I'm > not talking about settlements here, just whether the stamp is OK. The > biggest transaction system to date is the one for Master Card and > Visa, and it's both too small and too expensive by several orders of > magnitude each. It's exactly the same problem as checking the signature on this e-mail. You seem to be arguing that it's uneconomical to solve. I think the people who use S/MIME every day would argue otherwise. >> You settle at the ISP level ... > > Settlements: You run an ISP, you tell us. There are something like > 5000 > ISPs in the U.S. and probably at least that many outside the U.S. Are > you > going to send out 5000 checks every month for your settlements? (Or > net > it out with each, so it's on average only 2500.) How are you going to > keep track of whether the other ISPs have paid up, and if they don't, > what > will you do about it? You can't wave these issues away, these are the > nuts and bolts that make a payment system work or not, and if you don't > shut down the deadbeats, the e-postage stops being real money. My ISP has 3.3 million customers. Surely it's infeasible for them to send a bill to every single one of those customers, once every month? My god, how could they ever hope to do that, for a sum of money which might be as small as $30? Clearly this whole ISP thing is just totally impossible. Come to think of it, the US has around 10,000 banks (or similar savings institutions). Is it really feasible that all those banks be somehow able to process small monetary transfers between each other, often many times a day? Ludicrous! I mean, anyone could just set up a bank and send out fake checks and never pay up, and you'd never be able to do anything about it. Clearly checks are utterly impossible, in fact the entire banking system must be the product of a deranged imagination. > If the ISPs do the settlements on behalf of their customers, the ISPs > are > acting as banks, with all of the fraud and default problems that > regular > banks have, and which they spend a lot of money to handle. Real banks > handle the clearing problem with centralized clearing systems they all > join, Mastercard/Visa for credit cards, NYCE, Cirrus, and PLUS for ATM > transactions, and the Federal Reserve for checks. However, none of those systems actually use cryptography for security, except incidentally for encrypting transmissions. There's no way to check the validity of a check or credit card without making a network connection, and that's what makes fraud easy and drives up the cost. If credit card numbers were secured with SSL-like public key certificates, you'd wipe out all the current 'small transaction' scams involving generation of random credit card numbers for starters. Do the same with checks and there goes check fraud. Sure, you'd still have the occasional Savings & Loan or BCCI scandal, but the average day-to-day fraud rate by random criminals would be far lower. > Even worse, what about the ISPs that aren't in the US? How do you send > 50 cents to each of five ISPs in Bangladesh? Credit cards? The idea that I should be able to phone Bangladesh is ridiculous. I mean, how is my 20 cents going to get to the Bangladesh phone company? Credit cards? > Identity: lots of people have pointed out the zombie problem, that > spammers will hijack Aunt Betsy's computer and charge the postage to > her. > The response I usually hear from epostage enthusiasts is that Aunt > Betsy > won't let the zombies on her PC once she's had to pay a few hundred > bucks > in spam epostage. Based on my observation of the real world, that's > not > gonna happen. Every month you see the predictable story about some > loser > whose PC got misconfigured or got a Moldavian dialer installed or > something, and was shocked to get a thousand dollar phone bill. Do > they > actually pay the thousand bucks? Never. They negotiate it down, stiff > the phone company, or something. Have you seen any stories about people who have done that *repeatedly*? I doubt it, because I expect after the second or third such incident they'd find it tough to get the phone company to continue to do business with them. So maybe Aunt Betsy would be unable to get an ISP to do business with her, because of her chronic inability to either use a computer safely or pay the cost of her own incompetence. In which case, that's her problem. > ISPs would be stuck in a no-win situation where their customers will > hate them if they try to collect, and their e-mail peers will hate > them if they don't. One word: Pre-payment. I purchase $20 of e-postage to last me a few months. If I lose it for whatever reason, the ISP doesn't have to spend any money collecting anything. Just like if I lose a book of stamps from my wallet or have it stolen, the Post Office doesn't have to chase me for the price of a book of stamps. In fact, you even explain the system to the user in exactly those terms. > Here's a thought experiment: imagine that you run a store in some part > of > the wild west, and 90% of the cash that people offer you to pay for > stuff > is bogus. How are you going to handle transactions? How long will you > spend examining each coin? Will you refuse to do business with anyone > who's offered you bogus money? What about people who've gotten it in > change somewhere else and didn't notice? This is the environment > e-postage has to face, not a little fraud, but vastly more bogus > transactions (at least attempted ones) than real ones. I don't know of > any financial system that works in an environment like that. That's easy: vending machines in colleges. Tiny transactions, no foolproof security, and a population rich in engineers who are short on cash and have lots of time for experimentation. Clearly Coke and Pepsi will never find it cost-effective to put vending machines at MIT, for example. >> It's time to go for an e-postage system that simply reflects the >> resources being used. > > OK, so build one. I don't know how to build one where the transaction > costs aren't 10 times greater than the costs that the transactions are > supposed to cover, despite a decade of micropayment research, but maybe > we've overlooked something. Well, there are David Chaum's papers on the subject for starters. Digicash didn't fail because it was technically impossible; it failed because it didn't offer compelling benefits to the people who would have needed to implement it, the banks and merchants and governments. In fact, it had major negatives from their point of view, like offering anonymity for customers. mathew --Apple-Mail-4--935645855 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGEDCCAskw ggIyoAMCAQICAwwEFTANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDQwMzI4MjA1ODExWhcNMDUwMzI4MjA1ODExWjBAMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMR0wGwYJKoZIhvcNAQkBFg5tZXRhQHBvYm94LmNvbTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOXun6xaDS5SyU0KswTKlW/Fdfknsyfk64UT B6Lb0AyYlNPoNGsgFtBRRQru1WYXmdUsyru8cvp0u9aqjslP6BFv13VF3XBWhDGctnO1gUkuaWNi G58zUvADdOJen8jL1SyzXF4gpY8dxk4gNwp8a1NqN5NBQwfrHSOdWtdqNudJCF7dwCGJBgyoN3I9 v1WtVRZIeNn7S1AmwtbCPckcYwnBK28giolxm6eYS2FDHEFyM1PPuvuvBm0zShLhWNxQSRsUL9gd CWgyrcShStkwx9rinFo9Ens0/r7zcytPFL77t1p16mQ8O6J1ZGeF6t9yMJm5tDL+IfQbtJruSwF5 ERUCAwEAAaMrMCkwGQYDVR0RBBIwEIEObWV0YUBwb2JveC5jb20wDAYDVR0TAQH/BAIwADANBgkq hkiG9w0BAQQFAAOBgQAynR69x1axSiz4b32j6kRWj+jjQJFvl5zMvdnZpRWdyvL9gscwt2bro3TD cvEI9kELco0BzcLyftMV9rGjSOuiCpJRsWe0/uGB/YVhAuuTpBPoEQblQb4cwoE578of2pludQWB yg0Qn5aGXTS+uYsm34s94E3jObPTiGUIiukROzCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEF BQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUg VG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24g U2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTEr MCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAw MDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3Vs dGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWlu ZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me 7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r 1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCB kTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3Rl LmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPq Cy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUa C4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx 0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz dWluZyBDQQIDDAQVMAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJ KoZIhvcNAQkFMQ8XDTA0MDQyMjAxNDQxM1owIwYJKoZIhvcNAQkEMRYEFGI0C6VrMX6scJVwv97L Aa73n6swMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBD b25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBAgMMBBUwegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgSXNzdWluZyBDQQIDDAQVMA0GCSqGSIb3DQEBAQUABIIBAIi6/kpFBQFUSLyim/K2 VS24nc8q0TipaZUiAdxqwV9szJR7SIJBNOgKH13aOsSsru8i1Ae+KzK+D+fd3XKmZEE5cF3C6wWo 65DlLUerHZMy/fAokW7UJWyaaE6zGl68hTfF/wveP8Z0WU3RGeQk9NAuhvo9uaBY2Vl90evMNWzS W2OQooD8pgBPWGBQln7smdngwZmfdLIiBwgWCZf1fgYcV8tdq+eeRx8MoxdKTiegu1shKOorjgka oCfYhCvh36qevyCqCRqrvM2sxl2v5YjltqVp995oTYDpIJhrKQn5PUNnogPofXLXOheRF2M9ttGR E/LSR3QnTvoNVbos+rIAAAAAAAA= --Apple-Mail-4--935645855-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 08:20:54 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA21414 for ; Thu, 22 Apr 2004 08:20:54 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGdAa-0001DM-Ts for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 08:19:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MCJ8JZ004668 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 08:19:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGd6c-0008RQ-OV for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 08:15:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA20938 for ; Thu, 22 Apr 2004 08:14:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGd6V-0001bb-Rl for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 08:14:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGd5X-0001LE-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 08:13:56 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGd4o-00017L-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 08:13:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGcu2-0003WV-2s; Thu, 22 Apr 2004 08:02:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGcr2-0002ir-Kd for asrg@optimus.ietf.org; Thu, 22 Apr 2004 07:58:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA20482 for ; Thu, 22 Apr 2004 07:58:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGcqv-0005eh-Rr for asrg@ietf.org; Thu, 22 Apr 2004 07:58:49 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGcpx-0005P9-00 for asrg@ietf.org; Thu, 22 Apr 2004 07:57:50 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BGcow-00056p-00 for asrg@ietf.org; Thu, 22 Apr 2004 07:56:47 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 22 Apr 2004 12:01:58 +0100 From: "Tom Thomson" To: "Seth Breidbart" , Subject: RE: [Asrg] Re: the e-postage argument Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal In-Reply-To: <200404220121.i3M1Lu022626@panix5.panix.com> X-OriginalArrivalTime: 22 Apr 2004 11:01:58.0093 (UTC) FILETIME=[3B0A07D0:01C42859] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 12:55:59 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Seth Breidbart wrote@ > "Tom Thomson" wrote: > (He didn't quote properly, so it isn't clear what he wrote.) Maybe your MUA needs fixing. Or maybe you aren't aware of the convention that the symbol ">" at the beginning of a line indicates that the line is quoted, and the absence of that symbol indicates that it is not? One practice that I don't indulge in is carefully selecting which parts I quote in a way cleverly designed to suggest that the person quoted holds a position opposite to that which he actually holds. And a practice I do indulge in is indicating where I have cut a quote with the conventional "[snip]". Perhaps that's what you mean when you say I "didn't quote properly", since you appear to have adopted the opposite policy? > > How come SSL certificates in HTTPS transactions can work? Aren't they > > reasonably analogous? > > No; anybody can generate one. Somebody who wanted billions of valid > ones could just spend a little CPU time. I think it';s pretty clear here that you are answering Barry, not me. What do you thing ">" at the beginning of a line means? > > For most users, all outgping email is already routed through the > > ISP's outgoing mail servers, so the extra costs they cause are > > limited to the cost of generating the digest and signing it. For > > most emails, outgpoing email is not routed through the ISP's > > servers, so there is also the additional cost of accepting, storing, > > and forwarding the email. > > The reason for the discrepancy is probably just spam. > No, it certainly isn't. Most users are not savvy, are using dial-up (or ADSL) connections, and all there stuff goes through the ISPs server (which is where thir dial-up connection or their always-on DSL connection ends). Most email comes from business users who use there own mail server, rather than their ISP's mail server. That's nothing to do with spam. Certainly spammers may have some influence on the size of the majority of email that doesn't go through the IPS's server, but which direction is that influence - some would claim they reduce it (lots of spam from hijacked machines, probably on dial-up accounts which have to go through ISP's server). > > A charging model which allows say 50 emails per day free will > > probably leave email free to the average consumer > > What stops spammers from using ISPs that allow unlimited email, or > inventing their own "ISPs"? Nothing, that's one of the resons the e-post idea won't work without transfer payments (it's just a small generalisation of the "the spammer sets up his own ISP" problem that I pointed out and you have conveniently snipped). > > There is no need to introduce inter-ISP payments for handling > > each-other's email traffic distinct from any payments already used > > for providing bandwidth and/or handling general internet traffic. > > Somebody who hosts a website generally doesn't much care how much > somebody else's customers look at that website (and somebody with > customers doesn't care what websites they look at or how much). But > the whole problem here is that people _do_ care about how much email > gets received. If that's true, why haven't the ISPs already introduced such inter-ISP payments to cover this thing they care about? inter-ISP payments for email volume might work extremely well as a means of reducing spam (since it would encourage ISPs obliged to make the payments to crack down on it) if set at a high enough level, and would certainly work better on their own without the added complication of e-stamps or whatever involving the end users. > > The european postal union certainly deosn't have such transfer > > payments between its members, why should an email system? > > If it doesn't, what stops a spammer from joining? Nothing, except that if the stamp cost is low enough he has no incentive to join. Wasn't that the precise point I made before, and which you have snipped? > > The vast bureaucracy may not be too great a price to pay to > > eliminate spam. Government control of our email (through government > > regulation of the clearing houses) may not be too great a price to > > pay. > > It is for something that won't work. (When has a government provided > anything else?) Are you agreeing with me vehemently, or something? The sentence you snipped here read "Personally, I'd prefer to carry on searching for a better solution." _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 09:16:38 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA24881 for ; Thu, 22 Apr 2004 09:16:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGdrL-0006YE-NS for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 09:03:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MD3Jpt025176 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 09:03:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGdjw-0003zj-6N for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 08:55:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA23911 for ; Thu, 22 Apr 2004 08:55:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGdjp-0004m4-22 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 08:55:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGdio-0004TO-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 08:54:30 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGdi2-00049g-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 08:53:42 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGdXj-0007lI-L6; Thu, 22 Apr 2004 08:43:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGdRH-0005lJ-Ca for asrg@optimus.ietf.org; Thu, 22 Apr 2004 08:36:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA22711 for ; Thu, 22 Apr 2004 08:36:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGdRA-0007Qm-Dg for asrg@ietf.org; Thu, 22 Apr 2004 08:36:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGdQ7-00074r-00 for asrg@ietf.org; Thu, 22 Apr 2004 08:35:12 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BGdO3-0006XS-00 for asrg@ietf.org; Thu, 22 Apr 2004 08:33:03 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BGdO4-0002IO-00 for asrg@ietf.org; Thu, 22 Apr 2004 08:33:04 -0400 Received: from [68.246.34.170] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BGdO3-0005o0-00 for asrg@ietf.org; Thu, 22 Apr 2004 08:33:04 -0400 Message-ID: <4087BB72.2000401@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 2b. New draft of the LMAP Discussion document posted Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 08:32:50 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit A new draft of the LMAP discussion document has been posted to the ID archive: http://www.ietf.org/internet-drafts/draft-irtf-asrg-lmap-discussion-01.txt When providing comments, keep in mind that IRTF documents do not require consensus to be published as per section 3 of RFC 2014. Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "And this too shall come to pass" ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 09:53:21 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA26986 for ; Thu, 22 Apr 2004 09:53:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGeLa-0008E9-Qa for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 09:34:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MDYYPg031621 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 09:34:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGe6m-0003K7-35 for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 09:19:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA25157 for ; Thu, 22 Apr 2004 09:19:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGe6e-0002uB-KN for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 09:19:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGe5Z-0002dc-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 09:18:02 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGe5C-0002OS-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 09:17:38 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGds5-0006fU-Og; Thu, 22 Apr 2004 09:04:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGdo8-0004wj-1O for asrg@optimus.ietf.org; Thu, 22 Apr 2004 09:00:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA24130 for ; Thu, 22 Apr 2004 08:59:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGdo0-000601-Sl for asrg@ietf.org; Thu, 22 Apr 2004 08:59:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGdnF-0005lY-00 for asrg@ietf.org; Thu, 22 Apr 2004 08:59:06 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BGdmD-0005WP-00 for asrg@ietf.org; Thu, 22 Apr 2004 08:58:01 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BGdlc-0005za-00; Thu, 22 Apr 2004 08:57:24 -0400 Received: from [68.246.34.170] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BGdlb-0007sE-00; Thu, 22 Apr 2004 08:57:24 -0400 Message-ID: <4087C12A.2030209@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: mathew CC: asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <408460BB.40404@solidmatrix.com> <4DBC7314-93FA-11D8-9A39-00039380F1B6@pobox.com> In-Reply-To: <4DBC7314-93FA-11D8-9A39-00039380F1B6@pobox.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 08:57:14 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit mathew wrote: > On Apr 19, 2004, at 19:28, Yakov Shafranovich wrote: ... >> I am refering to the issue of hijacked computers. With an e-postage >> system nothing stops a spammer from stealing Aunt Mary's computer via >> a virus and sending out spam with her e-postage account. Who is going >> to pay in that case? The usual response to that example is that her >> e-postage account will run out. This is basically the same as rate >> limiting and can be done today without resorting to e-postage. But >> rate limiting is not always possible such as when an ISP rents out the >> underlying connectivity from a third party. There was also a >> suggestion in one of the subgroups to write up a BCP describing how to >> do rate limiting. > > > Your logic here seems to be "having a limited supply of funds to be used > for e-postage is a bit like rate limiting, and rate limiting is > sometimes difficult, hence limiting e-postage funds is difficult". > Needless to say, that doesn't follow at all. A dolphin is a bit like a > fish, and fish can't breathe air, therefore dolphins can't breathe air. > What I am trying to say is that if the whole intent of e-postage is to do rate-limiting, then just do rate limiting and skip the e-postage. > >> Otherwise, I do not see what the ASRG or the IETF can do for or >> against e-postage - it is simply not within the scope of standards at >> this point. > > > Well, it might be useful to set out some requirements. Or is that not > within the IETF's remit? (Serious question.) > It is more of an IRTF issue at this point, so if sufficient people want to pursue discussion on it, we can spill it off into a separate ASRG list. However, what I am really interest in seeing about e-postage is discussion on how it can stop spam. Perhaps we can look into why people think that e-postage will stop spam and carry over those principles into other proposals. I want to isolate the principles of why e-postage will help from the actual technical problems involved with making e-postage work such double-spending. Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "Some lies are easier to believe than the truth" (Dune) ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 10:02:04 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA27430 for ; Thu, 22 Apr 2004 10:02:03 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGedL-0004Sp-PB for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 09:52:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MDqtOx017155 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 09:52:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGeL5-0008BU-MY for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 09:34:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA25956 for ; Thu, 22 Apr 2004 09:33:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGeKy-0006lg-3z for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 09:33:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGeJw-0006RZ-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 09:32:53 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGeIr-0005xa-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 09:31:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGe6b-0003JT-J0; Thu, 22 Apr 2004 09:19:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGdxw-0000pf-Ed for asrg@optimus.ietf.org; Thu, 22 Apr 2004 09:10:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA24654 for ; Thu, 22 Apr 2004 09:10:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGdxp-0000gl-9Q for asrg@ietf.org; Thu, 22 Apr 2004 09:10:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGdwy-0000RC-00 for asrg@ietf.org; Thu, 22 Apr 2004 09:09:09 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BGdw7-0000Bf-00 for asrg@ietf.org; Thu, 22 Apr 2004 09:08:15 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BGdw5-0002dE-00; Thu, 22 Apr 2004 09:08:13 -0400 Received: from [68.246.34.170] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BGdw3-0000Xm-00; Thu, 22 Apr 2004 09:08:13 -0400 Message-ID: <4087C3B4.2040706@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: Barry Shein CC: asrg@ietf.org Subject: Re: [Asrg] Re: E-postage References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> <40849808.3090005@solidmatrix.com> <16517.56612.196778.643255@world.std.com> In-Reply-To: <16517.56612.196778.643255@world.std.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 09:08:04 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > On April 19, 2004 at 23:24 research@solidmatrix.com (Yakov Shafranovich) wrote: > > > for any proposal calling for a major infrastructure overhaul - there > > simply isn't enough monetary or non-monetary incentive for network > > operators, software providers and governments to make a major change of > > that scale. It may very well be that the system may collapse due to that > > (which I personally do not think will happen). > > It (e-postage) doesn't require much any infrastructure overhaul. > > Maybe some ways of imagining it being implemented do, but maybe the > goal should be to say well, if we do it that way it'd require a major > infrastructure haul, can we do it some other way. > Let me ask a different question - can you elaborate as to the specific reasons why e-postage will help with spam. Perhaps we can achieve those same reasons with other means as well. > In brief how about: > > A) Each ISP creates stamps according to some accepted method, > probably some cryptographic approach. Think SSL certificates or > some similar precedent. > > B) They attach a stamp to mail according to some policy such > as e-mail originating from their customers. > > C) Stamps can be allocated according to any policy they choose, at > least at first. For example, give each customer 1,000 stamps per > month and charge for excess, whatever, that's a marketing decision. > > D) However, other ISPs can choose to transit or not email with > particular stamps. > There would be an issue of distributed trust. Your ISP has to establish trust with each ISP that issues stamps. A more viable solution would be using a few centralized authorities to issue certificates that can allow ISPs to issue stamps. But then you run into the question of what happens if a spammer operates an ISP. Today's CAs do not revoke certificates for policy reasons but that can probably be changed. > E) Unstamped mail could be accepted for a while and then ISPs can > choose to reject it. > There is really no way to restrict unstamped email unless it goes to the ISPs mail servers. I just want to point out this distinction - people would still be free to run their own email servers over whatever system they would like such as FreeNet. > Ok, maybe it needs work. But it's hardly off-the-wall, and it doesn't > require major infrastructure nor would take years and years. If a few > major players said this is the way we're going, here's some software > to do this, and we'd be off and running. > > I don't propose that as a worked-out solution, only as an example that > one can approach the problem more positively, and to point out that > ready-made, all-purpose blow-offs like "it would take too long" really > don't improve the quality of discussion, except perhaps when posed as > questions rather than assertions. > > What I am really interested in discussing is why this would help. The issues of how e-postage would work can be left to be worked out but the interesting thing is how will e-postage help with spam? Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "And this too shall come to pass" ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 10:47:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA01639 for ; Thu, 22 Apr 2004 10:47:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGfS4-00026u-IP for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 10:45:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MEjKYr008108 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 10:45:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGfAQ-0005GN-KH for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 10:27:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA00069 for ; Thu, 22 Apr 2004 10:26:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGfAI-0005At-NL for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 10:26:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGf9L-0004uS-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 10:26:00 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGf8Q-0004eI-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 10:25:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGeo5-0002ON-N8; Thu, 22 Apr 2004 10:04:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGekG-0006Pn-1r for asrg@optimus.ietf.org; Thu, 22 Apr 2004 10:00:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA27256 for ; Thu, 22 Apr 2004 09:59:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGek8-0005j3-Bt for asrg@ietf.org; Thu, 22 Apr 2004 09:59:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGejA-0005UQ-00 for asrg@ietf.org; Thu, 22 Apr 2004 09:58:56 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BGeiS-0005GG-00 for asrg@ietf.org; Thu, 22 Apr 2004 09:58:13 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 22 Apr 2004 14:04:12 +0100 From: "Tom Thomson" To: "Yakov Shafranovich" , "Barry Shein" Cc: Subject: RE: [Asrg] Re: E-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal In-Reply-To: <4087C3B4.2040706@solidmatrix.com> X-OriginalArrivalTime: 22 Apr 2004 13:04:12.0921 (UTC) FILETIME=[4EEFF690:01C4286A] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 14:58:14 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: [snip] > There would be an issue of distributed trust. Your ISP has to establish > trust with each ISP that issues stamps. A more viable solution would be > using a few centralized authorities to issue certificates that can allow > ISPs to issue stamps. But then you run into the question of what happens > if a spammer operates an ISP. Today's CAs do not revoke certificates for > policy reasons but that can probably be changed. Why do you think that can be changed? The CAs are in the CA business to make money. Managing a revocation list and making it accessible is an expense, and there appears to be no return on it. The CA has maybe never heard of a person who relies on a certificate, has no contractual relationship with someone who relies on a certificate, so someone who relies on the certificate has no come-back against the CA, the CA has no liability for any loss incurred through reliance on its certificates. On the other hand, the CA has a clear contractual relationship with the person it certifies (at least in the current model, where the person certified buys the certificate from the CA), so if it revokes the certificate it may get dragged through the courts (win or lose, being dragged through the courts is a pain no-one wants). So why would a CA set up an expensive reveocation mechanism and risk court action against it by its customers in order to make someone who has no connection at all with it a bit happier? Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 11:30:55 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA05596 for ; Thu, 22 Apr 2004 11:30:55 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGg4P-0005nV-Ro for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 11:25:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MFOver022268 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 11:24:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGfnR-0007ml-VA for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 11:07:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA03774 for ; Thu, 22 Apr 2004 11:07:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGfnJ-0000gf-MW for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 11:07:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGfmI-0000LZ-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 11:06:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGflB-00001n-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 11:05:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGfTk-000310-PI; Thu, 22 Apr 2004 10:47:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGfHS-0006GB-Ur for asrg@optimus.ietf.org; Thu, 22 Apr 2004 10:34:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA00711 for ; Thu, 22 Apr 2004 10:34:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGfHK-00077x-Sg for asrg@ietf.org; Thu, 22 Apr 2004 10:34:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGfGJ-0006r7-00 for asrg@ietf.org; Thu, 22 Apr 2004 10:33:12 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BGfFo-0006ac-00 for asrg@ietf.org; Thu, 22 Apr 2004 10:32:40 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id 36EE316E09 for ; Thu, 22 Apr 2004 10:37:28 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] 2b. SMTP-VERIFY - Request to publish LMAP proposals In-Reply-To: Your message of "Tue, 20 Apr 2004 00:09:15 EDT." <4084A26B.7020904@solidmatrix.com> Message-Id: <20040422143728.36EE316E09@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 10:37:28 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Yakov Shafranovich wrote: > As per MARID charter, the IRTF chair and the chairs of the ASRG received > a request from the IESG to submit the LMAP proposals and the LMAP > discussion document to the RFC Editor for publication. There is a new version of the discussion document available. Feedback and comments should be given here. I plan on issuing at least one more draft before submitting it to the RFC editor. http://www.ietf.org/internet-drafts/draft-irtf-asrg-lmap-discussion-01.txt Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 11:49:37 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA06722 for ; Thu, 22 Apr 2004 11:49:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGgKX-0003bB-AO for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 11:41:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MFfbDF013828 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 11:41:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGgDI-0000TH-HA for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 11:34:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA05830 for ; Thu, 22 Apr 2004 11:34:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGgDF-0000g7-KW for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 11:34:05 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGgCM-0000QY-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 11:33:11 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGgBY-0000B5-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 11:32:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGg4V-0005uQ-LY; Thu, 22 Apr 2004 11:25:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGfnv-0007um-FJ for asrg@optimus.ietf.org; Thu, 22 Apr 2004 11:07:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA03805 for ; Thu, 22 Apr 2004 11:07:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGfnn-0000ke-5R for asrg@ietf.org; Thu, 22 Apr 2004 11:07:47 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGfmd-0000Ou-00 for asrg@ietf.org; Thu, 22 Apr 2004 11:06:36 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BGflc-00004N-00 for asrg@ietf.org; Thu, 22 Apr 2004 11:05:32 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 22 Apr 2004 15:11:31 +0100 From: "Tom Thomson" To: "Yakov Shafranovich" , "Barry Shein" Cc: Subject: RE: [Asrg] Re: E-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal In-Reply-To: <4087C3B4.2040706@solidmatrix.com> X-OriginalArrivalTime: 22 Apr 2004 14:11:31.0500 (UTC) FILETIME=[B61E36C0:01C42873] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 16:05:32 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > Let me ask a different question - can you elaborate as to the specific > reasons why e-postage will help with spam. Perhaps we can achieve those > same reasons with other means as well. Surely the argument is that if the cost of sending spam goes up to such a level that sending spam ceases to be profitable, then no-one will do it any more? I don't fully believe this argument myself, or at least I don't believe it can be achieved by e-postage, for a number of reasons. First, we still see junk mail on paper. Something like 65% of my paper mail is junk. So the charge for paper mail hasn't eliminated spam. Second, who pays the charge? If a spammer "owns" a bunch of zombie machines scattered round the world, they pay the email charge - he doesn't. So it's not much of a deterrent to him. Of course it may encourage people to secure their machines so that they don't end up paying, but I'm not certain that that will produce a big reduction in volume - look at the number of critical security problems published in the last year (by reliable bodies like CERT) for *NIX systems, or the rather smaller number for Windows systems - and look at the delays in availability of fixes. There's plenty of window for the attackers even if people are sufficiently clued up to keep their machines "secure". Of course it's possible to build very secure systems and to use multiple layers of firewalls, but the average guy is not going to do that because it's both extremely difficult with current platforms and very expensive. Third, there's one born every minute. The spammer can recruit people as spam-mailers, people who believe they will make money by working for him and won't stop sending spam on his behalf until they have lost a packet (some won't even stop until they've gone bankrupt). They make the losses, he makes the profits. Fourth, we don't know what the value (to the spammer) of spam is. Obviously different spams generate different returns. The gullibility and greed of some people is so great that even with a high email price some spams will remain profitable - and of course this relates to the first point above. So we don't know how high we have to set the price to get spam down to a "reasonable" level, and setting the price too high is as bad as the spam - my email is just as unusable if no-one can afford to email me as it is if I have to spend too much time filtering out the spam. Maybe over time we can find the right pricing level, if there is one, but maybe there isn't a right pricing level to find. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 13:17:03 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA11321 for ; Thu, 22 Apr 2004 13:17:03 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhk6-00088c-JD for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 13:12:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MHC6FR031268 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 13:12:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhZr-0004V9-1D for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 13:01:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA10773 for ; Thu, 22 Apr 2004 13:01:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGhZm-0001aI-3V for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 13:01:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGhZ5-0001IS-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 13:00:43 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGhYG-0000zN-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 12:59:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhOs-00019l-EE; Thu, 22 Apr 2004 12:50:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhFI-0005iD-3Y for asrg@optimus.ietf.org; Thu, 22 Apr 2004 12:40:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA09391 for ; Thu, 22 Apr 2004 12:40:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGhFD-0003Mw-39 for asrg@ietf.org; Thu, 22 Apr 2004 12:40:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGhEG-00035K-00 for asrg@ietf.org; Thu, 22 Apr 2004 12:39:13 -0400 Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx with esmtp (Exim 4.12) id 1BGhDN-0002mC-00 for asrg@ietf.org; Thu, 22 Apr 2004 12:38:17 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 473AE98381 for ; Thu, 22 Apr 2004 12:38:11 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3MGcBB09639; Thu, 22 Apr 2004 12:38:11 -0400 (EDT) Message-Id: <200404221638.i3MGcBB09639@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: Subject: Re: [Asrg] Re: the e-postage argument References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 12:38:11 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 "Tom Thomson" wrote: > Seth Breidbart wrote@ > >> "Tom Thomson" wrote: >> (He didn't quote properly, so it isn't clear what he wrote.) > > Maybe your MUA needs fixing. Or maybe you aren't aware of the convention > that the symbol ">" at the beginning of a line indicates that the line is > quoted, and the absence of that symbol indicates that it is not? Or maybe one paragraph read like a reply to the preceding one, but neither was quoted. >> > How come SSL certificates in HTTPS transactions can work? Aren't they >> > reasonably analogous? >> >> No; anybody can generate one. Somebody who wanted billions of valid >> ones could just spend a little CPU time. > > I think it';s pretty clear here that you are answering Barry, not me. What > do you thing ">" at the beginning of a line means? If you count, you'll notice that the single ">" in my message was inserted by _me_; your message lacked it, which is why I believed you quoted improperly. >> > For most users, all outgping email is already routed through the >> > ISP's outgoing mail servers, so the extra costs they cause are >> > limited to the cost of generating the digest and signing it. For >> > most emails, outgpoing email is not routed through the ISP's >> > servers, so there is also the additional cost of accepting, storing, >> > and forwarding the email. >> The reason for the discrepancy is probably just spam. > No, it certainly isn't. Most users are not savvy, are using dial-up (or > ADSL) connections, and all there stuff goes through the ISPs server (which > is where thir dial-up connection or their always-on DSL connection ends). > Most email comes from business users who use there own mail server, rather > than their ISP's mail server. That's nothing to do with spam. I don't know how you conclude that there's more business than individual email; however, according to those with the ability to measure, the majority of email is spam. In any case, for the purposes of this sort of structure, a business might as well be considered an ISP. >> > There is no need to introduce inter-ISP payments for handling >> > each-other's email traffic distinct from any payments already used >> > for providing bandwidth and/or handling general internet traffic. >> >> Somebody who hosts a website generally doesn't much care how much >> somebody else's customers look at that website (and somebody with >> customers doesn't care what websites they look at or how much). But >> the whole problem here is that people _do_ care about how much email >> gets received. > > If that's true, why haven't the ISPs already introduced such inter-ISP > payments to cover this thing they care about? There is no "the ISPs". There are lots of individual ISPs. They don't cooperate all that well. Guess what will happen to the first ISP that demands payments to receive email. If you guessed anything other than "it won't get any" you lose. > inter-ISP payments for email volume might work extremely well as a > means of reducing spam (since it would encourage ISPs obliged to > make the payments to crack down on it) if set at a high enough > level, and would certainly work better on their own without the > added complication of e-stamps or whatever involving the end users. How do you set it up and enforce it? You can't get there from here. >> > The european postal union certainly deosn't have such transfer >> > payments between its members, why should an email system? >> If it doesn't, what stops a spammer from joining? > > Nothing, except that if the stamp cost is low enough he has no incentive to > join. So a low enough stamp cost won't deter spammers, and a higher stamp cost will get them to join and still not deter them. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 13:35:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA12599 for ; Thu, 22 Apr 2004 13:35:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhwb-0003we-V1 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 13:25:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MHP1A4015160 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 13:25:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhu1-00035G-C2 for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 13:22:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA11932 for ; Thu, 22 Apr 2004 13:22:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGhtx-0007Wi-9F for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 13:22:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGht5-0007FM-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 13:21:23 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGhsJ-0006vc-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 13:20:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhl0-0008Px-BM; Thu, 22 Apr 2004 13:13:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGhbT-0005BF-4P for asrg@optimus.ietf.org; Thu, 22 Apr 2004 13:03:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA10899 for ; Thu, 22 Apr 2004 13:03:06 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGhbO-00026H-Ma for asrg@ietf.org; Thu, 22 Apr 2004 13:03:06 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGhal-0001qw-00 for asrg@ietf.org; Thu, 22 Apr 2004 13:02:27 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BGhZu-0001aP-00 for asrg@ietf.org; Thu, 22 Apr 2004 13:01:34 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 797B948BF9 for ; Thu, 22 Apr 2004 13:01:27 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3MH1LG12605; Thu, 22 Apr 2004 13:01:21 -0400 (EDT) Message-Id: <200404221701.i3MH1LG12605@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: Subject: Re: [Asrg] Re: E-postage References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 13:01:21 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 "Tom Thomson" wrote: > Yakov Shafranovich wrote: >> Today's CAs do not revoke certificates for >> policy reasons but that can probably be changed. > > Why do you think that can be changed? The CAs are in the CA business to > make money. Nobody is going to trust an irrevocable mailing certificate, so nobody is going to buy them. In any case, revocation per se isn't strictly necessary. For instance, issue (at a noticeable price) one-day certificates, which can be renewed a day at a time for free if they aren't used to sign spam. Non-spammers pay a one-time fee (refundable, even); spammers lose their deposit for a single day of spamming (and even that runs into BLs of "don't trust this certificate" which could be run by third parties). Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 15:02:28 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18192 for ; Thu, 22 Apr 2004 15:02:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjPB-0006zf-Vx for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 14:58:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MIwbq1026878 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 14:58:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjG7-0003ti-Kc for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 14:49:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17267 for ; Thu, 22 Apr 2004 14:49:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGjG2-00015v-PH for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 14:49:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGjF5-0000pD-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 14:48:12 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGjE4-0000YU-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 14:47:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGj89-0002GJ-PA; Thu, 22 Apr 2004 14:41:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGivm-0007Fc-O1 for asrg@optimus.ietf.org; Thu, 22 Apr 2004 14:28:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA16210 for ; Thu, 22 Apr 2004 14:28:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGivi-0003AX-4G for asrg@ietf.org; Thu, 22 Apr 2004 14:28:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGiue-0002oV-00 for asrg@ietf.org; Thu, 22 Apr 2004 14:27:04 -0400 Received: from mercury.mv.net ([199.125.85.40]) by ietf-mx with smtp (Exim 4.12) id 1BGitd-0002GM-00 for asrg@ietf.org; Thu, 22 Apr 2004 14:26:01 -0400 Received: (qmail 21202 invoked from network); 22 Apr 2004 14:25:52 -0400 Received: from iridium.mv.net (HELO mv.mv.com) (199.125.85.17) by mercury.mv.net with SMTP; 22 Apr 2004 14:25:54 -0400 X-Peer-Info: remote-ip 199.125.85.17 local-ip 199.125.85.40 local-name mercury.mv.net Received: (qmail 4777 invoked by uid 101); 22 Apr 2004 14:25:52 -0400 From: "Mark E. Mallett" To: Yakov Shafranovich Cc: ASRG Subject: Re: [Asrg] 2b. SMTP Session Verification - New blacklist for spamvertised domains Message-ID: <20040422182552.GA24693@iridium.mv.net> References: <4078BD36.5090900@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4078BD36.5090900@solidmatrix.com> User-Agent: Mutt/1.4.2.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 14:25:52 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Sat, Apr 10, 2004 at 11:36:22PM -0400, Yakov Shafranovich wrote: > A new blacklists for spamvertized domains has been brought up. You can > find it at: > > http://www.surbl.org/ Hmm... maybe I am misreading, but this seems just wrong: It's important to note that SURBL should be used with the basic, "registrar" domain, i.e., the domain name that would be registered at a registrar. While the current version does count frequently occurring spam subdomains (e.g., subdomain.spamdomain.com), future versions of SURBL will probably only have the basic domain (e.g., spamdomain.com). Therefore applications using SURBL should remove all but the basic domain before trying to match them. Due to the way the current data is counted, the basic domain will work just as well or better than one with a subdomain. Therefore for future compatibility SURBL users should start using only the base domain. Better terminology would help- I'm reading the above to mean that they reduce every name to a second-level domain. In that case if there's a spamvertized domain in, say, "nh.us" then all of nh.us is impacted. Hardly seems like a good thing to me. Actually the FAQ goes on to say (or at least I infer- it's hard to read), that reports are counted at each level (so a report on foo.nh.us would add a count to both "foo.nh.us" and "nh.us"). However it also recommends that the client check the second level domain first, and also says that it's likely that *only* second level domains will be listed in the future. I understand the goal of trying to de-randomize (and normalize) spamvertized URLs. But I don't really think subdomain stripping alone is workable. Normalizing a la URIDNSBL seems slightly better, although still not perfect. mm _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 15:23:18 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA20945 for ; Thu, 22 Apr 2004 15:23:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjSD-0001YU-06 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 15:01:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MJ1ii7005971 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 15:01:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjL5-0005um-Lv for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 14:54:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17724 for ; Thu, 22 Apr 2004 14:54:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGjL0-0002Xg-UC for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 14:54:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGjK7-0002HA-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 14:53:24 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGjJh-0001zn-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 14:52:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGj8E-0002IT-UZ; Thu, 22 Apr 2004 14:41:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGj0v-0008EY-OR for asrg@optimus.ietf.org; Thu, 22 Apr 2004 14:33:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA16552 for ; Thu, 22 Apr 2004 14:33:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGj0r-0004aS-3F for asrg@ietf.org; Thu, 22 Apr 2004 14:33:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGizr-0004JB-00 for asrg@ietf.org; Thu, 22 Apr 2004 14:32:28 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BGiyk-00040h-00 for asrg@ietf.org; Thu, 22 Apr 2004 14:31:18 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 22 Apr 2004 18:37:15 +0100 From: "Tom Thomson" To: "Seth Breidbart" , Subject: RE: [Asrg] Re: E-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal In-Reply-To: <200404221701.i3MH1LG12605@panix5.panix.com> X-OriginalArrivalTime: 22 Apr 2004 17:37:15.0031 (UTC) FILETIME=[736F9270:01C42890] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 19:31:15 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Seth Breidbart worte > "Tom Thomson" wrote: > > Yakov Shafranovich wrote: > > >> Today's CAs do not revoke certificates for > >> policy reasons but that can probably be changed. > > > > Why do you think that can be changed? The CAs are in the CA business to > > make money. > > Nobody is going to trust an irrevocable mailing certificate, so nobody > is going to buy them. But there are hordes of CAs out there making money of what are, in effect, irevocable certificates. How are you going to get CAs to change their behaviour? > In any case, revocation per se isn't strictly necessary. For > instance, issue (at a noticeable price) one-day certificates, which > can be renewed a day at a time for free if they aren't used to sign > spam. Non-spammers pay a one-time fee (refundable, even); spammers > lose their deposit for a single day of spamming (and even that runs > into BLs of "don't trust this certificate" which could be run by third > parties). That's an interesting idea. Of course the CAs have the problem of managing daily renewals, which isn't a zero cost operation, but if every user of email in the world needs a ertificate there's a big enough market to make a good profit on small margins. But will Aunt Mary be able to work out how to generate a key-pair and send the public half off for signing, and install the certificate when it comes back and install a new certificate every day when it arrives? How much of this can be automated for Aunt Mary in the MUA? Do have you a less complicated certificate mechanism in mind? A possible problem: sometimes mail is sent to a machine that is currently off line, and gets held in some relay (the outgoing mail server) for some days. Lets hope that the next machine down the line checks the certificate's valididity for the date in the first Received header, not the date at which it receives the mail, or the certificate will appear out of date. On second thoughts, let's hope it doesn't - or I can just stick a fake received by header at the front of my mail and that certificate that never got renewed because it was used to send spam can be used for quite some time - but then it becomes hard to send mail from a machine that's often off line to another machine that's often off line - you have to find a day when they are both on line. Of course if email were always a single end-to-end transaction life would be much easier. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 15:57:42 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24360 for ; Thu, 22 Apr 2004 15:57:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGk7Z-0001q2-8j for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 15:44:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MJiTYX007044 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 15:44:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjaV-0001Y7-7N for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 15:10:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19244 for ; Thu, 22 Apr 2004 15:10:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGjaQ-0006wa-7D for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 15:10:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGjZS-0006g2-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 15:09:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGjYa-0006P2-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 15:08:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjPa-000748-HZ; Thu, 22 Apr 2004 14:59:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjBB-00034L-HQ for asrg@optimus.ietf.org; Thu, 22 Apr 2004 14:44:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17004 for ; Thu, 22 Apr 2004 14:44:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGjB6-0007XL-N4 for asrg@ietf.org; Thu, 22 Apr 2004 14:44:04 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGjA9-0007Fu-00 for asrg@ietf.org; Thu, 22 Apr 2004 14:43:05 -0400 Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx with esmtp (Exim 4.12) id 1BGj93-0006jt-00 for asrg@ietf.org; Thu, 22 Apr 2004 14:41:58 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 90F35982CB for ; Thu, 22 Apr 2004 14:41:52 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3MIfqu29526; Thu, 22 Apr 2004 14:41:52 -0400 (EDT) Message-Id: <200404221841.i3MIfqu29526@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: Subject: Re: [Asrg] Re: E-postage References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 14:41:52 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 "Tom Thomson" wrote: > Seth Breidbart worte >> "Tom Thomson" wrote: >> > Yakov Shafranovich wrote: >> Nobody is going to trust an irrevocable mailing certificate, so nobody >> is going to buy them. > > But there are hordes of CAs out there making money of what are, in effect, > irevocable certificates. How are you going to get CAs to change their > behaviour? In deciding which email to receive (or allow to bypass strong filtration), would you trust an irrevocable certificate from TrustE? How about one from Verislime? How about a revocable certificate from Spamhaus? If you want your email to be received, which of those would you buy? > But will Aunt Mary be able to work out how to generate a key-pair > and send the public half off for signing, and install the > certificate when it comes back and install a new certificate every > day when it arrives? No, but Aunt Mary doesn't know how to send mail other than through her ISP's mail swerver, which will take care of all that stuff for her. > A possible problem: sometimes mail is sent to a machine that is currently > off line, and gets held in some relay (the outgoing mail server) for some > days. One possible solution is to check the old certificate for revocation. Or, any outgoing server should have its own certificate, so it can re-sign the message when it comes back online. Any incoming server should check the certificate upon receipt; if the user doesn't trust his own incoming server, he has bigger problems. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 17:42:19 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03072 for ; Thu, 22 Apr 2004 17:42:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGlOX-00052R-Cs for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 17:06:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ML651n019363 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 17:06:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGkQi-0007oB-2W for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 16:04:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA24801 for ; Thu, 22 Apr 2004 16:04:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGkQe-000079-El for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 16:04:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGkPn-0007fD-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 16:03:20 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGkOv-0007PQ-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 16:02:25 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGk87-0001yz-Ud; Thu, 22 Apr 2004 15:45:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGjYU-0007oh-CC for asrg@optimus.ietf.org; Thu, 22 Apr 2004 15:08:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA18946 for ; Thu, 22 Apr 2004 15:08:10 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGjYP-0006Ne-Af for asrg@ietf.org; Thu, 22 Apr 2004 15:08:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGjXU-00067N-00 for asrg@ietf.org; Thu, 22 Apr 2004 15:07:12 -0400 Received: from trillian.net.astrum.ch ([213.144.132.251]) by ietf-mx with esmtp (Exim 4.12) id 1BGjWd-0005qw-00 for asrg@ietf.org; Thu, 22 Apr 2004 15:06:19 -0400 Received: from localhost (localhost [127.0.0.1]) by trillian.net.astrum.ch (Postfix) with ESMTP id 433B82B6A3 for ; Thu, 22 Apr 2004 21:06:15 +0200 (CEST) Received: from astrum.ch (marvin.net.astrum.ch [213.144.132.250]) by trillian.net.astrum.ch (Postfix) with ESMTP id 4BD5B28876 for ; Thu, 22 Apr 2004 21:06:14 +0200 (CEST) Message-ID: <408817A5.9050408@astrum.ch> From: Matthias Leisi User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: de-ch, de-de, de, en-us, en, fr MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] Re: E-postage References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed X-Virus-Scanned: by amavisd-new at astrum.ch Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 21:06:13 +0200 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Tom Thomson wrote: > But will Aunt Mary be able to work out how to generate a key-pair and s= end > the public half off for signing, and install the certificate when it co= mes > back and install a new certificate every day when it arrives? How much= of > this can be automated for Aunt Mary in the MUA? Do have you a less > complicated certificate mechanism in mind? The MUA can handle that process transparently. Besides, it's not=20 necessary for Aunt Mary to get her certificate signed by the Root-CA -=20 this can be delegated, most likely to her ISP. The ISP would then need=20 to get a signing certificate signed by the CA et voil=E0. Of course that's a very different business models for CAs. Established=20 CAs will want to fight with ISPs over who gets what percentage of Aunt=20 Marys monthly charges. OTOH, there is no need that the "mailing CAs" are the same as the=20 oligopolistic list embedded in webbrowsers. > A possible problem: sometimes mail is sent to a machine that is current= ly > off line, and gets held in some relay (the outgoing mail server) for so= me > days. Lets hope that the next machine down the line checks the > certificate's valididity for the date in the first Received header, not= the > date at which it receives the mail, or the certificate will appear out = of > date. PKIs can be designed to allow for such overlaps. -- Matthias --=20 Braindump-Blog http://matthias.leisi.net/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 18:36:57 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08833 for ; Thu, 22 Apr 2004 18:36:57 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGmeF-0007Th-JI for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 18:26:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MMQNS2028739 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 18:26:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGmGM-0000CU-0v for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 18:01:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05076 for ; Thu, 22 Apr 2004 18:01:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGmGH-0004Cm-AN for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 18:01:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGmFL-0003tk-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 18:00:40 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGmEb-0003au-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 17:59:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGlvq-0006T9-Lf; Thu, 22 Apr 2004 17:40:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGl0p-0000Pp-Qp for asrg@optimus.ietf.org; Thu, 22 Apr 2004 16:41:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28015 for ; Thu, 22 Apr 2004 16:41:32 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGl0l-0004BA-Pf for asrg@ietf.org; Thu, 22 Apr 2004 16:41:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGkzh-0003oR-00 for asrg@ietf.org; Thu, 22 Apr 2004 16:40:26 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=CFHhIENxyD1jhT7xhwM5CDkmKbgIAZ5NwFtYvdO8EXX) by ietf-mx with esmtp (Exim 4.12) id 1BGkyX-0003D4-00 for asrg@ietf.org; Thu, 22 Apr 2004 16:39:13 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id QAA03798; Thu, 22 Apr 2004 16:39:07 -0400 (EDT) From: der Mouse Message-Id: <200404222039.QAA03798@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] 2b. SMTP Session Verification - New blacklist for spamvertised domains In-Reply-To: <20040422182552.GA24693@iridium.mv.net> References: <4078BD36.5090900@solidmatrix.com> <20040422182552.GA24693@iridium.mv.net> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 16:37:42 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > It's important to note that SURBL should be used with the basic, > "registrar" domain, i.e., the domain name that would be registered > at a registrar. [...] > Better terminology would help- I'm reading the above to mean that > they reduce every name to a second-level domain. I'm not. There are plenty of TLDs where registrars register things at levels other than the second. For example, my own domain (rodents.montreal.qc.ca) is a regstrar domain in this sense; qc.ca is nothing. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 19:12:39 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11382 for ; Thu, 22 Apr 2004 19:12:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGnFR-0005Zg-HI for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 19:04:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3MN4neZ021423 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 19:04:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGn7P-0001vv-3B for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 18:56:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10005 for ; Thu, 22 Apr 2004 18:56:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGn7J-0004M4-Tz for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 18:56:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGn6Y-000467-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 18:55:39 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGn5x-0003p3-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 18:55:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGmmb-0003TJ-QG; Thu, 22 Apr 2004 18:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGmRf-00018h-RD for asrg@optimus.ietf.org; Thu, 22 Apr 2004 18:13:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06407 for ; Thu, 22 Apr 2004 18:13:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGmRa-0007P0-Rt for asrg@ietf.org; Thu, 22 Apr 2004 18:13:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGmQk-00078S-00 for asrg@ietf.org; Thu, 22 Apr 2004 18:12:27 -0400 Received: from mercury.mv.net ([199.125.85.40]) by ietf-mx with smtp (Exim 4.12) id 1BGmPk-0006sM-00 for asrg@ietf.org; Thu, 22 Apr 2004 18:11:24 -0400 Received: (qmail 19309 invoked from network); 22 Apr 2004 18:11:27 -0400 Received: from iridium.mv.net (HELO mv.mv.com) (199.125.85.17) by mercury.mv.net with SMTP; 22 Apr 2004 18:11:27 -0400 X-Peer-Info: remote-ip 199.125.85.17 local-ip 199.125.85.40 local-name mercury.mv.net Received: (qmail 1666 invoked by uid 101); 22 Apr 2004 18:11:26 -0400 From: "Mark E. Mallett" To: der Mouse Cc: asrg@ietf.org Subject: Re: [Asrg] 2b. SMTP Session Verification - New blacklist for spamvertised domains Message-ID: <20040422221126.GO14560@iridium.mv.net> References: <4078BD36.5090900@solidmatrix.com> <20040422182552.GA24693@iridium.mv.net> <200404222039.QAA03798@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200404222039.QAA03798@Sparkle.Rodents.Montreal.QC.CA> User-Agent: Mutt/1.4.2.1i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 18:11:26 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Thu, Apr 22, 2004 at 04:37:42PM -0400, der Mouse wrote: > > It's important to note that SURBL should be used with the basic, > > "registrar" domain, i.e., the domain name that would be registered > > at a registrar. [...] > > > Better terminology would help- I'm reading the above to mean that > > they reduce every name to a second-level domain. > > I'm not. > > There are plenty of TLDs where registrars register things at levels > other than the second. For example, my own domain > (rodents.montreal.qc.ca) is a regstrar domain in this sense; qc.ca is > nothing. Yes, very much part of my point. mm _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 20:06:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA14078 for ; Thu, 22 Apr 2004 20:06:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGo7s-0008GR-Vl for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 20:01:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N014gU031763 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 20:01:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGnrs-0003Ge-Mj for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 19:44:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA13226 for ; Thu, 22 Apr 2004 19:44:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGnrp-0002Db-0e for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 19:44:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGnqs-0001y6-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 19:43:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGnqK-0001i3-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 19:42:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGnes-0006TO-CN; Thu, 22 Apr 2004 19:31:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGnZK-00046Y-C0 for asrg@optimus.ietf.org; Thu, 22 Apr 2004 19:25:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11930 for ; Thu, 22 Apr 2004 19:25:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGnZG-0004i4-NE for asrg@ietf.org; Thu, 22 Apr 2004 19:25:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGnYI-0004Re-00 for asrg@ietf.org; Thu, 22 Apr 2004 19:24:18 -0400 Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx with esmtp (Exim 4.12) id 1BGnXH-0003x0-00 for asrg@ietf.org; Thu, 22 Apr 2004 19:23:15 -0400 Received: from fda.zemos.net ([69.141.77.58]) by comcast.net (sccrmhc11) with ESMTP id <2004042223224701100pf5hoe>; Thu, 22 Apr 2004 23:22:47 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id AB3FD18680; Thu, 22 Apr 2004 19:22:46 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 06385-03; Thu, 22 Apr 2004 19:22:46 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id 3C5571867F; Thu, 22 Apr 2004 19:22:46 -0400 (EDT) Message-ID: <408853C4.5080509@zemos.net> From: Philip Miller User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Debian/1.6-5 X-Accept-Language: en, en-us MIME-Version: 1.0 To: Yakov Shafranovich Cc: asrg@ietf.org References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <408460BB.40404@solidmatrix.com> <4DBC7314-93FA-11D8-9A39-00039380F1B6@pobox.com> <4087C12A.2030209@solidmatrix.com> In-Reply-To: <4087C12A.2030209@solidmatrix.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] E-postage: change economics of spam & discuss on a separate list Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 19:22:44 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: [snip earlier context because it's no longer relevant] > What I am trying to say is that if the whole intent of e-postage is to > do rate-limiting, then just do rate limiting and skip the e-postage. The purpose of E-postage, as I see such proposals, is to make the cost of indiscriminate spamming prohibitive. This does inherently rate-limit, but the intent is that spammers' customers won't see anything close to the current ROI of spamming. >>> Otherwise, I do not see what the ASRG or the IETF can do for or >>> against e-postage - it is simply not within the scope of standards at >>> this point. >> >> Well, it might be useful to set out some requirements. Or is that not >> within the IETF's remit? (Serious question.) > > It is more of an IRTF issue at this point, so if sufficient people want > to pursue discussion on it, we can spill it off into a separate ASRG list. I think it would be good to establish a separate list for discussion of this nature. There are many people with fine ideas, and it would help to collect them in a list which doesn't have have the denizens screaming that e-postage is evil. > However, what I am really interest in seeing about e-postage is > discussion on how it can stop spam. Perhaps we can look into why people > think that e-postage will stop spam and carry over those principles into > other proposals. I want to isolate the principles of why e-postage will > help from the actual technical problems involved with making e-postage > work such double-spending. As I said above, e-postage removes the economic incentives to spam. I really think that further discussion on the general list is not too productive. Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 20:52:34 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15979 for ; Thu, 22 Apr 2004 20:52:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGopJ-0005oN-0U for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 20:45:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N0juN5022329 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 20:45:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGohY-00033z-Ml for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 20:37:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15098 for ; Thu, 22 Apr 2004 20:37:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGohU-0000BR-8s for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 20:37:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGofS-0007SO-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 20:35:46 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BGoeW-00079c-01 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 20:34:48 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BGoLT-00079a-18 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 20:15:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGoCf-0001nB-AP; Thu, 22 Apr 2004 20:06:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGo5I-0006lm-CX for asrg@optimus.ietf.org; Thu, 22 Apr 2004 19:58:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA13720 for ; Thu, 22 Apr 2004 19:58:21 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGo5E-0005nj-Ap for asrg@ietf.org; Thu, 22 Apr 2004 19:58:20 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGo4Q-0005YE-00 for asrg@ietf.org; Thu, 22 Apr 2004 19:57:31 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BGo3U-0005J5-00 for asrg@ietf.org; Thu, 22 Apr 2004 19:56:32 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3MNuYQD030084; Thu, 22 Apr 2004 19:56:34 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id TAA16561; Thu, 22 Apr 2004 19:56:34 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16520.23473.537705.626727@world.std.com> To: Yakov Shafranovich Cc: Barry Shein , asrg@ietf.org Subject: Re: [Asrg] Re: E-postage In-Reply-To: <4087C3B4.2040706@solidmatrix.com> References: <20040413142358.BD50416DF5@mail.nitros9.org> <4080584F.10503@opendoors.com> <40805EE5.7060403@solidmatrix.com> <4080BCD9.3000105@opendoors.com> <16516.12619.744345.929026@world.std.com> <408465CB.3090500@solidmatrix.com> <16516.34678.371575.137422@world.std.com> <40849808.3090005@solidmatrix.com> <16517.56612.196778.643255@world.std.com> <4087C3B4.2040706@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 19:56:33 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 22, 2004 at 09:08 research@solidmatrix.com (Yakov Shafranovich) wrote: > > Let me ask a different question - can you elaborate as to the specific > reasons why e-postage will help with spam. Perhaps we can achieve those > same reasons with other means as well. 1. A way to measure and charge for resources consumed. 2. An incentive for measuring such things (like, claiming your settlements if it came to that.) It would be a nice first result if some sort of awareness resulted, like if someone's PC is being exploited by a spammer whenever their screen-saver runs and their ISP hasn't really paid attention maybe seeing "you sent 134,377 emal messages yesterday" on sign-up might pique their interest. And if their ISP can't be bothered to even do that then maybe when *their* next level up or whatever, perhaps some large service they would rather not lose contact with who is on the ball, says "you sent 16,333,432 messages to our customers last month, 20M would be considered excessive" and lazy ISP says wait, I only have 5,000 customers, that's over 3,000 msgs/customer/month or 100/customer per day just to this one service THAT DOESN'T SEEM LIKELY maybe I'd better pay attention before I hit that 20M... 3. Would/Could turn spam into a simple "theft-of-service" sort of crime, where it's fraudulently sent. 4. Most importantly, would have the potential (start down the road) for making the economics of spam as we know it, sending out tens of millions of spams per day just to get a few nibbles, impossible. > There is really no way to restrict unstamped email unless it goes to the > ISPs mail servers. I just want to point out this distinction - people > would still be free to run their own email servers over whatever system > they would like such as FreeNet. And we can't decrement TTLs in IP packets unless the email or other service does end-to-end w/ the ISP? I don't think so. Again, a straw man model. > > What I am really interested in discussing is why this would help. The > issues of how e-postage would work can be left to be worked out but the > interesting thing is how will e-postage help with spam? > Because the fundamental cause of spam is the absence of any relationship between resources consumed and resources paid for, to an astronomical sense. So much so that I assert spamming cannot exist without criminal abuse of others' resources. But this sort of approach will also help control a rich and reasonably honest mass advertiser. But that resource reality includes victims of spammers such as people who won't secure open proxies etc (with some appropriate leeway for mercy.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 20:55:26 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA16221 for ; Thu, 22 Apr 2004 20:55:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGora-0006UZ-ED for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 20:48:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N0mIGO024935 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 20:48:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGojT-0003a5-T3 for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 20:39:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15532 for ; Thu, 22 Apr 2004 20:39:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGojP-0000rl-I2 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 20:39:51 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGoiQ-0000W2-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 20:38:51 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGogJ-0007dV-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 20:36:39 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGoW0-0007ta-RM; Thu, 22 Apr 2004 20:26:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGoLo-0004Tx-F7 for asrg@optimus.ietf.org; Thu, 22 Apr 2004 20:15:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA14367 for ; Thu, 22 Apr 2004 20:15:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGoLk-0002Kp-EM for asrg@ietf.org; Thu, 22 Apr 2004 20:15:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGoL0-00025s-00 for asrg@ietf.org; Thu, 22 Apr 2004 20:14:39 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BGoKF-0001q3-00 for asrg@ietf.org; Thu, 22 Apr 2004 20:13:51 -0400 Received: from world.std.com (chungf@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3N0DqIX027262; Thu, 22 Apr 2004 20:13:52 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id UAA05768; Thu, 22 Apr 2004 20:13:52 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16520.24512.388679.356955@world.std.com> To: "Tom Thomson" Cc: "Yakov Shafranovich" , "Barry Shein" , Subject: RE: [Asrg] Re: E-postage In-Reply-To: References: <4087C3B4.2040706@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 20:13:52 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 22, 2004 at 16:05 tthomson@neosinteractive.com (Tom Thomson) wrote: > First, we still see junk mail on paper. Something like 65% of my paper mail > is junk. So the charge for paper mail hasn't eliminated spam. So you're saying unless it's zero then it's useless? I think this is called "making the best the enemy of the good". > Second, who pays the charge? If a spammer "owns" a bunch of zombie machines > scattered round the world, they pay the email charge - he doesn't. So it's > not much of a deterrent to him. Of course it may encourage people to secure > their machines so that they don't end up paying, but I'm not certain that That's all, you just answered your own question. > that will produce a big reduction in volume - look at the number of critical > security problems published in the last year (by reliable bodies like CERT) > for *NIX systems, or the rather smaller number for Windows systems - and > look at the delays in availability of fixes. There's plenty of window for > the attackers even if people are sufficiently clued up to keep their > machines "secure". Of course it's possible to build very secure systems and > to use multiple layers of firewalls, but the average guy is not going to do > that because it's both extremely difficult with current platforms and very > expensive. So I assume you have a foolproof, perfect solution to spam? Or you're just determined to wait until one comes along and let the status quo be? My assertion is that if people are abusing free resources in a big way then charge for them, set up a charging mechanism that deters the abusers w/o discouraging the honest! How hard is that to understand? > Third, there's one born every minute. The spammer can recruit people as > spam-mailers, people who believe they will make money by working for him and > won't stop sending spam on his behalf until they have lost a packet (some > won't even stop until they've gone bankrupt). They make the losses, he > makes the profits. So? At least their money, or lack thereof, places an upper-bound on the damage they can do. When they run out of money, they stop spamming, what a wonderful result. Just how much of the human condition are you trying to fix via this topic? I'd be more concerned about something like child porn on the net, in general (nothing to do with spam per se), than the possibility that someone might get conned by a spammer into sending email and lose a few bucks on the deal. Just as a f'rinstance. > Fourth, we don't know what the value (to the spammer) of spam is. Obviously > different spams generate different returns. The gullibility and greed of > some people is so great that even with a high email price some spams will > remain profitable - and of course this relates to the first point above. So > we don't know how high we have to set the price to get spam down to a > "reasonable" level, and setting the price too high is as bad as the spam - > my email is just as unusable if no-one can afford to email me as it is if I > have to spend too much time filtering out the spam. Maybe over time we can > find the right pricing level, if there is one, but maybe there isn't a right > pricing level to find. Now you're way out of anything this list could rationally deal with (unless you're posting from some country with a centralized pricing board.) You let the market decide. Put another way, do you think you and your friends emailing is comparable to a spammer's? The more noxious spammers probably send on the order of tens of millions of messages per day. Do you even send tens of messages per day, upwards of 100? If not, then we're looking at a millionfold difference in volume, and probably a lot more (the spammer does it 7 days a week) between your habits and a spammer's. I suspect that in a millionfold difference there's some room for pricing decisions. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 21:10:52 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA17215 for ; Thu, 22 Apr 2004 21:10:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGp9p-0003Xq-Fu for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 21:07:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N179S7013622 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 21:07:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGp7F-0001xz-IN for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 21:04:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA16828 for ; Thu, 22 Apr 2004 21:04:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGp7B-0007XI-4M for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 21:04:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGp6N-0007IT-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 21:03:36 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGp5j-00072u-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 21:02:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGosI-0006jK-Mm; Thu, 22 Apr 2004 20:49:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGoj1-0003Rk-EM for asrg@optimus.ietf.org; Thu, 22 Apr 2004 20:39:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA15467 for ; Thu, 22 Apr 2004 20:39:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGoix-0000iz-3m for asrg@ietf.org; Thu, 22 Apr 2004 20:39:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGoh1-00007n-00 for asrg@ietf.org; Thu, 22 Apr 2004 20:37:23 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BGoeu-00079c-00 for asrg@ietf.org; Thu, 22 Apr 2004 20:35:12 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by mx2.foretec.com with esmtp (Exim 4.24) id 1BGo8f-0006m8-Pj for asrg@ietf.org; Thu, 22 Apr 2004 20:01:53 -0400 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3N01oQD007611; Thu, 22 Apr 2004 20:01:50 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id UAA02016; Thu, 22 Apr 2004 20:01:50 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16520.23789.895405.50895@world.std.com> To: Yakov Shafranovich Cc: mathew , asrg@ietf.org Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP? In-Reply-To: <4087C12A.2030209@solidmatrix.com> References: <20040417055511.27928.qmail@xuxa.iecc.com> <40814E95.2070509@opendoors.com> <16516.15496.971964.662601@world.std.com> <408460BB.40404@solidmatrix.com> <4DBC7314-93FA-11D8-9A39-00039380F1B6@pobox.com> <4087C12A.2030209@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 20:01:49 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 22, 2004 at 08:57 research@solidmatrix.com (Yakov Shafranovich) wrote: > What I am trying to say is that if the whole intent of e-postage is to > do rate-limiting, then just do rate limiting and skip the e-postage. Why would anyone do rate-limiting so long as they can entice customers by offering them unlimited, free access to YOUR mailbox? It's beginning to install a charging mechanism and charges which will impose realistic rate-limiting. But a good first step would be creating mechanisms whereby everyone (well, at least ISPs or sizeable corps etc) can easily know what the situation is in cold, hard, numbers. > However, what I am really interest in seeing about e-postage is > discussion on how it can stop spam. Perhaps we can look into why people > think that e-postage will stop spam and carry over those principles into > other proposals. I want to isolate the principles of why e-postage will > help from the actual technical problems involved with making e-postage > work such double-spending. Because money talks and bullshit walks, Yakov, in as few words as is probably possible. We may not move it all to an idealized charging/settlement system in one fell swoop. But we can begin to move down that road by thinking about resource accountability and mechanism to help with that. Hell, you can do other things with the numbers, that's one underlying confusion, mechanism versus policy. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 23:14:10 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA23498 for ; Thu, 22 Apr 2004 23:14:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGr05-0006yX-MN for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 23:05:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N35DkZ026806 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 23:05:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGqsC-0004IX-Os for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 22:57:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA22620 for ; Thu, 22 Apr 2004 22:57:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGqs7-00070w-8A for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 22:56:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGqqx-0006gi-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 22:55:47 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGqqM-0006Ou-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 22:55:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGqlR-0002Ev-61; Thu, 22 Apr 2004 22:50:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGqeI-0008Dh-1L for asrg@optimus.ietf.org; Thu, 22 Apr 2004 22:42:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA21993 for ; Thu, 22 Apr 2004 22:42:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGqeC-0003Cq-DQ for asrg@ietf.org; Thu, 22 Apr 2004 22:42:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGqdK-0002w1-00 for asrg@ietf.org; Thu, 22 Apr 2004 22:41:42 -0400 Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx with esmtp (Exim 4.12) id 1BGqcQ-0002OD-00 for asrg@ietf.org; Thu, 22 Apr 2004 22:40:46 -0400 Received: from [192.168.0.3] (h00095b86f221.ne.client2.attbi.com[24.128.50.188]) by comcast.net (rwcrmhc12) with SMTP id <2004042302401801400i97c7e>; Fri, 23 Apr 2004 02:40:18 +0000 Message-Id: <8D34D8AA-94CF-11D8-BE9A-00039380F1B6@pobox.com> X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-3: like Habeas SWE (tm) Subject: Re: [Asrg] Re: the e-postage argument X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this From: mathew X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-2: brightly anticipated In-Reply-To: <200404220121.i3M1Lu022626@panix5.panix.com> References: <200404220121.i3M1Lu022626@panix5.panix.com> To: asrg@ietf.org X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-4--845883140; protocol="application/pkcs7-signature" X-Habeas-Swe-1: winter into spring X-Habeas-Swe-9: mark in spam to . X-Mailer: Apple Mail (2.613) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 22:40:15 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.2 required=5.0 tests=AWL,OPT_IN_CAPS autolearn=no version=2.60 --Apple-Mail-4--845883140 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit On Apr 21, 2004, at 21:21, Seth Breidbart quoted someone: >> How come SSL certificates in HTTPS transactions can work? Aren't they >> reasonably analogous? > > No; anybody can generate one. Somebody who wanted billions of valid > ones could just spend a little CPU time. No, it doesn't work like that. If it did, SSL would be useless. Sure, I can generate a self-signed SSL certificate, but that's not going to get me anywhere. See for example, for discussion of the lengths you have to go to to get Apple Mail to accept some random person's SSL cert. I guess the spammers could cold-call Aunt Tillie on the phone and walk her through the process of importing their self-signed certificate so that their bogus postage would be accepted, but at least it would slow them down a bit, eh? And if the postage verification was performed by her ISP, they'd have to persuade *them* to accept SSL certs signed by "Nigerian Opt-In Communications Inc." or whatever. Ask yourself why phishing sites don't use SSL. mathew --Apple-Mail-4--845883140 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGEDCCAskw ggIyoAMCAQICAwwEFTANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDQwMzI4MjA1ODExWhcNMDUwMzI4MjA1ODExWjBAMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMR0wGwYJKoZIhvcNAQkBFg5tZXRhQHBvYm94LmNvbTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOXun6xaDS5SyU0KswTKlW/Fdfknsyfk64UT B6Lb0AyYlNPoNGsgFtBRRQru1WYXmdUsyru8cvp0u9aqjslP6BFv13VF3XBWhDGctnO1gUkuaWNi G58zUvADdOJen8jL1SyzXF4gpY8dxk4gNwp8a1NqN5NBQwfrHSOdWtdqNudJCF7dwCGJBgyoN3I9 v1WtVRZIeNn7S1AmwtbCPckcYwnBK28giolxm6eYS2FDHEFyM1PPuvuvBm0zShLhWNxQSRsUL9gd CWgyrcShStkwx9rinFo9Ens0/r7zcytPFL77t1p16mQ8O6J1ZGeF6t9yMJm5tDL+IfQbtJruSwF5 ERUCAwEAAaMrMCkwGQYDVR0RBBIwEIEObWV0YUBwb2JveC5jb20wDAYDVR0TAQH/BAIwADANBgkq hkiG9w0BAQQFAAOBgQAynR69x1axSiz4b32j6kRWj+jjQJFvl5zMvdnZpRWdyvL9gscwt2bro3TD cvEI9kELco0BzcLyftMV9rGjSOuiCpJRsWe0/uGB/YVhAuuTpBPoEQblQb4cwoE578of2pludQWB yg0Qn5aGXTS+uYsm34s94E3jObPTiGUIiukROzCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEF BQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUg VG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24g U2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTEr MCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAw MDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3Vs dGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWlu ZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me 7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r 1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCB kTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3Rl LmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPq Cy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUa C4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx 0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz dWluZyBDQQIDDAQVMAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJ KoZIhvcNAQkFMQ8XDTA0MDQyMzAyNDAxNVowIwYJKoZIhvcNAQkEMRYEFB3FCC/sZjEaDlOJi90s sYuKSyRqMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBD b25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJ c3N1aW5nIENBAgMMBBUwegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgSXNzdWluZyBDQQIDDAQVMA0GCSqGSIb3DQEBAQUABIIBAEdsQfujgG4FYq0sUYWD rYe9HxeplANUeM5QctZYm/sYySFRU6dniF7bEsztHysd5gO0hGUQ34h8WmkWR44ixW4rVkgSCe/U 8YGt0e3LFUg9mygDa3Rj4fKriMuHUtQmUJK982cElGIQj9VgqSitbpNh6U5DTyIptS6klRf8haBR avkgyHnWIe+xJbeH0u6nOjp3cTR3eaS3mMBYaXUYmgVBB5I+gKL4iOjYNMW8NvtIMjepKG1VGIob tCHQm/GQm2EN97TDc3PJySb/CXFXn8C4vQdNTqz0jklUz00vtHEJj+HPd0R/BWknT6s7WdgBVpxF iBkD/YTeuH0u4fZatVwAAAAAAAA= --Apple-Mail-4--845883140-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 23:37:45 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA24614 for ; Thu, 22 Apr 2004 23:37:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGrPe-00061u-Bo for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 23:31:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N3VcQK023174 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 23:31:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGrIo-0004EO-IV for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 23:24:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA23973 for ; Thu, 22 Apr 2004 23:24:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGrIk-0006Y5-KS for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 23:24:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGrHl-0006EP-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 23:23:29 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGrGi-0005qK-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 23:22:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGr19-000773-2E; Thu, 22 Apr 2004 23:06:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGqvh-0005Cl-3h for asrg@optimus.ietf.org; Thu, 22 Apr 2004 23:00:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA22895 for ; Thu, 22 Apr 2004 23:00:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGqvb-0000K4-Ax for asrg@ietf.org; Thu, 22 Apr 2004 23:00:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGque-00002g-00 for asrg@ietf.org; Thu, 22 Apr 2004 22:59:37 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BGqtp-0007KA-00 for asrg@ietf.org; Thu, 22 Apr 2004 22:58:45 -0400 Received: from [192.168.0.3] (h00095b86f221.ne.client2.attbi.com[24.128.50.188]) by comcast.net (rwcrmhc11) with SMTP id <20040423025817013004p5lle>; Fri, 23 Apr 2004 02:58:17 +0000 Message-Id: <1010DC0F-94D2-11D8-BE9A-00039380F1B6@pobox.com> X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-3: like Habeas SWE (tm) Subject: Re: [Asrg] Re: E-postage X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this From: mathew X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-2: brightly anticipated In-Reply-To: References: To: asrg@ietf.org X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) Content-Type: text/plain; charset=US-ASCII; format=flowed X-Habeas-Swe-1: winter into spring Content-Transfer-Encoding: 7bit X-Habeas-Swe-9: mark in spam to . X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 22:58:14 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Apr 22, 2004, at 11:05, Tom Thomson wrote: > Surely the argument is that if the cost of sending spam goes up to > such a > level that sending spam ceases to be profitable, then no-one will do > it any > more? > > I don't fully believe this argument myself, or at least I don't > believe it > can be achieved by e-postage, for a number of reasons. Well, look at it this way: The *worst possible case* is that e-postage completely fails to make any dent in the amount of spam I receive, but I now get (say) 5 cents per spam in e-postage. Looking at this month's statistics, I'd be getting $20 a month free money from the spammers. That's enough to pay for a free Internet connection. Heck, if I make my postage 10 cents, they'll be buying me a free cable modem connection. Now, that's a worst case I'm prepared to live with! > First, we still see junk mail on paper. Something like 65% of my > paper mail > is junk. So the charge for paper mail hasn't eliminated spam. Do you get 50 pieces of paper junk mail every day? I don't. Maybe e-postage won't eliminate spam, but I'll settle for spam dropping in volume by a factor of 10 as a worthy start. > Second, who pays the charge? If a spammer "owns" a bunch of zombie > machines > scattered round the world, they pay the email charge - he doesn't. So > it's > not much of a deterrent to him. On the other hand, he's now committing actual theft from thousands of people, which may gain the interest of law enforcement. > Third, there's one born every minute. The spammer can recruit people as > spam-mailers, people who believe they will make money by working for > him and > won't stop sending spam on his behalf until they have lost a packet > (some > won't even stop until they've gone bankrupt). They make the losses, he > makes the profits. Hey, if a spammer can find enough suckers to buy me free Internet, I'm not complaining. > So we don't know how high we have to set the price to get spam down to > a > "reasonable" level, and setting the price too high is as bad as the > spam - > my email is just as unusable if no-one can afford to email me as it is > if I > have to spend too much time filtering out the spam. You mean no-one can afford to *risk* e-mailing you and *risk* having you cash the postage, right? Because you don't *have* to cash the e-postage... > Maybe over time we can find the right pricing level, if there is one, > but maybe there isn't a right pricing level to find. Well, there's only one way to find out, because we sure as hell can't trust the spammers to tell us. mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 22 23:43:06 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA24791 for ; Thu, 22 Apr 2004 23:43:06 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGrTs-0007d0-6Q for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 23:36:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N3a0f5029317 for asrg-archive@odin.ietf.org; Thu, 22 Apr 2004 23:36:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGrMr-0005cQ-DG for asrg-web-archive@optimus.ietf.org; Thu, 22 Apr 2004 23:28:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA24215 for ; Thu, 22 Apr 2004 23:28:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGrMn-0007ij-Dl for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 23:28:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGrM1-0007R5-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 23:27:54 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGrL1-00079k-00 for asrg-web-archive@ietf.org; Thu, 22 Apr 2004 23:26:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGrHM-0003rV-Mw; Thu, 22 Apr 2004 23:23:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGr6j-0000KZ-PA for asrg@optimus.ietf.org; Thu, 22 Apr 2004 23:12:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA23411 for ; Thu, 22 Apr 2004 23:12:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGr6e-0002yc-Nu for asrg@ietf.org; Thu, 22 Apr 2004 23:12:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGr4w-0002fP-00 for asrg@ietf.org; Thu, 22 Apr 2004 23:10:16 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BGr2g-00027b-00 for asrg@ietf.org; Thu, 22 Apr 2004 23:07:54 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 3666448C62 for ; Thu, 22 Apr 2004 23:07:56 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3N37uE04247; Thu, 22 Apr 2004 23:07:56 -0400 (EDT) Message-Id: <200404230307.i3N37uE04247@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <8D34D8AA-94CF-11D8-BE9A-00039380F1B6@pobox.com> (message from mathew on Thu, 22 Apr 2004 22:40:15 -0400) Subject: Re: [Asrg] Re: the e-postage argument References: <200404220121.i3M1Lu022626@panix5.panix.com> <8D34D8AA-94CF-11D8-BE9A-00039380F1B6@pobox.com> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 22 Apr 2004 23:07:56 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 mathew wrote: > On Apr 21, 2004, at 21:21, Seth Breidbart quoted someone: >>> How come SSL certificates in HTTPS transactions can work? Aren't they >>> reasonably analogous? >> >> No; anybody can generate one. Somebody who wanted billions of valid >> ones could just spend a little CPU time. > > No, it doesn't work like that. If it did, SSL would be useless. No, SSL encrypts. > Sure, I can generate a self-signed SSL certificate, but that's not > going to get me anywhere. It does for a number of stores I shop at. After all, what value does having a certificate signed by Verisign actually provide? If it turns out to be bogus and you lose money, will Verisign compensate you? Does Verisign have any actual responsibility to you, the truster of a certificate they issued? Or do you just like the assurance that "This certificate was issued by somebody who paid (somebody who paid)* to have a root certificate pre-implanted in my browser"? > Ask yourself why phishing sites don't use SSL. Why should they bother? Would it increase their success ratio? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 01:34:58 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA01194 for ; Fri, 23 Apr 2004 01:34:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGtAi-0007Vi-AR for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 01:24:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N5OKc5028862 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 01:24:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGt6O-0005um-DQ for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 01:19:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA00550 for ; Fri, 23 Apr 2004 01:19:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGt6J-0007au-B2 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 01:19:47 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGt5R-0007KK-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 01:18:54 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGt4p-00072o-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 01:18:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGswr-0002uQ-Tw; Fri, 23 Apr 2004 01:10:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGsuj-0001yy-UB for asrg@optimus.ietf.org; Fri, 23 Apr 2004 01:07:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA29728 for ; Fri, 23 Apr 2004 01:07:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGsue-00045X-Pq for asrg@ietf.org; Fri, 23 Apr 2004 01:07:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGstb-0003l9-00 for asrg@ietf.org; Fri, 23 Apr 2004 01:06:40 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BGssr-0003S3-00 for asrg@ietf.org; Fri, 23 Apr 2004 01:05:53 -0400 Received: (qmail 13066 invoked by uid 100); 23 Apr 2004 05:05:51 -0000 Message-ID: <20040423050551.13065.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Re: the e-postage argument In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Cc: tthomson@neosinteractive.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 23 Apr 2004 05:05:51 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 > The european postal union certainly deosn't have such transfer > payments between its members, why should an email system? I think it would be a good idea to look at this page: http://www.upu.int/payment_compensation/en/index.html You might want to take a look at http://www.upu.int in general. Don't miss the page where it says that their new low-cost online settlement clearing system costs betwen CH 1500 and CH 15000 per year (CH == Swiss francs) depending on how big you are. R's, John PS: I agree with everyone who says that rate limiting outbound mail from customers you don't know well is a good idea. But of course you can do that without faux postage. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 01:39:40 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA01435 for ; Fri, 23 Apr 2004 01:39:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGtMB-0002a4-8T for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 01:36:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3N5aBkZ009904 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 01:36:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGtKl-0001lN-8u for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 01:34:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA01191 for ; Fri, 23 Apr 2004 01:34:40 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGtKg-0003oy-5Y for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 01:34:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGtJn-0003Zf-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 01:33:44 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGtJF-0003Js-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 01:33:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGtAS-0007Qf-6G; Fri, 23 Apr 2004 01:24:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGt1V-0004OA-Aw for asrg@optimus.ietf.org; Fri, 23 Apr 2004 01:14:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA00245 for ; Fri, 23 Apr 2004 01:14:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGt1Q-0006C3-CA for asrg@ietf.org; Fri, 23 Apr 2004 01:14:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGt0V-0005v4-00 for asrg@ietf.org; Fri, 23 Apr 2004 01:13:47 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BGszf-0005eI-00 for asrg@ietf.org; Fri, 23 Apr 2004 01:12:55 -0400 Received: (qmail 15194 invoked by uid 100); 23 Apr 2004 05:12:58 -0000 Message-ID: <20040423051258.15193.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Re: E-postage In-Reply-To: <1010DC0F-94D2-11D8-BE9A-00039380F1B6@pobox.com> Organization: I.E.C.C., Trumansburg NY USA Cc: meta@pobox.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 23 Apr 2004 05:12:58 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >Well, look at it this way: The *worst possible case* is that e-postage >completely fails to make any dent in the amount of spam I receive, but >I now get (say) 5 cents per spam in e-postage. No, the worst possible case is that you get just as much spam as you do now, you get paid nothing for your incoming spam becasue spammers subvert the charging system, and your monthly ISP bill goes up to pay for the overhead of the complex but useless e-postage system. A common FUSSP error is to assume that spammers will play by your rules. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 06:48:54 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA27101 for ; Fri, 23 Apr 2004 06:48:54 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGy9T-0004m0-GQ for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 06:43:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NAhNNZ018348 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 06:43:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGy78-0004Bf-3O for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 06:40:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA26771 for ; Fri, 23 Apr 2004 06:40:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGy72-0000Dd-4e for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 06:40:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGy6A-0007l3-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 06:39:59 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGy55-0007V7-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 06:38:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGxyU-0001zy-IQ; Fri, 23 Apr 2004 06:32:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGxta-0000cU-Uq for asrg@optimus.ietf.org; Fri, 23 Apr 2004 06:26:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA26380 for ; Fri, 23 Apr 2004 06:26:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGxtU-0004Sz-Qh for asrg@ietf.org; Fri, 23 Apr 2004 06:26:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGxsX-0004D0-00 for asrg@ietf.org; Fri, 23 Apr 2004 06:25:55 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BGxrg-0003wu-00 for asrg@ietf.org; Fri, 23 Apr 2004 06:25:00 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 23 Apr 2004 10:28:45 +0100 From: "Tom Thomson" To: "Barry Shein" Cc: Subject: RE: [Asrg] Re: E-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) In-Reply-To: <16520.24512.388679.356955@world.std.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal X-OriginalArrivalTime: 23 Apr 2004 09:28:45.0328 (UTC) FILETIME=[5FE79100:01C42915] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 11:22:44 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > On April 22, 2004 at 16:05 tthomson@neosinteractive.com (Tom Thomson) wrote: > > First, we still see junk mail on paper. Something like 65% of my paper mail > > is junk. So the charge for paper mail hasn't eliminated spam. > > So you're saying unless it's zero then it's useless? I think this is > called "making the best the enemy of the good". No, I'm saying that 65% is far too high. I receive as much email in a day as I receive paper mail in a month, and that higher volume burden of tripling the mail volume with junk mail is much greater. Currently I don't see the proportion of spam in (free) email as being much different from the proportion of spam in (paid, stamped) paper mail so it's not obvious that switching to a paid, stamped system will improve things. Other people will have different experience, for example Alan De Kok seems to see a vastly higher proportion of spam, whereas some of my colleagues (those who don't post to ietf lists which publish email addresses of correspondents on a public web page, for example) see a much lower proportion of spam. So I would call it "making my self the enemy of something that will cause a lot of pain and will probably have no useful effect on the problem". > > Second, who pays the charge? If a spammer "owns" a bunch of zombie machines > > scattered round the world, they pay the email charge - he doesn't. So it's > > not much of a deterrent to him. Of course it may encourage people to secure > > their machines so that they don't end up paying, but I'm not certain that > > That's all, you just answered your own question. No I didn't. I made the point that the effect of people securing machines will be marginal at best (unless thr providers of Unix and Windows systems get their acts in order - and I'm not holding my breath for that). > > that will produce a big reduction in volume - look at the number of critical > > security problems published in the last year (by reliable bodies like CERT) > > for *NIX systems, or the rather smaller number for Windows systems - and > > look at the delays in availability of fixes. There's plenty of window for > > the attackers even if people are sufficiently clued up to keep their > > machines "secure". Of course it's possible to build very secure systems and > > to use multiple layers of firewalls, but the average guy is not going to do > > that because it's both extremely difficult with current platforms and very > > expensive. > > So I assume you have a foolproof, perfect solution to spam? No. If I had I would publish it. At the moment the best approaches I can see are (a) Seth Breidbarts's proposal for expensive 1 day certificates with free renewals for non-spammers, (b) a means of source verification combined with anti-spam legislation and enforcement of it, (c) getting ISPs to do outgoing spam filtering in their smart-hosts (to eliminate a lot of zombie spam), (d) getting ISPs to check stuff at their borders (the envelope From address for something passing out should be inside the boundary), and (e) getting ISPs to check that the From addresses in mail pushed through their servers match the dial-up or ADSL connection it arrived on. Of these, (c), (d), and (e) have been proposed quite regularly for over a decade, but most ISPs don't want to know because it solves someone else's problem not theirs, so I'm not expecting any of those to happen quickly. > Or you're just determined to wait until one comes along and let the > status quo be? No. I want to see things like LDAP and Seth's proposal embodied in RFCs (some of which will eventuially become standards track RFCs) and things like items (C), (d), and (e) on my list embedded in BCPs for mail server operators. I would also like to see more solutions proposed and debated in groups like this, so that we can get more proposals onto the standards track. Of course I#d also like to see secure bersions of %NIX and Windows, to kill off zombie spam and zombie relays, but as I said I'm not holding my breath on that one (thirtyfive years ago we knew how to build secure systems and how to write operating systems in high level languages to avoid the sort of flaws which we see so often today; then came C and C++ and operating systems written inthose languages, and we've no hope of building a secure system). > My assertion is that if people are abusing free resources in a big way > then charge for them, set up a charging mechanism that deters the > abusers w/o discouraging the honest! > > How hard is that to understand? No, it's not hard to understand. It would be nice if we could do it. I haven't seen a proposal that sets out a mechanism for doing it yet, though (apart from Seth's that I proposal referred to above) - just some claims that it's achievable by some variant of a stamp system. > > Third, there's one born every minute. The spammer can recruit people as > > spam-mailers, people who believe they will make money by working for him and > > won't stop sending spam on his behalf until they have lost a packet (some > > won't even stop until they've gone bankrupt). They make the losses, he > > makes the profits. > > So? > > At least their money, or lack thereof, places an upper-bound on the > damage they can do. When they run out of money, they stop spamming, > what a wonderful result. > > Just how much of the human condition are you trying to fix via this > topic? You miss the point. I don't much care if the idiots lose money. what I care about is that the spammer (the guy who persuades them to send out his email for him) still makes money, so he will continue to spam. If there were few enough idiots in the world that switching some of them off by bankrupting them would eliminate the spammer's supply of idiots who will fall for his scam and send his mail for him, I would be supporting your ideas instead of opposing them. But as I said, there' one born ebery minute - there are just too many. > I'd be more concerned about something like child porn on the net, in > general (nothing to do with spam per se), than the possibility that > someone might get conned by a spammer into sending email and lose a > few bucks on the deal. Just as a f'rinstance. Me too. But it's completely off topic here. > > Fourth, we don't know what the value (to the spammer) of spam is. Obviously > > different spams generate different returns. The gullibility and greed of > > some people is so great that even with a high email price some spams will > > remain profitable - and of course this relates to the first point above. So > > we don't know how high we have to set the price to get spam down to a > > "reasonable" level, and setting the price too high is as bad as the spam - > > my email is just as unusable if no-one can afford to email me as it is if I > > have to spend too much time filtering out the spam. Maybe over time we can > > find the right pricing level, if there is one, but maybe there isn't a right > > pricing level to find. > > Now you're way out of anything this list could rationally deal with > (unless you're posting from some country with a centralized pricing > board.) You're now saying that the list can't rationally deal a pricing level for email. So are you being irrational when you say that the list should say that that pricing level should higher than it is now? I don't think you are being irrational, and I don't believe that you think you are either, so I have to conclude that you made that statement without thinking about what it meant. > You let the market decide. The market decided about two decades ago. It decided that the marginal cost of email should be zero, or as close to it as makes no matter. The market has grown since then, and changed in other ways of course, but it hasn't changed this decision. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 07:53:19 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA29327 for ; Fri, 23 Apr 2004 07:53:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGzDb-0004Nq-NR for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 07:51:43 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NBphbp016842 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 07:51:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGz94-0003YR-Vm for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 07:47:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA29116 for ; Fri, 23 Apr 2004 07:47:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGz94-0001vb-7P for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 07:47:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGz8M-0001gH-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 07:46:19 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BGz79-0001Od-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 07:45:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGz5A-0002RJ-Sb; Fri, 23 Apr 2004 07:43:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGz4B-0002Cb-Th for asrg@optimus.ietf.org; Fri, 23 Apr 2004 07:41:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA28942 for ; Fri, 23 Apr 2004 07:41:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGz4B-0000ai-5T for asrg@ietf.org; Fri, 23 Apr 2004 07:41:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGz3L-0000LY-00 for asrg@ietf.org; Fri, 23 Apr 2004 07:41:08 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BGz2s-00005B-00 for asrg@ietf.org; Fri, 23 Apr 2004 07:40:39 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 23 Apr 2004 11:46:23 +0100 From: "Tom Thomson" To: "John Levine" , Subject: RE: [Asrg] Re: the e-postage argument Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) In-Reply-To: <20040423050551.13065.qmail@xuxa.iecc.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal X-OriginalArrivalTime: 23 Apr 2004 10:46:23.0125 (UTC) FILETIME=[382AFC50:01C42920] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 12:40:22 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit John Levine >asrg@johnlevine.com> wrote: > > The european postal union certainly deosn't have such transfer > > payments between its members, why should an email system? > > I think it would be a good idea to look at this page: > > http://www.upu.int/payment_compensation/en/index.html You're quite right. I was relying on someones incorrect description of the European Court of Justice decision against the German postal service in cases C147/97 and C148/97. Your email has made me go and look up the case, and of course it turns out to be totally irrelevant to terminal charges (which my informant told me had been abolished within the EU, citing these cases as evidence for it). That'll teach me to check the references when someone gives me news. If I'd though about it properly, I would have realised that operating without terminal charges within the EU would have been impossible from 1 Jan 2003 anyway (when postal service liberalisation was supposedly enforced). Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 08:48:21 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA01987 for ; Fri, 23 Apr 2004 08:48:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH04r-00012f-17 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 08:46:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NCkjxb004000 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 08:46:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH02I-0000Sm-Cd for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 08:44:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA01784 for ; Fri, 23 Apr 2004 08:44:03 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH02H-0001H8-4a for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 08:44:05 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH01J-00011Y-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 08:43:06 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BH00S-0000mO-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 08:42:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGzuT-0006iW-Oy; Fri, 23 Apr 2004 08:36:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BGzoG-0004w7-UF for asrg@optimus.ietf.org; Fri, 23 Apr 2004 08:29:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA00798 for ; Fri, 23 Apr 2004 08:29:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BGzoF-00054p-On for asrg@ietf.org; Fri, 23 Apr 2004 08:29:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BGzml-0004iu-00 for asrg@ietf.org; Fri, 23 Apr 2004 08:28:03 -0400 Received: from mail1.nber.org ([207.113.108.7]) by ietf-mx with esmtp (Exim 4.12) id 1BGzm5-0004Tf-00 for asrg@ietf.org; Fri, 23 Apr 2004 08:27:21 -0400 Received: from mail1 (root@localhost) by mail1.nber.org (8.12.8/8.12.8) with SMTP id i3NCRKt6030556 for ; Fri, 23 Apr 2004 08:27:20 -0400 Received: from nber1.nber.org (nber1.nber.org [207.113.108.252]) by mail1.nber.org (8.12.8/8.12.8) with ESMTP id i3NCRJab030502; Fri, 23 Apr 2004 08:27:19 -0400 From: Daniel Feenberg To: John Levine cc: asrg@ietf.org, tthomson@neosinteractive.com Subject: Re: [Asrg] Re: the e-postage argument In-Reply-To: <20040423050551.13065.qmail@xuxa.iecc.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 08:27:16 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On 23 Apr 2004, John Levine wrote: > > The european postal union certainly deosn't have such transfer > > payments between its members, why should an email system? > > I think it would be a good idea to look at this page: > > http://www.upu.int/payment_compensation/en/index.html > > You might want to take a look at http://www.upu.int in general. > > Don't miss the page where it says that their new low-cost online > settlement clearing system costs betwen CH 1500 and CH 15000 per > year (CH == Swiss francs) depending on how big you are. > > R's, > John Traditionally (for 100 years or so) post offices exchanged first class mail without the exchange of funds, but the rules always required that such mail hav substantial postage affixed at the source, it is just that the revenue was not shared with the receiving country PO. Parcel post has always involved settlements, as far as I know. Analogies do not make for strong arguments, and I can't tell if this one favors e-postage or not. The situations are quite different and little is to be learned by assuming the lessons of one are relevant to the other, although certainly they can be a source of ideas or inspiration. It does show that it is possible to have postage without settlements. Daniel Feenberg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 13:35:38 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22419 for ; Fri, 23 Apr 2004 13:35:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH4Xc-0003fn-6r for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 13:32:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NHWi4r014119 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 13:32:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH4TI-0002hr-HG for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 13:28:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA22018 for ; Fri, 23 Apr 2004 13:28:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH4TG-0000ET-Ck for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 13:28:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH4SL-0007lq-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 13:27:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BH4RP-0007Vy-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 13:26:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH4KK-0000Hr-MG; Fri, 23 Apr 2004 13:19:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH4Ci-0006U6-5P for asrg@optimus.ietf.org; Fri, 23 Apr 2004 13:11:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20504 for ; Fri, 23 Apr 2004 13:11:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH4Cg-0003Js-8L for asrg@ietf.org; Fri, 23 Apr 2004 13:11:06 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH4Bg-00033D-00 for asrg@ietf.org; Fri, 23 Apr 2004 13:10:05 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BH4Ag-0002aH-00 for asrg@ietf.org; Fri, 23 Apr 2004 13:09:02 -0400 Received: (qmail 21454 invoked by uid 100); 23 Apr 2004 17:08:54 -0000 Message-ID: <20040423170854.21453.qmail@xuxa.iecc.com> From: John Levine Subject: Re: [Asrg] Re: the e-postage argument In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA To: feenberg@nber.org cc: asrg@ietf.org Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 23 Apr 2004 17:08:54 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >Traditionally (for 100 years or so) post offices exchanged first class >mail without the exchange of funds, but the rules always required that >such mail hav substantial postage affixed at the source, it is just that >the revenue was not shared with the receiving country PO. Some sources claim that terminal dues weren't introduced until 1969, others suggest that transit and terminal payments were always collected. Hardly matters for this argument. >Analogies do not make for strong arguments, and I can't tell if this one >favors e-postage or not. The main point I was making is that settlement schemes are very complex, and are not cheap to implement. I agree that we can exchange e-mail without settlements. After all, that's what we do now. But in the absence of settlements, nobody's ever offered a persuasive argument for e-postage other than rate limiting. If you want to rate limit, you should rate limit, no need to pretend that stamps are involved. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 15:29:47 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02941 for ; Fri, 23 Apr 2004 15:29:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH6E7-0002Rr-D9 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 15:20:43 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NJKhLR009402 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 15:20:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH5wr-0006Dj-1U for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 15:02:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29026 for ; Fri, 23 Apr 2004 15:02:49 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH5wo-00035Q-5c for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 15:02:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH5tB-00026c-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 14:59:06 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BH5pa-0001Eg-01 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 14:55:22 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BH5ln-0005zo-UW for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 14:51:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH5JK-0002JQ-89; Fri, 23 Apr 2004 14:22:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH5Bt-0008AR-SF for asrg@optimus.ietf.org; Fri, 23 Apr 2004 14:14:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA24465 for ; Fri, 23 Apr 2004 14:14:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH5Br-0004Vd-Bt for asrg@ietf.org; Fri, 23 Apr 2004 14:14:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH5B2-0004F9-00 for asrg@ietf.org; Fri, 23 Apr 2004 14:13:28 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BH5A6-0003yZ-00 for asrg@ietf.org; Fri, 23 Apr 2004 14:12:30 -0400 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3NICTnh004741 for ; Fri, 23 Apr 2004 14:12:29 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id OAA10248; Fri, 23 Apr 2004 14:12:29 -0400 (EDT) Message-Id: <200404231812.OAA10248@world.std.com> From: Barry Shein To: asrg@ietf.org Subject: [Asrg] Answering a lot of questions about e-postage in a few sentences Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 14:12:29 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Yes you can equate e-postage to just rate-limiting etc. Why that seemingly simple thought just hasn't saved the day would seem to beg its own analysis. The problem is that spam has a huge social and economic component. I have noticed that money and the prospect of making some tends to cause changes in behavior. I'm trying to figure out how to make it profitable for those who can make a difference to not spam or tolerate spammers. Some mechanism, metering etc, might facilitate that new order. The only way we're going to fight spam is not with a little technical frill because you'd still have the whole problem of policy, of getting ISPs et al to adopt it. That's why I have little to zero faith in purely technical approaches that lack social/economic and even legal perception. It's like listening to someone equate masturbation with successful child-rearing; surely there are necessary if not sufficient critical commonalities between the two but let's be frank jerking off is just jerking off. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 15:47:24 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA05016 for ; Fri, 23 Apr 2004 15:47:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH6a0-0003Z0-2B for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 15:43:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NJhK3x013694 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 15:43:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH6VG-0001oL-20 for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 15:38:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA03582 for ; Fri, 23 Apr 2004 15:38:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH6VE-0005VH-N8 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 15:38:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH6RR-0004Zd-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 15:34:29 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BH6PF-0003qI-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 15:32:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH6Ee-0002sU-HV; Fri, 23 Apr 2004 15:21:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH5yo-0008LD-Tg for asrg@optimus.ietf.org; Fri, 23 Apr 2004 15:04:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29443 for ; Fri, 23 Apr 2004 15:04:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH5yl-0003dV-Vd for asrg@ietf.org; Fri, 23 Apr 2004 15:04:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH5wD-0002yJ-00 for asrg@ietf.org; Fri, 23 Apr 2004 15:02:14 -0400 Received: from [131.107.8.3] (helo=exchange.microsoft.com) by ietf-mx with esmtp (Exim 4.12) id 1BH5sE-0001qT-00 for asrg@ietf.org; Fri, 23 Apr 2004 14:58:06 -0400 Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by exchange.microsoft.com with Microsoft SMTPSVC(6.0.3790.1069); Fri, 23 Apr 2004 11:57:36 -0700 Received: from 10.197.0.83 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Fri, 23 Apr 2004 11:57:36 -0700 Received: from DF-CHOPPER.mercury.corp.microsoft.com ([10.197.0.104]) by DF-BEG.mercury.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 23 Apr 2004 11:57:36 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Asrg] Re: the e-postage argument Message-ID: <27C4E14288DB344FBA10705D57A9BB0401AD3B33@DF-CHOPPER.mercury.corp.microsoft.com> Thread-Topic: [Asrg] Re: the e-postage argument Thread-Index: AcQnjHfhV9ByRAnPSUuBMNN/0aIOMQB2BKXQ From: "Bob Atkinson" To: "der Mouse" , X-OriginalArrivalTime: 23 Apr 2004 18:57:36.0299 (UTC) FILETIME=[D78C6FB0:01C42964] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 11:59:47 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable > > An implicit assumption in this discussion is that in the ePostage > > model money must flow from sender to receiver. >=20 > Well, yes. The basic problem with spam is the imposition of cost on > unwilling recipients; I see little point in epostage that pays some > other party, as then the recipient has still lost; it's just that > someone else has benefited instead. I fail to see how this improves > matters significantly. It improves matters by significantly raising the transaction cost for the spammer to send mail (currently ballpark 0.01 cent), thus reducing the attractiveness of this advertising medium.=20 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 18:44:00 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19742 for ; Fri, 23 Apr 2004 18:44:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH9Mn-0000PH-Sh for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 18:41:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NMfrFp001559 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 18:41:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH9Ag-00051p-Eo for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 18:29:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18827 for ; Fri, 23 Apr 2004 18:29:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH9Ad-0007lk-E3 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 18:29:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH99g-0007WM-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 18:28:21 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BH98f-0007GI-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 18:27:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH94X-0002Yl-QH; Fri, 23 Apr 2004 18:23:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH900-00086P-6D for asrg@optimus.ietf.org; Fri, 23 Apr 2004 18:18:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18157 for ; Fri, 23 Apr 2004 18:18:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH8zx-0004oU-7Y for asrg@ietf.org; Fri, 23 Apr 2004 18:18:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH8yy-0004Xp-00 for asrg@ietf.org; Fri, 23 Apr 2004 18:17:17 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BH8xv-000436-00 for asrg@ietf.org; Fri, 23 Apr 2004 18:16:11 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BH8xS-0002Od-00; Fri, 23 Apr 2004 18:15:42 -0400 Received: from [68.246.128.243] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BH8xR-00083I-00; Fri, 23 Apr 2004 18:15:42 -0400 Message-ID: <40899587.2060401@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: Barry Shein CC: asrg@ietf.org Subject: Re: [Asrg] Answering a lot of questions about e-postage in a few sentences References: <200404231812.OAA10248@world.std.com> In-Reply-To: <200404231812.OAA10248@world.std.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 18:15:35 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > Yes you can equate e-postage to just rate-limiting etc. Why that > seemingly simple thought just hasn't saved the day would seem to beg > its own analysis. > > The problem is that spam has a huge social and economic component. > > I have noticed that money and the prospect of making some tends to > cause changes in behavior. I'm trying to figure out how to make it > profitable for those who can make a difference to not spam or tolerate > spammers. Some mechanism, metering etc, might facilitate that new > order. > > The only way we're going to fight spam is not with a little technical > frill because you'd still have the whole problem of policy, of getting > ISPs et al to adopt it. > > That's why I have little to zero faith in purely technical approaches > that lack social/economic and even legal perception. > Barry, You are correct! Only a combination of policy with technology or policy by itself can help. However, I think that there are other possibilities to achieve the same effect without end-to-end e-postage. The basic thought behind e-postage is that resources that are being used should be charged for. Today we already have one such system which is working sucessfully every day - the Internet. ISPs charge each other for uplink and downlink bandwidth and resources used. Now, lets say hypothetically speaking that all ISPs would charge their customers extra for lets say more than 1000 emails/day. Would it achieve the same effect as e-postage? Why isn't this model working today? Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "Some lies are easier to believe than the truth" (Dune) ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 19:37:21 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22397 for ; Fri, 23 Apr 2004 19:37:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHABy-00081y-Jl for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 19:34:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3NNYklt030859 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 19:34:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHA5o-00067C-Et for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 19:28:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21978 for ; Fri, 23 Apr 2004 19:28:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHA5m-0000Av-RZ for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 19:28:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHA4x-0007jv-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 19:27:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHA4X-0007Uj-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 19:27:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH9tu-0002zp-72; Fri, 23 Apr 2004 19:16:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BH9rL-0001sn-Gn for asrg@optimus.ietf.org; Fri, 23 Apr 2004 19:13:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA21274 for ; Fri, 23 Apr 2004 19:13:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BH9rK-000464-0n for asrg@ietf.org; Fri, 23 Apr 2004 19:13:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BH9qP-0003qt-00 for asrg@ietf.org; Fri, 23 Apr 2004 19:12:29 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BH9pb-0003M8-00 for asrg@ietf.org; Fri, 23 Apr 2004 19:11:39 -0400 Received: from fda.zemos.net ([69.141.77.58]) by comcast.net (sccrmhc12) with ESMTP id <200404232310580120023cc5e>; Fri, 23 Apr 2004 23:10:59 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id 9354F18680; Fri, 23 Apr 2004 19:10:57 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 18761-04; Fri, 23 Apr 2004 19:10:57 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id 4E5131867F; Fri, 23 Apr 2004 19:10:57 -0400 (EDT) Message-ID: <4089A27F.3050807@zemos.net> From: Philip Miller User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Debian/1.6-5 X-Accept-Language: en, en-us MIME-Version: 1.0 To: Yakov Shafranovich Cc: asrg@ietf.org References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> In-Reply-To: <40899587.2060401@solidmatrix.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 19:10:55 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yakov Shafranovich wrote: > [snip Barry's words and YS's policy comment] > The basic thought behind e-postage is that resources that are being used > should be charged for. Today we already have one such system which is > working sucessfully every day - the Internet. ISPs charge each other for > uplink and downlink bandwidth and resources used. Now, lets say > hypothetically speaking that all ISPs would charge their customers extra > for lets say more than 1000 emails/day. Would it achieve the same effect > as e-postage? Why isn't this model working today? Hypothetically, it works in the sense that each step upstream (in connectivity, not mail transmission) is charging those immediately downstream for messages transmitted. This means that even if spammers establish their own ISP, they will be charged by their uplink provider. However, this doesn't rectify the essential flaw that receivers bear the cost burden of email, not senders. Even if this raises the cost to send imposed on the sender, it in no way reduces the cost to the receiver. Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 23 22:42:19 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00323 for ; Fri, 23 Apr 2004 22:42:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHD3j-00088Q-59 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 22:38:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3O2cRUI031265 for asrg-archive@odin.ietf.org; Fri, 23 Apr 2004 22:38:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHD1t-00079V-Kw for asrg-web-archive@optimus.ietf.org; Fri, 23 Apr 2004 22:36:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00077 for ; Fri, 23 Apr 2004 22:36:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHD1q-0002NV-DQ for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 22:36:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHD0t-000272-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 22:35:32 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHCzx-0001qH-00 for asrg-web-archive@ietf.org; Fri, 23 Apr 2004 22:34:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHCqj-0003dE-PL; Fri, 23 Apr 2004 22:25:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHCkY-0002dw-5z for asrg@optimus.ietf.org; Fri, 23 Apr 2004 22:18:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA29541 for ; Fri, 23 Apr 2004 22:18:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHCkV-0005b1-0z for asrg@ietf.org; Fri, 23 Apr 2004 22:18:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHCje-0005M1-00 for asrg@ietf.org; Fri, 23 Apr 2004 22:17:43 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHCj0-00056J-00 for asrg@ietf.org; Fri, 23 Apr 2004 22:17:02 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3O2H39B020966; Fri, 23 Apr 2004 22:17:03 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id WAA03510; Fri, 23 Apr 2004 22:17:02 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16521.52766.528849.135849@world.std.com> To: Yakov Shafranovich Cc: Barry Shein , asrg@ietf.org Subject: Re: [Asrg] Answering a lot of questions about e-postage in a few sentences In-Reply-To: <40899587.2060401@solidmatrix.com> References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 23 Apr 2004 22:17:02 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit No activity towards establishing some reliable standards for metering et al. It'd be difficult for a non-neutral party to just assert standards in an area like this. It'd be better to outline some potential standards and then get feedback from those with a reasonable interest, the usual building of consensus cycle. Whatever happened to MS's "caller-id"? Is that dead or did it disappear into another group? Seemed there was a lot of talk about it and since I've heard nothing. Did they ever manage to get a completed example installed for their own domains? -b On April 23, 2004 at 18:15 research@solidmatrix.com (Yakov Shafranovich) wrote: > Barry Shein wrote: > > > Yes you can equate e-postage to just rate-limiting etc. Why that > > seemingly simple thought just hasn't saved the day would seem to beg > > its own analysis. > > > > The problem is that spam has a huge social and economic component. > > > > I have noticed that money and the prospect of making some tends to > > cause changes in behavior. I'm trying to figure out how to make it > > profitable for those who can make a difference to not spam or tolerate > > spammers. Some mechanism, metering etc, might facilitate that new > > order. > > > > The only way we're going to fight spam is not with a little technical > > frill because you'd still have the whole problem of policy, of getting > > ISPs et al to adopt it. > > > > That's why I have little to zero faith in purely technical approaches > > that lack social/economic and even legal perception. > > > > Barry, > > You are correct! Only a combination of policy with technology or policy > by itself can help. However, I think that there are other possibilities > to achieve the same effect without end-to-end e-postage. > > The basic thought behind e-postage is that resources that are being used > should be charged for. Today we already have one such system which is > working sucessfully every day - the Internet. ISPs charge each other for > uplink and downlink bandwidth and resources used. Now, lets say > hypothetically speaking that all ISPs would charge their customers extra > for lets say more than 1000 emails/day. Would it achieve the same effect > as e-postage? Why isn't this model working today? > > Yakov > ------- > Yakov Shafranovich / asrg shaftek.org > SolidMatrix Technologies, Inc. / research solidmatrix.com > "Some lies are easier to believe than the truth" (Dune) > ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 00:32:32 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA07127 for ; Sat, 24 Apr 2004 00:32:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHEof-00082B-IT for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 00:31:01 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3O4V1gC030882 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 00:31:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHEnI-0007fg-9u for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 00:29:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06996 for ; Sat, 24 Apr 2004 00:29:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHEnF-0005HH-CO for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 00:29:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHEmI-000511-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 00:28:35 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHElP-0004l0-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 00:27:39 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHEhu-00066c-EJ; Sat, 24 Apr 2004 00:24:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHEZC-00034o-Ni for asrg@optimus.ietf.org; Sat, 24 Apr 2004 00:15:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06260 for ; Sat, 24 Apr 2004 00:14:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHEZA-00016j-77 for asrg@ietf.org; Sat, 24 Apr 2004 00:15:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHEY2-0000qv-00 for asrg@ietf.org; Sat, 24 Apr 2004 00:13:51 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BHEWz-0000JE-00 for asrg@ietf.org; Sat, 24 Apr 2004 00:12:45 -0400 Received: from fda.zemos.net ([69.141.77.58]) by comcast.net (sccrmhc12) with ESMTP id <20040424041216012002l5a9e>; Sat, 24 Apr 2004 04:12:16 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id 9F48918680; Sat, 24 Apr 2004 00:12:10 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 21387-01; Sat, 24 Apr 2004 00:12:10 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id 1A9C91867F; Sat, 24 Apr 2004 00:12:10 -0400 (EDT) Message-ID: <4089E918.5000902@zemos.net> From: Philip Miller User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Debian/1.6-5 X-Accept-Language: en, en-us MIME-Version: 1.0 To: Barry Shein Cc: asrg@ietf.org References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <16521.52766.528849.135849@world.std.com> In-Reply-To: <16521.52766.528849.135849@world.std.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 00:12:08 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > No activity towards establishing some reliable standards for metering > et al. It'd be difficult for a non-neutral party to just assert > standards in an area like this. It'd be better to outline some > potential standards and then get feedback from those with a reasonable > interest, the usual building of consensus cycle. Sounds reasonable. > Whatever happened to MS's "caller-id"? Is that dead or did it > disappear into another group? Seemed there was a lot of talk about it > and since I've heard nothing. Did they ever manage to get a completed > example installed for their own domains? MS's point man on C-ID, Harry Katz, is very active on the MARID WG list, ietf-mxcomp AT imc.org The records for their domain include a number of hosts identified by IP address, as well as their MX's. Aside from a single IP with NXDOMAIN rDNS, all of the listed IPs have .microsoft.com PTR records. From that, plus the naming in those PTR records, I'm pretty sure their C-ID records do not include other corporations that send mail on their behalf. However, that doesn't mean that such mail would not be accepted by C-ID, because of it's header check ordering. Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 09:25:06 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA14043 for ; Sat, 24 Apr 2004 09:25:06 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHN7v-0007x0-9B for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 09:23:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ODNRPP030556 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 09:23:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHN6Z-0007ei-8E for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 09:22:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA13937 for ; Sat, 24 Apr 2004 09:22:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHN6X-0004Mu-Ls for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 09:22:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHN65-00047l-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 09:21:34 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHN4k-0003sd-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 09:20:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHMyo-0005Ky-07; Sat, 24 Apr 2004 09:14:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHMwz-0004Wl-DF for asrg@optimus.ietf.org; Sat, 24 Apr 2004 09:12:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA13633 for ; Sat, 24 Apr 2004 09:12:07 -0400 (EDT) From: william@elan.net Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHMwx-0001nx-Rv for asrg@ietf.org; Sat, 24 Apr 2004 09:12:07 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHMw4-0001Xw-00 for asrg@ietf.org; Sat, 24 Apr 2004 09:11:13 -0400 Received: from [200.218.224.2] (helo=aptiva.directnet.com.br) by ietf-mx with smtp (Exim 4.12) id 1BHMvd-0001Hd-00 for Asrg@ietf.org; Sat, 24 Apr 2004 09:10:45 -0400 To: Asrg@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--------uaakfecruadxvjewcunu" Subject: [Asrg] Weah, hello! :-) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 10:15:49 -0300 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=NO_REAL_NAME autolearn=no version=2.60 ----------uaakfecruadxvjewcunu Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit ------------------ Virus Warning Message (on ietf-mx) Found virus WORM_BAGLE.GEN-1 in file AttachedDocument.zip The file AttachedDocument.zip is moved to /etc/iscan/virus/virHDEU8aG4G. --------------------------------------------------------- ----------uaakfecruadxvjewcunu Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Looking forward for a response :P ..btw, "88415" is a password for archive ----------uaakfecruadxvjewcunu Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit ------------------ Virus Warning Message (on ietf-mx) AttachedDocument.zip is removed from here because it contains a virus. --------------------------------------------------------- ----------uaakfecruadxvjewcunu-- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 10:16:14 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA16840 for ; Sat, 24 Apr 2004 10:16:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHNuz-0002P4-EE for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 10:14:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3OEE96C009234 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 10:14:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHNu6-0001qC-8k for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 10:13:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA16486 for ; Sat, 24 Apr 2004 10:13:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHNu4-0001q3-0t for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 10:13:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHNtA-0001a4-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 10:12:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHNsT-0001JV-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 10:11:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHNp4-0007Ti-3D; Sat, 24 Apr 2004 10:08:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHNfO-0000mo-PQ for asrg@optimus.ietf.org; Sat, 24 Apr 2004 09:58:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15111 for ; Sat, 24 Apr 2004 09:57:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHNfM-0005jh-QJ for asrg@ietf.org; Sat, 24 Apr 2004 09:58:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHNeR-0005V6-00 for asrg@ietf.org; Sat, 24 Apr 2004 09:57:03 -0400 Received: from ptb-relay03.plus.net ([212.159.14.214]) by ietf-mx with esmtp (Exim 4.12) id 1BHNe7-0005Fx-00 for asrg@ietf.org; Sat, 24 Apr 2004 09:56:43 -0400 Received: from [212.159.76.2] (helo=beddo) by ptb-relay03.plus.net with smtp (Exim) id 1BHNdc-0004Kw-FT for asrg@ietf.org; Sat, 24 Apr 2004 13:56:12 +0000 From: cw To: X-Mailer: PocoMail 3.0 (1640) - Licensed Version Message-ID: <2004424145653.358216@beddo> In-Reply-To: <200404231812.OAA10248@world.std.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Subject: [Asrg] IM2000 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 14:56:53 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Hi folks, I have been doing a lot of digging around with various anti-spam proposals= and one thing that crossed my mind is in relation to IM2000.= (http://cr.yp.to/im2000.html) Incase there is anyone here unaware, IM2000 essentially proposes pushing the= message queues back to the sender so that people closer to the recipient do= not have to pay and those closer to the sender are given more motivation= for doing something about the sender. The proposal would require some significant infrastructure overhaul as would= many to get it implemented, but (and I am just thinking on my feat at the= moment) would it be possible to overlay something based on this onto the= existing infrastructure? To expand, if your incoming mailserver rejects all inbound messages with a= transient error and notifies the recipient. The recipient can then elect to= allow any similar messages through if the remote server tries again within= a set period of time. This may have to second guess how many times the remote server will retry= before giving up, and either allow or reject the message with a permanent= error if the recipient does not express their will in time. Either way, if the message is legitimate but ends up being bounced, a clear= message could indicate why and recommend trying again or contacting the= user via other means to arrange to allow the message through. What are the implications of running a system like this other than having to= develop a frontend for local users? Regards, Colin. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 10:59:58 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18818 for ; Sat, 24 Apr 2004 10:59:58 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHObq-0007PY-W9 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 10:58:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3OEwQx2028484 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 10:58:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHOYe-0006mI-Ro for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 10:55:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18756 for ; Sat, 24 Apr 2004 10:55:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHOYc-0005Ec-Ea for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 10:55:06 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHOXe-0004yU-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 10:54:07 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHOWe-0004gz-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 10:53:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHORk-0004va-RM; Sat, 24 Apr 2004 10:48:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHOP9-0004BY-2g for asrg@optimus.ietf.org; Sat, 24 Apr 2004 10:45:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18396 for ; Sat, 24 Apr 2004 10:45:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHOP6-0002aa-Ih for asrg@ietf.org; Sat, 24 Apr 2004 10:45:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHOOA-0002Kp-00 for asrg@ietf.org; Sat, 24 Apr 2004 10:44:18 -0400 Received: from [66.98.212.93] (helo=tin.nixcartel.org) by ietf-mx with esmtp (Exim 4.12) id 1BHONX-00024C-00 for asrg@ietf.org; Sat, 24 Apr 2004 10:43:39 -0400 Received: from dvb.homelinux.org (unknown [202.88.170.34]) by tin.nixcartel.org (Postfix) with ESMTP id DF9591AC06C for ; Sat, 24 Apr 2004 09:47:34 -0500 (CDT) Received: by dvb.homelinux.org (Postfix, from userid 500) id 8DEA134022; Sat, 24 Apr 2004 20:12:15 +0530 (IST) From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] IM2000 Message-ID: <20040424201215.A10101@evita.devdas.geek> Reply-To: Devdas Bhagat References: <200404231812.OAA10248@world.std.com> <2004424145653.358216@beddo> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <2004424145653.358216@beddo>; from asrg@fidei.co.uk on Sat, Apr 24, 2004 at 02:56:53PM +0100 X-Message-Flag: Friends protect friends from Microsoft Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 20:12:15 +0530 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On 24/04/04 14:56 +0100, cw wrote: > Hi folks, > I have been doing a lot of digging around with various anti-spam proposals > and one thing that crossed my mind is in relation to IM2000. > (http://cr.yp.to/im2000.html) > Incase there is anyone here unaware, IM2000 essentially proposes pushing > the message queues back to the sender so that people closer to the > recipient do not have to pay and those closer to the sender are given > more motivation for doing something about the sender. > The proposal would require some significant infrastructure overhaul as > would many to get it implemented, but (and I am just thinking on my feat > at the moment) would it be possible to overlay something based on this > onto the existing infrastructure? What about offline hosts? And when does the local copy get deleted? > > To expand, if your incoming mailserver rejects all inbound messages with > a transient error and notifies the recipient. The recipient can then > elect to allow any similar messages through if the remote server tries > again within a set period of time. A variant on greylisting with human intervention. > This may have to second guess how many times the remote server will retry > before giving up, and either allow or reject the message with a permanent > error if the recipient does not express their will in time. A (mis)feature which greylisting avoids by allowing mail through on the second try. > > Either way, if the message is legitimate but ends up being bounced, a > clear message could indicate why and recommend trying again or contacting > the user via other means to arrange to allow the message through. > > What are the implications of running a system like this other than > having to develop a frontend for local users? Avoid the frontend by using greylisting. The effect that this has had is that spammers use full fledged SMTP servers to spam, rather than open proxies. It hasn't had much real benefit, but greylisting was useful. Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 11:51:33 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20963 for ; Sat, 24 Apr 2004 11:51:33 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHPPp-0006BT-A9 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 11:50:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3OFo5GW023767 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 11:50:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHPKP-0004iv-Tm for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 11:44:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20557 for ; Sat, 24 Apr 2004 11:44:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHPKO-0001mm-Ss for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 11:44:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHPIz-0001KO-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 11:43:01 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHPHA-0000mg-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 11:41:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHPCH-0001sn-IE; Sat, 24 Apr 2004 11:36:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHP9T-0000ja-Cn for asrg@optimus.ietf.org; Sat, 24 Apr 2004 11:33:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20063 for ; Sat, 24 Apr 2004 11:33:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHP9S-0006hN-AO for asrg@ietf.org; Sat, 24 Apr 2004 11:33:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHP8V-0006Rz-00 for asrg@ietf.org; Sat, 24 Apr 2004 11:32:11 -0400 Received: from ptb-relay02.plus.net ([212.159.14.213]) by ietf-mx with esmtp (Exim 4.12) id 1BHP7j-0005wL-00 for asrg@ietf.org; Sat, 24 Apr 2004 11:31:23 -0400 Received: from [212.159.76.2] (helo=beddo) by ptb-relay02.plus.net with smtp (Exim) id 1BHP7E-000Ekp-Sp for asrg@ietf.org; Sat, 24 Apr 2004 15:30:52 +0000 From: cw To: X-Mailer: PocoMail 3.0 (1640) - Licensed Version Message-ID: <2004424163124.605682@beddo> In-Reply-To: <20040424201215.A10101@evita.devdas.geek> Subject: Re: [Asrg] IM2000 Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 16:31:24 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable On Sat, 24 Apr 2004 20:12:15 +0530, Devdas Bhagat wrote: >=A0What about offline hosts? And when does the local copy get deleted? I don't quite understand your question. If it is something on the specifics= of IM2000 then it would be best directed at the IM2000 mailing list as I= have only done a brief review of the principals and am not involved with= that project. *snip stuff on greylisting* I am aware of greylisting, though I hadn't considered what potential= benefits over greylisting such an approach would provide. Off the top of my= head, I think of viruses as an example. If these are sent as normal messages, then they will pass greylisting as the= legitimate servers will call back. Adding the layer of human intervention= would potentially be able to allow viruses to be rejected. Thinking further= though, it would be difficult to identify some virus messages from= legitimate messages without scanning the body. I guess it would also prevent abandoned mailboxes that someone forgot to= delete from growing in size and taking up more than zero bytes of storage,= but good housekeeping should limit the effect of that anyway. It is just an idea, if there aren't any real benefits over greylisting (and= my head is too full of Trust management systems at the moment to think= about it too much) then that is that. If someone can think of reasons why= it would be beneficial as opposed to greylisting then at least the idea is= out there. >It hasn't had much real benefit, but greylisting was useful. With regards to this specific line, do you have any specific links or other= evidence to support that statement? It would be useful for the report I am= writing at the moment. Regards, Colin. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 14:55:20 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28782 for ; Sat, 24 Apr 2004 14:55:20 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHSHe-0006FJ-Kd for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 14:53:50 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3OIro4I023990 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 14:53:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHSF9-0005S9-Od for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 14:51:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28693 for ; Sat, 24 Apr 2004 14:51:12 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHSF7-0003K0-16 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 14:51:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHSEF-000355-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 14:50:19 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHSDG-0002ot-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 14:49:18 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHSB4-0003aS-GB; Sat, 24 Apr 2004 14:47:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHSAG-00030W-JG for asrg@optimus.ietf.org; Sat, 24 Apr 2004 14:46:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28548 for ; Sat, 24 Apr 2004 14:46:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHSAD-000252-Rl for asrg@ietf.org; Sat, 24 Apr 2004 14:46:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHS9I-0001qy-00 for asrg@ietf.org; Sat, 24 Apr 2004 14:45:12 -0400 Received: from bolt.sonic.net ([208.201.242.18] ident=root) by ietf-mx with esmtp (Exim 4.12) id 1BHS8R-0001cz-00 for asrg@ietf.org; Sat, 24 Apr 2004 14:44:19 -0400 Received: from satellite.vo.cnchost.com (IDENT:root@localhost [127.0.0.1]) by bolt.sonic.net (8.12.10/8.12.1) with ESMTP id i3OIiIrB015769 for ; Sat, 24 Apr 2004 11:44:18 -0700 Message-Id: <6.0.0.10.0.20040424112909.06540388@127.0.0.1> X-Sender: jcdill%vo.cnchost.com@127.0.0.1 (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.10 (Beta) To: asrg@ietf.org From: JC Dill Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <4089A27F.3050807@zemos.net> References: <40899587.2060401@solidmatrix.com> <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 11:41:55 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 At 04:10 PM 4/23/2004, Philip Miller wrote: >Hypothetically, it works in the sense that each step upstream (in >connectivity, not mail transmission) is charging those immediately >downstream for messages transmitted. This means that even if spammers >establish their own ISP, they will be charged by their uplink provider. >However, this doesn't rectify the essential flaw that receivers bear the >cost burden of email, not senders. Even if this raises the cost to send >imposed on the sender, it in no way reduces the cost to the receiver. Here is the underlying problem with the ePostage proposal: In order for this to work, everyone has to implement it. If we get everyone to implement ANY new proposal that makes it harder (more costly, harder to prove you are a legitimate sender, whatever) to send bulk email, it goes a long way towards solving spam (sent in bulk). We don't need some ePostage scheme to make this work, we need a new protocol that everyone agrees to use, and a system for transitioning between the existing SMTP protocol and the new protocol, and widespread agreement to implement the new protocol. Trying to add ePostage on top of all of this adds an additional layer of complexity for no useful (spam stopping) gain. Then we can expect to see spammers move towards sending spam "not in bulk" by increasing use of zombie PCs, having millions of zombies sending 1 email an hour. jc _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 22:07:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA18792 for ; Sat, 24 Apr 2004 22:07:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZ1l-0008Aj-Fr for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:05:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P25rfN031409 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:05:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZ0P-0007Yl-Ow for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 22:04:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA18694 for ; Sat, 24 Apr 2004 22:04:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZ0M-0001Uc-Op for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:04:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHYzQ-0001HF-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:03:29 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHYyS-00013a-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:02:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHYu8-0005OV-UA; Sat, 24 Apr 2004 21:58:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHYmt-0003Wn-Mo for asrg@optimus.ietf.org; Sat, 24 Apr 2004 21:50:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18339 for ; Sat, 24 Apr 2004 21:50:28 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHYmq-00068k-Si for asrg@ietf.org; Sat, 24 Apr 2004 21:50:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHYm0-0005vN-00 for asrg@ietf.org; Sat, 24 Apr 2004 21:49:37 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BHYlM-0005Rc-00 for asrg@ietf.org; Sat, 24 Apr 2004 21:48:56 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc11) with SMTP id <20040425014826013004kthoe>; Sun, 25 Apr 2004 01:48:26 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 24 Apr 2004 20:48:21 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 24 Apr 2004 20:57:47 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 20:57:47 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.0 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> Well, yes. The basic problem with spam is the imposition of cost on > unwilling recipients; I see little point in epostage that pays some > other party, as then the recipient has still lost; it's just that > someone else has benefited instead. I fail to see how this improves > matters significantly. > It improves matters by significantly raising the transaction cost for the spammer to send mail (currently ballpark 0.01 cent), thus reducing the attractiveness of this advertising medium. That's the standard argument, yes. But the TRUTH of the matter is that spammers will just do what they've done ALL ALONG and shift that cost to others to pay... by making sure that OTHER users of the net will pay for the spammers' E-postage. (Spambot zombies, etc etc.) What you're doing is increasing (by a LARGE amount) the overhead of handling E-mail, not to mention the HUGELY labor-intensive work of correcting all the problems caused by the spammers and false charges, and all of those charges are going to be borne NOT by the spammers, but by everybody else. Remember the phone company's assertion that something like 85% of the cost of a long distance phone call is the cost of billing you for it. (And THAT is for a service where it's nearly impossible to "steal" service by billing to the "wrong" caller...). The result is that you're going to HUGELY increase cost of E-mail, and those costs are going to come back onto the LEGITIMATE users... For many, many years, directory assistance calls were "free". They were included in the cost of your phone service, and that cost a fraction of what it does today. Phone companies argued that "some people are abusing Directory Assistance!" and they said that they wanted to put into place a limit on free directory assistance... but not to worry, the limit would be high enough that almost no legitimate users would ever reach it and have to pay. As soon as they got the "pay for Directory Assistance" dam breached, they steadily reduced the number of free calls (now, most subscribers get NO free directory assistance calls per month) and increased the cost of each call to LUDICROUS levels. Then they added insult to injury by stopping even TRYING to provide phone books at pay telephones, so you have NO CHOICE but to call directory assistance for the phone numbers you need. Had they REALLY been concerned about abuse, a better (and less abuse-prone) scheme would have been: Directory Assistance calls, IF the number is not in the current published-and-delivered directory, are FREE. If you call directory assistance for a number which IS in the published-and-delivered directory (and that you thus could have looked up) then there is a dissuasive penalty of $5 per call. The fact that they charge for ALL directory assistance calls, INCLUDING for numbers which are not published in the directory, proves that they were NOT simply trying to stamp out abuse...! This thing about E-mail... "We'll of course give you enough "free" "e-mail stamps" each month that nobody legitimate will have to pay extra" is only just a ruse to get folks to say "Well, in that case... maybe it won't be so bad..." but you can COUNT on the same tightening-the-ratchet once the basic "pay per unit" scheme is in place... :-(((( AND, like SPF, you have NOT done anything that will PREVENT spam. So you have YET ANOTHER expensive and cumbersome intensively technical/administrative solution that ultimately WILL NOT SOLVE THE PROBLEM! Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 22:21:49 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19200 for ; Sat, 24 Apr 2004 22:21:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZEO-00048E-QU for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:18:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P2IuCR015878 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:18:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZ7C-0001pz-MU for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 22:11:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA18994 for ; Sat, 24 Apr 2004 22:11:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZ79-0003AO-Kd for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:11:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZ6H-0002wC-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:10:33 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHZ5d-0002ib-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:09:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZ1s-0008Gk-VQ; Sat, 24 Apr 2004 22:06:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHYub-0005Pj-Fd for asrg@optimus.ietf.org; Sat, 24 Apr 2004 21:58:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18547 for ; Sat, 24 Apr 2004 21:58:26 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHYuY-00009Q-GW for asrg@ietf.org; Sat, 24 Apr 2004 21:58:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHYtd-0007iT-00 for asrg@ietf.org; Sat, 24 Apr 2004 21:57:29 -0400 Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx with esmtp (Exim 4.12) id 1BHYtB-0007UU-00 for asrg@ietf.org; Sat, 24 Apr 2004 21:57:01 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc12) with SMTP id <2004042501562601400ia9v2e>; Sun, 25 Apr 2004 01:56:26 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 24 Apr 2004 20:55:06 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 24 Apr 2004 21:04:33 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 21:04:33 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.0 required=5.0 tests=AWL,CASHCASHCASH,NO_REAL_NAME, RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > ...Now, lets say hypothetically speaking that all ISPs would charge their customers extra for lets say more than 1000 emails/day. The problem is that the number will shrink, and shrink, and shrink, until you are charged for EVERY E-mail. And, just as the oligopoly reduces the number of independent small local ISPs and things are inexorably consolidating in the hands of folks like Comcast and SBC and Verizon et al, you're going to have a bunch of big companies which divvy up the market between them and without anything like genuine competition. We're seeing the resulting abuse TODAY with unjustified rate hikes based on flimsy arguments... where they're jacking up prices just because THEY CAN. :-((( > Would it achieve the same effect as e-postage? Why isn't this model working today? A whole lot of reasons. But a biggie is: 1) It's far too easy to steal someone else's bandwidth. If Aunt Gertrude's machine gets infected by a zombie spambot, the spammer can use her machine (and her postage) to pump out MILLIONS of E-mail messages. 2) Even if Aunt Gertrude's machine is rate-limited to 1000 E-mails a day (or a hundred!) the spammer can STILL infect that many more machines, and still bankrupt all of their available individual postage account balances. :-( 3) And somebody ($$$$$) is going to have to sort out the resulting mess. The spammers won't be paying THAT bill, either. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 22:25:17 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19398 for ; Sat, 24 Apr 2004 22:25:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZHL-0005HS-Nz for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:21:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P2LxB2020294 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:21:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZG3-0004e9-DZ for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 22:20:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19182 for ; Sat, 24 Apr 2004 22:20:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZG0-00059Q-Cm for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:20:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZEy-0004w1-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:19:33 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHZEX-0004ir-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:19:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZ7g-00022v-Cd; Sat, 24 Apr 2004 22:12:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZ2V-0008MA-EM for asrg@optimus.ietf.org; Sat, 24 Apr 2004 22:06:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA18781 for ; Sat, 24 Apr 2004 22:06:36 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZ2S-0001yK-Az for asrg@ietf.org; Sat, 24 Apr 2004 22:06:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZ1R-0001jk-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:05:34 -0400 Received: from rwcrmhc12.comcast.net ([216.148.227.85]) by ietf-mx with esmtp (Exim 4.12) id 1BHZ0q-0001UU-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:04:56 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc12) with SMTP id <2004042502042601400i5mcqe>; Sun, 25 Apr 2004 02:04:26 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 24 Apr 2004 21:04:26 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 24 Apr 2004 21:13:53 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] IM2000 and other lame schemes Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 21:13:53 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.9 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > To expand, if your incoming mailserver rejects all inbound messages with a= transient error and notifies the recipient. The recipient can then elect to= allow any similar messages through if the remote server tries again within= a set period of time. This may have to second guess how many times the remote server will retry= before giving up, and either allow or reject the message with a permanent= error if the recipient does not express their will in time. This kind of lame idea is a good example... so you end up increasing the cost of handling E-mail, wasting bandwidth and transmission latency on artificially necessary retries, and requiring new recordkeeping (queueing, etc) on both the recipient and sender ends. What the hell benefit is THAT? And the idea about "queueing it closer to the sender"... again, a large percentage of spam TODAY is sent by spambot zombies. So you're NOT clogging up SPAMMER uplinks... or increasing THEIR costs... you're clogging, abusing, and increasing the cost to VICTIM ISPs and VICTIM users. > Either way, if the message is legitimate but ends up being bounced, a clear= message could indicate why and recommend trying again or contacting the= user via other means to arrange to allow the message through. And when those messages bounce back to Yahoogroups or Majordomo or other mailing list software, or publishers sending thousands of legitimate users... who the heck do you think is going to deal with all those stupid "challenge/response" type situations? Publishers have already made quite clear their policy regarding such stuff. They just IGNORE such things, and if you want the information they're providing to you, you won't subject them to it. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 23:08:42 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21015 for ; Sat, 24 Apr 2004 23:08:42 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZs6-0000Wb-9g for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:59:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P2xwN7002013 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 22:59:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZi0-0005Yk-6D for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 22:49:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA20235 for ; Sat, 24 Apr 2004 22:49:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZhw-00048N-Ps for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:49:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZh1-0003uK-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:48:32 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHZgF-0003hA-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:47:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZdg-0004B4-49; Sat, 24 Apr 2004 22:45:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZRW-0007ge-SH for asrg@optimus.ietf.org; Sat, 24 Apr 2004 22:32:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19602 for ; Sat, 24 Apr 2004 22:32:27 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZRT-00007W-HM for asrg@ietf.org; Sat, 24 Apr 2004 22:32:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZQX-0007hx-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:31:29 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BHZQ2-0007Ut-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:30:58 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc11) with SMTP id <20040425023028013004mrhee>; Sun, 25 Apr 2004 02:30:28 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 24 Apr 2004 21:30:17 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 24 Apr 2004 21:39:44 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Blacklisting spam-promoted domains Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 21:39:44 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.9 required=5.0 tests=AWL,DOMAIN_BODY,NO_REAL_NAME, RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> Better terminology would help- I'm reading the above to mean that they reduce every name to a second-level domain. In that case if there's a spamvertized domain in, say, "nh.us" then all of nh.us is impacted. Hardly seems like a good thing to me. > Actually the FAQ goes on to say (or at least I infer- it's hard to read), that reports are counted at each level (so a report on foo.nh.us would add a count to both "foo.nh.us" and "nh.us"). However it also recommends that the client check the second level domain first, and also says that it's likely that *only* second level domains will be listed in the future. > I understand the goal of trying to de-randomize (and normalize) spamvertized URLs. But I don't really think subdomain stripping alone is workable. Normalizing a la URIDNSBL seems slightly better, although still not perfect. The "solution" that I use in my filter is that I list (in my HOSTS file) both fully qualified host names and IP addresses (forced to 127.0.0.1) AND a set of names that look like: *.domain.tld or even *.dom1.dom2.tld or the like. In the case of non-US domains, I'd store this as something like *.domain.co.uk while a regular .com domain I'd choose to blacklist as *.junkdomain.com The mail filter loads these blacklist domains from HOSTS and stores these in a hash table when it starts. When it finds a URL in an E-mail, it first looks to see if it matches an entry in the blacklist table exactly as it is. If not, it adds "*." to the URL's machine address and tries again. If still no, it removes levels to the right of the *. one at a time and searches again until there's nothing left, or until it finds a matching entry in the blacklist table. This allows the searches to go VERY fast (due to the hash technique used for the table) and it's insensitive to all these bogus randomly generated subdomain names that spammers employ to try to avoid people successfully blocking their machine names. Long-term, this isn't a perfect solution because ultimately spammers just use disposable throw-away single-use domain names (at $35 a shot or less they can afford to do that, after all) and the table will grow without limit. So probably this will have to revert eventually to some kind of cached, aged list or something (or even off to an indexed disk file for stuff that hasn't been seen in a while, perhaps). Of course, remember the old joke about the two old friends being chased by a bear through the woods. The one says to the other, "Do you really think you can outrun that bear?" "No," says the other, "...but I don't need to. I only need to outrun YOU." Ultimately, what matters is that my mail filter gets my spam mail down to an acceptably low level, and I use the mail that slips through to improve the variety of filtering techniques I use in my filter. Spammers continue to try new tricks and devious strategies that they are confident will screw up Bayesian filters or other classical filtering methods. But since my filter doesn't use all the same techniques that most other folks use, and since the pattern matching capabilities available to me using SPITBOL are far richer than the braindead regex-based pattern matching that most other antispam filters use, the great majority of tricks that spammers use are usually fairly easily dealt with by my filter. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 23:09:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21046 for ; Sat, 24 Apr 2004 23:09:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZs8-0000Xz-6k for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:00:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P3006W002098 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:00:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZpm-0007JS-Pm for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 22:57:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA20356 for ; Sat, 24 Apr 2004 22:57:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZpj-0005qq-B5 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:57:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZoo-0005dY-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:56:34 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHZoD-0005QK-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:55:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZgX-0005Ci-Df; Sat, 24 Apr 2004 22:48:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZYN-00022T-JQ for asrg@optimus.ietf.org; Sat, 24 Apr 2004 22:39:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19854 for ; Sat, 24 Apr 2004 22:39:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZYK-0001kU-7O for asrg@ietf.org; Sat, 24 Apr 2004 22:39:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZXN-0001Vx-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:38:33 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=tj0bGtgR8dZAfgXin15PVKTdLqtXrF93eWRqIH7z9BB) by ietf-mx with esmtp (Exim 4.12) id 1BHZWU-0001H7-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:37:38 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id WAA18536; Sat, 24 Apr 2004 22:37:33 -0400 (EDT) From: der Mouse Message-Id: <200404250237.WAA18536@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] IM2000 and other lame schemes In-Reply-To: References: Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 22:32:49 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > And the idea about "queueing it closer to the sender"... again, a > large percentage of spam TODAY is sent by spambot zombies. So you're > NOT clogging up SPAMMER uplinks... or increasing THEIR costs... > you're clogging, abusing, and increasing the cost to VICTIM ISPs and > VICTIM users. They _are_ spammers. They may be doing it unwittingly and/or unwillingly, but they're sending UBE. _Also_ victims, they may be, and I would cheerfully agree that they should not be punished as severely as knowing and willing spammers...but they're still spewing spam and need to be spanked. As long as people buy into the idea that UBE spewers are not spammers just because they're not aware they're doing it, the zombie armies will continue to be an unfixed and probably unfixable problem. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 23:12:25 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21173 for ; Sat, 24 Apr 2004 23:12:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHa0k-0003KK-53 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:08:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P38sov012784 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:08:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZsf-0000b3-SR for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 23:00:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20485 for ; Sat, 24 Apr 2004 23:00:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZsc-0006XE-CA for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:00:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZrg-0006IU-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:59:33 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHZql-00065F-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 22:58:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZgY-0005Cs-1A; Sat, 24 Apr 2004 22:48:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZA5-0002UV-RI for asrg@optimus.ietf.org; Sat, 24 Apr 2004 22:14:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19087 for ; Sat, 24 Apr 2004 22:14:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZA2-0003qP-KY for asrg@ietf.org; Sat, 24 Apr 2004 22:14:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZ99-0003dU-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:13:31 -0400 Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx with esmtp (Exim 4.12) id 1BHZ8b-0003Eq-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:12:57 -0400 Received: from fda.zemos.net ([69.141.77.58]) by comcast.net (sccrmhc13) with ESMTP id <2004042502122301600cptvde>; Sun, 25 Apr 2004 02:12:23 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id 0A33418680 for ; Sat, 24 Apr 2004 22:12:22 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29491-04 for ; Sat, 24 Apr 2004 22:12:21 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id AA9C11867F for ; Sat, 24 Apr 2004 22:12:21 -0400 (EDT) Message-ID: <408B1E83.9010506@zemos.net> From: Philip Miller User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Debian/1.6-5 X-Accept-Language: en, en-us MIME-Version: 1.0 To: asrg@ietf.org Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] Filtering Header Standard draft available Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 22:12:19 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I've compiled a first draft of a standard header to be added by email filters, antivirus scanners, classifiers, filers, and other things that examine email. It is available from . Much of its text is copied or derived from the contents of Yakov's wiki for the Filtering sub-group, . Text additions and revisions, particularly new field definitions, are welcome. Please submit such changes as diffs against the .xml file. If possible, please run the edited version through xml2rfc before sending me the patch, to ensure that the syntax is all correct. For Subversion users out there, I'm keeping the master version in a repository at . Any contribution, comment, or criticism is welcome. Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 23:34:52 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA22018 for ; Sat, 24 Apr 2004 23:34:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaML-00029Q-Sy for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:31:14 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P3VD96008264 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:31:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaIq-0000WS-TO for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 23:27:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21682 for ; Sat, 24 Apr 2004 23:27:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHaIo-0004wX-Vp for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:27:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHaHs-0004ip-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:26:37 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHaHJ-0004VG-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:26:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaEA-0007cy-F3; Sat, 24 Apr 2004 23:22:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHa3S-000476-Nz for asrg@optimus.ietf.org; Sat, 24 Apr 2004 23:11:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21148 for ; Sat, 24 Apr 2004 23:11:38 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHa3P-0001Bw-2Z for asrg@ietf.org; Sat, 24 Apr 2004 23:11:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHa28-0000sS-00 for asrg@ietf.org; Sat, 24 Apr 2004 23:10:21 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BHa0r-0000TF-00 for asrg@ietf.org; Sat, 24 Apr 2004 23:09:01 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc11) with SMTP id <20040425030831013004l3vte>; Sun, 25 Apr 2004 03:08:31 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 24 Apr 2004 22:07:16 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 24 Apr 2004 22:16:42 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] E-postage, more... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 22:16:42 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.0 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > The purpose of E-postage, as I see such proposals, is to make the cost of indiscriminate spamming prohibitive. This does inherently rate-limit, but the intent is that spammers' customers won't see anything close to the current ROI of spamming. That only presumes (and without a convincing basis for the presumption) that the spammer is somehow the person who gets nailed for the cost of the postage. There's terribly overwhelming experience to demonstrate convincingly that that is NOT the case. >>>> Otherwise, I do not see what the ASRG or the IETF can do for or >>> against e-postage - it is simply not within the scope of standards at >>> this point. >> >> Well, it might be useful to set out some requirements. Or is that not >> within the IETF's remit? (Serious question.) > > It is more of an IRTF issue at this point, so if sufficient people want > to pursue discussion on it, we can spill it off into a separate ASRG list. > I think it would be good to establish a separate list for discussion of this nature. There are many people with fine ideas, and it would help to collect them in a list which doesn't have have the denizens screaming that e-postage is evil. It's not ONLY just the issue of that it's evil. The bigger problem is that it simply DOES NOT WORK for the purpose it's being proposed for. (It's like declaring war on a sovereign nation to stamp out terrorism that the nation in question isn't actually involved in, and to bring an end to alleged WMD programs that in fact they don't still have. If we're going to go off half-cocked, let's make sure that at least we're doing this stuff for the RIGHT reasons, and that it has at least a PRAYER of achieving the stated/argued objectives!) Moving the discussion of E-postage off to another separate list (like Wong's SPF list) has the advantage (for advocates) that they can all preach together to the choir, after having chased off everyone who inconveniently points out the unpleasant truths that the system won't ultimately achieve its stated objectives. So they can wander around in their own holy little cloud working on imagined solutions, without having to deal with legitimate concerns pointed out by the unwashed non-believers...! :-) There is LITTLE POINT, I feel, in developing convoluted and elaborate technical "solutions" that the spammers have already demonstrated convincingly that they ALREADY have effective work-arounds and evasions available for. That is ESPECIALLY true when the proposed "solutions" have genuine and (for SOME users at least) terrible downsides which advocates of the solution in question hope to dismiss with a simple wave of the hand in the air. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 23:36:22 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA22090 for ; Sat, 24 Apr 2004 23:36:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaOy-0003CM-1c for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:33:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P3XuRI012287 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:33:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaLn-0001aA-7i for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 23:30:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21783 for ; Sat, 24 Apr 2004 23:30:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHaLl-0005bW-AA for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:30:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHaKl-0005Nl-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:29:36 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHaKM-0005AE-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:29:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaIj-0000Vy-PA; Sat, 24 Apr 2004 23:27:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHa6N-0005GN-3c for asrg@optimus.ietf.org; Sat, 24 Apr 2004 23:14:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21318 for ; Sat, 24 Apr 2004 23:14:40 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHa6L-00025P-7o for asrg@ietf.org; Sat, 24 Apr 2004 23:14:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHa5U-0001qW-00 for asrg@ietf.org; Sat, 24 Apr 2004 23:13:48 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BHa4j-0001Nt-00 for asrg@ietf.org; Sat, 24 Apr 2004 23:13:01 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc11) with SMTP id <20040425031231013004kpple>; Sun, 25 Apr 2004 03:12:31 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 24 Apr 2004 22:11:37 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 24 Apr 2004 22:21:04 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 22:21:04 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.0 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > As I said above, e-postage removes the economic incentives to spam. I really think that further discussion on the general list is not too productive. Except that it DOESN'T, because the case is compelling that... WHOEVER ends up picking up the tab for the E-postage... it WILL NOT BE _EITHER_ spammers, or the clueless businesses (say, mortgage brokers who buy leads and don't really want to know where those leads really came from) who hire those spammers to spam for them. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sat Apr 24 23:37:04 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA22126 for ; Sat, 24 Apr 2004 23:37:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaPz-0003W9-UX for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:34:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P3Yxdk013512 for asrg-archive@odin.ietf.org; Sat, 24 Apr 2004 23:34:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaOi-0002tD-Tp for asrg-web-archive@optimus.ietf.org; Sat, 24 Apr 2004 23:33:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21921 for ; Sat, 24 Apr 2004 23:33:38 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHaOg-0006Jq-TW for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:33:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHaNr-00065p-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:32:48 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHaNS-0005rG-00 for asrg-web-archive@ietf.org; Sat, 24 Apr 2004 23:32:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHaJF-000134-DF; Sat, 24 Apr 2004 23:28:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHZqm-0008Fx-67 for asrg@optimus.ietf.org; Sat, 24 Apr 2004 22:58:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA20405 for ; Sat, 24 Apr 2004 22:58:32 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHZqi-00064v-N1 for asrg@ietf.org; Sat, 24 Apr 2004 22:58:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHZpo-0005ra-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:57:36 -0400 Received: from rwcrmhc13.comcast.net ([204.127.198.39]) by ietf-mx with esmtp (Exim 4.12) id 1BHZpN-0005du-00 for asrg@ietf.org; Sat, 24 Apr 2004 22:57:09 -0400 Received: from WinProxy.anywhere (c-24-0-183-151.client.comcast.net[24.0.183.151]) by comcast.net (rwcrmhc13) with SMTP id <2004042502564001500pp876e>; Sun, 25 Apr 2004 02:56:40 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Sat, 24 Apr 2004 21:54:44 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Sat, 24 Apr 2004 22:04:11 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Certificates Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 24 Apr 2004 22:04:11 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=2.0 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > In deciding which email to receive (or allow to bypass strong filtration), would you trust an irrevocable certificate from TrustE? How about one from Verislime? How about a revocable certificate from Spamhaus? > If you want your email to be received, which of those would you buy? The bottom line, again, is that certificates (like SPF) ultimately DO NOT SOLVE THE PROBLEM of spamming for the terribly simple and obvious reason that machines possessing valid certificates will be infected by spambot zombies (in fact, since they're "certificated" they will be widely sought-after zombie targets). So your "certificate-approved" machine gets infected, and now it's pumping out "certificate-guaranteed" spam like there's no tomorrow. And that "certificated" mail is sailing past all the spam filtration. Certificates, like SPF, E-postage, and other such lame ideas, simply don't solve the problem. They do NOT guarantee that mail is, or is not, spam. The sad part is that they don't really even come close to that. The nice thing about my approach... don't allow most users (i.e. those users without a GENUINE, AGREED NEED) to send you HTML-burdened mails (force the mail to plain ASCII text) and similarly don't allow most users (other than those you've negotiated with and approved in advance) to send you attachments (and open that window, guardedly, for only a few trusted senders and a few specific attachment types). THEN, for the stuff that has gotten through (and where most of the tricks for obscuring content have been denied to the sender), you put it through a good content filter which will identify the stuff as spam if it looks like spam. It ultimately doesn't much matter if the last ten messages (or a thousand) that sender sent were legitimate. And if they're SPF-certified, and certificate-guaranteed too. If this one (possibly sent post-infection) is spam, it gets nailed. As it should. That's part of what's good about my system. It doesn't much care who guarantees (or used to) that the sender was once (and maybe still is) a good guy. Even "good guys" need to respect the limited size of my Inbox, and not waste my resources, and also respect the other policies I've established for what I'm willing to allow them to send me. If they don't play by my rules, then with very high likelihood they don't get access to my E-mail Inbox. PERIOD. My scheme virtually eliminates spams and worms being sent successfully (to ME at least) in E-mails, and to a very large degree regardless of who the sender is (whether supposedly, or in fact). My scheme also will reduce (received/stored) spam volumes (compared to today's HTML-burdened spam volumes) by something like 70-80%, simply by virtue of t-canning the worthless and superfluous HTML-burdened component. (While still allowing HTML-burdened mail from those occasional senders that have made a genuine, compelling argument for it that convinces me to open the (MY!) window wide enough to let THEIR use of it through.) Making that first filtering of the HTML junk happen also greatly increases the effectiveness of the content filtering of what's left, since there are very many fewer tricks left available to spammers and abusers for obscuring the true content of their unwanted messages. So many of these unworkable/ineffective antispam schemes are being proposed that simply DO NOT SOLVE THE PROBLEM since they presume that "good guys" are always really "good", that spammers only send from "bad" machines, that machines with "certificates" cannot be zombie-ized, that spammers must of course use bogus From: addresses, or even that they send from their own machines at all. What crazy la-la land are such deluded engineers living in, anyhow? Talk about a serious case of denial! Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 03:14:45 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA15069 for ; Sun, 25 Apr 2004 03:14:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHdp2-0006p6-0x for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 03:13:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3P7D30X026228 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 03:13:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHdhC-00046n-2c for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 03:04:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA14612 for ; Sun, 25 Apr 2004 03:04:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHdh8-0002Vt-31 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 03:04:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHdg8-0002H7-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 03:03:53 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHdfV-00022D-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 03:03:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHdbS-0002Cl-GK; Sun, 25 Apr 2004 02:59:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHdZJ-0001CY-N5 for asrg@optimus.ietf.org; Sun, 25 Apr 2004 02:56:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA14264 for ; Sun, 25 Apr 2004 02:56:46 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHdZF-0000Wq-OH for asrg@ietf.org; Sun, 25 Apr 2004 02:56:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHdYL-0000In-00 for asrg@ietf.org; Sun, 25 Apr 2004 02:55:50 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BHdXm-00004J-00 for asrg@ietf.org; Sun, 25 Apr 2004 02:55:14 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BHdXm-0000Av-1b for asrg@ietf.org; Sun, 25 Apr 2004 07:55:14 +0100 Mime-Version: 1.0 (Apple Message framework v613) Content-Transfer-Encoding: 7bit Message-Id: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Type: text/plain; charset=US-ASCII; format=flowed To: asrg@ietf.org From: Jonathan Morton X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Subject: [Asrg] My take on e-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 07:55:13 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit First things first. The resource being consumed/abused is the recipient's inbox. Therefore we need to make any charge a condition of entry into a participating recipient's inbox. That means the recipient is the one who needs to decide whether a stamp is needed, and whether any given stamp is sufficiently valid. Unilaterally charging a levy at the sending side isn't going to work, for a variety of reasons - primarily that the major ISPs will start using it as a revenue stream in it's own right, rather than for the intended purpose of preventing abuse by it's customers. Another reason is that spammers will set up their own ISPs and backbones to avoid the normal stamping routes as much as possible. In a recipient-driven scheme, senders still have to be able to buy stamps, but they will be able to choose their stamp vendor, rather than being limited to their ISP. There's always going to be a zombie-PC problem, to some extent at least. At the moment there are hundreds of thousands of insecure Windows machines out there, and they aren't going away. There is a very slight possibility that it might be feasible to economically force novice users onto a more secure platform - such as the Mac - but we can't rely on that, either. A problem is that zombies can't merely be used as a relay, they can also be used to leech any stamp account the victim uses for their own e-mail. However, the compromised stamp account will quickly either become empty or run up a monstrous bill on the victim's credit card (the former situation is obviously preferable, and I'd hope that consumer stamp accounts were set up that way). After that, the zombie can still spew mail all over the place, but it will be unstamped. The empty account (or huge bill) also serves as a wake-up call to the victim, to get their machine cleaned and secured. The interesting thing is that a stamp can also act as proof of where the mail was sent from, and/or who by, because there's a money trail (if nothing else) to follow, and each stamp is unique. This probably won't tell you who the spammer is, but it can help for whitelisting, forgery detection, and for notifying victims. And it doesn't require the victim's ISP to lift a finger, unless they also happen to be the stamp vendor. The big disadvantage for e-postage is that everyone now has to pay for e-mail service. A service which we presently take for granted as incrementally free. There are alternative schemes which can operate alongside e-postage to eliminate the monetary cost for most normal purposes. A combination of a proof-of-work stamp (such as hashcash) and a proof-of-identity signature would also serve a useful rate-limiting purpose. Again, it's up to the recipient to decide how strong a guarantee he requires before a mail can land in his inbox. (At the moment, most recipients' barriers to entry are exceptionally low, even with today's content filters, because there's no practical, universal way to detect forged mail.) The common factor in the above is that the sender can say "I want this mail to go through so badly that I will do one or more of the following: prove *I* sent it; pay for a stamp from a trustworthy vendor; expend N seconds of CPU time". The recipient can then look at the credentials supplied with the mail, optionally check them against stamp vendors' databases (etc.), and decide whether they're good enough. People, please point out what's wrong with the above, specific high-level design, not with "e-postage" in the abstract. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 14:00:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09276 for ; Sun, 25 Apr 2004 14:00:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHntH-00029X-3H for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 13:58:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PHw7D9008271 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 13:58:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHnqW-0001Er-Jn for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 13:55:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA08956 for ; Sun, 25 Apr 2004 13:55:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHnqU-0007D6-8b for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 13:55:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHnpX-0006zt-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 13:54:16 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHnog-0006nF-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 13:53:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHnhZ-0006mo-6y; Sun, 25 Apr 2004 13:46:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHnfG-0005XH-2t for asrg@optimus.ietf.org; Sun, 25 Apr 2004 13:43:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA08389 for ; Sun, 25 Apr 2004 13:43:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHnfD-0004iM-Q5 for asrg@ietf.org; Sun, 25 Apr 2004 13:43:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHneB-0004SN-00 for asrg@ietf.org; Sun, 25 Apr 2004 13:42:32 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHndc-0004Ds-00 for asrg@ietf.org; Sun, 25 Apr 2004 13:41:56 -0400 Received: from shell.TheWorld.com (shell04.theworld.com [192.74.137.74]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PHftWm027394; Sun, 25 Apr 2004 13:41:55 -0400 Received: (from root@localhost) by shell.TheWorld.com (8.9.3/8.9.3) id NAA245523; Sun, 25 Apr 2004 13:41:55 -0400 (EDT) Message-Id: <200404251741.NAA245523@shell.TheWorld.com> From: Zorya To: asrg@ietf.org Subject: [Asrg] Read this article and then never darken our doors again... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 13:41:55 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 This one is for those of you who will respond at every opportunity about how spammers will just move off-shore as disproof of any hope for a legal approach to the problem, over and over and over and over, demanding the criticism be responded to, over and over and over and over and over, as if it were a coup de grace: http://www.washingtonpost.com/wp-dyn/articles/A34438-2004Apr22.html Raids Shutter Online Piracy Sites U.S. and international law enforcement authorities on Wednesday conducted a series of raids against Web site operators suspected of distributing more than $50 million worth of pirated music, movies and software, a move the U.S. Justice Department described as the largest-ever crackdown on online piracy. The Justice Department coordinated more than 120 searches in 10 countries and 27 U.S. states... I know, you *like* piracy or don't like the RIAA so this isn't to your liking so um, er, so, uh, doh, or maybe 10 countries isn't enough to convince you, you're going to hold out for a single raid in 180 countries simultaneously before you'll yield the point because, well, yielding a point is embarrassing... But before you come back with that sort of thing please take a deep breath and consider even for just one second that maybe you're a naive, confused and ignorant individual who shouldn't be cluttering up lists like this with your own personal limitations and wasting the time of others. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 15:07:17 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12073 for ; Sun, 25 Apr 2004 15:07:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHowm-0002xx-NI for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:05:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PJ5mHw011397 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:05:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHowL-0002Oy-HZ for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 15:05:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11785 for ; Sun, 25 Apr 2004 15:05:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHowI-0006C6-IT for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:05:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHovS-0005xv-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:04:26 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHouU-0005kq-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:03:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHopG-0003It-1J; Sun, 25 Apr 2004 14:58:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHojg-0001Om-Dm for asrg@optimus.ietf.org; Sun, 25 Apr 2004 14:52:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA11148 for ; Sun, 25 Apr 2004 14:52:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHojd-0003Zy-KK for asrg@ietf.org; Sun, 25 Apr 2004 14:52:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHoih-0003OS-00 for asrg@ietf.org; Sun, 25 Apr 2004 14:51:15 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHoiQ-0003Ca-00 for asrg@ietf.org; Sun, 25 Apr 2004 14:50:58 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PIouC0016365; Sun, 25 Apr 2004 14:50:56 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id OAA02627; Sun, 25 Apr 2004 14:50:55 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16524.2190.719185.602448@world.std.com> To: JC Dill Cc: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <6.0.0.10.0.20040424112909.06540388@127.0.0.1> References: <40899587.2060401@solidmatrix.com> <200404231812.OAA10248@world.std.com> <6.0.0.10.0.20040424112909.06540388@127.0.0.1> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 14:50:54 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 24, 2004 at 11:41 jcdill-asrg@vo.cnchost.com (JC Dill) wrote: > > Here is the underlying problem with the ePostage proposal: > > In order for this to work, everyone has to implement it. > Ultimately? Perhaps. Incrementally, certainly. I'd imagine a period where the numbers are just sent around to begin to get a feel for what it'll be like and then individuals or organizations or ISPs begin to just block or otherwise treat as potential spam any e-mail w/o legitimate postage and slowly crank up the "volume". I think the same sort of evolution gets proposed with schemes such as caller-id etc. where at first it's only advisory and then slowly but surely as most sites comply becomes more and more mandatory which can be incremental in and of itself (warning sent, marked as possible spam, quarantined automatically, finally blocked.) Not that I like caller-id, but the concept is fairly common to the various proposals. I'd imagine the economic incentives for e-postage could make for a fairly rapid deployment but that doesn't imply that babies must be thrown out with the bathwater. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 15:22:15 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13364 for ; Sun, 25 Apr 2004 15:22:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpBK-0003bD-2c for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:20:50 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PJKoEe013827 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:20:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHp6p-0001QM-8b for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 15:16:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13053 for ; Sun, 25 Apr 2004 15:16:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHp6o-0000iZ-1N for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:16:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHp5v-0000XX-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:15:16 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHp5U-0000M7-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:14:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHp3j-0008AB-Kq; Sun, 25 Apr 2004 15:12:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHp28-0007Ev-6S for asrg@optimus.ietf.org; Sun, 25 Apr 2004 15:11:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12486 for ; Sun, 25 Apr 2004 15:11:16 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHp25-0007Se-47 for asrg@ietf.org; Sun, 25 Apr 2004 15:11:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHp1E-0007GQ-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:10:25 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHp0T-00074E-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:09:37 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PJ9ZC0000363; Sun, 25 Apr 2004 15:09:35 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id PAA18792; Sun, 25 Apr 2004 15:09:34 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16524.3310.724548.495226@world.std.com> To: gep2@terabites.com Cc: asrg@ietf.org Subject: Re: [Asrg] E-postage In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 15:09:34 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 24, 2004 at 20:57 gep2@terabites.com (gep2@terabites.com) wrote: > But the TRUTH of the matter is that spammers will just do what they've done ALL > ALONG and shift that cost to others to pay... by making sure that OTHER users of > the net will pay for the spammers' E-postage. (Spambot zombies, etc etc.) Yeah but now it's going to begin to cost the ISPs, or the victims, who harbor such behavior so there's some real incentive to get this cleaned up. > What you're doing is increasing (by a LARGE amount) the overhead of handling > E-mail, not to mention the HUGELY labor-intensive work of correcting all the > problems caused by the spammers and false charges, and all of those charges are > going to be borne NOT by the spammers, but by everybody else. And you think that spammers aren't currently vastly increasing the cost of handling e-mail now? I guess as an ISP that's the most frustrating part of any spam discussion, this idea that well, spam is annoying, but it's basically free so any cost to clean it up is just an added cost to the service. Crap. The other day we were being pelted by a single spam from over 1,500 different IP addresses, presumably all compromised. That's not a singular incident, in fact the day before a similar incident involving over 1,000 hosts occurred tho I'll admit numbers like that don't tend to happen daily, probably the same bunch of criminals in that case, but a coupla-few times a month? Yes. Hundreds at a time? A few times per week, etc. Spammers who can switch between a dozen or two IP addresses as fast as you can block them? Daily. Do you think that kind of rising tide, while maintaining an acceptable service to customers, is without cost? Not to mention all the money which goes into spam-fighting, most of it nearly useless (firewalls, software, etc), and customer support, people expect help with this and a lot of the problems they run into they do not expect to pay for (e.g., clearing up a false positive, how to deal with an overflowed mailbox, etc.) So, your point only holds water if we're to agree that the current situation is cost-free or nearly so, so the solution must be cost-free or nearly so. I assure you, we do not agree on that point. > > Remember the phone company's assertion that something like 85% of the cost of a > long distance phone call is the cost of billing you for it. (And THAT is for a Yeah, sure, do you have a cite for this, numbers like this along with the assertion that it costs some percentage like that to collect taxes are awfully popular urban legends but upon examination tend to fall apart. > service where it's nearly impossible to "steal" service by billing to the > "wrong" caller...). The result is that you're going to HUGELY increase cost of > E-mail, and those costs are going to come back onto the LEGITIMATE users... > > For many, many years, directory assistance calls were "free". They were > included in the cost of your phone service, and that cost a fraction of what it > does today. > > Phone companies argued that "some people are abusing Directory Assistance!" and > they said that they wanted to put into place a limit on free directory > assistance... but not to worry, the limit would be high enough that almost no > legitimate users would ever reach it and have to pay. > > As soon as they got the "pay for Directory Assistance" dam breached, they > steadily reduced the number of free calls (now, most subscribers get NO free > directory assistance calls per month) and increased the cost of each call to > LUDICROUS levels. Then they added insult to injury by stopping even TRYING to > provide phone books at pay telephones, so you have NO CHOICE but to call > directory assistance for the phone numbers you need. > > Had they REALLY been concerned about abuse, a better (and less abuse-prone) > scheme would have been: Directory Assistance calls, IF the number is not in the > current published-and-delivered directory, are FREE. If you call directory > assistance for a number which IS in the published-and-delivered directory (and > that you thus could have looked up) then there is a dissuasive penalty of $5 per > call. The fact that they charge for ALL directory assistance calls, INCLUDING > for numbers which are not published in the directory, proves that they were NOT > simply trying to stamp out abuse...! Well, your notions of economic justice in directory assistance no doubt are interesting perhaps you should call your phone company. > This thing about E-mail... "We'll of course give you enough "free" "e-mail > stamps" each month that nobody legitimate will have to pay extra" is only just a > ruse to get folks to say "Well, in that case... maybe it won't be so bad..." but > you can COUNT on the same tightening-the-ratchet once the basic "pay per unit" > scheme is in place... :-(((( But you ignore the downside of not doing anything. One of my more dire predictions is that the entire email system as we know it falls apart and ends up in the hands of the phone companies who as monopolies (regional or otherwise) will just position it like SMS and charge 15cents/email or thereabouts. > AND, like SPF, you have NOT done anything that will PREVENT spam. So you have > YET ANOTHER expensive and cumbersome intensively technical/administrative > solution that ultimately WILL NOT SOLVE THE PROBLEM! Um, this doesn't follow, if e-mail got terribly expensive as you fear I suspect that one result would certainly be the death of spam, even if it'd be within a regimen you dislike. I think I'll chalk your point up to: I don't want to pay and email sounds like I might have to pay, so keep thinking until you can come up with a solution that works well and costs nothing. Well, hey, good luck. > > Gordon Peterson http://personal.terabites.com/ > 1977-2002 Twenty-fifth anniversary year of Local Area Networking! > Support free and fair US elections! http://stickers.defend-democracy.org > 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". > 12/09/00: the date the Republican Party took down democracy in America. > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 15:31:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13634 for ; Sun, 25 Apr 2004 15:31:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpK1-0006hA-2I for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:29:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PJTns1025731 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:29:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpGY-0005OK-Di for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 15:26:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13463 for ; Sun, 25 Apr 2004 15:26:12 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpGX-0002ew-0h for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:26:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpFc-0002TS-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:25:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHpEv-0002IP-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:24:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpBW-0003bk-1X; Sun, 25 Apr 2004 15:21:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHp5q-0000w0-0u for asrg@optimus.ietf.org; Sun, 25 Apr 2004 15:15:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12952 for ; Sun, 25 Apr 2004 15:15:08 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHp5o-0000We-NC for asrg@ietf.org; Sun, 25 Apr 2004 15:15:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHp4q-0000Jk-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:14:08 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=xV0otCRqsAxt0rA3DRkNnKEqO1fbkfLdwpb4zt8gYGx) by ietf-mx with esmtp (Exim 4.12) id 1BHp3s-0007j5-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:13:08 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id PAA01767; Sun, 25 Apr 2004 15:13:03 -0400 (EDT) From: der Mouse Message-Id: <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 15:05:08 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > People, please point out what's wrong with the above, specific > high-level design, not with "e-postage" in the abstract. Have you read the taugh whitepaper? Some of the points it raises apply to your sketched design. In particular, the social resistance to pay-by-unit systems applies, and the micropayment infrastructure impossibility applies (and even more so, because you're positing one micropayment infrastructure per stamp vendor, so you get less economy of scale). Furthermore, the money paid for stamps goes to the wrong place, ie, not to the recipients. (Stamp vendors could in principle pay recipients who get mail with their stamps. This involves creation of _another_ micropayment infrastructure per stamp vendor.) You write that > In a recipient-driven scheme, senders still have to be able to buy > stamps, but they will be able to choose their stamp vendor, rather > than being limited to their ISP. Except that they have to choose a vendor acceptable to the recipient. Keeping track of which recipients demand stamps from which vendors will be another cost which you don't seem to have mentioned. If there are a large number of stamp vendors it rapidly becomes almsot intractable. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 15:31:43 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13684 for ; Sun, 25 Apr 2004 15:31:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpK1-0006he-O6 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:29:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PJTn1t025761 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:29:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpIT-00064i-3t for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 15:28:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13537 for ; Sun, 25 Apr 2004 15:28:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpIR-00032w-U7 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:28:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpHV-0002qr-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:27:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHpGb-0002fL-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:26:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpCT-0003wH-CC; Sun, 25 Apr 2004 15:22:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHp9k-00034r-AX for asrg@optimus.ietf.org; Sun, 25 Apr 2004 15:19:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13277 for ; Sun, 25 Apr 2004 15:19:10 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHp9i-0001Ig-V9 for asrg@ietf.org; Sun, 25 Apr 2004 15:19:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHp8k-00017C-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:18:11 -0400 Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx with esmtp (Exim 4.12) id 1BHp84-0000kV-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:17:28 -0400 Received: from fda.zemos.net ([69.141.77.58]) by comcast.net (sccrmhc13) with ESMTP id <2004042519164901600d2jvhe>; Sun, 25 Apr 2004 19:16:49 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id BB58418680; Sun, 25 Apr 2004 15:16:47 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 03275-01; Sun, 25 Apr 2004 15:16:47 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id 3980E1867F; Sun, 25 Apr 2004 15:16:47 -0400 (EDT) Message-ID: <408C0E9D.8060007@zemos.net> From: Philip Miller User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Debian/1.6-5 X-Accept-Language: en, en-us MIME-Version: 1.0 To: Zorya Cc: ASRG References: <200404251741.NAA245523@shell.TheWorld.com> In-Reply-To: <200404251741.NAA245523@shell.TheWorld.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Read this article and then never darken our doors again... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 15:16:45 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Zorya wrote: > This one is for those of you who will respond at every opportunity > about how spammers will just move off-shore as disproof of any hope > for a legal approach to the problem, over and over and over and over, > demanding the criticism be responded to, over and over and over and > over and over, as if it were a coup de grace: Barry, First, let me state that I agree with the principle of your post. I, too, think that rigorous law enforcement of all relevant statutes against spammers could have a large effect on the volumes of spam seen on the Internet. The best example of this would be the amazing disappearance of South Korean-originating messages after they put strong laws into place. However, there are two qualities of copyright infringement enforcement that are not (yet) present when dealing with spam: 1. There are no strong, lobbying corporate interests pushing for stringent regulations and harsh action. On the contrary, some of the big lobbyists oppose strong anti-spam laws in the U.S. 2. Some of the biggest spamming countries (traditionally, China is cited as the best example) have no interest in cooperating in cracking down on their 'local entrepreneurs'. China is also notably absent from the list of countries involved in the action you linked to. Take a look at BBC's reportage of this event: . From the bottom of that article, the participating nations were > ... Belgium, the United Kingdom, Denmark, France, Germany, Hungary, > Israel, the Netherlands, Singapore and Sweden. When we can get some of the large American and European ISPs on board to lobby for enforcement action, we may yet see news like this about anti-spam raids. Specifically, we'd want to see AOL, EarthLink, MSN, Comcast, RoadRunner, Wanadoo, & BT. Concerted pressure from that crowd would have a *HUGE* impact. Until then, I think ad-hoc filtering and small, directed technical measures (I'm thinking LMAP here) will be the order of the day. Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 15:34:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13776 for ; Sun, 25 Apr 2004 15:34:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpMs-0007SL-IT for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:32:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PJWk5i028657 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 15:32:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpLL-00070Y-B7 for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 15:31:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13624 for ; Sun, 25 Apr 2004 15:31:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpLJ-0003fV-TF for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:31:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpKL-0003Rb-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:30:10 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHpJM-0003DW-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:29:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpCU-0003wX-6k; Sun, 25 Apr 2004 15:22:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpAr-0003K0-1V for asrg@optimus.ietf.org; Sun, 25 Apr 2004 15:20:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13300 for ; Sun, 25 Apr 2004 15:20:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpAp-0001VE-MT for asrg@ietf.org; Sun, 25 Apr 2004 15:20:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHp9l-0001JC-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:19:14 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHp8t-00017b-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:18:19 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PJIIWm026672; Sun, 25 Apr 2004 15:18:18 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id PAA23374; Sun, 25 Apr 2004 15:18:18 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16524.3834.261410.998419@world.std.com> To: Jonathan Morton Cc: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 15:18:18 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 25, 2004 at 07:55 chromi@chromatix.demon.co.uk (Jonathan Morton) wrote: > First things first. The resource being consumed/abused is the > recipient's inbox. Therefore we need to make any charge a condition of > entry into a participating recipient's inbox. That means the recipient > is the one who needs to decide whether a stamp is needed, and whether > any given stamp is sufficiently valid. Well, I disagree with this 100%, it's just false. If people could send advertising via paper post for free do you think the problem is primarily the recipient's? What about the effect it has on the letter carriers and the postal system in general? This is another proposal which works forward from spam is free, just annoying. It's a terribly naive way to look at resource abuse. > Unilaterally charging a levy at the sending side isn't going to work, > for a variety of reasons - primarily that the major ISPs will start > using it as a revenue stream in it's own right, rather than for the > intended purpose of preventing abuse by it's customers. Another reason And this is a problem because...? > is that spammers will set up their own ISPs and backbones to avoid the > normal stamping routes as much as possible. But no one will accept their stamps! Why don't you try setting up your own post office and printing your own stamps and see how the Royal Post reacts. > In a recipient-driven scheme, senders still have to be able to buy > stamps, but they will be able to choose their stamp vendor, rather than > being limited to their ISP. > > There's always going to be a zombie-PC problem, to some extent at > least. At the moment there are hundreds of thousands of insecure > Windows machines out there, and they aren't going away. There is a > very slight possibility that it might be feasible to economically force > novice users onto a more secure platform - such as the Mac - but we > can't rely on that, either. > > A problem is that zombies can't merely be used as a relay, they can > also be used to leech any stamp account the victim uses for their own > e-mail. However, the compromised stamp account will quickly either > become empty or run up a monstrous bill on the victim's credit card > (the former situation is obviously preferable, and I'd hope that > consumer stamp accounts were set up that way). After that, the zombie > can still spew mail all over the place, but it will be unstamped. The > empty account (or huge bill) also serves as a wake-up call to the > victim, to get their machine cleaned and secured. > > The interesting thing is that a stamp can also act as proof of where > the mail was sent from, and/or who by, because there's a money trail > (if nothing else) to follow, and each stamp is unique. This probably > won't tell you who the spammer is, but it can help for whitelisting, > forgery detection, and for notifying victims. And it doesn't require > the victim's ISP to lift a finger, unless they also happen to be the > stamp vendor. > > The big disadvantage for e-postage is that everyone now has to pay for > e-mail service. A service which we presently take for granted as > incrementally free. > > There are alternative schemes which can operate alongside e-postage to > eliminate the monetary cost for most normal purposes. A combination of > a proof-of-work stamp (such as hashcash) and a proof-of-identity > signature would also serve a useful rate-limiting purpose. Again, it's > up to the recipient to decide how strong a guarantee he requires before > a mail can land in his inbox. (At the moment, most recipients' > barriers to entry are exceptionally low, even with today's content > filters, because there's no practical, universal way to detect forged > mail.) > > The common factor in the above is that the sender can say "I want this > mail to go through so badly that I will do one or more of the > following: prove *I* sent it; pay for a stamp from a trustworthy > vendor; expend N seconds of CPU time". The recipient can then look at > the credentials supplied with the mail, optionally check them against > stamp vendors' databases (etc.), and decide whether they're good > enough. > > People, please point out what's wrong with the above, specific > high-level design, not with "e-postage" in the abstract. Yeha, who pays for all the overhead in your proposal. Create an economy, or it's just schoolboy fantasising. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 16:05:38 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15280 for ; Sun, 25 Apr 2004 16:05:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHppA-0007dT-Il for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:02:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PK20oF029346 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:02:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpkX-0006DJ-SU for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 15:57:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14726 for ; Sun, 25 Apr 2004 15:57:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpkW-0001G0-BH for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:57:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpjX-00013F-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:56:12 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHpib-0000qp-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 15:55:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpcc-0003gU-A6; Sun, 25 Apr 2004 15:49:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpX0-00025F-8j for asrg@optimus.ietf.org; Sun, 25 Apr 2004 15:43:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14158 for ; Sun, 25 Apr 2004 15:43:12 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpWy-00069Y-Pc for asrg@ietf.org; Sun, 25 Apr 2004 15:43:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpVy-0005wP-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:42:11 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BHpV0-0005iu-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:41:10 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BHpV1-0000ML-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:41:11 -0400 Received: from [68.246.239.236] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BHpUy-0000Si-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:41:10 -0400 Message-ID: <408C144E.80903@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <4089A27F.3050807@zemos.net> In-Reply-To: <4089A27F.3050807@zemos.net> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 15:41:02 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.5 required=5.0 tests=AWL,NO_COST autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit [Replying to multiple messages] Philip Miller wrote: > Yakov Shafranovich wrote: > >> [snip Barry's words and YS's policy comment] >> The basic thought behind e-postage is that resources that are being >> used should be charged for. Today we already have one such system >> which is working sucessfully every day - the Internet. ISPs charge >> each other for uplink and downlink bandwidth and resources used. Now, >> lets say hypothetically speaking that all ISPs would charge their >> customers extra for lets say more than 1000 emails/day. Would it >> achieve the same effect as e-postage? Why isn't this model working today? > > > Hypothetically, it works in the sense that each step upstream (in > connectivity, not mail transmission) is charging those immediately > downstream for messages transmitted. This means that even if spammers > establish their own ISP, they will be charged by their uplink provider. > However, this doesn't rectify the essential flaw that receivers bear the > cost burden of email, not senders. Even if this raises the cost to send > imposed on the sender, it in no way reduces the cost to the receiver. > A few comments on this. First a hierarchy structure for e-postage must solve the settlement problem although I don't know how the business side of it will work it. For example, if each receiving ISP would let the uplink provider negotiate on their behalf, and the uplink provider would combine the total e-postage costs for their customers and negotiate on their behalf with other provider, that might reduce the problem. Or maybe not. But in any case, you basic distinction is correct - the receivers bear the cost burden. However, IMHO it is not only the receivers - the senders and the intermediate systems do as well. However, the cost of processing unwanted email versus simple bandwidth costs is much greater on the receiver's side. In other systems cited as examples, there is no concept that the receiver can charge for resources consumed. The closest example is inter-phone company, or inter-post office settlements, but the individual receivers have no power to charge. Therefore, were the bandwidth costs of postal service minimal to allow marketing companies to deluge your mailbox, I am not sure if the receivers would be able to do much. > Jonathan Morton wrote: >> First things first. The resource being consumed/abused is the >> recipient's inbox. Therefore we need to make any charge a condition of >> entry into a participating recipient's inbox. That means the recipient >> is the one who needs to decide whether a stamp is needed, and whether >> any given stamp is sufficiently valid. >> What makes it more interesting is that existing postal, phone and fax systems do not operate this way. Under normal circumstances, the sender alone pays for resources consumed during the transport of his message. If postal service would charge 1c for transporting junk mail, nothing stops companies from sending thousands of mailings to your house since there is no charge for entry into your mailbox. On the Internet however, the transport charges for bandwidth are so minimal that it makes it worthwhile for spammers to deluge your mailbox. What we are talking about introducing an ability for the receiver to charge for entry into his inbox like Jonathan is saying above. A similar notion of interrupt rights and charging for them was floated in a research paper recently. What is interesting is that such notion does not exist in the postal system aside from inter-post office settlements where still the post offices of each countries are not charging for interrupt rights BUT are charging for the transport costs to deliver the message to the postal boxes of customers. While the idea sounds swell in theory, it needs more work in practice, especially the part about costs vs. benefits. Of course the recipient is always free to do whatever he wants, so a distributed system where the recipient gets to decide if he can charge for entry to his inbox can work if there are standards in place for negotiating that. > Philip Miller wrote: >> Barry Shein wrote: >> >>> No activity towards establishing some reliable standards for metering >>> et al. It'd be difficult for a non-neutral party to just assert >>> standards in an area like this. It'd be better to outline some >>> potential standards and then get feedback from those with a reasonable >>> interest, the usual building of consensus cycle. >> >> >> Sounds reasonable. IRTF activities are usually not geared toward making standards, rather toward long term research in outlining some potential standards. When we get an idea sufficiently congealed with enough interested stakeholders and enough community interest, we pass it on to the IETF for standards development. Therefore, if you want to start outlining some potential work, go right ahead. BUT keep in mind that along for such outline it needs to be shown that the idea in question will provide enough anti-spam benefits vs. the costs of implementation. Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "Some lies are easier to believe than the truth" (Dune) ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 16:10:54 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15432 for ; Sun, 25 Apr 2004 16:10:54 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpwV-0001J7-Ie for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:09:35 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PK9ZiP005021 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:09:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHprT-0008Dw-10 for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 16:04:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15256 for ; Sun, 25 Apr 2004 16:04:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHprR-0002qE-Bs for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:04:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpqU-0002e5-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:03:23 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHpq2-0002S1-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:02:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHplL-0006SR-R4; Sun, 25 Apr 2004 15:58:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpfm-0004rl-4S for asrg@optimus.ietf.org; Sun, 25 Apr 2004 15:52:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14454 for ; Sun, 25 Apr 2004 15:52:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpfk-0000GK-IH for asrg@ietf.org; Sun, 25 Apr 2004 15:52:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpen-00000B-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:51:17 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHpdl-0007Xc-00 for asrg@ietf.org; Sun, 25 Apr 2004 15:50:13 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PJnvel005365; Sun, 25 Apr 2004 15:49:57 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id PAA13993; Sun, 25 Apr 2004 15:49:57 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16524.5733.316205.565059@world.std.com> To: Philip Miller Cc: Zorya , ASRG In-Reply-To: <408C0E9D.8060007@zemos.net> References: <200404251741.NAA245523@shell.TheWorld.com> <408C0E9D.8060007@zemos.net> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Read this article and then never darken our doors again... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 15:49:57 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Again, the best being made the enemy of the good. Notice tho that these countries you mention do participate in systems such as long-distance telephony and int'l package and mail delivery. So obviously some sort of pressure can be brought to bear, for starters, if they won't comply then they may find themselves either cut-off or severely firewalled. How well do you think it'd work if, for example, all of China tomorrow decided to only talk to the rest of the net using DECnet protocols? Or even protocols of their own invention? etc. On April 25, 2004 at 15:16 millenix@zemos.net (Philip Miller) wrote: > Zorya wrote: > > This one is for those of you who will respond at every opportunity > > about how spammers will just move off-shore as disproof of any hope > > for a legal approach to the problem, over and over and over and over, > > demanding the criticism be responded to, over and over and over and > > over and over, as if it were a coup de grace: > > Barry, > First, let me state that I agree with the principle of your post. I, too, > think that rigorous law enforcement of all relevant statutes against > spammers could have a large effect on the volumes of spam seen on the > Internet. The best example of this would be the amazing disappearance of > South Korean-originating messages after they put strong laws into place. > > However, there are two qualities of copyright infringement enforcement that > are not (yet) present when dealing with spam: > 1. There are no strong, lobbying corporate interests pushing for stringent > regulations and harsh action. On the contrary, some of the big lobbyists > oppose strong anti-spam laws in the U.S. > > 2. Some of the biggest spamming countries (traditionally, China is cited as > the best example) have no interest in cooperating in cracking down on their > 'local entrepreneurs'. China is also notably absent from the list of > countries involved in the action you linked to. > Take a look at BBC's reportage of this event: > . From the bottom of that > article, the participating nations were > > > ... Belgium, the United Kingdom, Denmark, France, Germany, Hungary, > > Israel, the Netherlands, Singapore and Sweden. > > When we can get some of the large American and European ISPs on board to > lobby for enforcement action, we may yet see news like this about anti-spam > raids. Specifically, we'd want to see AOL, EarthLink, MSN, Comcast, > RoadRunner, Wanadoo, & BT. Concerted pressure from that crowd would have a > *HUGE* impact. Until then, I think ad-hoc filtering and small, directed > technical measures (I'm thinking LMAP here) will be the order of the day. > > Philip Miller -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 16:28:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16025 for ; Sun, 25 Apr 2004 16:28:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqDT-0006rb-DW for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:27:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PKR7qY026378 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:27:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHq6p-0004td-LY for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 16:20:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15805 for ; Sun, 25 Apr 2004 16:20:12 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHq6n-0005yT-Qn for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:20:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHq5s-0005my-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:19:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHq59-0005bg-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:18:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpzp-0002rx-9l; Sun, 25 Apr 2004 16:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHpy5-0002IG-AE for asrg@optimus.ietf.org; Sun, 25 Apr 2004 16:11:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA15458 for ; Sun, 25 Apr 2004 16:11:10 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHpy3-0004CZ-Kk for asrg@ietf.org; Sun, 25 Apr 2004 16:11:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHpx5-0003xY-00 for asrg@ietf.org; Sun, 25 Apr 2004 16:10:11 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHpw8-0003le-00 for asrg@ietf.org; Sun, 25 Apr 2004 16:09:12 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PK9BRY026591; Sun, 25 Apr 2004 16:09:11 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id QAA22038; Sun, 25 Apr 2004 16:09:11 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16524.6886.604923.78448@world.std.com> To: Yakov Shafranovich Cc: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <408C144E.80903@solidmatrix.com> References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <4089A27F.3050807@zemos.net> <408C144E.80903@solidmatrix.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 16:09:10 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 25, 2004 at 15:41 research@solidmatrix.com (Yakov Shafranovich) wrote: > A few comments on this. > > First a hierarchy structure for e-postage must solve the settlement > problem although I don't know how the business side of it will work it. > For example, if each receiving ISP would let the uplink provider > negotiate on their behalf, and the uplink provider would combine the > total e-postage costs for their customers and negotiate on their behalf > with other provider, that might reduce the problem. Or maybe not. Why? Why do you imagine this? For example, when the USPS puts postage bound for France on a United Airline flight then, you imagine, they buy stamps from United Airlines for each letter or somehow resolve the sharing of postage with them in some complex piece by piece method? Nonsense! They pay the airline for space or weight or something similar. Much like an ISP would pay the next tier up for bandwidth to deliver the email injected into the system by their customers. I'm not saying it's impossible that there might be some other charging method sensitive to per-piece costs, but I am saying that there is NO other way is nonsense. Nonsense because given the way other analogous media is handled it's the least likely way e-postage would be handled. So it's a pure straw man. They'd have to do this, this is unworkable, so the idea is unworkable. Nonsense, they don't have to "do this" as your antecedent demands.[q > But in any case, you basic distinction is correct - the receivers bear > the cost burden. However, IMHO it is not only the receivers - the No, it's not correct. If that were the case you'd be charging your ISP for the privilege of letting you have an internet connection. Huh? > senders and the intermediate systems do as well. However, the cost of > processing unwanted email versus simple bandwidth costs is much greater > on the receiver's side. In other systems cited as examples, there is no First, "much greater" does not equate with "insignificant" (to the other side), or ignorable. Second, at this point for every spam you see probably 100,000 or thereabouts are being processed due to the number being filtered out on plausibility grounds (e.g. refusing mail with no legitimate domain or rdns) and the non-stop, high-powered spew of essentially dictionary and similar attacks. So, when you begin to figure in the lower cost per piece you actually ever see in your mailbox and the relative cost versus the flood of millions per day you don't see maybe those costs begin to come more closely into line. At any rate, no system I can think of outside of e-mail is purely geared towards resolving some sort of receiver pays other than some much-maligned, relatively recent cell-phone systems and even on those there's much activity to either block or change the charging for marketing calls. But telephone in general, postal, sender pays. This fiction seems to only exist on this list. It makes me wonder what the actual agenda is when there's such strenuous advocacy for a model which is so far disconnected from reality. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 16:40:17 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16465 for ; Sun, 25 Apr 2004 16:40:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqNn-0001vn-Vj for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:37:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PKblSw007411 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:37:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqMK-00016K-Jc for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 16:36:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16339 for ; Sun, 25 Apr 2004 16:36:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHqMI-0001H3-Nu for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:36:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHqLL-00015i-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:35:15 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHqKw-0000um-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:34:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqGH-0007kd-Pd; Sun, 25 Apr 2004 16:30:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqEd-0007Ay-4y for asrg@optimus.ietf.org; Sun, 25 Apr 2004 16:28:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16064 for ; Sun, 25 Apr 2004 16:28:16 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHqEb-0007Vy-6k for asrg@ietf.org; Sun, 25 Apr 2004 16:28:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHqDc-0007KF-00 for asrg@ietf.org; Sun, 25 Apr 2004 16:27:16 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BHqCv-000792-00 for asrg@ietf.org; Sun, 25 Apr 2004 16:26:33 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id 8315116DF5 for ; Sun, 25 Apr 2004 16:31:25 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] E-postage In-Reply-To: Your message of "Sun, 25 Apr 2004 15:09:34 EDT." <16524.3310.724548.495226@world.std.com> Message-Id: <20040425203125.8315116DF5@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 16:31:25 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Barry Shein wrote: > The other day we were being pelted by a single spam from over 1,500 > different IP addresses, presumably all compromised. That's not a > singular incident, in fact the day before a similar incident involving > over 1,000 hosts occurred tho I'll admit numbers like that don't tend > to happen daily, I *dream* of getting spam from only 1K hosts a day. While my situation is unusual, it's the leading edge, and a predictor of others situations in the future. > So, your point only holds water if we're to agree that the current > situation is cost-free or nearly so, so the solution must be cost-free > or nearly so. I'd put the objections a different way. It's difficult to quantify the recipients cost due to spam. Sure, you can come up with reasonable figures for end-users losing productivity due to spam, but those figures aren't a line item on someones budget. In contrast, anti-spam systems *are* line items, especially to the people who deploy them, and to anti-spam companies. Any solution, therefore, which reduces spam, has huge cost to some parties, and non-accountable savings to others. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 16:41:22 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16521 for ; Sun, 25 Apr 2004 16:41:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqQG-0002a0-58 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:40:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PKeKV4009912 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 16:40:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqOI-00023X-In for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 16:38:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16406 for ; Sun, 25 Apr 2004 16:38:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHqOG-0001e9-Kq for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:38:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHqNI-0001Sq-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:37:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHqMZ-0001He-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 16:36:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqGI-0007ky-O7; Sun, 25 Apr 2004 16:30:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqFa-0007SO-1S for asrg@optimus.ietf.org; Sun, 25 Apr 2004 16:29:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16121 for ; Sun, 25 Apr 2004 16:29:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHqFY-0007iA-5R for asrg@ietf.org; Sun, 25 Apr 2004 16:29:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHqEn-0007Wh-00 for asrg@ietf.org; Sun, 25 Apr 2004 16:28:29 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=ytn5GvxsBHSSUR9ViYfB54ROV9QEKRv8ENdtpJD9n57) by ietf-mx with esmtp (Exim 4.12) id 1BHqEA-0007L3-00 for asrg@ietf.org; Sun, 25 Apr 2004 16:27:50 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id QAA02214; Sun, 25 Apr 2004 16:27:50 -0400 (EDT) From: der Mouse Message-Id: <200404252027.QAA02214@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <16524.6886.604923.78448@world.std.com> References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <4089A27F.3050807@zemos.net> <408C144E.80903@solidmatrix.com> <16524.6886.604923.78448@world.std.com> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 16:22:30 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > At any rate, no system I can think of outside of e-mail is purely > geared towards resolving some sort of receiver pays other than some > much-maligned, relatively recent cell-phone systems and even on those > there's much activity to either block or change the charging for > marketing calls. > But telephone in general, postal, sender pays. This is because no other system outside of e-mail has the same underlying cost structure that e-mail does. The phone system perhaps comes cloest - and, surprise surprise, that's the system where the analogue of spam is most hated and most acted against. > This fiction seems to only exist on this list. It's not a fiction. It's a fundamental difference between e-mail and all those analogies people seem to like so much, a difference that is in large part why the analogies are flawed. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 17:21:14 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18106 for ; Sun, 25 Apr 2004 17:21:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHr2W-00063u-4E for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:19:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLJqxk023298 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:19:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHr23-0005mS-6x for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:19:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18042 for ; Sun, 25 Apr 2004 17:19:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHr20-0001wW-Tc for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:19:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHr1A-0001kL-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:18:29 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHr0C-0001Xp-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:17:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqxr-0004c9-WA; Sun, 25 Apr 2004 17:15:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHqwA-0003zq-4A for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:13:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA17867 for ; Sun, 25 Apr 2004 17:13:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHqw7-0000lw-VG for asrg@ietf.org; Sun, 25 Apr 2004 17:13:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHqv9-0000aQ-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:12:16 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BHquD-0000OI-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:11:17 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BHquC-000582-MT; Sun, 25 Apr 2004 22:11:16 +0100 In-Reply-To: <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] My take on e-postage To: der Mouse X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 22:11:16 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> People, please point out what's wrong with the above, specific >> high-level design, not with "e-postage" in the abstract. > > Have you read the taugh whitepaper? Some of the points it raises apply > to your sketched design. No - do you have a link? > In particular, the social resistance to pay-by-unit systems applies, > and the micropayment infrastructure impossibility applies (and even > more so, because you're positing one micropayment infrastructure per > stamp vendor, so you get less economy of scale). I agree on the social resistance, which is why I proposed the proof-of-work stamps (which involve a non-monetary expenditure) to go alongside it. I'm afraid the micropayment argument doesn't hold water, because you can always pay for blocks of, say, a thousand stamps at a time, and exactly how hard is it to keep track of one counter per paying customer? Incidentally, if you can prove your identity, the recipient can add you to a whitelist that says "I don't need a paid stamp from this sender". > Furthermore, the money paid for stamps goes to the wrong place, ie, not > to the recipients. (Stamp vendors could in principle pay recipients > who get mail with their stamps. This involves creation of _another_ > micropayment infrastructure per stamp vendor.) Good point. There's a way around this, though - how about the recipient's stamp vendor collects a portion of the stamp's value from the sender's stamp vendor, and credits it to the recipient's account? If accounting is kept at both ends, then actual money would only change hands relatively infrequently - in blocks, just like the sender pays for the original stamps. But, this does require some kind of business relationship - perhaps via an intermediary to help it scale - between the two vendors. This ignores mailing lists and the like, however. These are an interesting problem, because the sender wants his single mail to be seen by all members of the list, which could be thousands of recipients - that's a lot of stamps. For this reason, mailing lists are already prime targets of spammers, especially since it's presently quite easy to forge entry. Probably the strongest solution is for the listserv to use the proof-of-identity, perhaps combined with a proof-of-work or a paid stamp, from the sender - and for the list subscribers to use proof-of-identity of the listserv, with a whitelist entry to prevent the listserv from having to attach (paid *or* worked) stamps. But this requires upgrading the list software. Another solution is to use a proof-of-work stamp, made for the sender-to-list connection, with a particularly high validity threshold. The recipient can then check that via a whitelist entry on the "To" address, without involving the listserv itself. >> In a recipient-driven scheme, senders still have to be able to buy >> stamps, but they will be able to choose their stamp vendor, rather >> than being limited to their ISP. > > Except that they have to choose a vendor acceptable to the recipient. > Keeping track of which recipients demand stamps from which vendors will > be another cost which you don't seem to have mentioned. If there are a > large number of stamp vendors it rapidly becomes almsot intractable. If there are a relatively large number of stamp vendors, then they will be differentiated into (roughly) two classes - trustworthy and untrustworthy - depending on whether they give out free or subsidised accounts to spammers or not. (Fair enough, some other factors will probably come into play as well.) A relatively large number of vendors also helps to open competition. Recipients can whitelist the trustworthy ones and blacklist the others - which is a much easier problem than the present practice of blacklisting individual senders. Senders then only have the task of finding a trustworthy stamp vendor, which shouldn't be difficult, and they can move away from it if their mails stop getting through. This is made even easier if there are a number of public lists to consult. Just for the record, I don't believe e-postage is The Solution, in any form. Whether it can sensibly become even part of the solution is open to debate. I'm just trying to get the debate back on track. :) -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 17:38:25 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18619 for ; Sun, 25 Apr 2004 17:38:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrFy-0001Ge-SE for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:33:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLXkUa004867 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:33:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrCb-00006j-MD for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:30:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18315 for ; Sun, 25 Apr 2004 17:30:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrCZ-00041H-AG for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:30:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrBZ-0003oy-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:29:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrAX-0003Uy-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:28:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHr4a-0006ee-Gg; Sun, 25 Apr 2004 17:22:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHr2u-00065E-MO for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:20:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18061 for ; Sun, 25 Apr 2004 17:20:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHr2s-00027q-Bu for asrg@ietf.org; Sun, 25 Apr 2004 17:20:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHr1t-0001vi-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:19:13 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BHr0q-0001Xx-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:18:08 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BHr0q-0005BO-Uj; Sun, 25 Apr 2004 22:18:08 +0100 In-Reply-To: <16524.3834.261410.998419@world.std.com> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <16524.3834.261410.998419@world.std.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <0CCE8697-96FE-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] My take on e-postage To: Barry Shein X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 22:18:08 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> First things first. The resource being consumed/abused is the >> recipient's inbox. Therefore we need to make any charge a condition >> of >> entry into a participating recipient's inbox. That means the >> recipient >> is the one who needs to decide whether a stamp is needed, and whether >> any given stamp is sufficiently valid. > > Well, I disagree with this 100%, it's just false. > > If people could send advertising via paper post for free do you think > the problem is primarily the recipient's? What about the effect it has > on the letter carriers and the postal system in general? > > This is another proposal which works forward from spam is free, just > annoying. Paper post is charged for on a transportation-costs basis. If paper post were free, then utilisation would indeed go up, increasing it's cost, at which point it would no longer be free. So it stabilises in a non-free state, just like it is today. QED. By contrast, the transportation costs of e-mail are practically nil. Spammers happily paid for phat pipes to send mail through, before widespread blacklisting forced them into using zombies. The cost is, and has always been, the recipient's time spent in sifting through the mess. (I count the recipient's ISP in this as well.) -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 17:43:27 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18783 for ; Sun, 25 Apr 2004 17:43:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrNw-0004NG-LK for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:42:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLg0OM016810 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:42:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrKK-00036D-Q2 for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:38:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18617 for ; Sun, 25 Apr 2004 17:38:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrKI-0005WU-Ck for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:38:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrJK-0005Ly-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:37:15 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrIv-0005Bf-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:36:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrFE-0000zX-H8; Sun, 25 Apr 2004 17:33:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHr7m-0007Al-Kj for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:25:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18230 for ; Sun, 25 Apr 2004 17:25:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHr7k-00036N-72 for asrg@ietf.org; Sun, 25 Apr 2004 17:25:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHr6o-0002vQ-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:24:19 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BHr6I-0002kU-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:23:46 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BHr6I-0005Cc-Ea; Sun, 25 Apr 2004 22:23:46 +0100 In-Reply-To: <200404252027.QAA02214@Sparkle.Rodents.Montreal.QC.CA> References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <4089A27F.3050807@zemos.net> <408C144E.80903@solidmatrix.com> <16524.6886.604923.78448@world.std.com> <200404252027.QAA02214@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences To: der Mouse X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 22:23:46 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> At any rate, no system I can think of outside of e-mail is purely >> geared towards resolving some sort of receiver pays other than some >> much-maligned, relatively recent cell-phone systems and even on those >> there's much activity to either block or change the charging for >> marketing calls. I don't think anyone's suggesting the recipient should pay for e-mail. What we do want is for the sender to pay the recipient's costs, because the recipient's costs are much greater than those due to mere transport. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 17:47:39 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19108 for ; Sun, 25 Apr 2004 17:47:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrOt-0004en-Hf for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:42:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLgxIk017896 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:42:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrMW-0003sJ-JU for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:40:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18664 for ; Sun, 25 Apr 2004 17:40:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrMU-0005u2-6K for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:40:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrLL-0005iL-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:39:20 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrKp-0005XD-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:38:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrGD-0001Lh-9G; Sun, 25 Apr 2004 17:34:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrDZ-0000O6-5b for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:31:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18359 for ; Sun, 25 Apr 2004 17:31:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrDW-0004D5-P5 for asrg@ietf.org; Sun, 25 Apr 2004 17:31:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrCY-000419-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:30:14 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHrBX-0003iz-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:29:11 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PLT8RY010200; Sun, 25 Apr 2004 17:29:09 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id RAA23042; Sun, 25 Apr 2004 17:29:08 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16524.11684.292529.646662@world.std.com> To: der Mouse Cc: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <200404252027.QAA02214@Sparkle.Rodents.Montreal.QC.CA> References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <4089A27F.3050807@zemos.net> <408C144E.80903@solidmatrix.com> <16524.6886.604923.78448@world.std.com> <200404252027.QAA02214@Sparkle.Rodents.Montreal.QC.CA> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 17:29:08 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 25, 2004 at 16:22 mouse@Rodents.Montreal.QC.CA (der Mouse) wrote: > > At any rate, no system I can think of outside of e-mail is purely > > geared towards resolving some sort of receiver pays other than some > > much-maligned, relatively recent cell-phone systems and even on those > > there's much activity to either block or change the charging for > > marketing calls. > > > But telephone in general, postal, sender pays. > > This is because no other system outside of e-mail has the same > underlying cost structure that e-mail does. The phone system perhaps > comes cloest - and, surprise surprise, that's the system where the > analogue of spam is most hated and most acted against. Electricity too cheap to meter! GE used to use that slogan, in the 1960's, to sell the idea of nuclear power plants. It's always suspect, tho not a priori false, and certainly suspect here, for the very reason we're here; it becomes abused. > > This fiction seems to only exist on this list. > > It's not a fiction. It's a fundamental difference between e-mail and > all those analogies people seem to like so much, a difference that is > in large part why the analogies are flawed. I'm not sure using the two words "fundamental difference" as an emphasizer clinches it, maybe "literally" different, nah that grates, um, ... It's not "fundamentally different", it's mostly different as a matter of a degree, different costs, which would seem to argue "fundamentally the same". Amazing what a slippery thing the truth is. But, an infrastructure capable of carrying millions/billions of individual communications events etc at a relatively low-cost to the end-users, which can be flooded by abuse. Fundamentally the same, different cost factors, but the same can be said about a lot of similar things. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 17:48:46 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19172 for ; Sun, 25 Apr 2004 17:48:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrPP-0004gC-5F for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:43:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLhVk8017984 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:43:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrOO-0004NM-0i for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:42:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18735 for ; Sun, 25 Apr 2004 17:42:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrOL-0006J3-Gq for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:42:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrNS-00067U-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:41:30 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrMz-0005vL-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:41:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrK7-00032Z-9d; Sun, 25 Apr 2004 17:38:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrFh-000107-TI for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:33:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18537 for ; Sun, 25 Apr 2004 17:33:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrFf-0004cY-G7 for asrg@ietf.org; Sun, 25 Apr 2004 17:33:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrEl-0004QZ-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:32:32 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BHrE8-0004EB-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:31:52 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3PLUwel005560; Sun, 25 Apr 2004 17:30:58 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id RAA29150; Sun, 25 Apr 2004 17:30:58 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16524.11794.475833.97321@world.std.com> To: "Alan DeKok" Cc: asrg@ietf.org Subject: Re: [Asrg] E-postage In-Reply-To: <20040425203125.8315116DF5@mail.nitros9.org> References: <16524.3310.724548.495226@world.std.com> <20040425203125.8315116DF5@mail.nitros9.org> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 17:30:58 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 25, 2004 at 16:31 aland@ox.org (Alan DeKok) wrote: > Barry Shein wrote: > > The other day we were being pelted by a single spam from over 1,500 > > different IP addresses, presumably all compromised. That's not a > > singular incident, in fact the day before a similar incident involving > > over 1,000 hosts occurred tho I'll admit numbers like that don't tend > > to happen daily, > > I *dream* of getting spam from only 1K hosts a day. That's 1,000 different hosts sending ONE SPAM simultaneously, at one given instant. Not 1,000 per day. > > situation is cost-free or nearly so, so the solution must be cost-free > > or nearly so. > > I'd put the objections a different way. It's difficult to quantify > the recipients cost due to spam. Sure, you can come up with > reasonable figures for end-users losing productivity due to spam, but > those figures aren't a line item on someones budget. > > In contrast, anti-spam systems *are* line items, especially to the > people who deploy them, and to anti-spam companies. Any solution, > therefore, which reduces spam, has huge cost to some parties, and > non-accountable savings to others. > > Alan DeKok. > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 17:57:17 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19395 for ; Sun, 25 Apr 2004 17:57:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHraR-00006P-Vk for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:54:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLstC2000389 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:54:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrV1-0006f1-75 for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:49:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19197 for ; Sun, 25 Apr 2004 17:49:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrUy-00000a-Mg for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:49:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrU8-0007dL-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:48:24 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrTb-0007Rp-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:47:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrOu-0004fU-UX; Sun, 25 Apr 2004 17:43:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrMS-0003oL-4E for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:40:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18652 for ; Sun, 25 Apr 2004 17:40:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrMP-0005tQ-LF for asrg@ietf.org; Sun, 25 Apr 2004 17:40:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrLI-0005hj-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:39:16 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BHrKU-0005X0-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:38:26 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 10E0648979 for ; Sun, 25 Apr 2004 17:38:26 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3PLcQe15641; Sun, 25 Apr 2004 17:38:26 -0400 (EDT) Message-Id: <200404252138.i3PLcQe15641@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: (gep2@terabites.com) Subject: Re: [Asrg] E-postage References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 17:38:26 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 >> ...Now, lets say hypothetically speaking that all ISPs would charge their >> customers extra for lets say more than 1000 emails/day. > > The problem is that the number will shrink, and shrink, and shrink, until you > are charged for EVERY E-mail. At which point I'll declare myself an ISP and send directly. Actually, that won't happen, because the ISP market is a lot more competitive than the phone market. > And, just as the oligopoly reduces the number of independent small > local ISPs and things are inexorably consolidating in the hands of > folks like Comcast and SBC and Verizon et al, you're going to have a > bunch of big companies which divvy up the market between them and > without anything like genuine competition. And for a $250/month colo machine (or likely a lot cheaper), I'll become the email provider of choice for a few thousand people at $1 each, making a huge profit for me, and cutting their email charges down to $1/month. > We're seeing the resulting abuse TODAY with unjustified rate hikes > based on flimsy arguments... where they're jacking up prices just > because THEY CAN. :-((( In how competitive a market? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 17:59:12 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19504 for ; Sun, 25 Apr 2004 17:59:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrcn-0000r8-F2 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:57:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLvLpS003286 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:57:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHraq-00009X-FN for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:55:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19323 for ; Sun, 25 Apr 2004 17:55:16 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHran-00017K-Rs for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:55:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrZt-0000wF-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:54:22 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrZb-0000lG-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:54:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrUj-0006c4-4p; Sun, 25 Apr 2004 17:49:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrPF-0004fi-ED for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:43:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18765 for ; Sun, 25 Apr 2004 17:43:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrPC-0006X0-UZ for asrg@ietf.org; Sun, 25 Apr 2004 17:43:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrOM-0006JD-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:42:26 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BHrNg-00067i-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:41:44 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id ECC6A48B3D for ; Sun, 25 Apr 2004 17:41:44 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3PLfi515740; Sun, 25 Apr 2004 17:41:44 -0400 (EDT) Message-Id: <200404252141.i3PLfi515740@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: (gep2@terabites.com) Subject: Re: [Asrg] IM2000 and other lame schemes References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 17:41:44 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 gep2@terabites.com wrote: >> To expand, if your incoming mailserver rejects all inbound messages with a= > transient error and notifies the recipient. The recipient can then elect to= > allow any similar messages through if the remote server tries again within= > a set period of time. > This may have to second guess how many times the remote server will retry= > before giving up, and either allow or reject the message with a permanent= > error if the recipient does not express their will in time. > > This kind of lame idea is a good example... so you end up increasing the cost of > handling E-mail, wasting bandwidth and transmission latency on artificially > necessary retries, and requiring new recordkeeping (queueing, etc) on both the > recipient and sender ends. Wrong. The sender doesn't need any new recordkeeping, that's how standard MTAs (not spamware) work already, which is _why_ the idea works. The recipient has to do more work, but the benefit is spam reduction. The amount of delayed mail can be kept quite small. > And the idea about "queueing it closer to the sender"... again, a > large percentage of spam TODAY is sent by spambot zombies. So > you're NOT clogging up SPAMMER uplinks... or increasing THEIR > costs... you're clogging, abusing, and increasing the cost to VICTIM > ISPs and VICTIM users. Except that in that case, _if_ the ISPs can be convinced they need to take action, the spam goes away before most of its victims will see it. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 18:02:47 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19652 for ; Sun, 25 Apr 2004 18:02:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHree-0001IJ-IB for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:59:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PLxGct004971 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 17:59:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrcs-0000rS-5l for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 17:57:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19426 for ; Sun, 25 Apr 2004 17:57:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrcp-0001Y4-Lx for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:57:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrbx-0001Lr-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:56:30 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrbG-00019S-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 17:55:46 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrVk-00072X-73; Sun, 25 Apr 2004 17:50:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrRI-0005Jt-11 for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:45:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19038 for ; Sun, 25 Apr 2004 17:45:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrRF-00072o-Dy for asrg@ietf.org; Sun, 25 Apr 2004 17:45:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrQQ-0006pM-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:44:35 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=wChY6SDIn1SWPhxpQtlSIgLSCBw24jBzwbkkhuq5zdB) by ietf-mx with esmtp (Exim 4.12) id 1BHrPc-0006aC-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:43:45 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id RAA02636; Sun, 25 Apr 2004 17:43:44 -0400 (EDT) From: der Mouse Message-Id: <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 17:28:51 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit >> Have you read the taugh whitepaper? Some of the points it raises >> apply to your sketched design. > No - do you have a link? http://www.taugh.com/epostage.pdf - or at least that's where I found it when I fetched it, and there's still something there now; I haven't checked that it's the same, but have no reason to think it's not. > I'm afraid the micropayment argument doesn't hold water, because you > can always pay for blocks of, say, a thousand stamps at a time, and > exactly how hard is it to keep track of one counter per paying > customer? It's a lot more than that that the stamp vendor needs to keep track of. The first thing that comes to mind is that recipients need a way to check that a stamp hasn't already been used - and even if the sender sends them in order, the recipients won't necessarily check them in order. >> Furthermore, the money paid for stamps goes to the wrong place, ie, >> not to the recipients. (Stamp vendors could in principle pay >> recipients who get mail with their stamps. This involves creation >> of _another_ micropayment infrastructure per stamp vendor.) > Good point. There's a way around this, though - how about the > recipient's stamp vendor collects a portion of the stamp's value from > the sender's stamp vendor, and credits it to the recipient's account? Sounds superficially plausible, but what do you do for fraud prevention (that is, how can each tell that the other is reporting honest totals)? This gets an awful lot of regulatory entities involved, especially when (say) one of them is in China and the other is in Nigeria. > This ignores mailing lists and the like, however. [...] Very true. > Another solution is to use a proof-of-work stamp, There really is no such thing. Hashcash is not something that can be attached to a message; it requires an interactive protocol. (There may be some way to do proof-of-work in an open-loop form, but I haven't seen it yet.) > Recipients can whitelist the trustworthy [stamp vendors] and > blacklist the others - which is a much easier problem than the > present practice of blacklisting individual senders. For a little while, until spammers start creating throwaway stamp vendors, the way they create throwaway domains now. Still, it may be worth trying. Most of this - on both our parts - is, fundamentally, speculation, at present. After all, none of this stops people who mutually feel like it from continuing to use SMTP the way we all have been so far. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 18:10:46 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA20500 for ; Sun, 25 Apr 2004 18:10:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHriQ-0004wR-5I for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 18:03:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PM3A0W018991 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 18:03:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrhi-0004Bp-7k for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 18:02:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA19644 for ; Sun, 25 Apr 2004 18:02:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrhf-0002XO-HM for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 18:02:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrgf-0002Lg-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 18:01:22 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrgH-0002AT-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 18:00:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrdR-00018s-FB; Sun, 25 Apr 2004 17:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrap-00009V-6E for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:55:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19320 for ; Sun, 25 Apr 2004 17:55:15 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHram-00017A-I6 for asrg@ietf.org; Sun, 25 Apr 2004 17:55:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrZr-0000vz-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:54:20 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=JHJjtNz7b8en10dS7tHic0wHH9PqyFFWAgwYtpaaE8K) by ietf-mx with esmtp (Exim 4.12) id 1BHrZU-0000lC-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:53:56 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id RAA02700; Sun, 25 Apr 2004 17:53:56 -0400 (EDT) From: der Mouse Message-Id: <200404252153.RAA02700@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <16524.11684.292529.646662@world.std.com> References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <4089A27F.3050807@zemos.net> <408C144E.80903@solidmatrix.com> <16524.6886.604923.78448@world.std.com> <200404252027.QAA02214@Sparkle.Rodents.Montreal.QC.CA> <16524.11684.292529.646662@world.std.com> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 17:45:56 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit > Electricity too cheap to meter! > GE used to use that slogan, in the 1960's, to sell the idea of > nuclear power plants. > It's always suspect, tho not a priori false, and certainly suspect > here, for the very reason we're here; it becomes abused. I know someone who has phone service with, effectively, a continent-wide local calling area. (That is, one flat fee per month (USD 40.00 is what I recall) covers all calls within North America.) I gather it's new and thus relatively experimental, but people don't do such things unless they have reason to think they will succeed commercially. >> It's not a fiction. It's a fundamental difference between e-mail >> and all those analogies people seem to like so much, a difference >> that is in large part why the analogies are flawed. > It's not "fundamentally different", it's mostly different as a matter > of a degree, different costs, which would seem to argue > "fundamentally the same". It is a fundamental difference in that it is a difference at the foundation (the "fundament"). It is a quantitative, rather than qualitative, difference, yes, but it is still fundamental. (Actually, given how much of the reason it matters is social, I think a good case could be made that it is a quantitative difference large enough to have become qualitative. I'm not going to more than mention it, though, bceause I don't think it really matters whether it's thought of as qualitative or quantitative: it's drastic enough either way.) /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 18:17:14 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21319 for ; Sun, 25 Apr 2004 18:17:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrrb-0001iv-M4 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 18:12:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3PMCdBt006621 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 18:12:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHrqK-00010H-8X for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 18:11:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA20558 for ; Sun, 25 Apr 2004 18:11:16 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHrqH-0004HE-JI for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 18:11:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrpJ-00045P-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 18:10:18 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHrob-0003ud-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 18:09:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHriH-0004tt-JK; Sun, 25 Apr 2004 18:03:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHreq-0001Is-Gb for asrg@optimus.ietf.org; Sun, 25 Apr 2004 17:59:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA19551 for ; Sun, 25 Apr 2004 17:59:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHren-0001yW-Rz for asrg@ietf.org; Sun, 25 Apr 2004 17:59:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHrdx-0001mc-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:58:34 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BHrdJ-0001Zq-00 for asrg@ietf.org; Sun, 25 Apr 2004 17:57:53 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id D39E14890D for ; Sun, 25 Apr 2004 17:57:53 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3PLvr516505; Sun, 25 Apr 2004 17:57:53 -0400 (EDT) Message-Id: <200404252157.i3PLvr516505@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: (gep2@terabites.com) Subject: Re: [Asrg] Certificates References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 17:57:53 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 gep2@terabites.com wrote: >> In deciding which email to receive (or allow to bypass strong >> filtration), would you trust an irrevocable certificate from TrustE? >> How about one from Verislime? How about a revocable certificate from >> Spamhaus? >> >> If you want your email to be received, which of those would you buy? > > The bottom line, again, is that certificates (like SPF) ultimately > DO NOT SOLVE THE PROBLEM of spamming for the terribly simple and > obvious reason that machines possessing valid certificates will be > infected by spambot zombies (in fact, since they're "certificated" > they will be widely sought-after zombie targets). And about 40 seconds after they start spewing, spamhaus revokes their certificate. > So your "certificate-approved" machine gets infected, and now it's > pumping out "certificate-guaranteed" spam like there's no tomorrow. For 40 seconds, maybe. > Certificates, like SPF, E-postage, and other such lame ideas, simply > don't solve the problem. They do NOT guarantee that mail is, or is > not, spam. No, but they can help reduce the amount of mail that's misclassified. > The nice thing about my approach... don't allow most users > (i.e. those users without a GENUINE, AGREED NEED) to send you > HTML-burdened mails (force the mail to plain ASCII text) and > similarly don't allow most users (other than those you've negotiated > with and approved in advance) to send you attachments (and open that > window, guardedly, for only a few trusted senders and a few specific > attachment types). > > THEN, for the stuff that has gotten through (and where most of the > tricks for obscuring content have been denied to the sender), you > put it through a good content filter which will identify the stuff > as spam if it looks like spam. There don't seem to be any such content filters that are good enough now; requiring them as part of your solution doesn't make your solution any more viable. > My scheme virtually eliminates spams and worms being sent > successfully (to ME at least) in E-mails, "virtually"? How do they ever get through? > Making that first filtering of the HTML junk happen also greatly > increases the effectiveness of the content filtering of what's left, > since there are very many fewer tricks left available to spammers > and abusers for obscuring the true content of their unwanted > messages. When it's necessary, they'll find more, just like they always have. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 20:11:17 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25709 for ; Sun, 25 Apr 2004 20:11:17 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHtfZ-0004xd-Mu for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 20:08:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q08LIn019065 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 20:08:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHtes-0004ZS-Te for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 20:07:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25444 for ; Sun, 25 Apr 2004 20:07:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHteq-0003ug-Tk for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 20:07:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHtci-0003jd-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 20:05:25 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHtcV-0003Yt-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 20:05:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHtZR-0002uB-9J; Sun, 25 Apr 2004 20:02:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHtX0-00023I-GS for asrg@optimus.ietf.org; Sun, 25 Apr 2004 19:59:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA25231 for ; Sun, 25 Apr 2004 19:59:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHtWy-0002aj-EU for asrg@ietf.org; Sun, 25 Apr 2004 19:59:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHtW5-0002Ou-00 for asrg@ietf.org; Sun, 25 Apr 2004 19:58:34 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BHtVO-0002DV-00 for asrg@ietf.org; Sun, 25 Apr 2004 19:57:50 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BHtVO-00017D-CX; Mon, 26 Apr 2004 00:57:50 +0100 In-Reply-To: <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] My take on e-postage To: der Mouse X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 00:57:49 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> Have you read the taugh whitepaper? Some of the points it raises >>> apply to your sketched design. >> No - do you have a link? > > http://www.taugh.com/epostage.pdf - or at least that's where I found it > when I fetched it, and there's still something there now; I haven't > checked that it's the same, but have no reason to think it's not. At least some of it's objections seem to hinge on stamps being anonymous. Unlike e-coins, that need not be the case. As I mention below, some problems are more easily solved with identified stamps. >> I'm afraid the micropayment argument doesn't hold water, because you >> can always pay for blocks of, say, a thousand stamps at a time, and >> exactly how hard is it to keep track of one counter per paying >> customer? > > It's a lot more than that that the stamp vendor needs to keep track of. > The first thing that comes to mind is that recipients need a way to > check that a stamp hasn't already been used - and even if the sender > sends them in order, the recipients won't necessarily check them in > order. Not necessary, if the stamp cryptographically includes both the sender and recipient addresses. If the recipient doesn't recognise the address the stamp was made for delivery to, it's invalid. >>> Furthermore, the money paid for stamps goes to the wrong place, ie, >>> not to the recipients. (Stamp vendors could in principle pay >>> recipients who get mail with their stamps. This involves creation >>> of _another_ micropayment infrastructure per stamp vendor.) >> Good point. There's a way around this, though - how about the >> recipient's stamp vendor collects a portion of the stamp's value from >> the sender's stamp vendor, and credits it to the recipient's account? > > Sounds superficially plausible, but what do you do for fraud > prevention (that is, how can each tell that the other is reporting > honest totals)? This gets an awful lot of regulatory entities > involved, especially when (say) one of them is in China and the other > is in Nigeria. I don't have a strong solution to that. However, it should be a simple matter to at least list the actual stamps being claimed, and check them against stamps issued. In the event of a dispute - for example, two vendors try to claim the same stamp - we start wanting to prove which claiming vendor actually has the stamp's addressed recipient as a customer. One way of doing that, which should be cheap enough to deal with small disputes, is to send a special stamp to the recipient and see which vendor it comes back from. Since the revenue from the stamp belongs to the recipient, it doesn't matter if he switched vendors in the meantime. It also doesn't particularly matter if the test stamp never comes back. For wider disputes, when measurable amounts of money get involved, you start bringing humans in to negotiate. At some point, you might need to downgrade disputing vendors' reputation, or even start legal proceedings. That last, however, is way beyond any reasonable technical measures, and indicates (alleged) fraud on the order of hundreds of thousands of stamps. >> This ignores mailing lists and the like, however. [...] > > Very true. > >> Another solution is to use a proof-of-work stamp, > > There really is no such thing. Hashcash is not something that can be > attached to a message; it requires an interactive protocol. (There may > be some way to do proof-of-work in an open-loop form, but I haven't > seen it yet.) Why is this? Is it because the validity threshold of the recipient isn't a priori known to the sender? If so, then a variation on the usual "delivery failed" mechanism (insufficient hashcash for delivery, please send 30 bits) should handle it. If for some other reason, please expand. >> Recipients can whitelist the trustworthy [stamp vendors] and >> blacklist the others - which is a much easier problem than the >> present practice of blacklisting individual senders. > > For a little while, until spammers start creating throwaway stamp > vendors, the way they create throwaway domains now. Which is why I said whitelists as well as blacklists. It does mean there will be some barrier to entry for new stamp vendors, but I don't know if that will be a serious problem. > Still, it may be worth trying. Most of this - on both our parts - is, > fundamentally, speculation, at present. After all, none of this stops > people who mutually feel like it from continuing to use SMTP the way we > all have been so far. Naturally. This is also why the proprietary systems being proposed by certain large corporations may not succeed, however much money is behind them. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 20:46:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA26789 for ; Sun, 25 Apr 2004 20:46:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHuDG-0006Qe-PO for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 20:43:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q0hA6E024707 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 20:43:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHuAd-0005hv-Vo for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 20:40:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA26668 for ; Sun, 25 Apr 2004 20:40:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHuAb-0002kI-NR for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 20:40:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHu9h-0002Yp-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 20:39:30 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHu94-0002ND-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 20:38:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHu6M-0004L6-7b; Sun, 25 Apr 2004 20:36:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHu2z-00039n-PK for asrg@optimus.ietf.org; Sun, 25 Apr 2004 20:32:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA26352 for ; Sun, 25 Apr 2004 20:32:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHu2x-0001BI-I6 for asrg@ietf.org; Sun, 25 Apr 2004 20:32:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHu20-0000zd-00 for asrg@ietf.org; Sun, 25 Apr 2004 20:31:33 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=KTu52Z3u3w91qipbEZA9cp8jGsGLGF3oL8md06GGPX3) by ietf-mx with esmtp (Exim 4.12) id 1BHu17-0000nF-00 for asrg@ietf.org; Sun, 25 Apr 2004 20:30:38 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id UAA03203; Sun, 25 Apr 2004 20:30:37 -0400 (EDT) From: der Mouse Message-Id: <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 20:18:49 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit >> It's a lot more than that that the stamp vendor needs to keep track >> of. The first thing that comes to mind is that recipients need a >> way to check that a stamp hasn't already been used > Not necessary, if the stamp cryptographically includes both the > sender and recipient addresses. Then the recipient needs a way to check the crypto signature - and even then, you have to figure out a way that stamps can't get reused with forged sender addresses. (That is, X sends mail to Y, with a valid stamp . Spammer gets hold of a copy (through any of many possible means) and sends mail with that stamp, to Y, forging X's address as the sender.) >>> Another solution is to use a proof-of-work stamp, >> There really is no such thing. Hashcash is not something that can >> be attached to a message; it requires an interactive protocol. >> (There may be some way to do proof-of-work in an open-loop form, but >> I haven't seen it yet.) > Why is this? Why? Simply because all the hashcash protocols I've seen outlined, or that I've thought of, involve some kind of challenge by the recipient which must be answered by the "payer". A simple example might be "find a data blob whose SHA-1 hash has these 20 bits set to these values". As I said, I don't know whether this is an inherent property of hashcash (by which I really mean "proof-of-work", even though, strictly, hashcash is but one form of p-o-w) or whether it's just an artifact of the hashcash schemes I am aware of. But until someone shows me one which doesn't have that property, I have to operate under the assumption that no such thing exists. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 22:09:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01033 for ; Sun, 25 Apr 2004 22:09:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvXK-0006tw-C8 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 22:07:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q27wgY026522 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 22:07:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvV2-0005ri-Jl for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 22:05:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA00878 for ; Sun, 25 Apr 2004 22:05:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHvUz-0004o7-J6 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 22:05:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHvU0-0004dD-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 22:04:33 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHvTh-0004SE-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 22:04:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvOe-000433-OT; Sun, 25 Apr 2004 21:59:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvLI-0002rC-Ub for asrg@optimus.ietf.org; Sun, 25 Apr 2004 21:55:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA00403 for ; Sun, 25 Apr 2004 21:55:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHvLF-0002nV-Rl for asrg@ietf.org; Sun, 25 Apr 2004 21:55:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHvKR-0002br-00 for asrg@ietf.org; Sun, 25 Apr 2004 21:54:40 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BHvJi-0002Pu-00 for asrg@ietf.org; Sun, 25 Apr 2004 21:53:54 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BHvJi-0001o2-C7; Mon, 26 Apr 2004 02:53:54 +0100 In-Reply-To: <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <92455BF8-9724-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] My take on e-postage To: der Mouse X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 02:53:53 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> It's a lot more than that that the stamp vendor needs to keep track >>> of. The first thing that comes to mind is that recipients need a >>> way to check that a stamp hasn't already been used >> Not necessary, if the stamp cryptographically includes both the >> sender and recipient addresses. > > Then the recipient needs a way to check the crypto signature - and even > then, you have to figure out a way that stamps can't get reused with > forged sender addresses. (That is, X sends mail to Y, with a valid > stamp . Spammer gets hold of a copy (through any of many possible > means) and sends mail with that stamp, to Y, forging X's address as the > sender.) But the recipient Y will be able to tell if he's seen the same stamp twice. That's trivial to deal with, especially since most modern MUAs (well, Eudora and Apple Mail, anyway) index their mail archive already by default. As for verifying crypto signatures, the public key from the vendor is needed for that, since the vendor issued the stamp. This is, broadly speaking, a one-time operation, which happens after the sender vendor's trustworthiness has been looked up. It's also an operation that could potentially be offloaded on the recipient's vendor, since the recipient is probably going to send the stamp there for reimbursement anyway. >>>> Another solution is to use a proof-of-work stamp, >>> There really is no such thing. Hashcash is not something that can >>> be attached to a message; it requires an interactive protocol. >>> (There may be some way to do proof-of-work in an open-loop form, but >>> I haven't seen it yet.) >> Why is this? > > Why? Simply because all the hashcash protocols I've seen outlined, or > that I've thought of, involve some kind of challenge by the recipient > which must be answered by the "payer". A simple example might be "find > a data blob whose SHA-1 hash has these 20 bits set to these values". > > As I said, I don't know whether this is an inherent property of > hashcash (by which I really mean "proof-of-work", even though, > strictly, hashcash is but one form of p-o-w) or whether it's just an > artifact of the hashcash schemes I am aware of. But until someone > shows me one which doesn't have that property, I have to operate under > the assumption that no such thing exists. Ah, I see what you're missing. What you need is more like "find a data blob Y, which is different from this challenge X, where both X and Y have the same first N bits in their SHA-1 hash". The challenge can then be arranged so that it contains various pieces of information about the mail itself, such as the sender, recipient, creation date and time, and possibly part of the content and/or some of the other header fields. This way, the sender and the recipient can both figure out what the challenge should be (except for the number of bits, but a sensible default can be assumed), and the sender can then, with reasonable confidence about validity, attach the hashcash stamp to the mail. If the sender has previously conversed with this recipient, it will also have a priori knowledge of N, improving efficiency. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 22:27:22 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01524 for ; Sun, 25 Apr 2004 22:27:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvoi-0003rD-FU for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 22:25:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q2PutZ014816 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 22:25:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvoJ-0003ZK-JX for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 22:25:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01495 for ; Sun, 25 Apr 2004 22:25:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHvoG-0000ot-AE for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 22:25:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHvnL-0000eN-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 22:24:32 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHvmv-0000Tp-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 22:24:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvg5-0001JH-BD; Sun, 25 Apr 2004 22:17:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHvcv-00007i-6e for asrg@optimus.ietf.org; Sun, 25 Apr 2004 22:13:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA01259 for ; Sun, 25 Apr 2004 22:13:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHvcr-0006Sy-VS for asrg@ietf.org; Sun, 25 Apr 2004 22:13:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHvbr-0006H4-00 for asrg@ietf.org; Sun, 25 Apr 2004 22:12:40 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BHvbS-00064y-00 for asrg@ietf.org; Sun, 25 Apr 2004 22:12:14 -0400 Received: (qmail 27972 invoked by uid 100); 26 Apr 2004 02:12:09 -0000 Message-ID: <20040426021209.27971.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <16524.11684.292529.646662@world.std.com> Organization: I.E.C.C., Trumansburg NY USA Cc: bzs@world.std.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 26 Apr 2004 02:12:09 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 > > > But telephone in general, postal, sender pays. > > > > This is because no other system outside of e-mail has the same > > underlying cost structure that e-mail does. The phone system perhaps > > comes cloest - and, surprise surprise, that's the system where the > > analogue of spam is most hated and most acted against. > >Electricity too cheap to meter! Actually, telephony has become too cheap to meter. Every local service provider from Verizon to Vonage has an unmetered plan that they're trying to get people to buy. The possiblities of abuse are limited, since the number of phone calls you can make is limited by the fact that you only have one mouth to speak out of, and the most annoying kinds of phone overusage abuse, telemarketing and junk faxes, are already heavily regulated or illegal. This tells me that it really is a poor analogy for e-mail, since one of the things that makes spam possible is that you can send a whole lot of mail from a modest IP connection. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Sun Apr 25 23:05:50 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA03077 for ; Sun, 25 Apr 2004 23:05:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHwQ3-0006de-3T for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 23:04:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q34UPB025513 for asrg-archive@odin.ietf.org; Sun, 25 Apr 2004 23:04:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHwOE-0005u6-T6 for asrg-web-archive@optimus.ietf.org; Sun, 25 Apr 2004 23:02:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA02974 for ; Sun, 25 Apr 2004 23:02:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHwOB-0000Ij-CY for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 23:02:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHwNI-000075-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 23:01:41 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHwMn-0007iY-00 for asrg-web-archive@ietf.org; Sun, 25 Apr 2004 23:01:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHwHo-0004C3-JK; Sun, 25 Apr 2004 22:56:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHwER-0003Cf-KE for asrg@optimus.ietf.org; Sun, 25 Apr 2004 22:52:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA02571 for ; Sun, 25 Apr 2004 22:52:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHwEN-0006B5-VF for asrg@ietf.org; Sun, 25 Apr 2004 22:52:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHwDP-0005yr-00 for asrg@ietf.org; Sun, 25 Apr 2004 22:51:28 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BHwCR-0005cg-00 for asrg@ietf.org; Sun, 25 Apr 2004 22:50:27 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id 9D00748B35 for ; Sun, 25 Apr 2004 22:50:21 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3Q2oLi01823; Sun, 25 Apr 2004 22:50:21 -0400 (EDT) Message-Id: <200404260250.i3Q2oLi01823@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> (message from der Mouse on Sun, 25 Apr 2004 20:18:49 -0400 (EDT)) Subject: Re: [Asrg] My take on e-postage References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sun, 25 Apr 2004 22:50:21 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 der Mouse wrote: > Why? Simply because all the hashcash protocols I've seen outlined, or > that I've thought of, involve some kind of challenge by the recipient > which must be answered by the "payer". A simple example might be "find > a data blob whose SHA-1 hash has these 20 bits set to these values". Simple attempt (which probably won't work, but would take me a few hours to figure out why): "The message, including the timestamp (which must be accurate to 10 seconds and only one is accepted per 10 seconds) and including From and Envelope-To (same as To) must have the first 20 bits of its MD5 equal to 10101010101010101010; you may insert an X-HashCash-Munger: header to make it work" You can't do the work once for many recipients because the recipient is included in the hash; and you can't re-use it because of the timestamp. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 00:48:50 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA07980 for ; Mon, 26 Apr 2004 00:48:50 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHxy9-0000gu-HA for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 00:43:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q4hnWP002652 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 00:43:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHxw5-0008LB-B9 for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 00:41:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA07799 for ; Mon, 26 Apr 2004 00:41:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHxw2-0004AT-Rj for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 00:41:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHxvA-0003zL-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 00:40:45 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BHxuh-0003nU-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 00:40:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHxqc-0006Me-8j; Mon, 26 Apr 2004 00:36:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BHxoN-0005mE-L5 for asrg@optimus.ietf.org; Mon, 26 Apr 2004 00:33:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA07166 for ; Mon, 26 Apr 2004 00:33:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BHxoL-0002Np-2i for asrg@ietf.org; Mon, 26 Apr 2004 00:33:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BHxnL-00025m-00 for asrg@ietf.org; Mon, 26 Apr 2004 00:32:40 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=EvJ6hgibINPx6r6INmMl4U6ph1ukq6Ub99W7yx3txOu) by ietf-mx with esmtp (Exim 4.12) id 1BHxmL-0001qy-00 for asrg@ietf.org; Mon, 26 Apr 2004 00:31:37 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id AAA09210; Mon, 26 Apr 2004 00:31:37 -0400 (EDT) From: der Mouse Message-Id: <200404260431.AAA09210@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <200404260250.i3Q2oLi01823@panix5.panix.com> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> <200404260250.i3Q2oLi01823@panix5.panix.com> Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by Sparkle.Rodents.Montreal.QC.CA id AAA09210 Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 00:12:25 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable >> Why? Simply because all the hashcash protocols I've seen outlined, >> or that I've thought of, involve some kind of challenge by the >> recipient which must be answered by the "payer". A simple example >> might be "find a data blob whose SHA-1 hash has these 20 bits set to >> these values". > Simple attempt (which probably won't work, but would take me a few > hours to figure out why): "The message, including the timestamp > (which must be accurate to 10 seconds and only one is accepted per 10 > seconds) and including From and Envelope-To (same as To) must have > the first 20 bits of its MD5 equal to 10101010101010101010; > You can't do the work once for many recipients because the recipient > is included in the hash; Right. > and you can't re-use it because of the timestamp. Not quite that simple. If the timestamp must match the time of the SMTP handoff, then you have to recompute the hashcash for every retry (and are vulnerable to unusually slow SMTP connections or recipient clocks set wrong); if the timestamp need not match the time of the SMTP handoff, you are vulnerable to backdated reuse. You may be on to something here, though. How about: The MD5 of the envelope-from, the envelope-to, the From:, To:, Message-Id:, and X-HashCash: headers, in that order, concatenated with the entire message body, must begin with however many 0 bits the recipient requires. I think that addresses the issue. Thank you. (Replay isn't, I think, much of an issue, when you can replay only whole messages including the envelope.) Of course, it still suffers from the usual problems endemic to all hashcash, notably the very wide variety in CPU speeds out there. J.=A0Random=A0Hacker in Outer Slobbovia running on a half-lung salvaged 68020 will be utterly blocked by hashcash values high enough to be even noticed by Evil=A0Q.=A0Spammer's late-model 8-CPU 18GHz Hexium. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 03:18:14 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA27990 for ; Mon, 26 Apr 2004 03:18:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI0MB-0000KN-Tb for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 03:16:47 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q7Glvg001259 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 03:16:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI0JX-00089E-2G for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 03:14:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA27529 for ; Mon, 26 Apr 2004 03:14:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI0JU-0003LH-Tx for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 03:14:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI0HU-0002sE-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 03:11:58 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI0Gn-0002g2-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 03:11:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI0Ck-0005r1-Nj; Mon, 26 Apr 2004 03:07:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI0BQ-0005KB-TF for asrg@optimus.ietf.org; Mon, 26 Apr 2004 03:05:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA27245 for ; Mon, 26 Apr 2004 03:05:37 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI0BM-0001kC-Uf for asrg@ietf.org; Mon, 26 Apr 2004 03:05:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI0AQ-0001aO-00 for asrg@ietf.org; Mon, 26 Apr 2004 03:04:40 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BI0A1-0001Q3-00 for asrg@ietf.org; Mon, 26 Apr 2004 03:04:13 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc12) with SMTP id <20040426070338012002kf37e>; Mon, 26 Apr 2004 07:03:38 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Mon, 26 Apr 2004 02:02:41 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Mon, 26 Apr 2004 02:13:03 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org In-Reply-To: <20040425160005.21167.48295.Mailman@www1.ietf.org> X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: Asrg] My take on e-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 02:13:03 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > First things first. The resource being consumed/abused is the recipient's inbox. While not the ONLY one, I'll agree that that's the one which is the biggest problem and the most annoying from the perspective of typical users. > Therefore we need to make any charge a condition of entry into a participating recipient's inbox. I don't think it needs to be a CHARGE, per se. But clearly we need to have a variety of ways that recipients can control who gets to put stuff (and more to the point, what KINDS of stuff) into their Inbox. I've specifically mentioned HTML and attachments, but a similar control might be that a recipient might want to limit the ability of non-whitelisted senders to (say) drop messages bigger than a certain SIZE into their Inbox, too. If someone is going to be gone on a cruise for a week or two, and has a typical 10Mb Inbox provided by their ISP, it's a big problem if someone (especially someone sending a mis-addressed E-mail!) drops an 8Mb E-mail into their Inbox the moment the vacationer heads out the door! Their mailbox might be bouncing important mail before their flight even takes off to their holiday destination. :-(( > That means the recipient is the one who needs to decide whether a stamp is needed, and whether any given stamp is sufficiently valid. I don't think that recipients really give even a half-hoot about stamps. What they have is a limited resource (Inbox, and their time!), and they typically want to restrict WHO has access to it, or (if they're a newcomer) how much space they can use until the recipient has decided whether or not to grant them more. > Unilaterally charging a levy at the sending side isn't going to work, for a variety of reasons - primarily that the major ISPs will start using it as a revenue stream in it's own right, rather than for the intended purpose of preventing abuse by it's customers. ABSOLUTELY!!!! Worse, the "revenue stream" will end up costing consumers A WHOLE LOT MORE than they pay today, for a whole lot less usable service. > Another reason is that spammers will set up their own ISPs and backbones to avoid the normal stamping routes as much as possible. Phooey!! They don't send their own mail out NOW! But whatever the mechanism is by which they avoid paying "postage", we agree that spammers won't be paying the costs of sending out their junk E-mails. Someone else will pay (and dearly, no doubt). > In a recipient-driven scheme, senders still have to be able to buy stamps, but they will be able to choose their stamp vendor, rather than being limited to their ISP. Stamps are stupid and cumbersome. I agree with those who point out that the purpose is to limit sending rate and volume, and that there must be easier and less complicated/expensive/disadvantageous ways to do that. > There's always going to be a zombie-PC problem, to some extent at least. Thanks for also pointing that out. That is in fact the KEY problem, at least using present-day spammer approaches. > At the moment there are hundreds of thousands of insecure Windows machines out there, and they aren't going away. If anything, the Internet user population is overall DECREASING in savvy-level as more and more clueless-type-folks find their way increasingly online. > There is a very slight possibility that it might be feasible to economically force novice users onto a more secure platform - such as the Mac - There's NOTHING inherently more secure about the Mac, other than the fact that it's a distinctly second-string system in terms of frequency and therefore hackers haven't focused their attention on it. If everyone were running Macs, or everyone were running Linux, then hackers would be writing Mac or Linux worms instead, and they'd be comparably successful. Note that (just recently) a multi-university "distributed supercomputer cluster" of *nix-based boxes was penetrated by hackers, much to the chagrin of the associated administrators. And THAT was a system which DID have savvy, highly-intelligent-and-qualified admins AND expensive, professional-grade systems and "serious" OSes. > ...but we can't rely on that, either. Right, on that we agree. > A problem is that zombies can't merely be used as a relay, they can also be used to leech any stamp account the victim uses for their own e-mail. Absolutely. And that's why _all_ of these modified-DNS, SMTP-auth, SPF, certificate, E-postage, and similar such systems are ALL simply non-starters. NONE of them solve the problem, because zombie enlistment will enroll legitimate (trusted, legitimate) systems to serve spammers. Any antispam approach (at least based on everything I've seen so far) which doesn't also address the worm/virus/zombie problem in a major way is like pissing into the wind. > However, the compromised stamp account will quickly either become empty or run up a monstrous bill on the victim's credit card (the former situation is obviously preferable, and I'd hope that consumer stamp accounts were set up that way). Either way, there's going to have to be a procedure (probably involving per$onnel) to deal with that $ituation when it (frequently) develop$. Taking the "Harry Hardass" approach ("well, that's just too frickin' bad, maybe you'll learn next time to not let your system get infected!") will end up eventually driving a lot of people offline that *need* to be online. This kind of thing will eventually become a NIGHTMARE, and a costly one to boot. I really don't see it as a practical solution. > After that, the zombie can still spew mail all over the place, but it will be unstamped. The empty account (or huge bill) also serves as a wake-up call to the victim, to get their machine cleaned and secured. Fine, but again, meanwhile, you're going to have lots and lots of spam. And for every spambot zombie that you clean up, the spammer will create two new ones. > The interesting thing is that a stamp can also act as proof of where the mail was sent from, and/or who by, because there's a money trail (if nothing else) to follow, and each stamp is unique. Again, I think this is one of those "it seems like a step in the right direction" things, like SPF, that ultimately doesn't really answer the spam problem in a meaningful way. > This probably won't tell you who the spammer is, but it can help for whitelisting... Well, you know, I don't think that you really HAVE to do that for useful whitelisting. It's sorta like the metal grills in the door windows of microwave ovens... if the holes are small enough, the microwaves simply don't escape even though there are millions of holes. If the bogus senders don't know how to get their spam through the holes, and the holes are small enough, then most spams are going to hit the barrier and fall by the wayside. Hopefully most recipients will open their "permission windows" to their Inboxes JUST large enough to let in the stuff they want, from the folks they trust, and keep them tight enough that almost nothing else manages to slip in. > forgery detection, Forgery detection sounds fine, and I suppose that you could even just build your OWN statistical table based on IP addresses that you've seen in the headers of valid E-mails coming from whitelisted senders, but again that fails dramatically when the "valid" non-forged sender gets infected and starts sending spams with valid return addresses. I think that one can forego trying to detect forgeries, actually, as long as you have a good way to detect spams based on their CONTENT. Content is really what decides whether something is spam or not, NOT whether it's forged, or sent in bulk, or most anything else. > ...and for notifying victims. And it doesn't require the victim's ISP to lift a finger, unless they also happen to be the stamp vendor. E-postage is cumbersome, costly, and very labor-intensive to deal with the problems that would inevitably result from it. > The big disadvantage for e-postage is that everyone now has to pay for e-mail service. A service which we presently take for granted as incrementally free. Yeah, that's not exactly an appealing aspect of it either. Especially as worthwhile organizations come up with good, non-abusive ways to further social goals using the low-cost options that E-mail makes available. Even just "community building" things like Yahoogroups... things which are very satisfying, even though most folks would never pay for them directly on an incremental basis. > There are alternative schemes which can operate alongside e-postage to eliminate the monetary cost for most normal purposes. A combination of a proof-of-work stamp (such as hashcash) and a proof-of-identity signature would also serve a useful rate-limiting purpose. Again, it's up to the recipient to decide how strong a guarantee he requires before a mail can land in his inbox. The problem, again, is that both "proof of work" and "proof of identity" are... JUST like E-postage... subject to being subverted/stolen by spammers. The army of spammer zombies out there have a collective computing power FAR greater than that of ALL the legitimate E-mail publishers. So that scheme simply doesn't work. And likewise, "identified" systems can be taken over by zombies. So neither of these schemes work. Period. > (At the moment, most recipients' barriers to entry are exceptionally low, even with today's content filters, because there's no practical, universal way to detect forged mail.) Detecting "forged" mail, while arguably nice to know, only tells you whether mail is (probably) forged. It doesn't tell you EITHER that the mail is, or that it is not, spam. Absolutely *nothing* whatsoever says that spam must use forged return addresses (and as I've pointed out, it's a KINDNESS of the spammers (after a fashion, anyhow) that they do for now usually use forged return addresses). It achieves little (and is probably counterproductive) to force spambot zombies to use real, legitimate E-mail addresses instead. And note that, as I've pointed out, those E-mail addresses don't even need to be valid for the sending MACHINE... a big ISP, for example swbell.net, will SPF-certify EVERY E-mail that uses a legitimate swbell.net user name (and there are probably MILLIONS of valid ones) since any of those could conceivably come from any swbell.net mail server. So this whole area, too, is honestly a non-starter (as much as Wong would try to make less-cognizant folks believe otherwise). > The common factor in the above is that the sender can say "I want this mail to go through so badly that I will do one or more of the following: prove *I* sent it; pay for a stamp from a trustworthy vendor; expend N seconds of CPU time". I think it's enlightening to understand that *NONE* of those costs need necessarily to be borne by the actual spammer. Clearly they can, and will, shift those to their victims... just as OBL didn't BUY the (literally HUNDREDS OF MILLIONS of dollars worth of) airplanes and fuel that they used to destroy WTC and damage the Pentagon. They STOLE our own resources and used our OWN things against us. Spammers do the exact same thing, and it's critical to not forget that. All of these schemes (except mine, I think) are based on spammers "playing by the (new) rules" and there's more than ample evidence to prove that they simply don't do that, and aren't likely to start doing so anytime soon. > The recipient can then look at the credentials supplied with the mail, optionally check them against stamp vendors' databases (etc.), and decide whether they're good enough. Again, a non-solution because spambot zombies will commandeer "credentialed" systems and spam from them. That's one of the distinguishing characteristics of my proposed approach... there is nobody who gets blanket approval to do anything everywhere (with the exception that everybody (by default, anyhow) can send HTML-free, attachment-free plain ASCII text E-mail, as long as it passes the content filter that identifies nearly all spam mail content). An infected zombie machine only can send the type of E-mails it usually sends, and only to the folks who have approved receiving those from it. Bogus counterfeit E-mails as From addresses for HTML-burdened E-mail are very very unlikely to get through the permissions gauntlet protecting the recipient's Inbox. Those trying to send executable attachments have less (almost zero!) likelihood of ever being delivered, simply because most recipients allow almost nobody to send them that kind of stuff. And it doesn't matter all that much if someone with lots of permissions ends up being infected, since chances are good that if they start sending spam, it will STILL be picked up by the content filter... (and they can only still spam to the people they habitually send that type and class of HTML-burdened stuff to, and the spammer doesn't really know who that might be so they don't have any very effective way of deciding what part of their spam victim database to send to each zombie spambot machine). Likewise, they in general don't know who the intended recipient might have whitelisted, so they don't know either which machines they'd need to infect (or what From addresses they'd have to counterfeit) in order to get their spam through to that specific recipient. What this ends up building is a fairly narrow-mesh permissions grid where a spammer has a very small chance of guessing their way successfully through it. And the biggest problem confounding most antispam approaches, the spambot zombie, is virtually eliminated as a threat (at least for E-mail transmission) by my approach's default of not allowing executable attachments from non-whitelisted (TO SEND EXECUTABLES!) senders. Again, note that typical users will normally not whitelist ANYBODY AT ALL to send them executable attachments! NONE of these other DNS-based, certificate-based, credentials-based, E-postage-based, Hashcash-based, upload-rate-limited, etc., technical proposals do much of anything at all to solve the problem of how easy it is to recruit zombie spambots, and that's a big part of why they simply don't solve the problem! > People, please point out what's wrong with the above, specific high-level design, not with "e-postage" in the abstract. Hopefully I've managed to pretty adequately do that. ;-) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 03:18:45 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA28033 for ; Mon, 26 Apr 2004 03:18:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI0MN-0000Lr-GW for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 03:16:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3Q7GxVu001345 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 03:16:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI0Jx-0008A4-Rn for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 03:14:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA27631 for ; Mon, 26 Apr 2004 03:14:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI0Jv-0003Ty-NE for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 03:14:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI0IR-00036f-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 03:12:56 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BI0HC-0002gB-03 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 03:11:38 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BI0B9-0002VZ-1N for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 03:05:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI07u-0004LX-QY; Mon, 26 Apr 2004 03:02:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI03g-000303-PF for asrg@optimus.ietf.org; Mon, 26 Apr 2004 02:57:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA27076 for ; Mon, 26 Apr 2004 02:57:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI03c-0000Ob-Tf for asrg@ietf.org; Mon, 26 Apr 2004 02:57:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI02d-0000CB-00 for asrg@ietf.org; Mon, 26 Apr 2004 02:56:36 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BI01c-0007eQ-00 for asrg@ietf.org; Mon, 26 Apr 2004 02:55:33 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BI00G-0003as-MI for asrg@ietf.org; Mon, 26 Apr 2004 07:54:08 +0100 Mime-Version: 1.0 (Apple Message framework v613) In-Reply-To: <200404260431.AAA09210@Sparkle.Rodents.Montreal.QC.CA> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> <200404260250.i3Q2oLi01823@panix5.panix.com> <200404260431.AAA09210@Sparkle.Rodents.Montreal.QC.CA> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Message-Id: <841979D0-974E-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: quoted-printable From: Jonathan Morton Subject: Re: [Asrg] My take on e-postage To: asrg@ietf.org X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 07:54:08 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable > Of course, it still suffers from the usual problems endemic to all > hashcash, notably the very wide variety in CPU speeds out there. > J.=A0Random=A0Hacker in Outer Slobbovia running on a half-lung = salvaged > 68020 will be utterly blocked by hashcash values high enough to be = even > noticed by Evil=A0Q.=A0Spammer's late-model 8-CPU 18GHz Hexium. Some numbers, using hashcash 0.27 (compiled with optimisation for each=20= machine): My 16MHz 68030 (an old Mac pulled from a skip) can do 1000 hashes a=20 second - it'll take 15-20 minutes on average to do a 20-bit collision. =20= For the impoverished people that must rely on such a machine, this is=20 vaguely acceptable. They can always go outside and do a bit of=20 gardening while they wait. My 200MHz Pentium-MMX can do 84000 hashes a second, reducing the time=20 for a 20-bit collision to 12 seconds - a much more acceptable figure. =20= The vast majority of Internet users in the Western world have a machine=20= at least this fast. Indeed any Pentium-class CPU would appear to be=20 able to produce a 20-bit collision in under a minute (on average). My 1600MHz Athlon-XP can do 575000 hashes a second - enough to reduce=20 the time for a 20-bit collision to 2 seconds. Most enthusiasts and=20 power users have a machine about this size, which reduces a 20-bit=20 hashcash to near invisibility for normal levels of e-mail. I estimate that the fastest current-generation CPUs can do a 20-bit=20 collision in about 1 second. Assuming spammers can build 4-way boxes=20 out of these, how many boxes will they need to fill a T1 to capacity,=20 the way they used to? Assuming a 5KB spam size, about 7500 of them. =20 Is this economically feasible for the spammer? You tell me. So, assuming the spammer is limited to conventional CPUs and that=20 hashcash is widely used, he is now rate-limited to 1 spam per second=20 per CPU for machines he builds himself, and perhaps 1 spam per 2-5=20 seconds per zombie he controls. This is a VAST improvement on the=20 current situation. On the other hand, in an earlier discussion on this subject, I pointed=20= out that dedicated hardware can be built to accelerate hashcash=20 generation. Someone else replied that if the spammers can do it, so=20 can Taiwan, and cheaper. If everyone has access to a SHA-1 coprocessor=20= and an e-mail program that supports it, the playing field becomes more=20= level, not less. However, there's a flaw in that argument too, because coprocessors=20 cheap enough for Aunt Tillie to buy one without thinking too hard about=20= it, are also cheap enough for the spammers to buy in hundreds, together=20= with a huge batch of USB hubs to plug them into a mere handful of=20 servers. But that still means the spammers can "only" send hundreds of=20= times as much mail as Aunt Tillie, which is still a vast improvement on=20= the status quo. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 08:15:27 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14355 for ; Mon, 26 Apr 2004 08:15:27 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI4u4-0006zH-1i for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 08:08:04 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QC84n5026859 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 08:08:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI4r6-00063g-Ep for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 08:05:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA13829 for ; Mon, 26 Apr 2004 08:04:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI4r5-0003xM-FL for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 08:04:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI4qF-0003kS-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 08:04:08 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI4pO-0003XS-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 08:03:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI4kL-0004bW-0O; Mon, 26 Apr 2004 07:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI4fc-0003mC-6h for asrg@optimus.ietf.org; Mon, 26 Apr 2004 07:53:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA13408 for ; Mon, 26 Apr 2004 07:53:06 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI4fb-0001Ti-5K for asrg@ietf.org; Mon, 26 Apr 2004 07:53:07 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI4ei-0001HC-00 for asrg@ietf.org; Mon, 26 Apr 2004 07:52:13 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BI4dq-00013T-00 for asrg@ietf.org; Mon, 26 Apr 2004 07:51:18 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BI4do-0005B2-Dp; Mon, 26 Apr 2004 12:51:16 +0100 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <063B2B61-9778-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] Re: Asrg] My take on e-postage To: gep2@terabites.com X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 12:51:16 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> First things first. The resource being consumed/abused is the >> recipient's inbox. > > While not the ONLY one, I'll agree that that's the one which is the > biggest > problem and the most annoying from the perspective of typical users. Agreed. > I've specifically mentioned HTML and attachments, but a similar > control might be > that a recipient might want to limit the ability of non-whitelisted > senders to > (say) drop messages bigger than a certain SIZE into their Inbox, too. > If > someone is going to be gone on a cruise for a week or two... > > I don't think that recipients really give even a half-hoot about > stamps. What > they have is a limited resource (Inbox, and their time!), and they > typically > want to restrict WHO has access to it, or (if they're a newcomer) how > much space > they can use until the recipient has decided whether or not to grant > them more. That's also an interesting way of looking at the problem, but it can already be handled without extra standards. Perhaps someone could write something to hook into procmail, and/or write a BCP. >> In a recipient-driven scheme, senders still have to be able to buy >> stamps, but they will be able to choose their stamp vendor, rather >> than being limited to their ISP. > > Stamps are stupid and cumbersome. I agree with those who point out > that the > purpose is to limit sending rate and volume, and that there must be > easier and > less complicated/expensive/disadvantageous ways to do that. Without attaching *some* new piece of information to the mail itself, the only even partial solution I can see is rate-limiting by the sender's ISP. Which isn't happening, in general. Only a few ISPs - the most savvy and network-oriented (as opposed to revenue-oriented) - seem to have any mechanism to detect and deal with zombies. >> There's always going to be a zombie-PC problem, to some extent at >> least. > > Thanks for also pointing that out. That is in fact the KEY problem, > at least using present-day spammer approaches. Hold onto that thought. Why did spammers start using zombies? Because we got good at blacklisting by IP address. Why did we blacklist by IP address, rather than whitelist by e-mail address? Because we didn't have any strong authentication method that was widely used - and we still don't. > There's NOTHING inherently more secure about the Mac, other than the > fact that > it's a distinctly second-string system in terms of frequency and > therefore > hackers haven't focused their attention on it. If everyone were > running Macs, > or everyone were running Linux, then hackers would be writing Mac or > Linux worms > instead, and they'd be comparably successful. > > Note that (just recently) a multi-university "distributed > supercomputer cluster" > of *nix-based boxes was penetrated by hackers, much to the chagrin of > the > associated administrators. And THAT was a system which DID have savvy, > highly-intelligent-and-qualified admins AND expensive, > professional-grade > systems and "serious" OSes. The difference is that the cluster was hacked by a determined, "professional" cracker in an isolated incident. The Wintel zombies are being compromised by what we used to call "script kiddies" using mass-market exploits, via vulnerabilities that were either known (and were patched) long before, or social engineering coupled with poor OS design. While the Mac and Linux are not perfect, they do lack many of the fundamental design flaws that make Windows such a soft target. Linux MUAs are largely incapable of creating an executable file on their own, and have to be deliberately coaxed into expanding a tarball in such a way. Apple Mail isn't quite as mistrustful, but it's generally clear to a Mac user what is an executable and what isn't. >> A problem is that zombies can't merely be used as a relay, they can >> also be used to leech any stamp account the victim uses for their own >> e-mail. > > Absolutely. And that's why _all_ of these modified-DNS, SMTP-auth, > SPF, > certificate, E-postage, and similar such systems are ALL simply > non-starters. > NONE of them solve the problem, because zombie enlistment will enroll > legitimate > (trusted, legitimate) systems to serve spammers. Then how do you propose to get rid of the zombies? I thought we just agreed they were always going to be a problem. If the resource being leeched is controlled by a third party, however, it's easier to monitor and take action on suspicious behaviour. This is why e-postage can be helpful - as I mentioned immediately afterwards, the compromised account will quickly run dry. >> However, the compromised stamp account will quickly either become >> empty or run up a monstrous bill on the victim's credit card (the >> former situation is obviously preferable, and I'd hope that consumer >> stamp accounts were set up that way). > > Either way, there's going to have to be a procedure (probably > involving per$onnel) to deal with that $ituation when it (frequently) > develop$. Of course. Education is vital! Perhaps, to save personnel costs, ISPs (especially those who are also stamp vendors) will start throwing in antivirus software, easy-to-use personal firewalls, and even (wow!) day classes for net-newbies. > Taking the "Harry Hardass" approach ("well, that's just too frickin' > bad, maybe you'll learn next time to not let your system get > infected!") will end up eventually driving a lot of people offline > that *need* to be online. This kind of thing will eventually become a > NIGHTMARE, and a costly one to boot. I really don't see it as a > practical solution. ISPs that take that kind of attitude probably deserve to lose customers. The *right* approach is to offer advice on how to clean up and secure their machine, and how to avoid future infections. It's not really all that hard, and they could even print a leaflet about it with step-by-step instructions. >> After that, the zombie can still spew mail all over the place, but it >> will be unstamped. The empty account (or huge bill) also serves as a >> wake-up call to the victim, to get their machine cleaned and secured. > > Fine, but again, meanwhile, you're going to have lots and lots of > spam. And for every spambot zombie that you clean up, the spammer > will create two new ones. Unstamped spam isn't going to get into the inboxes of participating recipients - that's the whole point. Once woken up, the victim might be one less person to get re-infected in the future, so perhaps the endless supply of zombies will get less plentiful in the future. At the moment, there's little or no feedback to victims, so they don't learn anything. >> The interesting thing is that a stamp can also act as proof of where >> the mail was sent from, and/or who by, because there's a money trail >> (if nothing else) to follow, and each stamp is unique. > > Again, I think this is one of those "it seems like a step in the right > direction" things, like SPF, that ultimately doesn't really answer the > spam problem in a meaningful way. ...but it's not actually a *bad* thing, is it? >> This probably won't tell you who the spammer is, but it can help for >> whitelisting... > > Well, you know, I don't think that you really HAVE to do that for > useful > whitelisting. It's sorta like the metal grills in the door windows of > microwave > ovens... if the holes are small enough, the microwaves simply don't > escape even > though there are millions of holes. Uh-huh... >> forgery detection, > > Forgery detection sounds fine, and I suppose that you could even just > build your > OWN statistical table based on IP addresses that you've seen in the > headers of > valid E-mails coming from whitelisted senders, but again that fails > dramatically > when the "valid" non-forged sender gets infected and starts sending > spams with > valid return addresses. But in that case, you know who's sending it, so you can block them temporarily and help them fix it. > I think that one can forego trying to detect forgeries, actually, as > long as you have a good way to detect spams based on their CONTENT. But we don't. If we did, we'd be able to stop spam, NOW, just by slapping one of these perfect filters on the front of our inbox. Here's some news: we already do use content filters - everything from Bayes through distributed bulk detectors to phrase matching. It helps, but it is absolutely nowhere near perfect. >> ...and for notifying victims. And it doesn't require the victim's >> ISP to lift a finger, unless they also happen to be the stamp vendor. > > E-postage is cumbersome, costly, and very labor-intensive to deal with > the problems that would inevitably result from it. Some of the proposed schemes undoubtedly are. Have you read the discussion I've been having with "der Mouse" over the past day or so? I think we've hashed out something a lot more scalable than most, though I won't pretend it's finished. Many schemes and objections seem to assume, for example, that stamps have to be anonymous like e-coins - which makes them unreasonably hard to verify. >> There are alternative schemes which can operate alongside e-postage >> to eliminate the monetary cost for most normal purposes. A >> combination of a proof-of-work stamp (such as hashcash) and a >> proof-of-identity signature would also serve a useful rate-limiting >> purpose. Again, it's up to the recipient to decide how strong a >> guarantee he requires before a mail can land in his inbox. > > The problem, again, is that both "proof of work" and "proof of > identity" are... JUST like E-postage... subject to being > subverted/stolen by spammers. The army of spammer zombies out there > have a collective computing power FAR greater than that of ALL the > legitimate E-mail publishers. So that scheme simply doesn't work. Take a look at the numbers I worked out, with commentary, in the discussion with "der Mouse". The gist of it is that while zombies can indeed be turned into hashcash factories, they will still be limited to a tiny fraction of what they'd normally be capable of if they were just limited by bandwidth. So it improves the situation dramatically when compared to the status quo. And that's while keeping the bit count low enough to run on Aunt Tillie's prehistoric Mac IIcx. If we forget about the IIcx and concentrate on Pentium-class customers, the rate limit gets even tighter. > And likewise, "identified" systems can be taken over by zombies. So > neither of these schemes work. Period. If an identification is compromised, a few spams will get through to particular recipients who have it on their whitelist, but the recipients will know exactly who needs to be told about it, and can remove the appropriate whitelist entries until it gets fixed. Without the whitelist, the identification becomes moot, as the filter will fall back on other schemes. >> (At the moment, most recipients' barriers to entry are exceptionally >> low, even with today's content filters, because there's no practical, >> universal way to detect forged mail.) > > Detecting "forged" mail, while arguably nice to know, only tells you > whether mail is (probably) forged. It doesn't tell you EITHER that > the mail is, or that it is not, spam. Do I want forged mail in my inbox? No, because whoever sent it can't be trusted to even say who he is. End of discussion. > [...] Likewise, they in general don't know who the intended recipient > might have whitelisted, so they don't know either which machines > they'd need to infect (or what From addresses they'd have to > counterfeit) in order to get their spam through to that specific > recipient. Stop. Think. How do mass-mailing worms usually find machines to infect? They scan the latest victim's address book. Then they send infected mail using every combination of addresses they can think of from that list. Chances are good, a lot of these people know each other and maybe even trust each other to send attachments once in a while. Add just a tiny bit of social engineering, and you have a fresh zombie. The same logic applies to spam. Chances are, a lot of people in the address book will be in each others' whitelists. > And the biggest problem confounding most antispam approaches, the > spambot zombie, is virtually eliminated as a threat (at least for > E-mail transmission) by my approach's default of not allowing > executable attachments from non-whitelisted (TO SEND EXECUTABLES!) > senders. Again, note that typical users will normally not whitelist > ANYBODY AT ALL to send them executable attachments! Executable attachments are old news. Every ISP with a clue already blocks them. The new threat is ZIP archives! Even better, they're polymorphic, password-encrypted ZIP archives that are hard to scan with antivirus programs! Tell me, how do these fit into your brilliant scheme? Don't forget that these ZIP archives are often apparently coming from people the recipient trusts, and probably has in their whitelist... -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 09:31:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA19455 for ; Mon, 26 Apr 2004 09:31:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI61A-0005Rp-GQ for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 09:19:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QDJSZT020936 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 09:19:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI5wk-0004Cl-OD for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 09:14:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA18603 for ; Mon, 26 Apr 2004 09:14:51 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI5wj-0005ps-AP for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:14:53 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI5vr-0005oK-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:14:00 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI5vN-0005mJ-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:13:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI5nG-0000rh-TH; Mon, 26 Apr 2004 09:05:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI5bn-00070g-Fh for asrg@optimus.ietf.org; Mon, 26 Apr 2004 08:53:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA16837 for ; Mon, 26 Apr 2004 08:53:12 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI5bl-00040L-SR for asrg@ietf.org; Mon, 26 Apr 2004 08:53:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI5ak-0003oO-00 for asrg@ietf.org; Mon, 26 Apr 2004 08:52:11 -0400 Received: from navgwout.symantec.com ([198.6.49.12]) by ietf-mx with esmtp (Exim 4.12) id 1BI5YV-0003MZ-00 for asrg@ietf.org; Mon, 26 Apr 2004 08:49:51 -0400 Received: from navgwout.symantec.com (localhost [127.0.0.1]) by navgwout.symantec.com (8.11.7p1+Sun/8.11.7) with SMTP id i3QCnK126381 for ; Mon, 26 Apr 2004 05:49:21 -0700 (PDT) Received: from uscu-smtpob01-1.symantec.com ([155.64.74.130]) by navgwout.symantec.com (SAVSMTP 3.1.2.35) with SMTP id M2004042605492005730 for ; Mon, 26 Apr 2004 05:49:20 -0700 In-Reply-To: <20040426070702.22451.18695.Mailman@www1.ietf.org> MIME-Version: 1.0 X-MIMETrack: S/MIME Sign by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 6.0.2CF1|June 9, 2003) at 04/26/2004 08:49:09 AM, Serialize by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 6.0.2CF1|June 9, 2003) at 04/26/2004 08:49:09 AM, Serialize complete at 04/26/2004 08:49:10 AM, S/MIME Sign failed at 04/26/2004 08:49:10 AM: The cryptographic key was not found, S/MIME Sign by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 6.0.2CF1|June 9, 2003) at 04/26/2004 08:49:14 AM, Serialize by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 6.0.2CF1|June 9, 2003) at 04/26/2004 08:49:14 AM, Serialize complete at 04/26/2004 08:49:14 AM, S/MIME Sign failed at 04/26/2004 08:49:14 AM: The cryptographic key was not found, Serialize by Router on USCU-SMTPOB01-1/GLOBE-ADMIN/SYMANTEC(602CF1HF35 | July 14, 2003) at 04/26/2004 05:49:20 AM, Serialize complete at 04/26/2004 05:49:20 AM To: asrg@ietf.org X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003 From: Richard Willey Message-ID: Content-Type: text/plain; charset="US-ASCII" Subject: [Asrg] E-Postage, Micropayments, and layering violations Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 08:49:18 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 While the great debate regarding e-postage and micropayments is certainly amusing to watch, it doesn't seem to be accomplishing very much. I would like to humbly make the following suggestion: 1. An E-Postage system represents a specialized type of Micropayment architecture. 2. Micropayment architectures have an enormous number of uses above and beyond E-Postage systems. 3. The mailing list should not focus on implementing its own Micropayment architecture, but rather: (a) Determine whether a working micropayment architecture would represent a feasible solution to SPAM (b) Determine whether an E-Postage system would create a unique set of requirements for a working micropayments architecture. (c) Attempt to ballpark a set of parameters that describe the boundary conditions necessary to make an E-Postage system feasible. For example, (i) Transaction costs must be less than X (ii) The system must scale to support Y requests (iii) Peak load over time can be modelled by equation Z Personally, I started life as an academic economist. As such, I am very biased in favor of user fees. E-Postage seems like the best way to proceed, but I have no illusions that that this list is going to develop a workable architecture. Ultimately, I very much hope that ISPs are forced to adopt business models based on charging for bandwidth and bursting. I would even go so far as to argue that consumers have a vested interest in adopting point-to-point encryption to destroy the ability of the ISPs subsidize bandwidth with "value added services" However, that;s an argument for another day. Richard Willey Strategic Marketing Symantec Corporation Office: (408) 517-7740 Interoffice: 6 [408] 7740 Mobile: (408) 410-7112 : Hail Ants _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 09:46:06 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA20140 for ; Mon, 26 Apr 2004 09:46:05 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI6Hp-0002wW-2X for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 09:36:41 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QDafuA011308 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 09:36:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI6EG-00029n-38 for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 09:33:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA19538 for ; Mon, 26 Apr 2004 09:32:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI6EE-0006x9-6G for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:32:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI6DG-0006ug-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:31:58 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI6Co-0006sX-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:31:30 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI61h-0005Wf-9J; Mon, 26 Apr 2004 09:20:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI5wj-0004Cf-El for asrg@optimus.ietf.org; Mon, 26 Apr 2004 09:14:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA18598 for ; Mon, 26 Apr 2004 09:14:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI5wh-0005pj-QX for asrg@ietf.org; Mon, 26 Apr 2004 09:14:51 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI5vq-0005o3-00 for asrg@ietf.org; Mon, 26 Apr 2004 09:13:58 -0400 Received: from sierra.rtfm.com ([198.144.203.251]) by ietf-mx with esmtp (Exim 4.12) id 1BI5v8-0005j8-00 for asrg@ietf.org; Mon, 26 Apr 2004 09:13:15 -0400 Received: from romeo.rtfm.com (romeo.rtfm.com [198.144.203.242]) by sierra.rtfm.com (Postfix) with ESMTP id 7503671B5; Mon, 26 Apr 2004 06:14:27 -0700 (PDT) Received: by romeo.rtfm.com (Postfix, from userid 556) id A89AE44AE7; Mon, 26 Apr 2004 06:12:42 -0700 (PDT) To: der Mouse Cc: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage Reply-To: EKR References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> <200404260250.i3Q2oLi01823@panix5.panix.com> <200404260431.AAA09210@Sparkle.Rodents.Montreal.QC.CA> From: Eric Rescorla In-Reply-To: <200404260431.AAA09210@Sparkle.Rodents.Montreal.QC.CA> (der Mouse's message of "Mon, 26 Apr 2004 00:12:25 -0400 (EDT)") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) XEmacs/21.4 (Reasonable Discussion, berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 06:12:42 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable der Mouse writes: > Of course, it still suffers from the usual problems endemic to all > hashcash, notably the very wide variety in CPU speeds out there. > J.=A0Random=A0Hacker in Outer Slobbovia running on a half-lung salvaged > 68020 will be utterly blocked by hashcash values high enough to be even > noticed by Evil=A0Q.=A0Spammer's late-model 8-CPU 18GHz Hexium. One response to this has been to try to design functions that are less dependent on processing power and more dependent on stuff that's less variable.=20 See, e.g., http://citeseer.ist.psu.edu/context/2125750/0 http://citeseer.ist.psu.edu/554568.html That said, I seem to remember hearing that there have been problems with these functions, though I don't track the field that carefully... -Ekr _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 10:11:28 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA22141 for ; Mon, 26 Apr 2004 10:11:28 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI6iv-0005vT-2l for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 10:04:41 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QE4fbV022762 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 10:04:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI6cW-0001KL-Ni for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 09:58:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA20874 for ; Mon, 26 Apr 2004 09:57:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI6cS-0000gx-W5 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:58:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI6bW-0000cg-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:57:02 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI6aY-0000XY-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 09:56:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI6Rq-0006l4-3E; Mon, 26 Apr 2004 09:47:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI6Nr-0004so-OI for asrg@optimus.ietf.org; Mon, 26 Apr 2004 09:42:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA19977 for ; Mon, 26 Apr 2004 09:42:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI6No-0007Ri-4y for asrg@ietf.org; Mon, 26 Apr 2004 09:42:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI6Mz-0007QS-00 for asrg@ietf.org; Mon, 26 Apr 2004 09:42:01 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BI6MA-0007Oa-00 for asrg@ietf.org; Mon, 26 Apr 2004 09:41:11 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BI6M9-0005sT-9X for asrg@ietf.org; Mon, 26 Apr 2004 14:41:09 +0100 Mime-Version: 1.0 (Apple Message framework v613) In-Reply-To: References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> <200404260250.i3Q2oLi01823@panix5.panix.com> <200404260431.AAA09210@Sparkle.Rodents.Montreal.QC.CA> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Message-Id: <5FAF692C-9787-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: quoted-printable From: Jonathan Morton Subject: Re: [Asrg] My take on e-postage To: asrg@ietf.org X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 14:41:08 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable >> Of course, it still suffers from the usual problems endemic to all >> hashcash, notably the very wide variety in CPU speeds out there. >> J.=A0Random=A0Hacker in Outer Slobbovia running on a half-lung = salvaged >> 68020 will be utterly blocked by hashcash values high enough to be=20 >> even >> noticed by Evil=A0Q.=A0Spammer's late-model 8-CPU 18GHz Hexium. > > One response to this has been to try to design functions that are > less dependent on processing power and more dependent on stuff > that's less variable. > > That said, I seem to remember hearing that there have been > problems with these functions, though I don't track the > field that carefully... The main one I remember (offhand) is something using memory bandwidth=20 rather than core. The problem with that is anything with a large=20 enough working set to swamp the 2MB and 4MB on-die caches that are now=20= appearing, will simply not run on my Mac IIcx with only 8MB *total*=20 RAM. And the spammers can always splurge for a big IBM POWER5 workstation=20 with 8MB on-module L2 cache (4 dies per module, 2MB per die) and insane=20= amounts of L3 cache. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 11:29:35 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27128 for ; Mon, 26 Apr 2004 11:29:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7ru-0005v6-69 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 11:18:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QFI2iE022750 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 11:18:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7lE-0003cB-LF for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 11:11:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26107 for ; Mon, 26 Apr 2004 11:11:04 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI7lB-00057m-VV for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 11:11:06 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI7k4-000536-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 11:09:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI7j9-0004zK-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 11:08:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7bU-00019P-2W; Mon, 26 Apr 2004 11:01:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7Wb-00089W-UO for asrg@optimus.ietf.org; Mon, 26 Apr 2004 10:56:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA25490 for ; Mon, 26 Apr 2004 10:55:57 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI7WZ-0004Hz-DG for asrg@ietf.org; Mon, 26 Apr 2004 10:55:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI7Vl-0004FG-00 for asrg@ietf.org; Mon, 26 Apr 2004 10:55:09 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BI7Up-0004Bu-00 for asrg@ietf.org; Mon, 26 Apr 2004 10:54:11 -0400 Received: (qmail 10819 invoked by uid 100); 26 Apr 2004 14:54:10 -0000 Message-ID: <20040426145410.10818.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] E-Postage, Micropayments, and layering violations In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Cc: richard_willey@symantec.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 26 Apr 2004 14:54:10 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >3. The mailing list should not focus on implementing its own Micropayment >architecture, but rather: > >(a) Determine whether a working micropayment architecture would represent >a feasible solution to SPAM >(b) Determine whether an E-Postage system would create a unique set of >requirements for a working micropayments architecture. >(c) Attempt to ballpark a set of parameters that describe the boundary >conditions necessary to make an E-Postage system feasible. ... ... which remains entirely hypothetical since nobody has any idea how to build a micropayment system within a couple of orders of magnitude of what you'd need for any plausible e-mail system. The unique requirement is be that the vast majority of attempted transactions would be bogus which rules out a lot of statistical approaches, but it's the scale that's the killer. >Ultimately, I very much hope that ISPs are forced to adopt business >models based on charging for bandwidth and bursting. ISPs do charge for bandwidth. My ISP charges more for a full T1 than for a fractional T1. DSL connections come in different sizes where you pay more for a faster connection. Above T1 you also get burst charges. On the other hand, at the retail level, the trend has always been toward flat rates, just like it has been in every other even vaguely comparable service. See Andy Odlyzko's papers on this subject. Underlying IP bandwidth isn't the problem. The total amount of mail that my users send every day is far less than a single (legal) MP3 download from my web server. I agree that we need some sort of rate limiting for mail, but I'd rather address rate limiting directly than try to invent elaborate indirect systems that we hope will rate limit as a side effect. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 11:30:10 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA27277 for ; Mon, 26 Apr 2004 11:30:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7t1-0006RB-BM for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 11:19:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QFJBE5024741 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 11:19:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7pV-0004n4-2X for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 11:15:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26302 for ; Mon, 26 Apr 2004 11:15:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI7pP-0005NC-8C for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 11:15:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI7o6-0005Ka-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 11:14:07 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI7no-0005Hf-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 11:13:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7bV-00019r-If; Mon, 26 Apr 2004 11:01:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI7Xb-0008HX-VZ for asrg@optimus.ietf.org; Mon, 26 Apr 2004 10:57:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA25528 for ; Mon, 26 Apr 2004 10:56:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI7XZ-0004L3-Fb for asrg@ietf.org; Mon, 26 Apr 2004 10:57:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI7Wd-0004Ib-00 for asrg@ietf.org; Mon, 26 Apr 2004 10:56:03 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BI7WG-0004Fp-00 for asrg@ietf.org; Mon, 26 Apr 2004 10:55:40 -0400 Received: (qmail 11365 invoked by uid 100); 26 Apr 2004 14:55:39 -0000 Message-ID: <20040426145539.11364.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage In-Reply-To: <841979D0-974E-11D8-A46E-000393863768@chromatix.demon.co.uk> Organization: I.E.C.C., Trumansburg NY USA Cc: chromi@chromatix.demon.co.uk Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 26 Apr 2004 14:55:39 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 > Assuming spammers can build 4-way boxes out of these, how many > boxes will they need to fill a T1 to capacity, the way they used to? > Assuming a 5KB spam size, about 7500 of them. Is this economically > feasible for the spammer? You tell me. Of course it is. They infect 10,000 new zombie PCs every day. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 13:18:12 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03911 for ; Mon, 26 Apr 2004 13:18:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI9gg-0002bi-91 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 13:14:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QHEYEn010014 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 13:14:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI9YR-00006O-VJ for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 13:06:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03057 for ; Mon, 26 Apr 2004 13:05:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI9YQ-0006H0-50 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 13:06:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI9Xc-0006DI-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 13:05:13 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BI9Wg-00069Z-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 13:04:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI9Oj-00057Q-QJ; Mon, 26 Apr 2004 12:56:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI9A3-0000jw-E0 for asrg@optimus.ietf.org; Mon, 26 Apr 2004 12:40:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA01562 for ; Mon, 26 Apr 2004 12:40:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI9A1-0004OI-Qj for asrg@ietf.org; Mon, 26 Apr 2004 12:40:49 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI98q-0004Es-00 for asrg@ietf.org; Mon, 26 Apr 2004 12:39:37 -0400 Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx with esmtp (Exim 4.12) id 1BI97i-000410-00 for asrg@ietf.org; Mon, 26 Apr 2004 12:38:26 -0400 Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id i3QGbmN19674 for ; Mon, 26 Apr 2004 12:37:48 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JCWQMD0A; Mon, 26 Apr 2004 12:37:49 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.65]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JM9F46PP; Mon, 26 Apr 2004 12:37:48 -0400 Message-ID: <408D3ADB.8040403@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage References: <20040426145539.11364.qmail@xuxa.iecc.com> In-Reply-To: <20040426145539.11364.qmail@xuxa.iecc.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 12:37:47 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit John Levine wrote: >> Assuming spammers can build 4-way boxes out of these, how many >>boxes will they need to fill a T1 to capacity, the way they used to? >>Assuming a 5KB spam size, about 7500 of them. Is this economically >>feasible for the spammer? You tell me. > Of course it is. They infect 10,000 new zombie PCs every day. Multiply that by 6. We're seeing 65,000 - 70,000 zombie detections per day, and the daily detection count is still trending upwards. 80% of spam detected by this method (it's catching approximately 65-70% of all of our spam) is coming from detections less than 4 days old. 90% < 6 days old. 95% < 12 days old. Are we having fun yet? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 14:04:15 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06194 for ; Mon, 26 Apr 2004 14:04:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAD6-00057Q-8V for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 13:48:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QHm45a019671 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 13:48:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIA7x-0000Vi-Hv for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 13:42:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05005 for ; Mon, 26 Apr 2004 13:42:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIA7v-00016E-4V for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 13:42:43 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIA6s-0000wU-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 13:41:41 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIA5i-0000nB-01 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 13:40:27 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BI9vo-0005tp-6d for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 13:30:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI9k3-00046n-Qg; Mon, 26 Apr 2004 13:18:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BI9fL-0002Mz-S0 for asrg@optimus.ietf.org; Mon, 26 Apr 2004 13:13:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03597 for ; Mon, 26 Apr 2004 13:13:09 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BI9fJ-0006w2-Pu for asrg@ietf.org; Mon, 26 Apr 2004 13:13:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BI9ed-0006sR-00 for asrg@ietf.org; Mon, 26 Apr 2004 13:12:30 -0400 Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx with esmtp (Exim 4.12) id 1BI9dl-0006k6-00 for asrg@ietf.org; Mon, 26 Apr 2004 13:11:33 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc11) with SMTP id <2004042617105701100paml6e>; Mon, 26 Apr 2004 17:10:57 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Mon, 26 Apr 2004 12:09:19 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Mon, 26 Apr 2004 12:19:39 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] Re: Asrg] My take on e-postage To: asrg@ietf.org Cc: chromi@chromatix.demon.co.uk X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 12:19:39 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> I've specifically mentioned HTML and attachments, but a similar > control might be > that a recipient might want to limit the ability of non-whitelisted > senders to > (say) drop messages bigger than a certain SIZE into their Inbox, too. > If > someone is going to be gone on a cruise for a week or two... >> I don't think that recipients really give even a half-hoot about > stamps. What > they have is a limited resource (Inbox, and their time!), and they > typically > want to restrict WHO has access to it, or (if they're a newcomer) how > much space > they can use until the recipient has decided whether or not to grant > them more. > That's also an interesting way of looking at the problem, Thanks. The biggest problem with unrestricted sending is that one's inbox fills up and mail starts bouncing. THAT creates HUGE problems for (at least many) people. > ...but it can already be handled without extra standards. Sure, and my solution doesn't really require "standards" either, since by its nature it is single-ended. > Perhaps someone could write something to hook into procmail, and/or write a BCP. I guess I really need to find out more about BCP documents. What does it take to write them, is there a particular format they must adhere to, and where must they be submitted for review/distribution/archiving/etc? >>> In a recipient-driven scheme, senders still have to be able to buy >> stamps, but they will be able to choose their stamp vendor, rather >> than being limited to their ISP. >> Stamps are stupid and cumbersome. I agree with those who point out > that the > purpose is to limit sending rate and volume, and that there must be > easier and > less complicated/expensive/disadvantageous ways to do that. > Without attaching *some* new piece of information to the mail itself, the only even partial solution I can see is rate-limiting by the sender's ISP. And that implies that the ISP treats E-mail as a special case, and/or forces originators within their network to use the ISP's mail servers (which many of us REALLY do not want to do). In my case, for example, I'd really rather use the mail server provided by DomainDirect (my domain provider for terabites.com, and indeed for all the domains I provide for my consulting clients) rather than the one provided by comcast.net. It simply looks more professional to have my server be "mail.terabites.com" or "smtp.terabites.com" than "dfw.comcast.net" or whatever. And of course, there's also the issue about braindead SPF-type schemes which try to FORCE users to use mail server IP addresses which are coherent with the From: address... if I'm going to use my terabites.com E-mail address, then I would not be able to do that from my comcast.net-provided SMTP server. One interesting-sounding alternative approach is to MAKE SURE that any Web site being promoted by the spam gets LOTS AND LOTS of hits... for example, by having EVERY recipient of the spam auto-generate hits against the Web sites being promoted. (The result is essentially a DDOS attack against the spammer's site!) The problem with that approach, as fun as it initially sounds, is that it's far too easy for the spammer to use that mechanism to "joe-job" someone else. > Which isn't happening, in general. And for a number of good reasons, including that in general they don't have any ready way to control what is and isn't E-mail... and to decide what you count and what you don't. Do copies count as much as original destination addresses? How about bcc copies? What about mails sent to forwarding services or mailing lists (or zombies, for that matter)? It's ultimately pretty easy to evade such schemes. > Only a few ISPs - the most savvy and network-oriented (as opposed to revenue-oriented) - seem to have any mechanism to detect and deal with zombies. It's very hard to deal with in any definitive way. How do you distinguish whether outgoing mail from a normally-reputable system is really still legitimate? >>> There's always going to be a zombie-PC problem, to some extent at >> least. >> Thanks for also pointing that out. That is in fact the KEY problem, > at least using present-day spammer approaches. > Hold onto that thought. > Why did spammers start using zombies? Because we got good at blacklisting by IP address. That, plus they simply decided that it was silly for them to use their OWN resources for spamming, when it was so easy to steal resources from other people. > Why did we blacklist by IP address, rather than whitelist by e-mail address? Because we didn't have any strong authentication method that was widely used - and we still don't. Well, not really. A salesman who hands out thousands of business cards a year (or a company which posts a customer service e-mail address on the labels of their products) is EXPECTING to get mail from people they haven't whitelisted... just as publishing your telephone number in the phone book is done PRECISELY SO THAT you can be called by people you haven't given your phone number to, personally (and thus 'whitelisted'). Normal whitelisting schemes generally don't allow you to get mail from people not yet on your whitelist. Blacklisting IP addresses, on the other hand, allowed us to block known-bad open relays and other familiar sites that spammers were massively misusing. This fixation on "authentication" and forged From addresses is really dumb because it really does NOT solve the problem. (NEITHER the spam problem NOR the worm/virus problem). It's really just a diversion chewing up a lot of engineering time and standards committee effort which ultimately isn't going to be effective for the stated purpose. >> There's NOTHING inherently more secure about the Mac, other than the > fact that > it's a distinctly second-string system in terms of frequency and > therefore > hackers haven't focused their attention on it. If everyone were > running Macs, > or everyone were running Linux, then hackers would be writing Mac or > Linux worms > instead, and they'd be comparably successful. >> Note that (just recently) a multi-university "distributed > supercomputer cluster" > of *nix-based boxes was penetrated by hackers, much to the chagrin of > the > associated administrators. And THAT was a system which DID have savvy, > highly-intelligent-and-qualified admins AND expensive, > professional-grade > systems and "serious" OSes. > The difference is that the cluster was hacked by a determined, "professional" cracker in an isolated incident. The Wintel zombies are being compromised by what we used to call "script kiddies" using mass-market exploits, via vulnerabilities that were either known (and were patched) long before, or social engineering coupled with poor OS design. Most spammers are NOT casual "script kiddies" working out of their dorm room just on a lark. Hackers, maybe, are of that ilk.... but not spammers. Spammers are generating REAL MONEY by their antisocial behavior, and are plenty ready to use any techniques they can to continue doing so. It took concerted, ongoing court actions over many years to put Spamford Wallace out of the business. I still contend that Macs and *nix boxes are generally just as vulnerable, and are only "safer" because they're less numerous and thus less attractive targets for spammers and hackers to go after. > While the Mac and Linux are not perfect, they do lack many of the fundamental design flaws that make Windows such a soft target. Microsoft has gotten the message, and their new systems are going to be substantially harder to break into. We're just starting to see the results of those changes. Regardless, the fact is that the ultimately secure system has never been created (despite billions of dollars spent by the military over several decades trying to do so) and if we ever DID create such a beast, it probably wouldn't be good for much of anything. > Linux MUAs are largely incapable of creating an executable file on their own, Who or what says the MUA has to do it? > ...and have to be deliberately coaxed into expanding a tarball in such a way. Apple Mail isn't quite as mistrustful, but it's generally clear to a Mac user what is an executable and what isn't. Mac and Apple are largely RESPONSIBLE for much of the problem. They are the ones who created and pushed the idea of hiding file extensions and file types, and for dumb users to "just click on everything" [blindly!] to make it do something. >>> A problem is that zombies can't merely be used as a relay, they can >> also be used to leech any stamp account the victim uses for their own >> e-mail. >> Absolutely. And that's why _all_ of these modified-DNS, SMTP-auth, > SPF, > certificate, E-postage, and similar such systems are ALL simply > non-starters. > NONE of them solve the problem, because zombie enlistment will enroll > legitimate > (trusted, legitimate) systems to serve spammers. > Then how do you propose to get rid of the zombies? I thought we just agreed they were always going to be a problem. One major move towards getting rid of them, as I've stated repeatedly, is to restrict (by default, at least) incoming attachments (by several classes of risk and danger) to only specified, recipient-approved senders. That would (at a minimum) virtually eliminate E-mail attachments as a vector for spambot zombie worms, since the great majority of recipients probably wouldn't accept executable-type attachments from ANYBODY AT ALL. > If the resource being leeched is controlled by a third party, however, it's easier to monitor and take action on suspicious behaviour. That's like saying that there ought to be somebody (FBI?) monitoring and pursuing stuff like Nigerian spam. If there really were, then why in the hell does this crap keep going and going? Why don't they round up these scum and put them all out of business? There can't POSSIBLY be THAT many of them. The fact seems to be that the third parties that are supposed to be protecting the public simply are NOT doing their job. > This is why e-postage can be helpful - as I mentioned immediately afterwards, the compromised account will quickly run dry. As has been repeatedly stated (and just as repeatedly ignored) there is NOTHING about E-postage and requiring money and payments that can't be achieved without money or payments entering into it. For that matter, you could even GIVE away the "stamp" that the sender would need to use. For instance, when you give someone your E-mail address (at your Web site, on your business card, whatever) simply tell them to "put 17XyZ in the subject line somewhere, otherwise your mail won't be delivered to me." Everyone would present the key in a different way, complicating address (and key!) harvesters. This could then be used in conjunction with a permissions whitelist such as I've proposed... you can whitelist people (mailing lists, for example) that don't need to include the passkey, but non-whitelisted senders (that still could be restricted against sending HTML-burdened mail or attachments of various kinds) might also have to have one of the recognized passkeys in the subject line somewhere. >>> However, the compromised stamp account will quickly either become >> empty or run up a monstrous bill on the victim's credit card (the >> former situation is obviously preferable, and I'd hope that consumer >> stamp accounts were set up that way). >> Either way, there's going to have to be a procedure (probably > involving per$onnel) to deal with that $ituation when it (frequently) > develop$. > Of course. Education is vital! That type of "education" is brutal and ineffective. Ultimately, what happens when people run up (via worms etc) thousands of dollars of phone bills to Moldavian 900-number dialup accounts is that the phone companies end up getting stiffed, but not before they spend hundreds or thousands of dollars worth of time trying to deal with the mess. > Perhaps, to save personnel costs, ISPs (especially those who are also stamp vendors) will start throwing in antivirus software, easy-to-use personal firewalls, and even (wow!) day classes for net-newbies. And who do you believe will pay for all of that stuff? Not the spammers, that's for sure. And when are busy people going to make time to attend those classes? Get real. >> Taking the "Harry Hardass" approach ("well, that's just too frickin' > bad, maybe you'll learn next time to not let your system get > infected!") will end up eventually driving a lot of people offline > that *need* to be online. This kind of thing will eventually become a > NIGHTMARE, and a costly one to boot. I really don't see it as a > practical solution. > ISPs that take that kind of attitude probably deserve to lose customers. As do the ones that simply pass on the high costs of these ill-conceived and ultimately ineffective "anti-spam" solutions...! > The *right* approach is to offer advice on how to clean up and secure their machine, and how to avoid future infections. And maybe a Web site could help teach people that, but there are plenty of sites with that information available today and lots of people that just don't find it, or care enough to take it to heart. Meanwhile, ISPs that ought to know better (such as AOL, with perhaps the highest ratio of "clueless newbies" of anyone) are among the WORST by virtue of promoting the pointless and gratuitous use of HTML-burdened E-mail!!! > It's not really all that hard, and they could even print a leaflet about it with step-by-step instructions. And who will pay for THAT? Again, not the spammers. >>> After that, the zombie can still spew mail all over the place, but it >> will be unstamped. The empty account (or huge bill) also serves as a >> wake-up call to the victim, to get their machine cleaned and secured. >> Fine, but again, meanwhile, you're going to have lots and lots of > spam. And for every spambot zombie that you clean up, the spammer > will create two new ones. > Unstamped spam isn't going to get into the inboxes of participating recipients - that's the whole point. There are more than enough stamps to go around, and plenty of infected zombies to "steal" stamps from. > Once woken up, the victim might be one less person to get re-infected in the future, Nice thought, but.... > ...so perhaps the endless supply of zombies will get less plentiful in the future. In fact, experience demonstrates otherwise... people who get infected by worms and viruses tend to get infected over and over again. And this isn't just about computing... consider folks in the hospital for life-threatening emphysema, who still insist that they have a 'right' to keep smoking. > At the moment, there's little or no feedback to victims, so they don't learn anything. It's not just a "learning" thing, they have to CARE. And many, simply, do not. >>> The interesting thing is that a stamp can also act as proof of where >> the mail was sent from, and/or who by, because there's a money trail >> (if nothing else) to follow, and each stamp is unique. >> Again, I think this is one of those "it seems like a step in the right > direction" things, like SPF, that ultimately doesn't really answer the > spam problem in a meaningful way. > ...but it's not actually a *bad* thing, is it? Anything that increases costs and doesn't solve the problems it's claimed to solve (or at least comprise a major step in right direction, and without significant counterbalancing negatives) is "a *bad* thing", IMHO at least. >> Forgery detection sounds fine, and I suppose that you could even just > build your > OWN statistical table based on IP addresses that you've seen in the > headers of > valid E-mails coming from whitelisted senders, but again that fails > dramatically > when the "valid" non-forged sender gets infected and starts sending > spams with > valid return addresses. > But in that case, you know who's sending it, so you can block them temporarily and help them fix it. Do YOU intend to go around cleaning up other people's messes? *I* don't have the time for that, as a general rule. I do it for my consulting clients, but then again THEY *pay* me for that. :-) >> I think that one can forego trying to detect forgeries, actually, as > long as you have a good way to detect spams based on their CONTENT. > But we don't. If we did, we'd be able to stop spam, NOW, just by slapping one of these perfect filters on the front of our inbox. You really haven't been paying attention, have you? There are a number of familiar tricks and evasions that spammers use which frustrate and confound antispam content filters. One of them is 'text as image' which would require OCR software or something (at least) to decipher the content of the mail message. Another is obscuring the content by HTML tricks (bogus tags, scripted decryption, misrepresented links, font and color tricks, obscured non-canonical URLs, and so forth ad infinitum). Denying the spammer those tricks and evasions makes it VERY VERY MUCH EASIER for effective and practical antispam content filters to do their job. But also let's recognize that when dealing with the question of antispam content filters, "good" might be quite adequate, even if they're not 100% "perfect". It wouldn't really bother me TOO much if a spam or two got through my filter, say once a week or once or twice a month. And there are a number of apparently "good" antispam content-based filters out there. They will be BETTER once the attachment/HTML issues are resolved. > Here's some news: we already do use content filters - everything from Bayes through distributed bulk detectors to phrase matching. It helps, but it is absolutely nowhere near perfect. Doesn't have to be perfect. Most importantly, we need to be able to have techniques which evolve as spammers get more devious. SpamAssassin is a good start, at least in terms of what it apparently does (I'd probably be less impressed about the language it's likely written in). >> E-postage is cumbersome, costly, and very labor-intensive to deal with > the problems that would inevitably result from it. > Some of the proposed schemes undoubtedly are. Have you read the discussion I've been having with "der Mouse" over the past day or so? Sure. > I think we've hashed out something a lot more scalable than most, though I won't pretend it's finished. Many schemes and objections seem to assume, for example, that stamps have to be anonymous like e-coins - which makes them unreasonably hard to verify. I simply think they're (still!) cumbersome and inconvenient, and don't really solve the problem. > ...The gist of it is that while zombies can indeed be turned into hashcash factories, they will still be limited to a tiny fraction of what they'd normally be capable of if they were just limited by bandwidth. There are SO MANY zombies (and spammers can make about as many more as they want) that for all intents and purposes they have no genuine limits to EITHER computing power, OR bandwidth. > So it improves the situation dramatically when compared to the status quo. So what happens to companies (say, like Yahoogroups) that (legitimately) sends out probably billions of E-mail messages a day? Sorry, I truly don't like ideas that make sending (legitimate!) E-mails significantly more expensive. ULTIMATELY, we LEGITIMATE users have to pay the price for that... spammers won't pay it, that's for sure. > And that's while keeping the bit count low enough to run on Aunt Tillie's prehistoric Mac IIcx. If we forget about the IIcx and concentrate on Pentium-class customers, the rate limit gets even tighter. Sorry, I don't like junk like that. It's a lot like schemes that used to count on slower processors and which then fail when timing loops (say in device drivers) time out far faster than they were ever supposed to. >> And likewise, "identified" systems can be taken over by zombies. So > neither of these schemes work. Period. > If an identification is compromised, a few spams will get through to particular recipients who have it on their whitelist, but the recipients will know exactly who needs to be told about it, and can remove the appropriate whitelist entries until it gets fixed. You don't have to have stamps or authenticated IDs to achieve that. All you need is a multilevel address scheme, or (barring that) even just the "free stamp" passcode thing in the subject line as I discussed earlier. (A new header line would work just as well, if you didn't want to use the subject line for it.) > Without the whitelist, the identification becomes moot, as the filter will fall back on other schemes. We agree that whitelisting and filtering are key parts of the solution, anyhow. >>> (At the moment, most recipients' barriers to entry are exceptionally >> low, even with today's content filters, because there's no practical, >> universal way to detect forged mail.) >> Detecting "forged" mail, while arguably nice to know, only tells you > whether mail is (probably) forged. It doesn't tell you EITHER that > the mail is, or that it is not, spam. > Do I want forged mail in my inbox? No, because whoever sent it can't be trusted to even say who he is. End of discussion. So let's say that we stop all forged or bogus from addresses. BFD. Spammers change (overnight) to use "real" return addresses. There, are you happy now? (Really... THINK about the implications...) Again, you've probably made the problem WORSE, rather than better. >> [...] Likewise, they in general don't know who the intended recipient > might have whitelisted, so they don't know either which machines > they'd need to infect (or what From addresses they'd have to > counterfeit) in order to get their spam through to that specific > recipient. > Stop. Think. How do mass-mailing worms usually find machines to infect? They scan the latest victim's address book. Then they send infected mail using every combination of addresses they can think of from that list. Chances are good, a lot of these people know each other and maybe even trust each other to send attachments once in a while. That doesn't help unless (1) you know what TYPE of attachments the sender is approved to send to a given recipient, _and_ (2) sending that specific type of attachment can be used to the spambot's advantage. > The same logic applies to spam. Chances are, a lot of people in the address book will be in each others' whitelists. Actually, probably not. Most of my correspondents don't send me HTML-burdened E-mail, and fewer still send me attachments. Almost none send me executable attachments! Of those who DO send HTML-burdened E-mail (with my very begrudging approval), basically NONE of those use scripting or ActiveX in their E-mail messages. It's very much mistaken to believe that you have to whitelist everyone you receive E-mail from. You apparently don't really understand my proposal. >> And the biggest problem confounding most antispam approaches, the > spambot zombie, is virtually eliminated as a threat (at least for > E-mail transmission) by my approach's default of not allowing > executable attachments from non-whitelisted (TO SEND EXECUTABLES!) > senders. Again, note that typical users will normally not whitelist > ANYBODY AT ALL to send them executable attachments! > Executable attachments are old news. Every ISP with a clue already blocks them. The new threat is ZIP archives! Even better, they're polymorphic, password-encrypted ZIP archives that are hard to scan with antivirus programs! Antivirus programs are based on the premise that you know all the viruses, which presumption clearly fails for new viruses. > Tell me, how do these fit into your brilliant scheme? Very simple. Since they're potentially carrying extremely dangerous cargo, AND since they're very rarely used for legitimate purposes, you either classify them like you do executable attachments, or you could create a special attachment class for encrypted archives. Then you'd only receive such stuff from people (if any, probably there aren't any) that you had already arranged with and whitelisted to send you that type of stuff. > Don't forget that these ZIP archives are often apparently coming from people the recipient trusts, and probably has in their whitelist... You've completely ignored or misunderstood the nature of my whitelist, it seems. Think of it as more than a binary "whitelist", rather more like a "permissions list". Each whitelisted sender would have your approval to send you certain classes of mutually agreeable HTML and/or attachments, based upon your relationship with that sender. By default, non-whitelisted senders could only send you plain ASCII text E-mails, without any HTML or attachments at all (and those would be subject to further limitations, say a maximum "unknown sender" size limit and (hopefully!) after having passed a good antispam content filter. Think of it more like the type of permissions that an NTFS file system supports... some users can list the filenames in a directory but not access the files, maybe they can't list the filenames but CAN open them (only!) if they know the filename already, maybe they can write a file but not read it, maybe they can read or write a file but not delete or rename it, or whatever. The fact that it's so much more fine-grained than a crude binary "whitelist" means that you can create a very narrow set of rights and permissions for the people you normally deal with, and most spammers or zombies won't understand or be able to figure out the rules, and therefore will have a lot of trouble not running afoul of them and having their spam output t-canned. Does that make more sense now? Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 14:40:09 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09114 for ; Mon, 26 Apr 2004 14:40:09 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAuE-0005zp-1w for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:32:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QIWcHF023044 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:32:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAjv-0003Bf-2I for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 14:21:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07554 for ; Mon, 26 Apr 2004 14:21:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIAjs-0004HE-HZ for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:21:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIAi4-0003z6-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:20:05 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIAfJ-0003QC-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:17:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAUV-0006Aw-6Y; Mon, 26 Apr 2004 14:06:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAIs-0002CO-UR for asrg@optimus.ietf.org; Mon, 26 Apr 2004 13:54:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05830 for ; Mon, 26 Apr 2004 13:53:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIAIq-0001qe-G9 for asrg@ietf.org; Mon, 26 Apr 2004 13:54:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIAHt-0001o0-00 for asrg@ietf.org; Mon, 26 Apr 2004 13:53:02 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BIAH9-0001lc-00 for asrg@ietf.org; Mon, 26 Apr 2004 13:52:15 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BIAH6-0005wU-00; Mon, 26 Apr 2004 13:52:12 -0400 Received: from [68.246.21.183] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BIAH5-0001vh-00; Mon, 26 Apr 2004 13:52:12 -0400 Message-ID: <408D4C3F.8020505@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: gep2@terabites.com CC: asrg@ietf.org, chromi@chromatix.demon.co.uk Subject: Re: [Asrg] Re: Asrg] My take on e-postage References: In-Reply-To: X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 13:51:59 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit gep2@terabites.com wrote: >>Perhaps someone could write something to hook into procmail, and/or write a > BCP. > > I guess I really need to find out more about BCP documents. What does it take > to write them, is there a particular format they must adhere to, and where must > they be submitted for review/distribution/archiving/etc? > > Since this is an IRTF group, BCPs produced by this group go through the IETF standards process which is described in RFC 2026 (http://www.faqs.org/rfcs/rfc2026.html). The process starts by writing up a draft as described here (http://www.ietf.org/ID.html). Approval is done by the IESG and finished documents are archived as RFCs at the RFC Editor's page. Details of the BCP process are described in section 5 of RFC 2026. Reading the Tao of the IETF helps also (http://www.ietf.org/tao.html also published as RFC 3160). If a given document is within the scope of the ASRG and documents the discussions in the group, or is a work of several group members, than the Internet draft that is produced can be published under the ASRG's name as draft-irtf-asrg-xxx. This requires approval from the chairs. Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "Some lies are easier to believe than the truth" (Dune) ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 14:43:18 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09310 for ; Mon, 26 Apr 2004 14:43:18 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAvP-0006J0-1V for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:33:51 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QIXpLk024233 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:33:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIApy-0004fT-D4 for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 14:28:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08116 for ; Mon, 26 Apr 2004 14:28:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIApv-0004xd-Ub for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:28:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIAp0-0004st-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:27:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIAo4-0004oG-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:26:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAi3-0002B9-1k; Mon, 26 Apr 2004 14:20:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAVV-0006Rv-Ja for asrg@optimus.ietf.org; Mon, 26 Apr 2004 14:07:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06290 for ; Mon, 26 Apr 2004 14:07:02 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIAVT-0002Xo-6t for asrg@ietf.org; Mon, 26 Apr 2004 14:07:03 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIAUZ-0002Ut-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:06:08 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BIATw-0002QT-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:05:28 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc12) with SMTP id <20040426180458012002mscve>; Mon, 26 Apr 2004 18:04:58 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Mon, 26 Apr 2004 13:04:11 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Mon, 26 Apr 2004 13:14:30 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Certificates etc Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 13:14:30 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> The nice thing about my approach... don't allow most users > (i.e. those users without a GENUINE, AGREED NEED) to send you > HTML-burdened mails (force the mail to plain ASCII text) and > similarly don't allow most users (other than those you've negotiated > with and approved in advance) to send you attachments (and open that > window, guardedly, for only a few trusted senders and a few specific > attachment types). >> THEN, for the stuff that has gotten through (and where most of the > tricks for obscuring content have been denied to the sender), you > put it through a good content filter which will identify the stuff > as spam if it looks like spam. > There don't seem to be any such content filters that are good enough now; No, largely because HTML and text-as-image (enabled by HTML!) create difficulties for content filters. > ...requiring them as part of your solution doesn't make your solution any more viable. They work TOGETHER. Is that so hard to understand? >> My scheme virtually eliminates spams and worms being sent > successfully (to ME at least) in E-mails, > "virtually"? How do they ever get through? Oh, theoretically, you MIGHT get an executable attachment from some worm which happens (against all odds) to forge (or infect!) an E-mail address that you've actually allowed to send you executable attachments. I agree that it's very unlikely (and, if you don't allow ANY E-mail addresses to send you executable attachments... which will be true for most users... it's essentially impossible.) >> Making that first filtering of the HTML junk happen also greatly > increases the effectiveness of the content filtering of what's left, > since there are very many fewer tricks left available to spammers > and abusers for obscuring the true content of their unwanted > messages. > When it's necessary, they'll find more, just like they always have. Perhaps, but that doesn't preclude the creation of corresponding new "permissions" required to send that type of stuff, if it's happening through E-mail. The point is that you create a MUCH smaller (and much better defended!) target for spammers, that is VERY much harder to hit. I'm not promising that spammers won't find some other way to annoy people, and that to some degree we're not still going to play on ongoing game of "whack a mole". But at least my approach will make it a MUCH harder game for them to play, on several different levels, and will do so by a scheme that it's VERY difficult for them to force their way through from the outside. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 14:51:14 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09862 for ; Mon, 26 Apr 2004 14:51:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIB86-0001BW-Ab for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:46:58 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QIkwTZ004550 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:46:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIB3W-0008VS-DP for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 14:42:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09261 for ; Mon, 26 Apr 2004 14:42:10 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIB3T-00062A-Qr for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:42:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIB2b-0005z6-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:41:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIB2H-0005ul-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:40:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAuc-00063S-6k; Mon, 26 Apr 2004 14:33:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAjz-0003Br-SK for asrg@optimus.ietf.org; Mon, 26 Apr 2004 14:22:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07587 for ; Mon, 26 Apr 2004 14:22:00 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIAjx-0004JU-61 for asrg@ietf.org; Mon, 26 Apr 2004 14:22:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIAiG-00041U-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:20:18 -0400 Received: from sccrmhc13.comcast.net ([204.127.202.64]) by ietf-mx with esmtp (Exim 4.12) id 1BIAfZ-0003Nu-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:17:29 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc13) with SMTP id <2004042618165901600d56n0e>; Mon, 26 Apr 2004 18:16:59 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Mon, 26 Apr 2004 13:16:15 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Mon, 26 Apr 2004 13:26:34 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] E-postage and stamps Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 13:26:34 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> But the recipient Y will be able to tell if he's seen the same stamp twice. That's trivial to deal with, especially since most modern MUAs (well, Eudora and Apple Mail, anyway) index their mail archive already by default. > As for verifying crypto signatures, the public key from the vendor is needed for that, since the vendor issued the stamp. This is, broadly speaking, a one-time operation, which happens after the sender vendor's trustworthiness has been looked up. It's also an operation that could potentially be offloaded on the recipient's vendor, since the recipient is probably going to send the stamp there for reimbursement anyway. This really is amusing in a pitiful sort of way. Other than STILL trying to create the world's biggest micropayments system (which really IS a solution in search of a problem, it seems...) what the hell is the point of worrying about all this? Who needs encryption, who needs single-use detection? My idea where recipients can hand out an assortment of "stamp tokens" for free along with their E-mail address would handle the same issues pretty well. The person sending would need to include at least one recognized "stamp token" either in the Subject line or perhaps in an extra header line somehow. The recipient could have an arbitrary number of "stamp tokens" outstanding and could revoke any or all of them any time they wished. Using nonstandard mechanisms for relating the stamp token required with the E-mail address (and how to present the stamp token) would pretty well invalidate E-mail address harvesters. The recipients' E-mail system could provide a database function to help identify past legitimate mailers who had used the compromised stamp token, to alert them to the changed token. I don't really care in general for the idea of "stamps" but if you're all going to fixate like this on the E-postage concept, then you might as well at least look at other ways to make it harder to send out megatons of E-mail indiscriminately. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 14:59:53 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10357 for ; Mon, 26 Apr 2004 14:59:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIB8p-0001K4-PY for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:47:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QIlhqt005080 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:47:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIB4Q-0000Bs-J2 for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 14:43:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09282 for ; Mon, 26 Apr 2004 14:43:07 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIB4N-000668-U2 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:43:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIB3V-00062c-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:42:14 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIB2x-0005zI-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:41:39 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAuc-00063a-Mz; Mon, 26 Apr 2004 14:33:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAk2-0003Bw-IO for asrg@optimus.ietf.org; Mon, 26 Apr 2004 14:22:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07604 for ; Mon, 26 Apr 2004 14:22:03 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIAk0-0004K5-1P for asrg@ietf.org; Mon, 26 Apr 2004 14:22:04 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIAiU-000437-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:20:31 -0400 Received: from mail1.nber.org ([207.113.108.7]) by ietf-mx with esmtp (Exim 4.12) id 1BIAfp-0003VM-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:17:45 -0400 Received: from mail1 (root@localhost) by mail1.nber.org (8.12.8/8.12.8) with SMTP id i3QIHjve023374 for ; Mon, 26 Apr 2004 14:17:46 -0400 Received: from nber1.nber.org (nber1.nber.org [207.113.108.252]) by mail1.nber.org (8.12.8/8.12.8) with ESMTP id i3QIHjab023360; Mon, 26 Apr 2004 14:17:45 -0400 From: Daniel Feenberg To: Chris Lewis cc: asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage In-Reply-To: <408D3ADB.8040403@americasm01.nt.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 14:17:39 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Mon, 26 Apr 2004, Chris Lewis wrote: > John Levine wrote: > > > 80% of spam detected by this method (it's catching approximately 65-70% > of all of our spam) is coming from detections less than 4 days old. 90% > < 6 days old. 95% < 12 days old. > Can you tell us the number of hosts in each category? And how long hosts remain infected? That would give us an idea of the gross flows into and out of infected status. If spam is proportionate to hosts, then the above figures suggest that 75% of hosts are corrected within 4-6 days. My reasoning is that only 10x more hosts are in the 6 day window than in the 4 day window. So if there are 80x infected hosts in 4 days, that is 20x hosts/day. But in 6 days there are only 90x total infected hosts, or 5x hosts/day for the 2 additional days rather than the expected (steady state) 20x hosts. That suggests that 15x hosts were cleaned up. This would be clear if we knew the number of hosts, so that I didn't need the mystery factor x =spams/(hosts*100) Daniel Feenberg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 15:06:49 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11145 for ; Mon, 26 Apr 2004 15:06:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIBKf-00031r-B1 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:59:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QIxv0H011639 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 14:59:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIBFB-0001yj-N4 for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 14:54:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10059 for ; Mon, 26 Apr 2004 14:54:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIBF8-00071d-QS for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:54:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIBEG-0006xS-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:53:21 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIBDl-0006t2-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 14:52:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIB89-0001Br-OL; Mon, 26 Apr 2004 14:47:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIAwo-0006jY-5T for asrg@optimus.ietf.org; Mon, 26 Apr 2004 14:35:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08782 for ; Mon, 26 Apr 2004 14:35:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIAwl-0005bH-Fs for asrg@ietf.org; Mon, 26 Apr 2004 14:35:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIAvy-0005WD-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:34:27 -0400 Received: from zcars04e.nortelnetworks.com ([47.129.242.56]) by ietf-mx with esmtp (Exim 4.12) id 1BIAvL-0005PH-00 for asrg@ietf.org; Mon, 26 Apr 2004 14:33:47 -0400 Received: from zcard307.ca.nortel.com (zcard307.ca.nortel.com [47.129.242.67]) by zcars04e.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id i3QIXEg11512 for ; Mon, 26 Apr 2004 14:33:14 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard307.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JCWQMTYZ; Mon, 26 Apr 2004 14:33:15 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.65]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JM9F464S; Mon, 26 Apr 2004 14:33:14 -0400 Message-ID: <408D55EA.4000008@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 14:33:14 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Daniel Feenberg wrote: > > On Mon, 26 Apr 2004, Chris Lewis wrote: > > >>John Levine wrote: >> >> >>80% of spam detected by this method (it's catching approximately 65-70% >>of all of our spam) is coming from detections less than 4 days old. 90% >>< 6 days old. 95% < 12 days old. >> > > > Can you tell us the number of hosts in each category? And how long hosts > remain infected? That would give us an idea of the gross flows into and > out of infected status. Here's a table: Age (days) IP Count/cum% Hit Count/cum% 0 67974/ 5.0 174862/25.4 1 65816/ 9.8 184589/52.1 2 54233/13.8 118338/69.3 3 48207/17.4 50991/76.7 4 38517/20.2 45567/83.3 5 42021/23.3 42143/89.4 6 55652/27.4 26002/93.2 7 57634/31.6 3889/93.7 8 50108/35.3 2445/94.1 9 45304/38.6 1551/94.3 10 54740/42.6 3264/94.8 11 60550/47.1 3612/95.3 12 43338/50.3 2883/95.7 13 42773/53.4 7164/96.8 14 47288/56.9 942/96.9 15 44260/60.1 524/97.0 16 48189/63.7 1087/97.1 17 43812/66.9 1147/97.3 18 39178/69.8 864/97.4 19 39474/72.7 611/97.5 20 38916/75.5 1320/97.7 21 40344/78.5 894/97.8 22 37221/81.2 3122/98.3 23 28497/83.3 907/98.4 24 32483/85.7 1000/98.6 25 38186/88.5 4719/99.3 26 42249/91.6 1393/99.5 27 41198/94.7 1816/99.7 28 39267/97.6 1487/99.9 29 33023/100.0 396/100.0 30 261/100.0 0/100.0 Totals 1360713/ 100 689529/ 100 We expire after 30 days. > If spam is proportionate to hosts, then the above figures suggest that 75% > of hosts are corrected within 4-6 days. It isn't proportionate to hosts. > My reasoning is that only 10x more > hosts are in the 6 day window than in the 4 day window. So if there are > 80x infected hosts in 4 days, that is 20x hosts/day. But in 6 days there > are only 90x total infected hosts, or 5x hosts/day for the 2 additional > days rather than the expected (steady state) 20x hosts. That suggests that > 15x hosts were cleaned up. This would be clear if we knew the number of > hosts, so that I didn't need the mystery factor x =spams/(hosts*100) I think you'll find that the rapid dropoff isn't necessarily due to system cleanups, but rather to spammers using the newest ones possible to avoid blacklisting. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 17:30:08 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA25201 for ; Mon, 26 Apr 2004 17:30:07 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDYK-0000ip-Sn for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 17:22:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QLMCBx002764 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 17:22:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDKp-0005ZO-Ob for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 17:08:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA22925 for ; Mon, 26 Apr 2004 17:08:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIDKn-0003t0-H9 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 17:08:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIDIM-0003SR-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 17:05:43 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIDDn-0002cJ-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 17:00:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BID9x-000101-OU; Mon, 26 Apr 2004 16:57:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BICvP-0005G0-0Y for asrg@optimus.ietf.org; Mon, 26 Apr 2004 16:41:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16999 for ; Mon, 26 Apr 2004 16:41:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BICvN-0006wm-1c for asrg@ietf.org; Mon, 26 Apr 2004 16:41:57 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BICjB-0004uj-00 for asrg@ietf.org; Mon, 26 Apr 2004 16:29:22 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BICK4-0004BV-00 for asrg@ietf.org; Mon, 26 Apr 2004 16:03:24 -0400 Received: from fda.zemos.net ([69.141.77.58]) by comcast.net (sccrmhc12) with ESMTP id <20040426200249012002msr7e>; Mon, 26 Apr 2004 20:02:49 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id D452318781; Mon, 26 Apr 2004 16:02:47 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17223-04; Mon, 26 Apr 2004 16:02:47 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id 4428A18721; Mon, 26 Apr 2004 16:02:47 -0400 (EDT) Message-ID: <408D6AE4.6080408@zemos.net> From: Philip Miller Reply-To: ASRG - Filtering Subgroup User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Debian/1.6-5 X-Accept-Language: en, en-us MIME-Version: 1.0 To: ASRG Cc: ASRG - Filtering Subgroup Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] NOT E-Postage - Filtering Header Draft Posted Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 16:02:44 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sorry to divert you all from the critical debate over E-Postage. ;-) I'm posting updated versions of my Filtering Header draft at . If anyone with any interest in the operation of email filters could take a look at it and post comments and/or suggestions here, I'd appreciate it. New versions are online pretty much as soon as I make the changes. Thanks. Regards, Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 18:02:47 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27180 for ; Mon, 26 Apr 2004 18:02:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDwC-0006vF-98 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 17:46:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QLkqCw026604 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 17:46:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDru-0005P7-JW for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 17:42:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA25834 for ; Mon, 26 Apr 2004 17:42:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIDrs-0006yj-3x for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 17:42:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIDqs-0006vR-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 17:41:23 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIDqQ-0006sU-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 17:40:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDZC-0000x7-Su; Mon, 26 Apr 2004 17:23:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDLL-0005eL-CK for asrg@optimus.ietf.org; Mon, 26 Apr 2004 17:08:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA23026 for ; Mon, 26 Apr 2004 17:08:43 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIDLJ-0003xm-56 for asrg@ietf.org; Mon, 26 Apr 2004 17:08:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIDJV-0003dJ-00 for asrg@ietf.org; Mon, 26 Apr 2004 17:06:54 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIDGV-00035v-00 for asrg@ietf.org; Mon, 26 Apr 2004 17:03:47 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3QL3gLh016350; Mon, 26 Apr 2004 17:03:42 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id RAA10820; Mon, 26 Apr 2004 17:03:42 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16525.31022.249245.795386@world.std.com> To: Jonathan Morton Cc: Barry Shein , asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <0CCE8697-96FE-11D8-A46E-000393863768@chromatix.demon.co.uk> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <16524.3834.261410.998419@world.std.com> <0CCE8697-96FE-11D8-A46E-000393863768@chromatix.demon.co.uk> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 17:03:42 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL,PENIS_ENLARGE2 autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 25, 2004 at 22:18 chromi@chromatix.demon.co.uk (Jonathan Morton) wrote: > By contrast, the transportation costs of e-mail are practically nil. No they're not. Yes they are. No they're not. Yes they are. No they're not... Yes they are. I can see we are now in a context-free loop. As founder and CEO of an ISP for these past ~15 years I actually provide e-mail systems to the general public and do the budgets etc so have some actual, current, knowledge about the costs. And you...? > Spammers happily paid for phat pipes to send mail through, before > widespread blacklisting forced them into using zombies. The cost is, > and has always been, the recipient's time spent in sifting through the > mess. (I count the recipient's ISP in this as well.) Spammers use zombies for two major reasons: 1. IP mobility - to avoid blacklisting as you say. 2. Free resources - the economics of spamming is such that they must steal resources, they could never pay for what they consume, their service just isn't valuable enough which is why it tends to revolve around cheesy come-ons for mostly phony penis enlargement pills and similar. Point 2 is in direct contradiction to what you asserted, that they "happily paid for phat pipes", can you tell me what you base that assertion on? The important point is that what spammers sell is CRIME. They don't sell advertising, any more than a guy who sells stolen watches out of the back of his car is selling watches. You might end up with a watch, but the value of his service is CRIME, being able to offer you one cheaper than one might reasonably expect because it's stolen, his costs are nearly zero. The same can be said of spammers. They employ zombies and open relays etc because that is the crime they are selling. If the spammer had to provide the service legally he'd have to charge many times what he charges, probably some astronomical sum to slam 100M mailboxes w/ a penis enlargement ad, just for a comparison paper email to 100M in the US would cost around $2M in postage alone. I'll wildly guess that for a legitimate advertiser $100,000 would be a very reasonable charge for sending email to 100M mailboxes, assuming such a thing existed. That's around 1/10th cent per piece. What do you imagine a spammer charges to send 100M pieces? $100? Probably around that. Now, tell me what your brain says to you when someone offers you a brand new Rolex in the box for $100? Howsabout $10? Howsabout 10c? Anyhow, just like the watch, the customer might ultimately get some advertising (and that watch *might* be a rolex for $100), but the actual service is crime. Just like you could steal a watch for yourself, you could spam for yourself, but there is a certain wisdom in paying a criminal to do it for you. Thus, all spammers are criminals. Quod Erat Demonstrandum. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 18:28:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00031 for ; Mon, 26 Apr 2004 18:28:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEO4-0001Um-Mi for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:15:40 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QMFeW7005743 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:15:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEFG-0004kS-NK for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 18:06:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27763 for ; Mon, 26 Apr 2004 18:06:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIEFD-00017j-V7 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:06:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIEEO-00012y-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:05:41 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIEDn-0000xg-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:05:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDxJ-0007GC-GV; Mon, 26 Apr 2004 17:48:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDsr-0005rZ-OY for asrg@optimus.ietf.org; Mon, 26 Apr 2004 17:43:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA25878 for ; Mon, 26 Apr 2004 17:43:21 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIDsp-00073X-7m for asrg@ietf.org; Mon, 26 Apr 2004 17:43:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIDrx-0006zi-00 for asrg@ietf.org; Mon, 26 Apr 2004 17:42:29 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIDrP-0006vr-00 for asrg@ietf.org; Mon, 26 Apr 2004 17:41:55 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3QLEoLh015178; Mon, 26 Apr 2004 17:14:50 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id RAA17128; Mon, 26 Apr 2004 17:14:49 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16525.31689.515935.266863@world.std.com> To: der Mouse Cc: asrg@ietf.org Subject: Re: [Asrg] Re: Answering a lot of questions about e-postage in a few sentences In-Reply-To: <200404252153.RAA02700@Sparkle.Rodents.Montreal.QC.CA> References: <200404231812.OAA10248@world.std.com> <40899587.2060401@solidmatrix.com> <4089A27F.3050807@zemos.net> <408C144E.80903@solidmatrix.com> <16524.6886.604923.78448@world.std.com> <200404252027.QAA02214@Sparkle.Rodents.Montreal.QC.CA> <16524.11684.292529.646662@world.std.com> <200404252153.RAA02700@Sparkle.Rodents.Montreal.QC.CA> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 17:14:49 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 25, 2004 at 17:45 mouse@Rodents.Montreal.QC.CA (der Mouse) wrote: > > Electricity too cheap to meter! > > > GE used to use that slogan, in the 1960's, to sell the idea of > > nuclear power plants. > > > It's always suspect, tho not a priori false, and certainly suspect > > here, for the very reason we're here; it becomes abused. > > I know someone who has phone service with, effectively, a > continent-wide local calling area. (That is, one flat fee per month > (USD 40.00 is what I recall) covers all calls within North America.) > > I gather it's new and thus relatively experimental, but people don't do > such things unless they have reason to think they will succeed > commercially. Where, in this particular case, success may be measured in gaining enough market-share by driving your competition into bankruptcy that you can then charge whatever you like. Ask them for a 10 year or 25 year guarantee on flat-rate service, even w/o any pricing guarantee and tell us how they answer. Well, ok, unfair question because you'd never get an answer for other reasons of course. But I think you get my point: This very new pricing regimen from long distance carriers may not be indicative of anything other than a frothy marketplace. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 18:28:26 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00094 for ; Mon, 26 Apr 2004 18:28:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIERl-00038r-Lt for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:19:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QMJTKv012068 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:19:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEHs-000672-UE for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 18:09:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28183 for ; Mon, 26 Apr 2004 18:09:12 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIEHq-0001Ki-6v for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:09:14 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIEGz-0001IU-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:08:22 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIEGW-0001Fu-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:07:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEDm-000426-CM; Mon, 26 Apr 2004 18:05:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIDzp-0007Zf-Bp for asrg@optimus.ietf.org; Mon, 26 Apr 2004 17:50:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26395 for ; Mon, 26 Apr 2004 17:50:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIDzm-0007gz-Nc for asrg@ietf.org; Mon, 26 Apr 2004 17:50:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIDyx-0007cd-00 for asrg@ietf.org; Mon, 26 Apr 2004 17:49:43 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BIDy9-0007XA-00 for asrg@ietf.org; Mon, 26 Apr 2004 17:48:54 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BIDxv-0000Lw-3Z; Mon, 26 Apr 2004 22:48:39 +0100 In-Reply-To: <16525.31022.249245.795386@world.std.com> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <16524.3834.261410.998419@world.std.com> <0CCE8697-96FE-11D8-A46E-000393863768@chromatix.demon.co.uk> <16525.31022.249245.795386@world.std.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <79DB1610-97CB-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] My take on e-postage To: Barry Shein X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 22:48:38 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL,PENIS_ENLARGE2 autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> By contrast, the transportation costs of e-mail are practically nil. > > I can see we are now in a context-free loop. > > As founder and CEO of an ISP for these past ~15 years I actually > provide e-mail systems to the general public and do the budgets etc so > have some actual, current, knowledge about the costs. > > And you...? I have a calculator and a rough idea of what a T1 line costs, plus I'm making some assumptions which are probably valid in the US and many other Western countries. As an ISP, you're part of the recipient's end of the system, not the transport part. If you were a backbone, your experience on transport costs would be more useful for this particular argument. >> Spammers happily paid for phat pipes to send mail through, before >> widespread blacklisting forced them into using zombies. The cost is, >> and has always been, the recipient's time spent in sifting through the >> mess. (I count the recipient's ISP in this as well.) > > Spammers use zombies for two major reasons: > > 1. IP mobility - to avoid blacklisting as you say. > > 2. Free resources - the economics of spamming is such that they must > steal resources, they could never pay for what they consume, their > service just isn't valuable enough which is why it tends to revolve > around cheesy come-ons for mostly phony penis enlargement pills and > similar. > > Point 2 is in direct contradiction to what you asserted, that they > "happily paid for phat pipes", can you tell me what you base that > assertion on? I've read a couple of media interviews with spammers, back when they still did use their own T1 lines and servers. The journalist could see all the equipment stacked up and working away. > I'll wildly guess that for a legitimate advertiser $100,000 would be a > very reasonable charge for sending email to 100M mailboxes, assuming > such a thing existed. That's around 1/10th cent per piece. > > What do you imagine a spammer charges to send 100M pieces? $100? > Probably around that. Given that spammers typically work from an illegally collected list of addresses, that's actually quite a reasonable price. If each spam is 5K, 100M of them can be sent over a T1 in about an hour or two, ignoring bounces and retries, and assuming he's got a fast enough server. He only needs four or five $100 jobs a month to break even on the T1 rental. Ten, and he can live comfortably off the proceeds. So clearly the bandwidth cost of e-mail is negligible, somewhere around the microcent level. The costs to the recipient - and his ISP - are not. That was my entire point. The reason why the legit advertiser could charge so much per impression is that their address list must be collected and maintained far more carefully. They might also get a better response rate, because they can target the appropriate markets and avoid causing offence. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 18:35:39 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00532 for ; Mon, 26 Apr 2004 18:35:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEaA-0004WQ-M1 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:28:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QMSAjm017378 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:28:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIERn-0003AP-SR for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 18:19:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29411 for ; Mon, 26 Apr 2004 18:19:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIERl-00027z-1Z for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:19:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIEQy-00023f-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:18:41 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIEQN-0001yb-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:18:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEFk-00050O-Iq; Mon, 26 Apr 2004 18:07:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIECC-0003C5-Bp for asrg@optimus.ietf.org; Mon, 26 Apr 2004 18:03:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27245 for ; Mon, 26 Apr 2004 18:03:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIEC9-0000qY-DD for asrg@ietf.org; Mon, 26 Apr 2004 18:03:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIEBI-0000mv-00 for asrg@ietf.org; Mon, 26 Apr 2004 18:02:28 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BIEAL-0000iU-00 for asrg@ietf.org; Mon, 26 Apr 2004 18:01:29 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BIEAK-0000RM-IP; Mon, 26 Apr 2004 23:01:28 +0100 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <44572F45-97CD-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] Re: Asrg] My take on e-postage To: gep2@terabites.com X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 23:01:27 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> Only a few ISPs - the most savvy and network-oriented (as opposed to >> revenue-oriented) - seem to have any mechanism to detect and deal >> with zombies. > > It's very hard to deal with in any definitive way. How do you > distinguish > whether outgoing mail from a normally-reputable system is really still > legitimate? You pick up the phone, and have a brief word with your customer. If he hasn't any idea why his box is spewing a thousand mails a minute, you have an opportunity to deal with the problem, starting with blocking his outgoing SMTP. If he *does* know about it, then it's his responsibility. This isn't just hyperbole. This is roughly how my present ISP, Demon, says it handles excessive SMTP output. This is also how one of my previous ISPs alerted me to an inadvertent misconfiguration of my website, which was causing a type of DDoS on their webserver via a stack of poorly run Squid proxies. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 18:39:06 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00645 for ; Mon, 26 Apr 2004 18:39:06 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEhV-0005x9-6y for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:35:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QMZjjR022878 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 18:35:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEbG-0004lE-Qu for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 18:29:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00204 for ; Mon, 26 Apr 2004 18:29:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIEbE-0002iu-1N for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:29:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIEaJ-0002fk-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:28:19 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIEZU-0002cm-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 18:27:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIENR-000164-Vt; Mon, 26 Apr 2004 18:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIEEC-0004Fg-5Q for asrg@optimus.ietf.org; Mon, 26 Apr 2004 18:05:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27538 for ; Mon, 26 Apr 2004 18:05:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIEE9-00010f-3D for asrg@ietf.org; Mon, 26 Apr 2004 18:05:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIEDI-0000wT-00 for asrg@ietf.org; Mon, 26 Apr 2004 18:04:32 -0400 Received: from alph.hagenaars.com ([207.236.16.58] ident=mail) by ietf-mx with esmtp (Exim 4.12) id 1BIECR-0000r4-00 for asrg@ietf.org; Mon, 26 Apr 2004 18:03:39 -0400 Received: fromuser gj by alph.hagenaars.com with local (Exim 3.36 #1) id 1BIECB-0000Qv-00 for asrg@ietf.org; Mon, 26 Apr 2004 18:03:23 -0400 From: GertJan Hagenaars To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage Message-ID: <20040426220323.GA1103@hagenaars.com> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404251913.PAA01767@Sparkle.Rodents.Montreal.QC.CA> <170754AC-96FD-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404252143.RAA02636@Sparkle.Rodents.Montreal.QC.CA> <5B85241C-9714-11D8-A46E-000393863768@chromatix.demon.co.uk> <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200404260030.UAA03203@Sparkle.Rodents.Montreal.QC.CA> X-Files: The Truth is out there. User-Agent: Mutt/1.5.5.1+cvs20040105i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 18:03:23 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL,HTML_MESSAGE autolearn=no version=2.60 Apparently, der Mouse wrote: % >> It's a lot more than that that the stamp vendor needs to keep track % >> of. The first thing that comes to mind is that recipients need a % >> way to check that a stamp hasn't already been used % > Not necessary, if the stamp cryptographically includes both the % > sender and recipient addresses. % % Then the recipient needs a way to check the crypto signature - and even % then, you have to figure out a way that stamps can't get reused with % forged sender addresses. (That is, X sends mail to Y, with a valid % stamp . Spammer gets hold of a copy (through any of many possible % means) and sends mail with that stamp, to Y, forging X's address as the % sender.) Keep a cache of "seen stamps" for 10 days, refuse delivery of duplicate stamps, and make sure that stamps expire after a week or so. I do that now with message-IDs to remove duplicate messages to my inbox. However, the real trick is that it becomes much harder to scale this even if stamps are readily available. Instead of just using a single "to", now the spammer needs to keep track of both "from" and "to". And because of this, it becomes much easier to filter out specific spam. E.g. if I intend to receive email from you, I would have a specific filter that says that I will need to see a received line with sparkle.rodents in it. Or that I need to see the phrase "Ribbon Campaign" in the body of the email. Now we're getting into the area where it is no longer possible for a spammer to break into this scheme without a lot more knowledge of how my filters are set up. 
% /~\ The ASCII				der Mouse
% \ / Ribbon Campaign
%  X  Against HTML	       mouse@rodents.montreal.qc.ca
% / \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
CHeers, GertJan. -- +++++++++++++ -------- +++++ --- ++ - +0+ + ++ +++ +++++ ++++++++ +++++++++++++ sed '/^[when][coders]/!d G.J.W. Hagenaars -- gj at hagenaars dot com /^...[discover].$/d Remembering Mike Carty 1968-1994 /^..[real].[code]$/!d UltrixIrixAIXHPUXSunOSLinuxBSD, nothing but nix ' /usr/dict/words I'm Dutch, what's _your_ excuse? _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 19:28:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03327 for ; Mon, 26 Apr 2004 19:28:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIFRZ-0004Pa-WF for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 19:23:22 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3QNNLgv016953 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 19:23:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIFOq-0003yJ-6n for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 19:20:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02874 for ; Mon, 26 Apr 2004 19:20:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIFOo-00072S-Nb for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 19:20:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIFNn-0006vQ-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 19:19:28 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIFNB-0006rF-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 19:18:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIFKU-0003Og-23; Mon, 26 Apr 2004 19:16:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIFJ7-0003Eg-ME for asrg@optimus.ietf.org; Mon, 26 Apr 2004 19:14:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02539 for ; Mon, 26 Apr 2004 19:14:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIFJ6-0006QZ-20 for asrg@ietf.org; Mon, 26 Apr 2004 19:14:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIFIP-0006Jr-00 for asrg@ietf.org; Mon, 26 Apr 2004 19:13:54 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BIFHS-0006C8-00 for asrg@ietf.org; Mon, 26 Apr 2004 19:12:54 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.21) id 1BIFHR-0000tz-Kb; Tue, 27 Apr 2004 00:12:53 +0100 In-Reply-To: <408D55EA.4000008@americasm01.nt.com> References: <408D55EA.4000008@americasm01.nt.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] hashcash, was My take on e-postage To: "Chris Lewis" X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 00:12:53 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> 80% of spam detected by this method (it's catching approximately >>> 65-70% of all of our spam) is coming from detections less than 4 >>> days old. 90% < 6 days old. 95% < 12 days old. >> >> Can you tell us the number of hosts in each category? And how long >> hosts >> remain infected? That would give us an idea of the gross flows into >> and >> out of infected status. > > Here's a table: > > Age (days) IP Count/cum% Hit Count/cum% > 0 67974/ 5.0 174862/25.4 > 1 65816/ 9.8 184589/52.1 > 2 54233/13.8 118338/69.3 > 3 48207/17.4 50991/76.7 > 4 38517/20.2 45567/83.3 > 24 32483/85.7 1000/98.6 > 25 38186/88.5 4719/99.3 > 26 42249/91.6 1393/99.5 > 27 41198/94.7 1816/99.7 > 28 39267/97.6 1487/99.9 > 29 33023/100.0 396/100.0 > 30 261/100.0 0/100.0 > Totals 1360713/ 100 689529/ 100 > > We expire after 30 days. I don't get it. Why is the hit count for some days so much lower than the host count? Anyway, assuming your figures are correct, that indicates that 2/3rds of the hosts are rolling around to the beginning of the list again, because they're being detected as new immediately after being expired. That in turn seems to suggest 25k new zombies per day, rather than 70k. The total zombie pool is probably a more reliable figure, which I'll round up to 1500k. Assuming they're maximally used for sending spam for about 4 days on average, that's a sending pool of about 100k machines. If each has an average 128Kbit DSL uplink, that's equivalent to about 8000 T1s, each at 30k spams per second, totalling 240M spams per second. Rather a lot of bandwidth to draw upon, isn't it? Now let's assume that hashcash is widely deployed, but that the spammers have now set up a reasonably efficient P2P network between the zombies, allowing even the blacklisted ones to generate stamps for the others. Most zombies won't be screaming top-of-the-line boxes, rather there'll be a lot of 1-CPU Celerons and the like, so say 4 seconds per 20-bit collision on average. With 1.5M of them churning away, that's 375k spams a second - a massive 3 orders of magnitude reduction compared to 240M, even if it is still enough to saturate 12 T1s. So, OK, this is definitely going to turn off the non-hardcore spammers. Those that are left will be the ones to send the law after. Theft of service and computer intrusion on this kind of scale is a crime, no matter whether the actual spam is. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 20:18:45 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05528 for ; Mon, 26 Apr 2004 20:18:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIGGL-0002Te-Gr for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 20:15:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3R0FnIN009517 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 20:15:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIG8Q-0001hT-Vf for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 20:07:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05074 for ; Mon, 26 Apr 2004 20:07:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIG8P-00030O-1q for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 20:07:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIG7K-0002r3-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 20:06:30 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIG6h-0002lq-01 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 20:05:51 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIG5d-0003qi-0J for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 20:04:46 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIFwF-0008QX-Ua; Mon, 26 Apr 2004 19:55:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIFtl-00087c-Kt for asrg@optimus.ietf.org; Mon, 26 Apr 2004 19:52:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA04646 for ; Mon, 26 Apr 2004 19:52:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIFtj-0001sV-Pv for asrg@ietf.org; Mon, 26 Apr 2004 19:52:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIFsl-0001n9-00 for asrg@ietf.org; Mon, 26 Apr 2004 19:51:28 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BIFro-0001gU-00 for asrg@ietf.org; Mon, 26 Apr 2004 19:50:28 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BIFrj-00074N-00; Mon, 26 Apr 2004 19:50:23 -0400 Received: from [68.246.139.207] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BIFri-0004Ax-00; Mon, 26 Apr 2004 19:50:23 -0400 Message-ID: <408DA034.60203@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: Jonathan Morton CC: Chris Lewis , asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage References: <408D55EA.4000008@americasm01.nt.com> <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> In-Reply-To: <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 19:50:12 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Jonathan Morton wrote: > With 1.5M of them churning away, that's 375k spams a second - a massive > 3 orders of magnitude reduction compared to 240M, even if it is still > enough to saturate 12 T1s. > > So, OK, this is definitely going to turn off the non-hardcore spammers. > Those that are left will be the ones to send the law after. Theft of > service and computer intrusion on this kind of scale is a crime, no > matter whether the actual spam is. What you also have to factor here is how much money will be saved in order to produce this reduction versus the costs required to convert everybody to hashcash. Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "And this too shall come to pass" ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Mon Apr 26 20:57:08 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07147 for ; Mon, 26 Apr 2004 20:57:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIGr2-0007jh-GF for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 20:53:44 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3R0rivh029729 for asrg-archive@odin.ietf.org; Mon, 26 Apr 2004 20:53:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIGqk-0007ak-Oa for asrg-web-archive@optimus.ietf.org; Mon, 26 Apr 2004 20:53:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07025 for ; Mon, 26 Apr 2004 20:53:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIGqi-00079L-ED for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 20:53:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIGpn-000752-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 20:52:28 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIGpE-00070Y-00 for asrg-web-archive@ietf.org; Mon, 26 Apr 2004 20:51:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIGic-0006YB-Sw; Mon, 26 Apr 2004 20:45:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIGh1-0006Hq-JH for asrg@optimus.ietf.org; Mon, 26 Apr 2004 20:43:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA06563 for ; Mon, 26 Apr 2004 20:43:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIGgz-0006Bw-9U for asrg@ietf.org; Mon, 26 Apr 2004 20:43:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIGg5-00066e-00 for asrg@ietf.org; Mon, 26 Apr 2004 20:42:26 -0400 Received: from mail1.nber.org ([207.113.108.7]) by ietf-mx with esmtp (Exim 4.12) id 1BIGfC-000618-00 for asrg@ietf.org; Mon, 26 Apr 2004 20:41:30 -0400 Received: from mail1 (root@localhost) by mail1.nber.org (8.12.8/8.12.8) with SMTP id i3R0fPFh015771 for ; Mon, 26 Apr 2004 20:41:26 -0400 Received: from nber1.nber.org (nber1.nber.org [207.113.108.252]) by mail1.nber.org (8.12.8/8.12.8) with ESMTP id i3R0fPab015757; Mon, 26 Apr 2004 20:41:25 -0400 From: Daniel Feenberg To: Chris Lewis cc: asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage In-Reply-To: <408D55EA.4000008@americasm01.nt.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Mon, 26 Apr 2004 20:41:19 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Mon, 26 Apr 2004, Chris Lewis wrote: > Daniel Feenberg wrote: > > > > > On Mon, 26 Apr 2004, Chris Lewis wrote: > > > > > >>John Levine wrote: > >> > >> > >>80% of spam detected by this method (it's catching approximately 65-70% > >>of all of our spam) is coming from detections less than 4 days old. 90% > >>< 6 days old. 95% < 12 days old. > >> > > > > > > Can you tell us the number of hosts in each category? And how long hosts > > remain infected? That would give us an idea of the gross flows into and > > out of infected status. > > Here's a table: > > Age (days) IP Count/cum% Hit Count/cum% > 0 67974/ 5.0 174862/25.4 > 1 65816/ 9.8 184589/52.1 > 2 54233/13.8 118338/69.3 > 3 48207/17.4 50991/76.7 > 4 38517/20.2 45567/83.3 > 5 42021/23.3 42143/89.4 > 6 55652/27.4 26002/93.2 > 7 57634/31.6 3889/93.7 > 8 50108/35.3 2445/94.1 > 9 45304/38.6 1551/94.3 > 10 54740/42.6 3264/94.8 > 11 60550/47.1 3612/95.3 > 12 43338/50.3 2883/95.7 > 13 42773/53.4 7164/96.8 > 14 47288/56.9 942/96.9 > 15 44260/60.1 524/97.0 > 16 48189/63.7 1087/97.1 > 17 43812/66.9 1147/97.3 > 18 39178/69.8 864/97.4 > 19 39474/72.7 611/97.5 > 20 38916/75.5 1320/97.7 > 21 40344/78.5 894/97.8 > 22 37221/81.2 3122/98.3 > 23 28497/83.3 907/98.4 > 24 32483/85.7 1000/98.6 > 25 38186/88.5 4719/99.3 > 26 42249/91.6 1393/99.5 > 27 41198/94.7 1816/99.7 > 28 39267/97.6 1487/99.9 > 29 33023/100.0 396/100.0 > 30 261/100.0 0/100.0 > Totals 1360713/ 100 689529/ 100 > > We expire after 30 days. > > > If spam is proportionate to hosts, then the above figures suggest that 75% > > of hosts are corrected within 4-6 days. > > It isn't proportionate to hosts. > Comparing IP addresses only, it looks like that dropoff from day zero to day 9 (10 days) is about 1% per day. That is, 5% of hosts in one day, but 38.6% in 10 days. 1% cure rate per day is much more in accord with my expectations, but still better than never, which is what I feared. Daniel Feenberg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 01:22:19 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20704 for ; Tue, 27 Apr 2004 01:22:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIKzd-00087a-N6 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 01:18:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3R5IrxV031213 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 01:18:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIKuY-00073T-6b for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 01:13:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20306 for ; Tue, 27 Apr 2004 01:13:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIKuV-000121-C3 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 01:13:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIKtc-0000tg-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 01:12:41 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIKsf-0000ls-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 01:11:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIKoA-0005eT-TL; Tue, 27 Apr 2004 01:07:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIKg7-0004ew-MC for asrg@optimus.ietf.org; Tue, 27 Apr 2004 00:58:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA19677 for ; Tue, 27 Apr 2004 00:58:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIKg4-0006b2-Px for asrg@ietf.org; Tue, 27 Apr 2004 00:58:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIKfE-0006TX-00 for asrg@ietf.org; Tue, 27 Apr 2004 00:57:49 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=10QLbVfhVHbef5wiHj9yutn2mVqs4MZzHQ4LyVS6SaS) by ietf-mx with esmtp (Exim 4.12) id 1BIKeU-0006KH-00 for asrg@ietf.org; Tue, 27 Apr 2004 00:57:02 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id AAA29089; Tue, 27 Apr 2004 00:56:56 -0400 (EDT) From: der Mouse Message-Id: <200404270456.AAA29089@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <16525.31022.249245.795386@world.std.com> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <16524.3834.261410.998419@world.std.com> <0CCE8697-96FE-11D8-A46E-000393863768@chromatix.demon.co.uk> <16525.31022.249245.795386@world.std.com> Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by Sparkle.Rodents.Montreal.QC.CA id AAA29089 Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 00:39:51 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable >> By contrast, the transportation costs of e-mail are practically nil. > [(No they're not.\nYes they are.\n)*] > As founder and CEO of an ISP for these past ~15 years I actually > provide e-mail systems to the general public and do the budgets etc > so have some actual, current, knowledge about the costs. So, don't be coy, tell us: what _does_ it cost to transport an email - let's be generous and say a hundred-kilobyte email - from point A to point B? I'm paying CAD 30/month for any amount of data transfer up to something like 4GB. Of course, that pays for many other things too (like the use of endpoint equipment), but let's assume that is purely my share of the transport of up to 4GB of data. At that rate, transporting that hundred kilobytes costs a smidgen under CAD=A00.0007153 - less than three-quarters of a tenth of a cent. A more reasonable ten-kilobyte email - this one is maybe 3.5K before addition of all the Received: goop - would cost about a tenth that, or some seven millicents. Compared to all the other costs, notably the human costs, and especially considering that that's a gross overestimate because my $30/mo is paying for a number of things other than pure data transport, I think it's fair to call this "practically nil". > Spammers use zombies for two major reasons: > 1. IP mobility - to avoid blacklisting as you say. > 2. Free resources - [...] What reason do you have to think you know why spammers use zombies? > Point 2 is in direct contradiction to what you asserted, that they > "happily paid for phat pipes", can you tell me what you base that > assertion on? A number of past spamhauser _did_ pay for fairly fat pipes - or at least I've seen it reported thus, and not contradicted; I've not personally seen invoices or any such. Any spamhaus that does this, though, will rapidly find their IP space blocked (and, depending their upstream, sometimes yanked); I've always assumed that this is the major motivation behind spammer use of zombie armies. Indeed, the whole basis for differential routing abuse is "fat pipe out, thin pipe in". > Thus, all spammers are criminals. > Quod Erat Demonstrandum. You have not demonstrated this. For all your pretty arguments, and for all that I agree with most of them, you have not shown any point of criminal law that they are violating. (I suspect there are such, but your arguments haven't shown so.) /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 11:11:43 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA06259 for ; Tue, 27 Apr 2004 11:11:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIUAi-0007tm-Pw for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 11:06:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RF6uqa030358 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 11:06:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIU3w-0006I7-M6 for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 10:59:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05412 for ; Tue, 27 Apr 2004 10:59:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIU3q-0003og-7I for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 10:59:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIU2r-0003m1-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 10:58:50 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIU1u-0003k1-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 10:57:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BITtP-0004ES-VM; Tue, 27 Apr 2004 10:49:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BITma-0003AR-Jd for asrg@optimus.ietf.org; Tue, 27 Apr 2004 10:42:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04603 for ; Tue, 27 Apr 2004 10:41:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BITmU-00034E-0J for asrg@ietf.org; Tue, 27 Apr 2004 10:41:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BITlb-00032C-00 for asrg@ietf.org; Tue, 27 Apr 2004 10:40:59 -0400 Received: from navgwout.symantec.com ([198.6.49.12]) by ietf-mx with esmtp (Exim 4.12) id 1BITkf-0002xa-00 for asrg@ietf.org; Tue, 27 Apr 2004 10:40:01 -0400 Received: from navgwout.symantec.com (localhost [127.0.0.1]) by navgwout.symantec.com (8.11.7p1+Sun/8.11.7) with SMTP id i3REdX124766 for ; Tue, 27 Apr 2004 07:39:33 -0700 (PDT) Received: from uscu-smtpob01-1.symantec.com ([155.64.74.130]) by navgwout.symantec.com (SAVSMTP 3.1.2.35) with SMTP id M2004042707393213577 for ; Tue, 27 Apr 2004 07:39:33 -0700 In-Reply-To: <20040426160004.11664.33737.Mailman@www1.ietf.org> To: asrg@ietf.org MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003 From: Richard Willey X-MIMETrack: S/MIME Sign by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 6.0.2CF1|June 9, 2003) at 04/27/2004 10:37:20 AM, Serialize by Notes Client on Richard Willey/Cupertino/Cal/SYMANTEC(Release 6.0.2CF1|June 9, 2003) at 04/27/2004 10:37:20 AM, Serialize complete at 04/27/2004 10:37:20 AM, S/MIME Sign failed at 04/27/2004 10:37:20 AM: The cryptographic key was not found, Serialize by Router on USCU-SMTPOB01-1/GLOBE-ADMIN/SYMANTEC(602CF1HF35 | July 14, 2003) at 04/27/2004 07:39:33 AM, Serialize complete at 04/27/2004 07:39:33 AM Message-ID: Content-Type: text/plain; charset="US-ASCII" Subject: [Asrg] (no subject) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 07:39:31 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 >>3. The mailing list should not focus on implementing its own Micropayment >>architecture, but rather: >> >>(a) Determine whether a working micropayment architecture would represent >>a feasible solution to SPAM >>(b) Determine whether an E-Postage system would create a unique set of >>requirements for a working micropayments architecture. >>(c) Attempt to ballpark a set of parameters that describe the boundary >>conditions necessary to make an E-Postage system feasible. ... > ... which remains entirely hypothetical since nobody has any idea how >to build a micropayment system within a couple of orders of magnitude >of what you'd need for any plausible e-mail system. The unique >requirement is be that the vast majority of attempted transactions >would be bogus which rules out a lot of statistical approaches, but >it's the scale that's the killer. Not sure whether I necessarily buy into this assertion: One size does not fit all, and an anti-SPAM solution that is appropriate for one set of mail exchanges will not necessarily be applied to all mail exchanges. When I think about email, I differentiate between two different types of transactions: One set of exchanges occurs went I communicate with a relatively small group of individuals with whom I have some sort of trust relationship: This includes: (a) The people that I work with (b) My friends (c) My family These transactions encompass the vast majority of the emails that I send and receive. Equally significant, they don't require any type of E-Postage or Micropayments. Instead, some combination of whie listing and digital signatures represents a very efficient solution to this type of communications. However, there is a second set of email exchages that I need to consider. On occasion, I receive emails from "random" individuals with whom I don't have any kind of pre-existing trust relationship. While these exchanges are relatively infrequent, they often contain important information. Here, we require some form of additional solution that can be used to screen the wheat from the chaff. There are a wide variety of technical solutions that have been proposed including: (a) Challenge Response (b) Micro-Payments (c) Intelligent Filters. Personally, I think that the Micro-Payment systems offer the best approach. This is technology that is going to be adopted / deployed anyway and I'd just as soon piggyback off it. Your arguments that the system would collapse under transaction volume seem to assume that all emails would need to E-Postage rather than a selective subset. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 11:14:08 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA06480 for ; Tue, 27 Apr 2004 11:14:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIUES-0000Vb-VV for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 11:10:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RFAmd8001948 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 11:10:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIUA3-0007gT-R5 for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 11:06:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA05793 for ; Tue, 27 Apr 2004 11:06:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIU9x-0004Es-BV for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 11:06:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIU8y-0004Av-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 11:05:09 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIU8R-00047H-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 11:04:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BITuN-0004Pp-7E; Tue, 27 Apr 2004 10:50:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BITrX-0003bM-JG for asrg@optimus.ietf.org; Tue, 27 Apr 2004 10:47:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04881 for ; Tue, 27 Apr 2004 10:47:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BITrR-0003HD-3X for asrg@ietf.org; Tue, 27 Apr 2004 10:47:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BITqg-0003FD-00 for asrg@ietf.org; Tue, 27 Apr 2004 10:46:15 -0400 Received: from zcars0m9.nortelnetworks.com ([47.129.242.157]) by ietf-mx with esmtp (Exim 4.12) id 1BITq7-0003CN-00 for asrg@ietf.org; Tue, 27 Apr 2004 10:45:39 -0400 Received: from zcard309.ca.nortel.com (zcard309.ca.nortel.com [47.129.242.69]) by zcars0m9.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id i3REj8D15531 for ; Tue, 27 Apr 2004 10:45:08 -0400 (EDT) Received: from zcard031.ca.nortel.com ([47.129.242.121]) by zcard309.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JCT8LHQN; Tue, 27 Apr 2004 10:45:08 -0400 Received: from americasm01.nt.com (clewis-2.ca.nortel.com [47.129.150.65]) by zcard031.ca.nortel.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id JM9F47JC; Tue, 27 Apr 2004 10:45:07 -0400 Message-ID: <408E71F2.5000703@americasm01.nt.com> X-Sybari-Space: 00000000 00000000 00000000 00000000 From: "Chris Lewis" User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 CC: asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage References: <408D55EA.4000008@americasm01.nt.com> <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> In-Reply-To: <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 10:45:06 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Jonathan Morton wrote: >> Here's a table: >> >> Age (days) IP Count/cum% Hit Count/cum% >> 0 67974/ 5.0 174862/25.4 >> 1 65816/ 9.8 184589/52.1 >> 2 54233/13.8 118338/69.3 >> 3 48207/17.4 50991/76.7 >> 4 38517/20.2 45567/83.3 > I don't get it. Why is the hit count for some days so much lower than > the host count? The detector is running on a multitude of dmoains with vastly higher flows in total, whereas the hit count above is on our own production mail service. > Anyway, assuming your figures are correct, that indicates that 2/3rds of > the hosts are rolling around to the beginning of the list again, because > they're being detected as new immediately after being expired. That in > turn seems to suggest 25k new zombies per day, rather than 70k. Not quite - there's some information you're missing. Minimum redetection interval is 48 hours, yet this is on last detection. On the other hand, the numbers for previous days isn't going down by much. That first number (70K) is continuously rising. A month or two ago it was around 15-20K, a few months before that, it was 5kish. The redetection interval hasn't changed. > The > total zombie pool is probably a more reliable figure, which I'll round > up to 1500k. Dynamic IP detections (this thing makes no distinction) would tend to push it back down. When the expiration interval was four months, the total was around 2200K. The reduction of 4mos -> 1mos resulted in an immediate 2200K->1000k reduction, but only lost 3% of the detections. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 12:25:02 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA10184 for ; Tue, 27 Apr 2004 12:25:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIV3H-0004AR-Vq for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 12:03:20 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RG3JlI016019 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 12:03:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIUyT-0002qv-Pj for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 11:58:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08823 for ; Tue, 27 Apr 2004 11:58:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIUyQ-00009c-ER for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 11:58:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIUxG-0007mI-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 11:57:07 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIUvs-0007Xd-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 11:55:40 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIUvv-0003W5-JB for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 11:55:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIUkb-00080J-29; Tue, 27 Apr 2004 11:44:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIUUJ-0003Pg-MR for asrg@optimus.ietf.org; Tue, 27 Apr 2004 11:27:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07242 for ; Tue, 27 Apr 2004 11:27:08 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIUUG-0005kG-Ei for asrg@ietf.org; Tue, 27 Apr 2004 11:27:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIUTU-0005fm-00 for asrg@ietf.org; Tue, 27 Apr 2004 11:26:21 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BIUSo-0005bu-00 for asrg@ietf.org; Tue, 27 Apr 2004 11:25:38 -0400 Received: (qmail 28306 invoked by uid 100); 27 Apr 2004 15:25:39 -0000 Message-ID: <20040427152539.28305.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] (no subject) In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Cc: richard_willey@symantec.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 27 Apr 2004 15:25:39 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >One set of exchanges occurs went I communicate with a relatively small >group of individuals with whom I have some sort of trust relationship: ... Yup. Since spammers will try to sneak in there, you need some sort of hard to break authentication to identify their mail. Maybe something like domain keys will do the trick. S/MIME sure hasn't. Any suggestions? >However, there is a second set of email exchages that I need to consider. >On occasion, I receive emails from "random" individuals with whom I don't >have any kind of pre-existing trust relationship. >While these exchanges are relatively infrequent, they often contain >important information. Agreed. How much do you expect people to be willing to pay you in order or how many hoops will they be willing to jump through in order to send you important information? >Personally, I think that the Micro-Payment systems offer the best >approach. This is technology that is going to be adopted / deployed >anyway and I'd just as soon piggyback off it. I eagerly await your discussion of how you expect people to build a micropayment system that will handle a useful amount of mail (a good beta size would be five billion messages a day), run at a cost that people would be willing to pay (closer to a penny a message than to a dollar a message), and won't be subverted by spammers using fake postage, used postage, hijacked machines, and a dozen other scams we haven't thought of yet. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com PS: This discussion reminds me of people saying that current automobiles are unsatisfactory because the fuel is dirty and expensive, therefore future cars will run on water. Water is plentiful and ecologically benign. I don't have any idea how a water-powered car would work and neither does anyone else, but I think that cars will run on water anyway. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 13:24:45 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15181 for ; Tue, 27 Apr 2004 13:24:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIWBO-0006OX-Mi for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 13:15:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RHFkXY024576 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 13:15:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIW8j-0005Ms-DU for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 13:13:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA14237 for ; Tue, 27 Apr 2004 13:12:57 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIW8f-0006ZN-I6 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 13:12:57 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIW7i-0006Ru-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 13:11:59 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIW6j-0006Jk-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 13:10:57 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIVtF-0001sJ-Hv; Tue, 27 Apr 2004 12:57:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIVkh-0007pP-FS for asrg@optimus.ietf.org; Tue, 27 Apr 2004 12:48:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12301 for ; Tue, 27 Apr 2004 12:48:07 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIVkd-000467-Lv for asrg@ietf.org; Tue, 27 Apr 2004 12:48:07 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIVji-00041B-00 for asrg@ietf.org; Tue, 27 Apr 2004 12:47:10 -0400 Received: from peacock.verisign.com ([65.205.251.73]) by ietf-mx with esmtp (Exim 4.12) id 1BIVjK-0003wg-00 for asrg@ietf.org; Tue, 27 Apr 2004 12:46:46 -0400 Received: from MOU1WNEXC03.vcorp.ad.vrsn.com (verisign.com [65.205.251.55]) by peacock.verisign.com (8.12.11/) with ESMTP id i3RGkkT2015392; Tue, 27 Apr 2004 09:46:46 -0700 (PDT) Received: by mou1wnexc03.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 27 Apr 2004 09:46:46 -0700 Message-ID: From: "Hallam-Baker, Phillip" To: "'John Levine'" , asrg@ietf.org Cc: richard_willey@symantec.com Subject: RE: [Asrg] (no subject) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 09:46:41 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 > >One set of exchanges occurs went I communicate with a > relatively small > >group of individuals with whom I have some sort of trust > relationship: ... > > Yup. Since spammers will try to sneak in there, you need some sort of > hard to break authentication to identify their mail. Maybe something > like domain keys will do the trick. S/MIME sure hasn't. Any > suggestions? The problem with S/MIME is the distribution of keys. The problem with anything other than S/MIME is that the mail infrastructure is hostile to any format other than S/MIME. Solution is to fix S/MIME IMNSHO. Possibly by adding DK functionality, possibly by adding XKMS functionality. > Agreed. How much do you expect people to be willing to pay you in > order or how many hoops will they be willing to jump through in order > to send you important information? People will pay zilch for sending email. Enterprises will consider a one off or annual fee for some form of accreditation if it will significantly reduce cost of negotiating email interchange agreements currently necessary due to blacklist idiocy. BTW the whole of Spain is currently blacklisted. > PS: This discussion reminds me of people saying that current > automobiles are unsatisfactory because the fuel is dirty and > expensive, therefore future cars will run on water. Water is > plentiful and ecologically benign. I don't have any idea how a > water-powered car would work and neither does anyone else, but I think > that cars will run on water anyway. Yep. The problem I see here is that there is no value to adding postage until large numbers check, and no point checking until large numbers pay. Any I see plenty of people who don't want to change that situation. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 15:15:59 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA22787 for ; Tue, 27 Apr 2004 15:15:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIXzz-0000P3-Ec for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 15:12:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RJC7pf001539 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 15:12:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIXxB-0007Cc-PI for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 15:09:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA21644 for ; Tue, 27 Apr 2004 15:09:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIXx6-0002gv-Dg for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 15:09:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIXwP-0002Za-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 15:08:26 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIXvQ-0002PB-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 15:07:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIXkR-00066L-3t; Tue, 27 Apr 2004 14:56:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIXeh-0005Uf-Eb for asrg@optimus.ietf.org; Tue, 27 Apr 2004 14:50:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA19721 for ; Tue, 27 Apr 2004 14:50:03 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIXec-0000X7-IJ for asrg@ietf.org; Tue, 27 Apr 2004 14:50:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIXdj-0000Sh-00 for asrg@ietf.org; Tue, 27 Apr 2004 14:49:07 -0400 Received: from [66.98.212.93] (helo=tin.nixcartel.org) by ietf-mx with esmtp (Exim 4.12) id 1BIXdJ-0000OG-00 for asrg@ietf.org; Tue, 27 Apr 2004 14:48:41 -0400 Received: from dvb.homelinux.org (unknown [202.88.170.34]) by tin.nixcartel.org (Postfix) with ESMTP id 38DEE1AC06C for ; Tue, 27 Apr 2004 13:53:21 -0500 (CDT) Received: by dvb.homelinux.org (Postfix, from userid 500) id 0CCB834022; Wed, 28 Apr 2004 00:18:20 +0530 (IST) From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] (no subject) Message-ID: <20040428001819.A18364@evita.devdas.geek> Reply-To: Devdas Bhagat References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from pbaker@verisign.com on Tue, Apr 27, 2004 at 09:46:41AM -0700 X-Message-Flag: Friends protect friends from Microsoft Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 00:18:19 +0530 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On 27/04/04 09:46 -0700, Hallam-Baker, Phillip wrote: > currently necessary due to blacklist idiocy. BTW the whole of Spain > is currently blacklisted. No. Only Telefonica, and that by a single DNSBL. Only the users of that DNSBL will block Telefonica hosts. On the other hand, outside the US, bandwidth is much more expensive and any form of filtering that during or after the data phase is more expensive than JHD. Could we please keep this fact in mind when discussing solutions? Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 15:46:07 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24909 for ; Tue, 27 Apr 2004 15:46:07 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIYQL-0006ex-RV for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 15:39:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RJdLnb025591 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 15:39:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIYJR-0005Fi-2i for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 15:32:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24270 for ; Tue, 27 Apr 2004 15:32:10 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIYJN-0005Sv-KK for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 15:32:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIYIb-0005Nl-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 15:31:22 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIYHs-0005Hq-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 15:30:36 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIYDQ-0004Ql-Tl; Tue, 27 Apr 2004 15:26:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIYBc-0004BG-Cz for asrg@optimus.ietf.org; Tue, 27 Apr 2004 15:24:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA23626 for ; Tue, 27 Apr 2004 15:24:06 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIYBZ-0004Ld-46 for asrg@ietf.org; Tue, 27 Apr 2004 15:24:05 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIYAd-0004Gs-00 for asrg@ietf.org; Tue, 27 Apr 2004 15:23:07 -0400 Received: from pigeon.verisign.com ([65.205.251.71]) by ietf-mx with esmtp (Exim 4.12) id 1BIYAL-0004CM-00 for asrg@ietf.org; Tue, 27 Apr 2004 15:22:49 -0400 Received: from mou1wnexc01.vcorp.ad.vrsn.com (verisign.com [65.205.251.53]) by pigeon.verisign.com (8.12.11/) with ESMTP id i3RJMeX8029162; Tue, 27 Apr 2004 12:22:40 -0700 (PDT) Received: by mou1wnexc01.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 27 Apr 2004 12:22:40 -0700 Message-ID: From: "Hallam-Baker, Phillip" To: "'Devdas Bhagat'" , asrg@ietf.org Subject: RE: [Asrg] (no subject) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 12:22:38 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 > On the other hand, outside the US, bandwidth is much more > expensive and > any form of filtering that during or after the data phase is more > expensive than JHD. Could we please keep this fact in mind when > discussing solutions? I don't think it is relevant for two reasons: 1) Bandwidth costs are dropping pretty much everywhere. 2) Deterrence is a viable strategy. In the long term it does not matter if you filter before or after the message is received, provided you block a sufficient proportion of spam to make the business uneconomic. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 18:33:10 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07675 for ; Tue, 27 Apr 2004 18:33:10 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIb3w-0006xH-Nq for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 18:28:24 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RMSOG0026735 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 18:28:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIapQ-0002Zc-D8 for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 18:13:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA05982 for ; Tue, 27 Apr 2004 18:13:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIapL-0002fq-M0 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 18:13:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIaoJ-0002Yw-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 18:12:16 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIanT-0002SZ-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 18:11:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIadV-00040o-Q9; Tue, 27 Apr 2004 18:01:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIaaj-0002Oy-Qy for asrg@optimus.ietf.org; Tue, 27 Apr 2004 17:58:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04384 for ; Tue, 27 Apr 2004 17:58:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIaae-0000pF-TP for asrg@ietf.org; Tue, 27 Apr 2004 17:58:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIaZi-0000jL-00 for asrg@ietf.org; Tue, 27 Apr 2004 17:57:10 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIaZ1-0000eC-00 for asrg@ietf.org; Tue, 27 Apr 2004 17:56:27 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3RLuOFd022317; Tue, 27 Apr 2004 17:56:24 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id RAA08717; Tue, 27 Apr 2004 17:56:24 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16526.55047.872593.696375@world.std.com> To: der Mouse Cc: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <200404270456.AAA29089@Sparkle.Rodents.Montreal.QC.CA> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <16524.3834.261410.998419@world.std.com> <0CCE8697-96FE-11D8-A46E-000393863768@chromatix.demon.co.uk> <16525.31022.249245.795386@world.std.com> <200404270456.AAA29089@Sparkle.Rodents.Montreal.QC.CA> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 17:56:23 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > >So, don't be coy, tell us: what _does_ it cost to transport an email - >let's be generous and say a hundred-kilobyte email - from point A to >point B? Why would you only want to include transportation/bandwidth costs? This reminds me of people who'd call us and demand that a web site should only cost what the disk space it takes up costs, pennies, paid once. Granted I'd separate, e.g., human costs. But one reason for that is because we'll see something like 100K spams for every one that ends up in front of a human (e.g., unknown users via dictionary searches.) For those there's zero human cost in terms of someone having to read and delete those, but the cost in equipment etc bear a barrage like that seems reasonable (remember my comment about 1,000+ systems spewing the same spam simultaneously not being unusual?) Anyhow, what's your point, I seem to have completely lost that, that movie theater tickets should be about 1c because that's a good approximation of the wear and tear on the seat and they were going to show the movie anyhow so why leave a seat empty a penny is better than nothing? >> Thus, all spammers are criminals. > >> Quod Erat Demonstrandum. > >You have not demonstrated this. For all your pretty arguments, and for >all that I agree with most of them, you have not shown any point of >criminal law that they are violating. (I suspect there are such, but >your arguments haven't shown so.) Is your point that you doubt that, e.g., hijacking PCs via use of viruses/trojans and using them for personal gain (spamming) isn't criminal? I suppose you should be free to hold that view or even demand that someone convince you otherwise but somehow my instincts tell me you're just being argumentative and grasping for straws here. My point is that spammers' economics are such that they could not be the problem they are without mass unauthorized utilization of others' resources, such as the current favorite mode of using hijacked zombie PCs by the thousands. Is that carefully worded enough for your tastes while still making the point w/o attempting to win a case against Johnnie Cochran? Or should I throw in some allegedly's also? Sheesh. Haven't we gone waaaaaaaaaaay beyond trying to tackle this problem and are now neck deep in trying to nitpick each other to death? Ya know who's gonna win that one doncha? THE SPAMMERS!!! -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 18:49:39 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08660 for ; Tue, 27 Apr 2004 18:49:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbKd-0001IP-0H for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 18:45:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RMjcDv004975 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 18:45:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbGQ-0000dZ-SL for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 18:41:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08201 for ; Tue, 27 Apr 2004 18:41:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIbGL-0005zN-PV for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 18:41:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIbFQ-0005tF-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 18:40:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIbEr-0005n9-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 18:39:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbAL-0007zX-NC; Tue, 27 Apr 2004 18:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIb4m-00076B-G8 for asrg@optimus.ietf.org; Tue, 27 Apr 2004 18:29:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07287 for ; Tue, 27 Apr 2004 18:29:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIb4h-0004X8-Dn for asrg@ietf.org; Tue, 27 Apr 2004 18:29:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIb3n-0004PJ-00 for asrg@ietf.org; Tue, 27 Apr 2004 18:28:16 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIb2y-0004HB-00 for asrg@ietf.org; Tue, 27 Apr 2004 18:27:24 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3RMROdf026012; Tue, 27 Apr 2004 18:27:25 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id SAA19756; Tue, 27 Apr 2004 18:27:24 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16526.56908.486336.40443@world.std.com> To: John Levine Cc: asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) In-Reply-To: <20040427152539.28305.qmail@xuxa.iecc.com> References: <20040427152539.28305.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 18:27:24 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.2 required=5.0 tests=AWL,HTML_FONT_INVISIBLE, HTML_MESSAGE autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 27, 2004 at 15:25 asrg@johnlevine.com (John Levine) wrote: >I eagerly await your discussion of how you expect people to build a >micropayment system that will handle a useful amount of mail (a good >beta size would be five billion messages a day), run at a cost that >people would be willing to pay (closer to a penny a message than to a >dollar a message), and won't be subverted by spammers using fake >postage, used postage, hijacked machines, and a dozen other scams we >haven't thought of yet. 5 billion transactions per day doesn't impress me as proof positive of anything, particularly world-wide. Obviously if we can deliver that many emails per day THEN WE CLEARLY CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? And if we can deliver that many emails today at nearly no incremental cost, or so it appears, then what do you base your insinuation that adding the overhead of metering etc would skyrocket the cost on? We seem to have added all manner of spam filtering, right down to handshaking with multiple remote blacklists per message and running each one through all kinds of DNS and content checks such as spamassassin or various commercial spam filtering services' software. And all that doesn't seem to have, by its mere overhead, taken down the entire world email system, yet, even if it's a lousy trend. But it's not unreasonable to predict that if we had a pretty good, unified system for preventing spam in the first place (such as an e-postage system as idealized) then all that other overhead infrastructure would be taken apart, or most of it anyhow. So why do you keep asserting that adding the overhead that might be incurred in other per-message proposals is so obviously the straw that shall break the camel's back? (gak! lousy sentence, sorry.) As to scams, we're there right now (e.g., hijacked zombies, filter bypassing schemes intuitive boxcar rummage bigger better), but yes there's work to do or else we'd be done. >PS: This discussion reminds me of people saying that current >automobiles are unsatisfactory because the fuel is dirty and >expensive, therefore future cars will run on water. Water is >plentiful and ecologically benign. I don't have any idea how a >water-powered car would work and neither does anyone else, but I think >that cars will run on water anyway. I cannot imagine a topic which might be discussed on this research group for which this paragraph *couldn't* be a response. Can you? If we knew the right answer then I think we'd be done. But unless you're quite sure you've discovered some mathematical or physical law being violated (e.g., someone quite literally proposes a perpetual motion machine or equivalent and I mean "quite literally" quite literally) I don't see what a meta-comment like the above adds to the discussion. With all due respect. Otherwise it just strikes me as bullying forth a particular agenda while adding little or less. And one of questionable veracity, at least prima facie, IMHBCO. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 19:12:09 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA09441 for ; Tue, 27 Apr 2004 19:12:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbj2-0005Ef-5W for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 19:10:52 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RNAq54020124 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 19:10:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbda-0004Go-KI for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 19:05:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA09177 for ; Tue, 27 Apr 2004 19:05:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIbdV-0000nP-Dk for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:05:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIbcX-0000gf-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:04:10 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIbbY-0000aE-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:03:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbWb-0003Ks-DV; Tue, 27 Apr 2004 18:58:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbP8-0002IH-EX for asrg@optimus.ietf.org; Tue, 27 Apr 2004 18:50:18 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08701 for ; Tue, 27 Apr 2004 18:50:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIbP3-00070s-AG for asrg@ietf.org; Tue, 27 Apr 2004 18:50:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIbO7-0006uz-00 for asrg@ietf.org; Tue, 27 Apr 2004 18:49:16 -0400 Received: from sparkle.rodents.montreal.qc.ca ([216.46.5.7] ident=n8VD7NAintr5m8YeorcqOxbuoubT21yGrRqIMo3eAWD) by ietf-mx with esmtp (Exim 4.12) id 1BIbNG-0006of-00 for asrg@ietf.org; Tue, 27 Apr 2004 18:48:22 -0400 Received: (from mouse@localhost) by Sparkle.Rodents.Montreal.QC.CA (8.8.8/8.8.8) id SAA04945; Tue, 27 Apr 2004 18:48:15 -0400 (EDT) From: der Mouse Message-Id: <200404272248.SAA04945@Sparkle.Rodents.Montreal.QC.CA> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Erik-Conspiracy: There is no Conspiracy - and if there were I wouldn't be part of it anyway. To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <16526.55047.872593.696375@world.std.com> References: <8014E072-9685-11D8-A46E-000393863768@chromatix.demon.co.uk> <16524.3834.261410.998419@world.std.com> <0CCE8697-96FE-11D8-A46E-000393863768@chromatix.demon.co.uk> <16525.31022.249245.795386@world.std.com> <200404270456.AAA29089@Sparkle.Rodents.Montreal.QC.CA> <16526.55047.872593.696375@world.std.com> Content-Transfer-Encoding: 8bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 18:32:33 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit >> So, don't be coy, tell us: what _does_ it cost to transport an email >> - let's be generous and say a hundred-kilobyte email - from point A >> to point B? > Why would you only want to include transportation/bandwidth costs? Because we were discussing the transportation costs of email as compared to its other costs. The quote from chromi in the message of yours that I replied to is "By contrast, the transportation costs of e-mail are practically nil.". > Anyhow, what's your point, I seem to have completely lost that, That the transportation costs of email are practically nil, as compared to its other costs (storage, human time, etc). >>> Thus, all spammers are criminals. >> You have not demonstrated this. > Is your point that you doubt that, e.g., hijacking PCs via use of > viruses/trojans and using them for personal gain (spamming) isn't > criminal? No. Only that your arguments did not support the conclusion you (apparently) marshaled them to support. It's not that I doubt the conclusion (while it's inevitably jurisdiction-specific, I think it's probably true in most relevant jurisdictions); I'm just calling you on your invalid argument technique. > My point is that spammers' economics are such that they could not be > the problem they are without mass unauthorized utilization of others' > resources, Yes (most notably the recipients' inboxes and eyeball time). > such as the current favorite mode of using hijacked zombie PCs by the > thousands. "such as", perhaps. But you appeared to be arguing that the spammers needed to use the zombie armies for economic reasons, which I think is false - I think they do it to avoid widespread IP-based blocking. I'm not going to try to argue that point here; I argued it in my previous message, and nothing you said disputed it either the arguments or the conclusion as far as I could see. It's relevant here because antispam techniques that are grounded in things such as the assumption that spammers are using zombies for economic reasons will (probably) fail because their underlying assumptions are invalid. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 19:47:21 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11752 for ; Tue, 27 Apr 2004 19:47:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcEe-0001EO-RF for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 19:43:32 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RNhWKn004725 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 19:43:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcBT-0000ot-O3 for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 19:40:15 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10963 for ; Tue, 27 Apr 2004 19:40:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIcBQ-0004pm-1g for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:40:12 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIcAG-0004YU-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:39:01 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIc9J-0004LQ-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:38:01 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIbzk-0003eL-12 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:28:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbwj-0006lK-Uo; Tue, 27 Apr 2004 19:25:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbqA-000642-C2 for asrg@optimus.ietf.org; Tue, 27 Apr 2004 19:18:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA09573 for ; Tue, 27 Apr 2004 19:18:10 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIbq6-0001xa-RW for asrg@ietf.org; Tue, 27 Apr 2004 19:18:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIbpD-0001sH-00 for asrg@ietf.org; Tue, 27 Apr 2004 19:17:15 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BIboc-0001mq-00 for asrg@ietf.org; Tue, 27 Apr 2004 19:16:38 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BIboe-0006Yt-00 for asrg@ietf.org; Tue, 27 Apr 2004 19:16:40 -0400 Received: from [68.246.18.107] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BIbod-0006UU-00 for asrg@ietf.org; Tue, 27 Apr 2004 19:16:40 -0400 Message-ID: <408EE9D0.30308@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 3. E-postage and rate limiting - next steps Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 19:16:32 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit While the discussions may have been rather interesting at times, what next steps should be taken within the context of this group. Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "Some lies are easier to believe than the truth" (Dune) ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 19:47:24 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11770 for ; Tue, 27 Apr 2004 19:47:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcEf-0001FE-Sb for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 19:43:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3RNhXxu004778 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 19:43:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcBc-0000p1-NN for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 19:40:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10993 for ; Tue, 27 Apr 2004 19:40:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIcBZ-0004sK-0W for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:40:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIcAP-0004aA-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:39:10 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIc9K-0004Lh-01 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:38:02 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIbxd-0003aC-AU for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 19:25:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIbrs-0006C9-Jv; Tue, 27 Apr 2004 19:20:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIW4V-0004Nj-P8 for asrg@optimus.ietf.org; Tue, 27 Apr 2004 13:08:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA13516 for ; Tue, 27 Apr 2004 13:08:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIW4R-0005o2-Rv for asrg@ietf.org; Tue, 27 Apr 2004 13:08:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIW2J-0005OZ-00 for asrg@ietf.org; Tue, 27 Apr 2004 13:06:24 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIVzz-00055Y-00 for asrg@ietf.org; Tue, 27 Apr 2004 13:03:59 -0400 Received: from h210.c136.b246.tor.eicat.ca ([66.246.136.210] helo=shell.vex.net) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIVq5-0004xP-0o for asrg@ietf.org; Tue, 27 Apr 2004 12:53:45 -0400 Received: from smaug.vex.net (smaug.vex.net [66.246.136.211]) by shell.vex.net (Postfix) with ESMTP id CC9C1F635; Tue, 27 Apr 2004 12:53:39 -0400 (EDT) Received: from mail.crlf.net (mail.crlf.net [216.126.92.195]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (No client certificate requested) by smaug.vex.net (Postfix) with ESMTP id 8AAF32D8A0; Tue, 27 Apr 2004 12:53:37 -0400 (EDT) From: David Maxwell To: Yakov Shafranovich Cc: Jonathan Morton , Chris Lewis , asrg@ietf.org Subject: Re: [Asrg] hashcash, was My take on e-postage Message-ID: <20040427165339.GC22336@mail> References: <408D55EA.4000008@americasm01.nt.com> <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> <408DA034.60203@solidmatrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <408DA034.60203@solidmatrix.com> User-Agent: Mutt/1.4.2i Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 12:53:39 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Mon, 26 Apr 2004, Yakov Shafranovich wrote: > Jonathan Morton wrote: > >So, OK, this is definitely going to turn off the non-hardcore spammers. > > Those that are left will be the ones to send the law after. Theft of > >service and computer intrusion on this kind of scale is a crime, no > >matter whether the actual spam is. > > What you also have to factor here is how much money will be saved in > order to produce this reduction versus the costs required to convert > everybody to hashcash. You also need to factor in the ongoing costs to update the hashcash mechanism. You may need to either increase the number of bits collided, as generic hardware capability vs cost increases, or replace the scheme, if the hashing algorithm is broken, or specialized hardware is built. -- David Maxwell, david@vex.net|david@maxwell.net --> All this stuff in twice the space would only look half as bad! - me _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 20:08:32 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12799 for ; Tue, 27 Apr 2004 20:08:32 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcbb-0004VI-SU for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 20:07:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S07FvL017308 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 20:07:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcZr-0004Ez-O4 for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 20:05:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12584 for ; Tue, 27 Apr 2004 20:05:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIcZn-0000Gj-Qy for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 20:05:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIcYp-000071-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 20:04:24 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIcY1-0007nb-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 20:03:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcPp-0002dK-59; Tue, 27 Apr 2004 19:55:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIcJM-0001wS-LM for asrg@optimus.ietf.org; Tue, 27 Apr 2004 19:48:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11862 for ; Tue, 27 Apr 2004 19:48:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIcJI-00064d-RA for asrg@ietf.org; Tue, 27 Apr 2004 19:48:20 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIcIK-0005wV-00 for asrg@ietf.org; Tue, 27 Apr 2004 19:47:21 -0400 Received: from sokol.elan.net ([216.151.192.200]) by ietf-mx with esmtp (Exim 4.12) id 1BIcHh-0005pO-00 for asrg@ietf.org; Tue, 27 Apr 2004 19:46:41 -0400 Received: from sokol.elan.net (localhost.localdomain [127.0.0.1]) by sokol.elan.net (8.12.11/8.12.5) with ESMTP id i3S10lxi010746 for ; Tue, 27 Apr 2004 18:00:48 -0700 Received: from localhost (william@localhost) by sokol.elan.net (8.12.11/8.12.5/Submit) with ESMTP id i3S10luc010743 for ; Tue, 27 Apr 2004 18:00:47 -0700 X-Authentication-Warning: sokol.elan.net: william owned process doing -bs From: "william(at)elan.net" To: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: <16526.55047.872593.696375@world.std.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 18:00:47 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 As I'm trying to go through emails of last week when I was on vacation I get somewhat tired of seeing the same arguments over and over again on this never-ending thread. Without specifically commenting if e-postage is doable or has any chance of being adapted, I'd instead like people here to consider the reasons why e-postage is being proposed, what are the problems its supposed to solve and then see if there exist any other solutions that may accomplish the same and possible not have the same likely high implementation costs as e-postage. The reasons that I heard e-postage advocates make that they think e-postage can solve are: 1. To equalize cost of email distribution (the presumption made is that its cheaper for sender to send email then for recepient to process and store it). 2. To make cost of sending each piece of commercial advertisement email to be higher then possible profit that could result from the majority of spam offers with typical low-response rate. Thus making spammers use very targetted email lists with low # of complaints from those who receive their emails. Please consider if there exist other general problems that e-postage attempts to solve and post about it as well as thereafter consider if there exist other solutions that may solve these problems. Also in these and other discussions about cost of sending emails, you might want to consider that cost of rejecting email during initial stage of SMTP transmission is very low (can be considered 0 for practical purposes) where as cost is quite real for fully SMTP received email that is thereafter sent through filters, classified as spam, stored for human verification, etc -- William Leibzon Elan Networks william@elan.net _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 23:21:30 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20591 for ; Tue, 27 Apr 2004 23:21:30 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfYr-0001oT-6e for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 23:16:37 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S3GbNa006965 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 23:16:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfUz-0001Ly-G8 for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 23:12:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20045 for ; Tue, 27 Apr 2004 23:12:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIfUv-0001Tw-KA for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:12:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIfRs-000137-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:09:26 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIfQ2-0000fu-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:07:30 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIfM3-0006sP-EF for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:03:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfIo-0008Du-Dw; Tue, 27 Apr 2004 23:00:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfCe-0007UU-3L for asrg@optimus.ietf.org; Tue, 27 Apr 2004 22:53:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19184 for ; Tue, 27 Apr 2004 22:53:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIfCY-0006Ix-Fc for asrg@ietf.org; Tue, 27 Apr 2004 22:53:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIfBf-00069c-00 for asrg@ietf.org; Tue, 27 Apr 2004 22:52:40 -0400 Received: from peacock.verisign.com ([65.205.251.73]) by ietf-mx with esmtp (Exim 4.12) id 1BIfAn-0005zO-00 for asrg@ietf.org; Tue, 27 Apr 2004 22:51:45 -0400 Received: from mou1wnexc02.vcorp.ad.vrsn.com (verisign.com [65.205.251.54]) by peacock.verisign.com (8.12.11/) with ESMTP id i3S2pmDu006162; Tue, 27 Apr 2004 19:51:48 -0700 (PDT) Received: by mou1wnexc02.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Tue, 27 Apr 2004 19:51:48 -0700 Message-ID: From: "Hallam-Baker, Phillip" To: "'Barry Shein'" , John Levine Cc: asrg@ietf.org, richard_willey@symantec.com Subject: RE: [Asrg] (no subject) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 19:51:47 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.6 required=5.0 tests=AWL,NO_COST autolearn=no version=2.60 > 5 billion transactions per day doesn't impress me as proof positive > of anything, particularly world-wide. > > Obviously if we can deliver that many emails per day THEN WE CLEARLY > CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? The fact we perform 5 billion transactions with no charge mechanism in an entirely decentralized fashion does not provide an existence proof for being able to resolve 5 billion charge transactions. VeriSign handles 5 billion transactions a day and many milions of payment transactions, they even flow through some of the same systems. But they are not directly equivalent. A single payment transaction costs several hundred times more to support than a single DNS transaction. Funny thing is that the minute I suggest accreditation, which would involve each mail server requiring an SSL cert equivalent we have people railing against 'the VeriSign tax'. Then folk go and suggest a payment system which will inevitably require micropayments. Go work out where the cybercash IP is owned. I don't see the market opportunity here. Setting up a system that could handle the demands is certainly possible, it is already in place for the telephone. But the telephone markets are trending towards flat fee charging. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Tue Apr 27 23:21:41 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20610 for ; Tue, 27 Apr 2004 23:21:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfYs-0001p4-4z for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 23:16:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S3GclB007001 for asrg-archive@odin.ietf.org; Tue, 27 Apr 2004 23:16:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfVE-0001MX-Jp for asrg-web-archive@optimus.ietf.org; Tue, 27 Apr 2004 23:12:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20078 for ; Tue, 27 Apr 2004 23:12:49 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIfVA-0001Ui-NF for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:12:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIfSC-0001Bl-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:09:47 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIfQ9-0000fu-00 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:07:37 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIfJt-0006pQ-62 for asrg-web-archive@ietf.org; Tue, 27 Apr 2004 23:01:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfC1-0007TO-IB; Tue, 27 Apr 2004 22:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIf7g-0006yQ-Pv for asrg@optimus.ietf.org; Tue, 27 Apr 2004 22:48:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA18983 for ; Tue, 27 Apr 2004 22:48:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIf7b-0005SQ-Dy for asrg@ietf.org; Tue, 27 Apr 2004 22:48:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIf6g-0005JH-00 for asrg@ietf.org; Tue, 27 Apr 2004 22:47:30 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BIf5t-0005AD-00 for asrg@ietf.org; Tue, 27 Apr 2004 22:46:41 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BIf5X-0003vP-NI; Wed, 28 Apr 2004 03:46:19 +0100 In-Reply-To: <20040427165339.GC22336@mail> References: <408D55EA.4000008@americasm01.nt.com> <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> <408DA034.60203@solidmatrix.com> <20040427165339.GC22336@mail> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <34737540-98BE-11D8-9B38-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: Chris Lewis , asrg@ietf.org, Yakov Shafranovich From: Jonathan Morton Subject: Re: [Asrg] hashcash, was My take on e-postage To: David Maxwell X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 03:46:09 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> So, OK, this is definitely going to turn off the non-hardcore >>> spammers. >>> Those that are left will be the ones to send the law after. Theft of >>> service and computer intrusion on this kind of scale is a crime, no >>> matter whether the actual spam is. >> >> What you also have to factor here is how much money will be saved in >> order to produce this reduction versus the costs required to convert >> everybody to hashcash. Implementation costs are pretty low - a small plugin or extra feature in each popular MUA, plus possibly a verifier in the MTA or MDA chain. Aunt Tillie's prehistoric Mac is taken care of by a plugin for Eudora v3, for example. Low-power mobile devices may have a problem generating hashcash themselves, but their upstream provider may be able to do it for them, especially if they already charge (however indirectly) for e-mail. There's an education cost to get users to adopt it, but this should be minimal compared to many other schemes. Once the plugin/feature is installed, it should be possible to make both the hashcash generation and signature transparent to the user, except for the processing latency. Whitelisting can be ignored for truly novice users, but should be easy to teach to most, and will improve efficiency. Subscription to mailing lists and use of e-mail forwarding boxes will require adding acceptable "to" addresses to an internal list, which will be an interesting user-interface problem, but not insurmountable. Running costs are a certain amount of CPU time on the sender side, when sending to a recipient who hasn't whitelisted them yet. > You also need to factor in the ongoing costs to update the hashcash > mechanism. > > You may need to either increase the number of bits collided, as generic > hardware capability vs cost increases, or replace the scheme, if the > hashing algorithm is broken, or specialized hardware is built. If specialised hardware is built for one hash algorithm, it will be built for whatever other hash we migrate to as well, so unless the hash is actually cracked, we don't need to worry about changing it. The solution in the case of hardware acceleration being built is to move to a higher bit count, and start getting Taiwan to make cheap hash coprocessors so that ordinary users keep up with the spammers. Many users won't actually need the coprocessors, because they'll already have adequate mutual whitelists (so that hashcash is rarely needed) and/or decently powerful computers (which can generate even high values of hashcash in a reasonable time). Users who must contact strangers on a regular basis, such as sales and customer service departments, will benefit from the coprocessors. In this ecology, is there a place for paid-for e-stamps? Yes there is, in one form or another. How about if an "e-stamp" is nothing more than a hashcash token generated by a third party, to the sender's specifications on the sender's payment? That way, verification is no harder than for hashcash (ie. almost trivial), there's no need for inter-vendor settlements, there's almost no barrier to entry for vendors and there's no limit to scaling. It also means that hashcash becomes available to all, no matter what their hardware. The vendors are also in a good position to upgrade to coprocessor hardware, if and when it becomes necessary - which might, for particularly successful vendors, be before the spammers complete *their* prototype. It means Aunt Tillie doesn't need to find and buy a coprocessor for her Mac IIcx in order to file her tax return on time, or join a gardening discussion list. A popular argument as to why e-postage requires a micropayment system is that the money should go to the recipient. I don't think the money needs to go that far - just the value. We value having a nice, clean inbox - isn't that enough? -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 00:11:00 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22830 for ; Wed, 28 Apr 2004 00:11:00 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgMn-000062-Rv for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 00:08:13 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S48Df8000365 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 00:08:13 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgK8-0007Um-Tr for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 00:05:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22502 for ; Wed, 28 Apr 2004 00:05:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIgK4-0002rC-LH for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:05:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIgJ7-0002hE-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:04:26 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIgII-0002W9-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:03:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgB1-0006Gf-5k; Tue, 27 Apr 2004 23:56:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIfu3-0004cW-Gx for asrg@optimus.ietf.org; Tue, 27 Apr 2004 23:38:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21473 for ; Tue, 27 Apr 2004 23:38:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIftz-00061c-Dl for asrg@ietf.org; Tue, 27 Apr 2004 23:38:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIft3-0005r6-00 for asrg@ietf.org; Tue, 27 Apr 2004 23:37:30 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BIfsE-0005gX-00 for asrg@ietf.org; Tue, 27 Apr 2004 23:36:39 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BIfsH-0004Cv-Mg; Wed, 28 Apr 2004 04:36:41 +0100 In-Reply-To: <408EE9D0.30308@solidmatrix.com> References: <408EE9D0.30308@solidmatrix.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <435294DC-98C5-11D8-A28E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: ASRG From: Jonathan Morton Subject: Re: [Asrg] 3. E-postage and rate limiting - next steps To: Yakov Shafranovich X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 04:36:41 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > While the discussions may have been rather interesting at times, what > next steps should be taken within the context of this group. How about figuring out a robust hashcash and signature mechanism, and considering how well it would work, including the possibility of third parties selling hashcash as a form of decentralised e-postage. There's already some work in this area, which can be built upon, but a summary of this would be useful. Oh, and I think I've figured out a way to do signatures without involving the message content (which is liable to change in transit under various circumstances). It ties in neatly with hashcash. :) Simply put, since the hashcash must be unique per message, do the signature on the hashcash rather than the message itself. For messages which don't require high-value hashcash due to whitelisting, generate a trivial (say 8-bit) unique hashcash and use that for the signature. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 00:13:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22929 for ; Wed, 28 Apr 2004 00:13:16 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgPG-0000gr-19 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 00:10:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S4AkAJ002645 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 00:10:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgN8-000082-4e for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 00:08:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22629 for ; Wed, 28 Apr 2004 00:08:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIgN3-0003S0-Qc for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:08:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIgMC-0003FR-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:07:37 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIgLD-00033U-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:06:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgCH-0006N8-GA; Tue, 27 Apr 2004 23:57:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIg6b-0005q5-C7 for asrg@optimus.ietf.org; Tue, 27 Apr 2004 23:51:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21999 for ; Tue, 27 Apr 2004 23:51:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIg6W-0000Q5-TP for asrg@ietf.org; Tue, 27 Apr 2004 23:51:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIg5i-0000Gv-00 for asrg@ietf.org; Tue, 27 Apr 2004 23:50:35 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BIg5N-00007R-00 for asrg@ietf.org; Tue, 27 Apr 2004 23:50:13 -0400 Received: (qmail 28586 invoked by uid 100); 28 Apr 2004 03:50:10 -0000 Message-ID: <20040428035010.28585.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] no e-postage In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Cc: pbaker@verisign.com Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 28 Apr 2004 03:50:10 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.5 required=5.0 tests=AWL,NO_COST autolearn=no version=2.60 >> 5 billion transactions per day doesn't impress me as proof positive >> of anything, particularly world-wide. >> >> Obviously if we can deliver that many emails per day THEN WE CLEARLY >> CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? > >The fact we perform 5 billion transactions with no charge mechanism in an >entirely decentralized fashion does not provide an existence proof for >being able to resolve 5 billion charge transactions. ... Wow, who'd have thought that Phill would write a message and I'd agree with every word. Since what Barry seems to mean by e-postage is what other people call rate limiting and perhaps usage based charging, I wouldn't be averse to some suggestions about how we might do the former. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 00:16:02 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA23059 for ; Wed, 28 Apr 2004 00:16:02 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgSE-0001RT-TU for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 00:13:51 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S4DovK005535 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 00:13:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgPL-0000io-NF for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 00:10:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22825 for ; Wed, 28 Apr 2004 00:10:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIgPH-0003ul-AR for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:10:47 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIgOM-0003iV-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:09:51 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIgNl-0003Vi-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 00:09:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgLd-00081J-87; Wed, 28 Apr 2004 00:07:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgCO-0006NE-Vk for asrg@optimus.ietf.org; Tue, 27 Apr 2004 23:57:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA22096 for ; Tue, 27 Apr 2004 23:57:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIgCK-0001MF-KC for asrg@ietf.org; Tue, 27 Apr 2004 23:57:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIgBL-0001CT-00 for asrg@ietf.org; Tue, 27 Apr 2004 23:56:23 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BIgB4-00013a-00 for asrg@ietf.org; Tue, 27 Apr 2004 23:56:06 -0400 Received: (qmail 907 invoked by uid 100); 28 Apr 2004 03:56:09 -0000 Message-ID: <20040428035609.906.qmail@xuxa.iecc.com> From: John Levine Subject: Re: [Asrg] My take on e-postage In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA To: asrg@ietf.org Cc: william@elan.net Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 28 Apr 2004 03:56:09 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >Please consider if there exist other general problems that e-postage >attempts to solve and post about it as well as thereafter consider if >there exist other solutions that may solve these problems. 3. To improve delivery rates for legitimate bulk mailers. 4. To make vendors of e-postage systems rich. Of all the arguments advanced for e-postage, #3 is the only one that ever made sense, but there are approaches other than per-message metering that address that problem. Look at Ironport's Bonded Sender, for example. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 01:49:05 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA27036 for ; Wed, 28 Apr 2004 01:49:05 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIhvC-0005R3-FE for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 01:47:50 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S5loOw020885 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 01:47:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIhpb-00044Q-Km for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 01:42:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA26356 for ; Wed, 28 Apr 2004 01:42:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIhpW-0006Fy-Fb for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 01:41:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIhoI-00060S-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 01:40:43 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIhns-0005mq-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 01:40:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIhgv-0002NC-Sw; Wed, 28 Apr 2004 01:33:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgXn-0002YQ-Gn for asrg@optimus.ietf.org; Wed, 28 Apr 2004 00:19:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA23173 for ; Wed, 28 Apr 2004 00:19:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIgXi-0005Sr-V5 for asrg@ietf.org; Wed, 28 Apr 2004 00:19:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIgWu-0005IL-00 for asrg@ietf.org; Wed, 28 Apr 2004 00:18:41 -0400 Received: from mail1.panix.com ([166.84.1.72]) by ietf-mx with esmtp (Exim 4.12) id 1BIgVu-00056u-00 for asrg@ietf.org; Wed, 28 Apr 2004 00:17:38 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail1.panix.com (Postfix) with ESMTP id BBF4D4915C for ; Tue, 27 Apr 2004 23:11:57 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3S3B4R20912; Tue, 27 Apr 2004 23:11:04 -0400 (EDT) Message-Id: <200404280311.i3S3B4R20912@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <34737540-98BE-11D8-9B38-000393863768@chromatix.demon.co.uk> (message from Jonathan Morton on Wed, 28 Apr 2004 03:46:09 +0100) Subject: Re: [Asrg] hashcash, was My take on e-postage References: <408D55EA.4000008@americasm01.nt.com> <3EB63686-97D7-11D8-A46E-000393863768@chromatix.demon.co.uk> <408DA034.60203@solidmatrix.com> <20040427165339.GC22336@mail> <34737540-98BE-11D8-9B38-000393863768@chromatix.demon.co.uk> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Tue, 27 Apr 2004 23:11:04 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Jonathan Morton wrote: > If specialised hardware is built for one hash algorithm, it will be > built for whatever other hash we migrate to as well, so unless the hash > is actually cracked, we don't need to worry about changing it. Changing the hash makes the specialized hardware worthless; if it's spammers who paid for it, that raises their costs. > The solution in the case of hardware acceleration being built is to > move to a higher bit count, Thereby preventing my mother on her 486 from sending 3 messages a day. > and start getting Taiwan to make cheap hash > coprocessors so that ordinary users keep up with the spammers. How does that plug into a 486? > Users who must contact strangers on a regular basis, such as sales > and customer service departments, will benefit from the > coprocessors. Why would they be contacting strangers? They would generally be _replying_, so should expect to be whitelisted. Sales and customer service departments should expect to _receive_ lots of mail from strangers, so if they set their prices too high, they lose business. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 01:49:37 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA27132 for ; Wed, 28 Apr 2004 01:49:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIhvR-0005WM-7m for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 01:48:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3S5m5d9021217 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 01:48:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIhs8-0004hq-Kf for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 01:44:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA26636 for ; Wed, 28 Apr 2004 01:44:38 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIhs3-00071L-FD for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 01:44:35 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIhr6-0006iz-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 01:43:37 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIhpu-0006JL-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 01:42:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIhh9-0002R7-Jz; Wed, 28 Apr 2004 01:33:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIgs9-000569-RL for asrg@optimus.ietf.org; Wed, 28 Apr 2004 00:40:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA24543 for ; Wed, 28 Apr 2004 00:40:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIgs5-0002B5-66 for asrg@ietf.org; Wed, 28 Apr 2004 00:40:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIgr4-0001zi-00 for asrg@ietf.org; Wed, 28 Apr 2004 00:39:30 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BIgqf-0001o4-00 for asrg@ietf.org; Wed, 28 Apr 2004 00:39:06 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id ADAF2A3C04; Wed, 28 Apr 2004 14:08:29 +0930 (CST) Received: from rebel (ppp43-226.lns1.adl1.internode.on.net [150.101.43.226]) by mail.chariot.net.au (Postfix) with SMTP id EC4A55F72F; Wed, 28 Apr 2004 14:08:28 +0930 (CST) From: "Chris" To: "John Levine" , Cc: Subject: RE: [Asrg] My take on e-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <20040428035609.906.qmail@xuxa.iecc.com> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 14:07:49 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit An e-postage system would need to account for the every day person. why should they be charged for sending what is currently free? So if we take that into consideration what is the limit on the number of emails for free or charged 10,20 per day ? Who polices that level. what about China who polices it there? Ok set the level at zero. the average Joe will cop it sweet if it keeps spam out of their mail box. Does anyone here think e-mail will survive beyond a fee ? If so go ahead and introduce a fee. see how long it takes before an alternative becomes available. I will start writing one as soon as e-postage looks inevitable! Regards Chris P.S. How many of you would subscribe to this list if it was going to cost $0.20 every time And who pays for the duplicates we all receive? > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of John > Levine > Sent: Wednesday, 28 April 2004 1:26 PM > To: asrg@ietf.org > Cc: william@elan.net > Subject: Re: [Asrg] My take on e-postage > > > >Please consider if there exist other general problems that e-postage > >attempts to solve and post about it as well as thereafter consider if > >there exist other solutions that may solve these problems. > > 3. To improve delivery rates for legitimate bulk mailers. > > 4. To make vendors of e-postage systems rich. > > Of all the arguments advanced for e-postage, #3 is the only one that > ever made sense, but there are approaches other than per-message > metering that address that problem. Look at Ironport's Bonded Sender, > for example. > > Regards, > John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY > http://www.taugh.com > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 11:52:46 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23229 for ; Wed, 28 Apr 2004 11:52:46 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIrFM-0006f6-Ti for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 11:45:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SFjGHq025606 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 11:45:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIr0B-0001dH-2R for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 11:29:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA21595 for ; Wed, 28 Apr 2004 11:29:32 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIr08-0007Fr-Sf for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 11:29:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIqzp-0007AU-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 11:29:13 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIqyt-000750-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 11:28:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIqlb-0007VN-VQ; Wed, 28 Apr 2004 11:14:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIq9B-0000Sy-1Z for asrg@optimus.ietf.org; Wed, 28 Apr 2004 10:34:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA17770 for ; Wed, 28 Apr 2004 10:34:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIq8k-0001xE-UR for asrg@ietf.org; Wed, 28 Apr 2004 10:34:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIq70-0001cr-00 for asrg@ietf.org; Wed, 28 Apr 2004 10:32:35 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BIq6E-0001Ni-00 for asrg@ietf.org; Wed, 28 Apr 2004 10:31:46 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id BC6C716CCA for ; Wed, 28 Apr 2004 10:36:42 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: The end result of E-postage (was Re: [Asrg] (no subject) ) In-Reply-To: Your message of "Tue, 27 Apr 2004 19:51:47 PDT." Message-Id: <20040428143642.BC6C716CCA@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 10:36:42 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.5 required=5.0 tests=AWL,NO_COST autolearn=no version=2.60 "Hallam-Baker, Phillip" wrote: > The fact we perform 5 billion transactions with no charge mechanism in an > entirely decentralized fashion does not provide an existence proof for > being able to resolve 5 billion charge transactions. One way to lower the number of messages is to aggregate the costs per ISP over time. e.g. Rather than accounting for each transaction, account for N transactions between you and ISP X over Y hours. The real charges can then be based on differentials, and not on absolute numbers. "You're charging me $1000 for my mail, but I'm charging you $900 for mail you sent to me, so I've only got to pay you $100." The end result of this system, though, ends up looking a lot like accreditation, where the accreditation is "ISP is/is-not revenue-neutral to the rest of the net." i.e. has a balanced flow of traffic, OR pays his bills on time. We already know that spammers hide their traffic on zombie machines, so this system won't let us bill the spammers. Rather, it lets the spammed recipients bill the ISP originating the spam for not fixing their system. The ISP is then free to push those bills onto their customers, who are running zombied machines. That's probably the one real utility of any e-postage system: Permit better accounting of the cost of spam. Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 13:04:26 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA29017 for ; Wed, 28 Apr 2004 13:04:26 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIsGZ-0006GH-NR for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 12:50:36 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SGoZLV024069 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 12:50:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIsAN-0004rG-MB for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 12:44:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA27654 for ; Wed, 28 Apr 2004 12:44:08 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIsAK-0005vC-OG for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 12:44:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIs9Z-0005s4-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 12:43:22 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIs8p-0005mq-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 12:42:35 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIrxg-0002CO-5S; Wed, 28 Apr 2004 12:31:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIrqi-0000Fr-Qm for asrg@optimus.ietf.org; Wed, 28 Apr 2004 12:23:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25929 for ; Wed, 28 Apr 2004 12:23:49 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIrqg-0004YG-2j for asrg@ietf.org; Wed, 28 Apr 2004 12:23:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIrpt-0004Wa-00 for asrg@ietf.org; Wed, 28 Apr 2004 12:23:02 -0400 Received: from peacock.verisign.com ([65.205.251.73]) by ietf-mx with esmtp (Exim 4.12) id 1BIrpU-0004Ts-00 for asrg@ietf.org; Wed, 28 Apr 2004 12:22:36 -0400 Received: from mou1wnexc02.vcorp.ad.vrsn.com (verisign.com [65.205.251.54]) by peacock.verisign.com (8.12.11/) with ESMTP id i3SGMaNO017618; Wed, 28 Apr 2004 09:22:36 -0700 (PDT) Received: by mou1wnexc02.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Wed, 28 Apr 2004 09:22:36 -0700 Message-ID: From: "Hallam-Baker, Phillip" To: "'Alan DeKok'" , asrg@ietf.org MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Subject: [Asrg] Death, taxes and E-Postage. Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 09:22:34 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 > One way to lower the number of messages is to aggregate the costs > per ISP over time. e.g. Rather than accounting for each transaction, > account for N transactions between you and ISP X over Y hours. > > The real charges can then be based on differentials, and not on > absolute numbers. "You're charging me $1000 for my mail, but I'm > charging you $900 for mail you sent to me, so I've only got to pay you > $100." Sure we could do clearing. Any idea what it would take to set up such a system? The actual figures would be rather different and go through a clearing center: You used $900 worth of mail services during the billing period You provided $1000 worth of mail services during the billing period Charge for services used $918.00 Payment of services rendered -$980.00 Billing Fee $50.00 FCC connection surcharge $21.00 ACC intentional fee $12.23 Common fund $10.00 Technology fee $19.00 AMOUNT DUE $50.23 If you think otherwise take a look at your cellphone bill or your cable bill. Oh and if you are a private individual you would also owe taxes on the $980 but you could not offset the $918 you paid. The $980 is income, you can only offset the fees that were necessarily incurred in order to earn that income. You might arguably claim the $112.23 in charges but only if they were on the incomming. So you would actually be out of pocket $343.00 + 50.23 = 393.23 assuming a 35% tax rate. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 15:06:39 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08523 for ; Wed, 28 Apr 2004 15:06:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIuG9-0002J7-C1 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 14:58:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SIwHfR008870 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 14:58:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIuAu-0000pB-AE for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 14:52:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07251 for ; Wed, 28 Apr 2004 14:52:49 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIuAq-0006yv-9C for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 14:52:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIu9s-0006qo-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 14:51:49 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIu9D-0006kt-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 14:51:07 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BItwV-0005zX-D0 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 14:38:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BItpl-0004cE-22; Wed, 28 Apr 2004 14:31:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BItfT-0002BE-1p for asrg@optimus.ietf.org; Wed, 28 Apr 2004 14:20:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05453 for ; Wed, 28 Apr 2004 14:20:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BItfP-00054V-56 for asrg@ietf.org; Wed, 28 Apr 2004 14:20:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIteV-00052H-00 for asrg@ietf.org; Wed, 28 Apr 2004 14:19:23 -0400 Received: from [66.98.212.93] (helo=tin.nixcartel.org) by ietf-mx with esmtp (Exim 4.12) id 1BItdX-0004zG-00 for asrg@ietf.org; Wed, 28 Apr 2004 14:18:23 -0400 Received: from dvb.homelinux.org (unknown [202.88.170.34]) by tin.nixcartel.org (Postfix) with ESMTP id 316D81AC06C for ; Wed, 28 Apr 2004 13:23:20 -0500 (CDT) Received: by dvb.homelinux.org (Postfix, from userid 500) id F324334022; Wed, 28 Apr 2004 23:47:55 +0530 (IST) From: Devdas Bhagat To: asrg@ietf.org Subject: Re: [Asrg] Death, taxes and E-Postage. Message-ID: <20040428234755.A26721@evita.devdas.geek> Reply-To: Devdas Bhagat References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: ; from pbaker@verisign.com on Wed, Apr 28, 2004 at 09:22:34AM -0700 X-Message-Flag: Friends protect friends from Microsoft Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 23:47:55 +0530 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On 28/04/04 09:22 -0700, Hallam-Baker, Phillip wrote: > You used $900 worth of mail services during the billing period > You provided $1000 worth of mail services during the billing period > > Charge for services used $918.00 > Payment of services rendered -$980.00 > Billing Fee $50.00 > FCC connection surcharge $21.00 International connection taxes as well, and surcharges there. > So you would actually be out of pocket $343.00 + 50.23 = 393.23 assuming a > 35% tax rate. And more if you ever sent an email outside the country (taxes in both jursidictions?). Devdas Bhagat _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 15:41:48 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11749 for ; Wed, 28 Apr 2004 15:41:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIun1-00024K-Ix for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 15:32:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SJWFTp007952 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 15:32:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIudZ-0007xU-1q for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 15:22:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA10225 for ; Wed, 28 Apr 2004 15:22:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIudW-0001Lr-HG for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 15:22:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIucc-0001IB-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 15:21:30 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIubp-0001Fm-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 15:20:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIuSW-0003ys-Uo; Wed, 28 Apr 2004 15:11:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIuM9-0000Kw-LF for asrg@optimus.ietf.org; Wed, 28 Apr 2004 15:04:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08065 for ; Wed, 28 Apr 2004 15:04:26 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIuM5-0000Co-BH for asrg@ietf.org; Wed, 28 Apr 2004 15:04:25 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIuLC-00009D-00 for asrg@ietf.org; Wed, 28 Apr 2004 15:03:30 -0400 Received: from newgiles.striker.ottawa.on.ca ([205.150.200.131] helo=mail.nitros9.org) by ietf-mx with esmtp (Exim 4.12) id 1BIuKL-00004s-00 for asrg@ietf.org; Wed, 28 Apr 2004 15:02:38 -0400 Received: from newgiles.nitros9.org (localhost [127.0.0.1]) by mail.nitros9.org (Postfix) with ESMTP id 575AC16CCA for ; Wed, 28 Apr 2004 15:07:37 -0400 (EDT) From: "Alan DeKok" To: asrg@ietf.org Subject: Re: [Asrg] Death, taxes and E-Postage. In-Reply-To: Your message of "Wed, 28 Apr 2004 09:22:34 PDT." Message-Id: <20040428190737.575AC16CCA@mail.nitros9.org> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 15:07:37 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 "Hallam-Baker, Phillip" wrote: > Sure we could do clearing. Any idea what it would take to set up > such a system? A fair bit, which is why I was concentrating on the "conceptual" portion. "If we did it, ignoring the costs, it would look a lot like system FOO, so why don't we just do FOO from the start, and avoid the costs?" > The actual figures would be rather different and go through a > clearing center: Not necessarily. Clearing centers are used when independent parties wish to exchange information through an accredited service. On the net, people can talk to each other directly, without using an accreditation service for each transaction. e.g. I don't need to contact Verisign to check someones credentials, if I see that their certificate is signed by Verisign. In a theoretical e-postage system, parties can sign messages indicating consent to nullify mutual "costs" for e-postage. Those costs don't have to be real money, they can be e-postage tokens. The only need for a central clearing house is then to deal with the final portions of the costs which aren't mutually negated. But again, if such a system is set up, the end result of e-postage is pretty much a central accreditation service. So why not just set up an accreditation service, and stop the pretense that e-postage is useful? Alan DeKok. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 17:59:52 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26799 for ; Wed, 28 Apr 2004 17:59:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwup-0005e5-H9 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 17:48:27 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SLmRdq021697 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 17:48:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwen-0005js-KH for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:31:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA24368 for ; Wed, 28 Apr 2004 17:31:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIwej-0001Ak-Sv for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:31:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwd3-0000rO-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:30:06 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIwar-0000T8-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:27:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwKi-00025h-DO; Wed, 28 Apr 2004 17:11:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIv40-0005ko-EC for asrg@optimus.ietf.org; Wed, 28 Apr 2004 15:49:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12522 for ; Wed, 28 Apr 2004 15:49:46 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIv3x-0002pT-Kq for asrg@ietf.org; Wed, 28 Apr 2004 15:49:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIv31-0002mH-00 for asrg@ietf.org; Wed, 28 Apr 2004 15:48:48 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BIv2W-0002hK-00 for asrg@ietf.org; Wed, 28 Apr 2004 15:48:16 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc12) with SMTP id <2004042819474101200ngpsbe>; Wed, 28 Apr 2004 19:47:42 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Wed, 28 Apr 2004 14:46:19 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 28 Apr 2004 14:56:35 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Transactions Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 14:56:35 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > Obviously if we can deliver that many emails per day THEN WE CLEARLY CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? > And if we can deliver that many emails today at nearly no incremental cost, or so it appears, then what do you base your insinuation that adding the overhead of metering etc would skyrocket the cost on? Several points. 1) Exception handling on E-mail delivery is very simple... any question about whether it got delivered? Just send it again. Duplicate E-mail delivery isn't considered to be a huge problem. Multiple charging for the same E-mail is obviously a much bigger issue. 2) Auditability. When you're talking about money, you have to be much more disciplined (and you have to deal with correcting the inevitable mistakes etc which suddenly become a much bigger deal). 3) Handling "transactions" involves a much higher degree of guarantees... delivery, non-duplication, accuracy, privacy, etc etc. > We seem to have added all manner of spam filtering, Spam filtering, even quite elaborate spam filtering, is cheap in part because it's inherently single-ended and doesn't therefore require any kind of "delayed handling" (e.g. additional queuing while waiting for responses from other entities elsewhere on the net, dealing with exceptional situations such as cases where expected responses don't ever occur, etc. etc) > ...right down to handshaking with multiple remote blacklists per message and running each one through all kinds of DNS and content checks such as spamassassin or various commercial spam filtering services' software. Stuff that can be done locally is actually very cheap, and scales well. > And all that doesn't seem to have, by its mere overhead, taken down the entire world email system, yet, even if it's a lousy trend. The problem with the free market is that pricing and other abuses and their correction tends to exhibit a time constant that is not compatible with what human expectation wants it to be...! > But it's not unreasonable to predict that if we had a pretty good, unified system for preventing spam in the first place... That's rather like the old joke about the economist, physicist, engineer, etc all marooned on a desert island and eventually a crate of canned food washes ashore, and they all set about trying to figure out how to open the cans. It eventually ends with the economist announcing, "First, let's assume we have a can opener..." :-) The way to stop spam is ultimately for spammers to realize that it has a vanishingly small chance of getting through, and therefore it is largely futile and totally uneconomic to send it. Part of that shift involves making it more difficult or expensive to send spam (legal action, making it harder to create zombie spambots, etc) and part of it involves squashing virtually all the spam somewhere enroute, before any human eyes (likely to benefit the spammer at least) see it. I still very much like the idea of turning the firehose back on the spammer (or their Web/email host perhaps) in a sort of massively distributed retaliatory DDOS attack, but the issues then are whether the spammer being retaliated against is the real one and how to prevent "joe jobbing" (and this is true whether the retaliatory responses are automated, or even if human-approved before the counterstrikes are launched). > (such as an e-postage system as idealized) "idealized" is all too true... this is one of those schemes where the devil TRULY IS in the details and there are a LOT of devils there. In truth, the use of "stamps" would help even if the stamps were FREE and distributed by the addressees upon request. It's not at all clear that paying for them adds much (that's GOOD, anyhow) to the scheme. And in fact, that gets right back to the sort of scheme that I proposed to begin with... where the sender needs to negotiate (by plain ASCII text E-mails, that have to maybe meet size restrictions and can pass through antispam content filters) for permission to send a certain type of mail to the recipient. Whether that permission is granted by the recipient by adding their name and type of mail to the recipient-end whitelist (and then, I suppose, sending them E-mail to say it's okay), or whether that "permission" is granted in the more tangible form as a "postage stamp" or passcode (whether single-use or multiple-use! but 'revokable' without notice in any case) that the sender must include with their future E-mails in order to evidence prior approval... personally, I think it's just as easy for the recipient to look up the sender name (and perhaps 'passcode') and check the incoming E-mail type against that sender's pre-approved permissions as it is to process a "stamp". > ...then all that other overhead infrastructure would be taken apart, or most of it anyhow. Far better, I think, to AVOID the waste of building a pointless worldwide infrastructure that ultimately DOES NOT SOLVE THE PROBLEM (and later to realize that and take it back apart again). Let's be smarter about how we do things. > So why do you keep asserting that adding the overhead that might be incurred in other per-message proposals is so obviously the straw that shall break the camel's back? (gak! lousy sentence, sorry.) It's not just the overhead, and the need for worldwide concurrence. It's the fact that it creates as many problems (or more) than what it solves, and still doesn't fix the spam problem. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 17:59:52 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26802 for ; Wed, 28 Apr 2004 17:59:52 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwus-0005ga-Mx for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 17:48:30 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SLmUga021850 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 17:48:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwfK-0005pg-Hq for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:32:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA24472 for ; Wed, 28 Apr 2004 17:32:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIwfG-0001Fm-RC for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:32:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwdk-0000zk-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:30:49 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIwbN-0000YJ-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:28:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwM5-0002kL-Fr; Wed, 28 Apr 2004 17:12:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIvDV-0000wR-LV for asrg@optimus.ietf.org; Wed, 28 Apr 2004 15:59:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13340 for ; Wed, 28 Apr 2004 15:59:35 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIvDS-0003oi-HM for asrg@ietf.org; Wed, 28 Apr 2004 15:59:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIvCY-0003kQ-00 for asrg@ietf.org; Wed, 28 Apr 2004 15:58:39 -0400 Received: from sccrmhc11.comcast.net ([204.127.202.55]) by ietf-mx with esmtp (Exim 4.12) id 1BIvC7-0003fR-00 for asrg@ietf.org; Wed, 28 Apr 2004 15:58:11 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc11) with SMTP id <2004042819574201100mhnhoe>; Wed, 28 Apr 2004 19:57:42 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Wed, 28 Apr 2004 14:56:43 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 28 Apr 2004 15:06:59 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: asrg@ietf.org X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] HashCash Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 15:06:59 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > How about figuring out a robust hashcash and signature mechanism, and considering how well it would work, including the possibility of third parties selling hashcash as a form of decentralised e-postage. There's already some work in this area, which can be built upon, but a summary of this would be useful. > Oh, and I think I've figured out a way to do signatures without involving the message content (which is liable to change in transit under various circumstances). It ties in neatly with hashcash. :) > Simply put, since the hashcash must be unique per message, do the signature on the hashcash rather than the message itself. For messages which don't require high-value hashcash due to whitelisting, generate a trivial (say 8-bit) unique hashcash and use that for the signature. Hashcash and signatures are non-starters (or deserve to be) for the simple and immutable reason that compromised spambot zombies will pump out large numbers of hashcash-certified, signature-carrying spams. AGAIN, THIS DOES NOT SOLVE THE PROBLEM. It only makes the system more complicated and expensive. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:16:01 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28459 for ; Wed, 28 Apr 2004 18:16:01 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxJD-0002Hk-Es for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMDdT6008779 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwzJ-0007ff-LO for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:53:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA25746 for ; Wed, 28 Apr 2004 17:53:02 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIwzF-00036Z-U7 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:53:01 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwx5-0002iC-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:50:48 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIwwb-0002dE-02 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:50:18 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIwvO-00029j-Oc for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:49:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwhq-0006pp-6E; Wed, 28 Apr 2004 17:35:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwMv-0003P3-IB for asrg@optimus.ietf.org; Wed, 28 Apr 2004 17:13:25 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21968 for ; Wed, 28 Apr 2004 17:13:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIwMs-0006Qb-01 for asrg@ietf.org; Wed, 28 Apr 2004 17:13:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwLf-0006Ef-00 for asrg@ietf.org; Wed, 28 Apr 2004 17:12:08 -0400 Received: from domainmail.richmond.com ([208.253.112.161] helo=messagelevel.com) by ietf-mx with esmtp (Exim 4.12) id 1BIwK5-0005s7-00 for asrg@ietf.org; Wed, 28 Apr 2004 17:10:29 -0400 Message-Id: <200404281709.AA25690228@messagelevel.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: "Bill Mcinnis" Reply-To: To: , "Alan DeKok" Subject: Re: [Asrg] Death, taxes and E-Postage. X-Mailer: X-Declude-Sender: bill.mcinnis@messagelevel.com [127.0.0.1] X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: None [0] X-Note: This E-mail was sent from ([127.0.0.1]). Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 17:09:43 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Regardless of which route you go, you need to establish some sort of message level info in a queryable form, something will need to keep track of who sent what, from where. Once you have set that up, why not just use that check to validate if a message came from where it said it did, by going back to the purported originating system and see if they have the origination record. All that needs to be done from there is to set up a local database to store your origination records, and a module to communicate server to server (or to the central database) to check it. A system can be set up to store records for small mailers (law firsm, etc) who choose not to do that for themselves. bill mcinnis ---------- Original Message ---------------------------------- From: "Alan DeKok" Date: Wed, 28 Apr 2004 15:07:37 -0400 >"Hallam-Baker, Phillip" wrote: >> Sure we could do clearing. Any idea what it would take to set up >> such a system? > > A fair bit, which is why I was concentrating on the "conceptual" >portion. "If we did it, ignoring the costs, it would look a lot like >system FOO, so why don't we just do FOO from the start, and avoid the >costs?" > >> The actual figures would be rather different and go through a >> clearing center: > > Not necessarily. Clearing centers are used when independent parties >wish to exchange information through an accredited service. On the >net, people can talk to each other directly, without using an >accreditation service for each transaction. > > e.g. I don't need to contact Verisign to check someones credentials, >if I see that their certificate is signed by Verisign. > > In a theoretical e-postage system, parties can sign messages >indicating consent to nullify mutual "costs" for e-postage. Those >costs don't have to be real money, they can be e-postage tokens. The >only need for a central clearing house is then to deal with the final >portions of the costs which aren't mutually negated. > > But again, if such a system is set up, the end result of e-postage >is pretty much a central accreditation service. So why not just set >up an accreditation service, and stop the pretense that e-postage is >useful? > > Alan DeKok. > >_______________________________________________ >Asrg mailing list >Asrg@ietf.org >https://www1.ietf.org/mailman/listinfo/asrg > Checked for SPAM and email fraud by MessageLevel. Guarantee the authenticity of your email. (http://www.messagelevel.com) Version 1 / Released April 26, 2004 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:16:34 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28575 for ; Wed, 28 Apr 2004 18:16:34 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxJO-0002UW-5Y for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:54 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMDoHP009573 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIx0c-0007wG-1C for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:54:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA25911 for ; Wed, 28 Apr 2004 17:54:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIx0Y-0003LU-70 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:54:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwxw-0002rG-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:51:41 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIwwm-0002dE-01 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:50:28 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIwsR-00021K-Pp for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:45:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwaB-0004T5-VQ; Wed, 28 Apr 2004 17:27:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwJM-0001hL-Vr for asrg@optimus.ietf.org; Wed, 28 Apr 2004 17:09:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21042 for ; Wed, 28 Apr 2004 17:09:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIwJJ-0005pG-ES for asrg@ietf.org; Wed, 28 Apr 2004 17:09:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwGV-0005J2-00 for asrg@ietf.org; Wed, 28 Apr 2004 17:06:48 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIwDz-0004ud-00 for asrg@ietf.org; Wed, 28 Apr 2004 17:04:11 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3SL49e9015512; Wed, 28 Apr 2004 17:04:09 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id RAA29957; Wed, 28 Apr 2004 17:04:08 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.7239.854384.602331@world.std.com> To: "Chris" Cc: "John Levine" , , Subject: RE: [Asrg] My take on e-postage In-Reply-To: References: <20040428035609.906.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 17:04:07 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Well, for starters I want to thank you for being brutally honest about the concerns regarding e-postage because I think what you say is behind every other criticism. That said... On April 28, 2004 at 14:07 asrg@rebel.com.au (Chris) wrote: > > An e-postage system would need to account for the every day person. why > should they be charged for sending what is currently free? Because the current totally free system isn't working very well as evidenced by our convening here (that is, spam!) Unlimited free resources tend to get abused if there's some way to profit from that use. And that's about where we are right now. > So if we take that into consideration what is the limit on the number of > emails for free or charged 10,20 per day ? One would imagine it'd become a marketing issue, just like the monthly price of a connection and how fast that is, etc. > Who polices that level. what about China who polices it there? Again, the market. As to China, this is probably the least of China's problems. Do we really think we can solve all of China's problems right here or should even take them into account? How about the fact that all the e-mail headers and SMTP etc not to mention the RFCs are in English? Don't you think that poses some disadvantage to the average Chinese person? How would you like it if all that were in Chinese? It's not somewhere we're really set up to go here. > Ok set the level at zero. the average Joe will cop it sweet if it keeps spam > out of their mail box. > > Does anyone here think e-mail will survive beyond a fee ? If the fee is reasonable, like zero for most common, personal usage, etc, yes. > If so go ahead and introduce a fee. see how long it takes before an > alternative becomes available. > > I will start writing one as soon as e-postage looks inevitable! Yeah well you could also try setting up your own phone and postage systems and tell us how it works out. > > Regards > Chris > > P.S. How many of you would subscribe to this list if it was going to cost > $0.20 every time Who suggested $.20? Who suggested it'd be recipient-pays? > And who pays for the duplicates we all receive? Who suggested it'd be recipient-pays? -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:17:35 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28771 for ; Wed, 28 Apr 2004 18:17:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxJT-0002Za-IP for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMDtJo009886 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIx19-00084p-Ls for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:54:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26061 for ; Wed, 28 Apr 2004 17:54:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIx15-0003T2-UP for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:54:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwyl-000302-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:52:31 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIwwy-0002dE-02 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:50:40 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIwqG-0001xN-Qp for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:43:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwUR-0001pc-TO; Wed, 28 Apr 2004 17:21:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIw6g-0006Ct-4R for asrg@optimus.ietf.org; Wed, 28 Apr 2004 16:56:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA19737 for ; Wed, 28 Apr 2004 16:56:35 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIw6c-000423-Oz for asrg@ietf.org; Wed, 28 Apr 2004 16:56:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIw63-0003yo-00 for asrg@ietf.org; Wed, 28 Apr 2004 16:56:00 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIw5Q-0003t9-00 for asrg@ietf.org; Wed, 28 Apr 2004 16:55:20 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3SKtMRd031008; Wed, 28 Apr 2004 16:55:22 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id QAA27205; Wed, 28 Apr 2004 16:55:17 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.6697.641923.780337@world.std.com> To: John Levine Cc: asrg@ietf.org, pbaker@verisign.com Subject: Re: [Asrg] no e-postage In-Reply-To: <20040428035010.28585.qmail@xuxa.iecc.com> References: <20040428035010.28585.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 16:55:05 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.5 required=5.0 tests=AWL,NO_COST autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 28, 2004 at 03:50 asrg@johnlevine.com (John Levine) wrote: > >> 5 billion transactions per day doesn't impress me as proof positive > >> of anything, particularly world-wide. > >> > >> Obviously if we can deliver that many emails per day THEN WE CLEARLY > >> CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? > > > >The fact we perform 5 billion transactions with no charge mechanism in an > >entirely decentralized fashion does not provide an existence proof for > >being able to resolve 5 billion charge transactions. ... > > Wow, who'd have thought that Phill would write a message and I'd agree > with every word. Not surprising since he did a chop-job on my note to turn it into a straw-man to argue with. > Since what Barry seems to mean by e-postage is what other people call > rate limiting and perhaps usage based charging, I wouldn't be averse > to some suggestions about how we might do the former. Since you're adverse to usage-based charging who gets to decide who gets what limit in a rate-limiting scheme? You? Shall we just make you Commissar of E-Mail right now and let you lay down the rules of what content is worthy and what is not and how we may go about enforcing such a regimen? Because that's what's being sold here. If you don't just let people pay for what they use then either you will have vast resource abuse as we have now, or someone gets to decide how much they get to use, and why, by some other means, by making rules and having the power to enforce those rules. Me, I'd rather go into the post office and pay 37c to buy a stamp to mail a letter than try to convince the guy behind the counter that the contents of my letter conform to the postmaster-general's rules and should be of sufficient interest to the intended recipient that they should deliver it for free. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:18:05 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28848 for ; Wed, 28 Apr 2004 18:18:05 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxJU-0002b1-OX for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMDupX009977 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:13:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIx1J-0008BK-J9 for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:55:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26106 for ; Wed, 28 Apr 2004 17:55:06 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIx1F-0003UL-Rj for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:55:05 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwyw-00032k-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:52:43 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIwx1-0002dE-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:50:43 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIwpF-0001tr-Jf for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:42:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwT8-0001D6-Sw; Wed, 28 Apr 2004 17:19:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIvwe-0003Fl-NJ for asrg@optimus.ietf.org; Wed, 28 Apr 2004 16:46:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA18666 for ; Wed, 28 Apr 2004 16:46:14 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIvwb-0002hU-F8 for asrg@ietf.org; Wed, 28 Apr 2004 16:46:13 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIvvN-0002V7-00 for asrg@ietf.org; Wed, 28 Apr 2004 16:44:57 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIvuX-0002MX-00 for asrg@ietf.org; Wed, 28 Apr 2004 16:44:05 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3SKi6Rd009181; Wed, 28 Apr 2004 16:44:06 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id QAA23925; Wed, 28 Apr 2004 16:44:05 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.6037.193578.537697@world.std.com> To: "Hallam-Baker, Phillip" Cc: "'Barry Shein'" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: RE: [Asrg] (no subject) In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 16:44:05 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.5 required=5.0 tests=AWL,NO_COST autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Yeah well via some creative editing you managed to reverse my point and create a straw man to argue with. The responded-to claim was that it's difficult if not impossible to imagine a system which could impose a charging mechanism on 5 billion e-mail msgs/day, too many transactions. I countred that the fact that we obviously handle those 5B msgs/day would not seem to argue AGAINST the possibility of adding a little more processing to each, it would seem to argue FOR the possibility. But a proof? No, not a proof, not either way. Which was my point exactly. On April 27, 2004 at 19:51 pbaker@verisign.com (Hallam-Baker, Phillip) wrote: > > > 5 billion transactions per day doesn't impress me as proof positive > > of anything, particularly world-wide. > > > > Obviously if we can deliver that many emails per day THEN WE CLEARLY > > CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? > > The fact we perform 5 billion transactions with no charge mechanism in an > entirely decentralized fashion does not provide an existence proof for > being able to resolve 5 billion charge transactions. > > VeriSign handles 5 billion transactions a day and many milions of payment > transactions, they even flow through some of the same systems. But they > are not directly equivalent. A single payment transaction costs several > hundred times more to support than a single DNS transaction. > > Funny thing is that the minute I suggest accreditation, which would > involve each mail server requiring an SSL cert equivalent we have people > railing against 'the VeriSign tax'. Then folk go and suggest a payment > system which will inevitably require micropayments. Go work out where > the cybercash IP is owned. > > I don't see the market opportunity here. Setting up a system that could > handle the demands is certainly possible, it is already in place for the > telephone. But the telephone markets are trending towards flat fee > charging. > > > Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:19:36 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29026 for ; Wed, 28 Apr 2004 18:19:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxJY-0002eL-BY for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:14:00 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SME0j7010181 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:14:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIx1l-0008Fy-Pv for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:55:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26266 for ; Wed, 28 Apr 2004 17:55:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIx1h-0003Zo-Vi for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:55:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwzS-00039F-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:53:15 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BIwx9-0002dE-04 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:50:51 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BIwlV-0001jn-22 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:38:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwQn-00080m-4m; Wed, 28 Apr 2004 17:17:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIvt2-0002Ja-SE for asrg@optimus.ietf.org; Wed, 28 Apr 2004 16:42:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA18252 for ; Wed, 28 Apr 2004 16:42:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIvsz-000276-Kt for asrg@ietf.org; Wed, 28 Apr 2004 16:42:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIvry-0001xU-00 for asrg@ietf.org; Wed, 28 Apr 2004 16:41:26 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIvr0-0001qz-00 for asrg@ietf.org; Wed, 28 Apr 2004 16:40:26 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3SKePFd008710; Wed, 28 Apr 2004 16:40:25 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id QAA22914; Wed, 28 Apr 2004 16:40:24 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.5816.592078.439061@world.std.com> To: "william(at)elan.net" Cc: asrg@ietf.org Subject: Re: [Asrg] My take on e-postage In-Reply-To: References: <16526.55047.872593.696375@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 16:40:24 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit 3. a content-neutral way to control the problem. It may not be the only possible approach, but the hidden problem with many other approaches is that they still leave the problem of who gets to decide what is spam and what is not, particularly at the infrastructure level. Put another way for those not following, being able to pay your way tends to be fair in some generally agreed sense, at least it tends to be judgement-neutral as to the content. On the other hand, having to establish some sort of bureaucracy to decide what is spam and what is not could be a very unpleasant road to start down. Imagine if the post office would only deliver your mail if they thought you had something worthwhile to say. What a step backwards. Before 1989 you couldn't buy a connection to the internet unless you could show some bona-fide usage (defense contracting, and towards the very end of that era, being a university), and then if you were approved hook-up was basically free. When I first began getting the general public onto the net for merely having $20 to spend in 1989 yes, people raved that it was outrageous that what was previously free was now being charged for, where would this lead!? I think it all worked out mostly ok, regardless of the protestations of the demagogues who insisted that the net should be free and they alone should have the power to decide who gets access to that free resource. Because that's the way that goes. Either it's for sale, or eventually someone has to have the power to regulate the resources by policy. Worth a thought, perhaps. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:26:31 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29348 for ; Wed, 28 Apr 2004 18:26:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxJk-000326-Gz for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:14:12 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMECNj011641 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:14:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIx2o-0008Qh-O3 for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 17:56:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA26503 for ; Wed, 28 Apr 2004 17:56:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIx2k-0003mo-Sy for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:56:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIx21-0003dl-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:55:54 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIx06-0003H2-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 17:53:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwqe-0003vz-Dc; Wed, 28 Apr 2004 17:44:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIwVi-0002GZ-KX for asrg@optimus.ietf.org; Wed, 28 Apr 2004 17:22:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA23297 for ; Wed, 28 Apr 2004 17:22:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIwVe-0007jJ-VT for asrg@ietf.org; Wed, 28 Apr 2004 17:22:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIwUi-0007fj-00 for asrg@ietf.org; Wed, 28 Apr 2004 17:21:29 -0400 Received: from peacock.verisign.com ([65.205.251.73]) by ietf-mx with esmtp (Exim 4.12) id 1BIwTp-0007b4-00 for asrg@ietf.org; Wed, 28 Apr 2004 17:20:33 -0400 Received: from mou1wnexc02.vcorp.ad.vrsn.com (verisign.com [65.205.251.54]) by peacock.verisign.com (8.12.11/) with ESMTP id i3SLKYKw006260; Wed, 28 Apr 2004 14:20:34 -0700 (PDT) Received: by mou1wnexc02.vcorp.ad.vrsn.com with Internet Mail Service (5.5.2657.72) id ; Wed, 28 Apr 2004 14:20:34 -0700 Message-ID: From: "Hallam-Baker, Phillip" To: "'Barry Shein'" , "Hallam-Baker, Phillip" Cc: John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: RE: [Asrg] (no subject) MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 14:20:28 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 > Yeah well via some creative editing you managed to reverse my point > and create a straw man to argue with. Not at all, the argument you made was spurious under either interpretation. > I countred that the fact that we obviously handle those 5B msgs/day > would not seem to argue AGAINST the possibility of adding a little > more processing to each, it would seem to argue FOR the possibility. It would seem to me to be at best completely and utterly irrelevant. The ability to move an email message without any form of authentication whatsover does not seem to argue for the possibility of moving a payment with that email. The fact that the volume is 5 billion a day does argue that any settlement system is going to have to be substantial. > But a proof? No, not a proof, not either way. Which was my point > exactly. Actually your claim was: > > > Obviously if we can deliver that many emails per day > THEN WE CLEARLY > > > CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? I don't know how you expected this statement to be interpreted. I will merely observe that if the French had not rescued you from certain defeat at Yorktown you would now be speaking English. Phill _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:49:59 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00887 for ; Wed, 28 Apr 2004 18:49:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxde-00044G-NG for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:34:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMYkZP015637 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:34:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxZX-00026e-SE for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 18:30:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29733 for ; Wed, 28 Apr 2004 18:30:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIxZT-0006PE-Lt for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:30:27 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIxYV-0006JU-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:29:27 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIxXX-0006Db-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:28:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxKi-0004G3-UM; Wed, 28 Apr 2004 18:15:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIx7S-00024B-Q8 for asrg@optimus.ietf.org; Wed, 28 Apr 2004 18:01:30 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA26941 for ; Wed, 28 Apr 2004 18:01:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIx7O-0004Ey-Oi for asrg@ietf.org; Wed, 28 Apr 2004 18:01:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIx6W-0004C7-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:00:32 -0400 Received: from mailbox.onlinepolicy.net ([64.62.161.194]) by ietf-mx with esmtp (Exim 4.12) id 1BIx5g-000461-00 for asrg@ietf.org; Wed, 28 Apr 2004 17:59:40 -0400 Received: by mailbox.onlinepolicy.net (Postfix, from userid 504) id C31E4188F58; Wed, 28 Apr 2004 14:49:37 -0700 (PDT) Received: from [15.236.176.226] (ftc2nai176226.msr.hp.com [15.236.176.226]) by mailbox.onlinepolicy.net (Postfix) with ESMTP id B311818915C; Wed, 28 Apr 2004 14:49:36 -0700 (PDT) Message-ID: <4090292D.7000206@queernet.org> From: "Roger B.A. Klorese " User-Agent: Mozilla Thunderbird 0.6b (Windows/20040427) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Barry Shein Cc: John Levine , asrg@ietf.org, pbaker@verisign.com Subject: Re: [Asrg] no e-postage References: <20040428035010.28585.qmail@xuxa.iecc.com> <16528.6697.641923.780337@world.std.com> In-Reply-To: <16528.6697.641923.780337@world.std.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 14:59:09 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > > >> Obviously if we can deliver that many emails per day THEN WE CLEARLY > > >> CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? > > Nein. Using your own analogy: What if I could negotiate permission with the postmaster by phone and in lots of 1000 permissions, but could only buy postage at the post office, could only mail letters in envelopes that were pre-printed with the postage, could only buy one envelope at a time, and could only pay in pennies? There is reason to believe that the processing and data management backends for postage management will dwarf the costs of the dumbwork of moving the mail itself. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:55:45 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01152 for ; Wed, 28 Apr 2004 18:55:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxpk-0006fM-GR for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:47:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMlGU1025620 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:47:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxag-0002vD-G4 for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 18:31:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA29884 for ; Wed, 28 Apr 2004 18:31:38 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIxac-0006VW-92 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:31:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIxZj-0006RQ-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:30:43 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIxZG-0006NG-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:30:14 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxLX-0004nM-Ov; Wed, 28 Apr 2004 18:16:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxHC-0007yv-3F for asrg@optimus.ietf.org; Wed, 28 Apr 2004 18:11:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA27869 for ; Wed, 28 Apr 2004 18:11:30 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIxH8-0004ns-0b for asrg@ietf.org; Wed, 28 Apr 2004 18:11:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIxGA-0004lC-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:10:31 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIxFC-0004iC-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:09:30 -0400 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3SM8iod029980; Wed, 28 Apr 2004 18:08:44 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id SAA19947; Wed, 28 Apr 2004 18:08:44 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.11115.950037.312069@world.std.com> To: Cc: , "Alan DeKok" Subject: Re: [Asrg] Death, taxes and E-Postage. In-Reply-To: <200404281709.AA25690228@messagelevel.com> References: <200404281709.AA25690228@messagelevel.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 18:08:43 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Because the latter would require an extra real-time transaction where the former may or may not? On April 28, 2004 at 17:09 bill.mcinnis@messagelevel.com (Bill Mcinnis) wrote: > Regardless of which route you go, you need to > establish some sort of message level info in a queryable form, > something will need to keep track of who sent what, from where. > Once you have set that up, why not just use that check to validate > if a message came from where it said it did, by going back to the > purported originating system and see if they have the origination > record. > All that needs to be done from there is to set up a local database > to store your origination records, and a module to communicate > server to server (or to the central database) to check it. A system can be set up to store records > for small mailers (law firsm, etc) who choose not to do that for themselves. > > bill mcinnis > > ---------- Original Message ---------------------------------- > From: "Alan DeKok" > Date: Wed, 28 Apr 2004 15:07:37 -0400 > > >"Hallam-Baker, Phillip" wrote: > >> Sure we could do clearing. Any idea what it would take to set up > >> such a system? > > > > A fair bit, which is why I was concentrating on the "conceptual" > >portion. "If we did it, ignoring the costs, it would look a lot like > >system FOO, so why don't we just do FOO from the start, and avoid the > >costs?" > > > >> The actual figures would be rather different and go through a > >> clearing center: > > > > Not necessarily. Clearing centers are used when independent parties > >wish to exchange information through an accredited service. On the > >net, people can talk to each other directly, without using an > >accreditation service for each transaction. > > > > e.g. I don't need to contact Verisign to check someones credentials, > >if I see that their certificate is signed by Verisign. > > > > In a theoretical e-postage system, parties can sign messages > >indicating consent to nullify mutual "costs" for e-postage. Those > >costs don't have to be real money, they can be e-postage tokens. The > >only need for a central clearing house is then to deal with the final > >portions of the costs which aren't mutually negated. > > > > But again, if such a system is set up, the end result of e-postage > >is pretty much a central accreditation service. So why not just set > >up an accreditation service, and stop the pretense that e-postage is > >useful? > > > > Alan DeKok. > > > >_______________________________________________ > >Asrg mailing list > >Asrg@ietf.org > >https://www1.ietf.org/mailman/listinfo/asrg > > > > Checked for SPAM and email fraud by MessageLevel. > Guarantee the authenticity of your email. > (http://www.messagelevel.com) > Version 1 / Released April 26, 2004 > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 18:56:56 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01260 for ; Wed, 28 Apr 2004 18:56:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxrw-00073X-IC for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:49:32 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SMnWY0027118 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 18:49:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxdV-00043R-WB for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 18:34:38 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00024 for ; Wed, 28 Apr 2004 18:34:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIxdR-0006jE-QO for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:34:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIxcT-0006ev-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:33:33 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIxbn-0006bq-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:32:51 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxXC-0000Yu-Bx; Wed, 28 Apr 2004 18:28:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxKC-0003kc-Ci for asrg@optimus.ietf.org; Wed, 28 Apr 2004 18:14:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28198 for ; Wed, 28 Apr 2004 18:14:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIxK8-00051n-0D for asrg@ietf.org; Wed, 28 Apr 2004 18:14:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIxJ8-0004va-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:13:35 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIxIj-0004s8-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:13:09 -0400 Received: from world.std.com (world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3SMCZod005816; Wed, 28 Apr 2004 18:12:35 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id SAA20960; Wed, 28 Apr 2004 18:12:34 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.11346.656296.255405@world.std.com> To: "Hallam-Baker, Phillip" Cc: "'Barry Shein'" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: RE: [Asrg] (no subject) In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 18:12:34 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 28, 2004 at 14:20 pbaker@verisign.com (Hallam-Baker, Phillip) wrote: > > > > > Obviously if we can deliver that many emails per day > > THEN WE CLEARLY > > > > CAN HANDLE THAT MANY TRANSACTIONS PER DAY! Nicht wahr? > > I don't know how you expected this statement to be interpreted. > I will merely observe that if the French had not rescued you > from certain defeat at Yorktown you would now be speaking English. E-mail transactions, philip, that was the original assertion I was responding to, not my assertion. What you are responding to is anybody's guess. And I'll resist making obnoxious comments about Normandy and speaking German... -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 19:15:25 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02474 for ; Wed, 28 Apr 2004 19:15:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIy8Z-0004gj-Dd for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:06:43 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SN6hZ5018017 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:06:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIy2d-0002j0-UP for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 19:00:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01507 for ; Wed, 28 Apr 2004 19:00:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIy2Z-0000tA-GE for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:00:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIy1g-0000pZ-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:59:36 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIy0u-0000lZ-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 18:58:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxuM-0007TI-Fg; Wed, 28 Apr 2004 18:52:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxgO-0004dM-SE for asrg@optimus.ietf.org; Wed, 28 Apr 2004 18:37:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00193 for ; Wed, 28 Apr 2004 18:37:32 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIxgK-0006vj-FK for asrg@ietf.org; Wed, 28 Apr 2004 18:37:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIxfP-0006ry-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:36:35 -0400 Received: from mailbox.onlinepolicy.net ([64.62.161.194]) by ietf-mx with esmtp (Exim 4.12) id 1BIxeh-0006kq-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:35:51 -0400 Received: by mailbox.onlinepolicy.net (Postfix, from userid 504) id B032F189164; Wed, 28 Apr 2004 15:25:47 -0700 (PDT) Received: from [15.236.176.226] (ftc2nai176226.msr.hp.com [15.236.176.226]) by mailbox.onlinepolicy.net (Postfix) with ESMTP id DF5CF18915B; Wed, 28 Apr 2004 15:25:46 -0700 (PDT) Message-ID: <409031A9.2010809@queernet.org> From: "Roger B.A. Klorese " User-Agent: Mozilla Thunderbird 0.6b (Windows/20040427) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Barry Shein Cc: "Hallam-Baker, Phillip" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) References: <16528.11346.656296.255405@world.std.com> In-Reply-To: <16528.11346.656296.255405@world.std.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 15:35:21 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: >E-mail transactions, philip, that was the original assertion I was >responding to, not my assertion. What you are responding to is >anybody's guess. > > The idea, Barry, is that the business transaction (as in database and application interaction -- you know, what 99% of the IT world thiks of when you say "transaction") that is needed to support postage is likely to be much heavier-weight than the protocol interaction that is required to deliver the message itself. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 19:31:03 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03403 for ; Wed, 28 Apr 2004 19:31:03 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyU0-00029Q-Ue for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:28:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SNSqUi008259 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:28:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyHB-0006h2-Hw for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 19:15:37 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02541 for ; Wed, 28 Apr 2004 19:15:34 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIyH8-0002Lg-PL for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:15:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIyG3-0002AN-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:14:27 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIyEz-0001yx-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:13:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIy5z-0003c6-Pf; Wed, 28 Apr 2004 19:04:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIxxy-0000WB-Ga for asrg@optimus.ietf.org; Wed, 28 Apr 2004 18:55:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA01145 for ; Wed, 28 Apr 2004 18:55:42 -0400 (EDT) From: john.oppler@gm.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIxxu-0000Sy-0k for asrg@ietf.org; Wed, 28 Apr 2004 18:55:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIxx0-0000Nv-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:54:47 -0400 Received: from plgmler4.imr.gm.com ([199.228.142.104]) by ietf-mx with esmtp (Exim 4.12) id 1BIxwM-0000J1-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:54:06 -0400 Received: from plgmlir1.imr.gm.com (plgmlir1-2.imr.gm.com [199.228.142.169]) by plgmler4.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3SMs2Qt028552 for ; Wed, 28 Apr 2004 18:54:02 -0400 Received: from plgmlir1.imr.gm.com (localhost [127.0.0.1]) by plgmlir1.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3SMrt0c004506 for ; Wed, 28 Apr 2004 17:53:56 -0500 Received: from usabhmg02.mail.gm.com (USABHMG02.mail.gm.com [164.56.166.171]) by plgmlir1.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3SMrtae004500 for ; Wed, 28 Apr 2004 17:53:55 -0500 To: asrg@ietf.org X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: X-MIMETrack: Serialize by Router on USABHMG02/G/GMSERVER/GMC(Release 5.0.11GM5 |January 20, 2004) at 04/28/2004 06:53:55 PM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Subject: [Asrg] E-postage/hashcash - the future Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 09:53:49 +1100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.4 required=5.0 tests=AWL,NO_REAL_NAME,OFFERS_ETC autolearn=no version=2.60 Written purely from the perspective of a lame user From my way of thinking any form of payment ( monetary or value ) that is imposed on email will eliminate most spam as it exists today. I guess everyone realises that spam today is purely driven by the fact that email is virtually free and a lot of email messages can be sent over a very small period of time with little or no consequence to the sender. The premise has always been that a spammer only needs a very small response rate to make the exercise profitable. With that said, then a 'pay for email' system must work, right? Well I think it will but think a bit further into the future. Once a 'pay for email' system in invoked does the payment therefore invoke some responsibility on the payee for the email to be delivered? I think that in a legal sense that it does. What we will see then is spam email from legitimate sources. Once large corporations realise that they have to pay for email it will give them a sense of legitimacy and they will spam us all. Just like they do with the junk mail you get in your letter boxes today. So instead of an in box full of Vi@gra and medication messages, we will start to receive emails from our discount stores, banks, etc,etc Good thing? Don't know for now. John _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 19:38:04 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03867 for ; Wed, 28 Apr 2004 19:38:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyVd-0003DE-Ru for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:30:33 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SNUXjF012343 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:30:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyTi-00025n-4z for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 19:28:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02984 for ; Wed, 28 Apr 2004 19:28:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIyTf-0003HQ-AD for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:28:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIySj-0003Dn-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:27:33 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIySX-0003Aq-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:27:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIy91-0004tc-9I; Wed, 28 Apr 2004 19:07:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIy3Z-0002rC-QM for asrg@optimus.ietf.org; Wed, 28 Apr 2004 19:01:33 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01518 for ; Wed, 28 Apr 2004 19:01:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIy3V-0000yE-7z for asrg@ietf.org; Wed, 28 Apr 2004 19:01:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIy2X-0000su-00 for asrg@ietf.org; Wed, 28 Apr 2004 19:00:29 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BIy1e-0000oY-00 for asrg@ietf.org; Wed, 28 Apr 2004 18:59:34 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3SMxVV2028643 for ; Wed, 28 Apr 2004 18:59:31 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id SAA04156; Wed, 28 Apr 2004 18:59:31 -0400 (EDT) Message-Id: <200404282259.SAA04156@world.std.com> From: Barry Shein To: asrg@ietf.org Subject: [Asrg] point of information... Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 18:59:31 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Just interesting, to me anyhow, maybe you've run across this. The topic of flat-rating of long-distance telephony came up. As fate would have it, today I read a complaint by someone who claims he's plagued several times per week by a certain telemarketer and they won't stop even though he's called them and even written them trying to be removed. His take is that the calls are coming from India (his assertion), telemarketing goes outsource, and thus they're immune or at least highly resistant to things like do not call lists. Swell, flat-rate (or at least very cheap) telephony meets cheap, ``off-shore'' outsourcing external to US regulations. If this is a trend as I fear it might be (why not?) I suppose we can soon expect our phones to be ringing off the hook 7x24, why bother with niceties like reasonable calling hours when you can fish the pond for suckers willing to place an order RIGHT NOW for herbal viagra or getting a star named after each of their kids? As I said, just a point of information, but we should be careful what we use as illustrative examples. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 19:55:53 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA05198 for ; Wed, 28 Apr 2004 19:55:53 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyf7-0006cy-1d for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:40:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3SNeL1x025469 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 19:40:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyba-0005Sc-Pe for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 19:36:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03808 for ; Wed, 28 Apr 2004 19:36:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIybX-0004Ir-Pi for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:36:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIyah-0004DX-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:35:47 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIyZv-00048T-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 19:34:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyUH-0002T3-ID; Wed, 28 Apr 2004 19:29:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIyJD-0006my-15 for asrg@optimus.ietf.org; Wed, 28 Apr 2004 19:17:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02638 for ; Wed, 28 Apr 2004 19:17:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIyJA-0002WB-5Z for asrg@ietf.org; Wed, 28 Apr 2004 19:17:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIyID-0002SK-00 for asrg@ietf.org; Wed, 28 Apr 2004 19:16:42 -0400 Received: from mout.perfora.net ([217.160.230.41]) by ietf-mx with esmtp (Exim 4.12) id 1BIyHf-0002Nz-00 for asrg@ietf.org; Wed, 28 Apr 2004 19:16:07 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BIyHg-0002fl-00 for asrg@ietf.org; Wed, 28 Apr 2004 19:16:08 -0400 Received: from [68.246.132.191] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BIyHf-0006Gb-00 for asrg@ietf.org; Wed, 28 Apr 2004 19:16:08 -0400 Message-ID: <40903B32.4080408@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Subject: [Asrg] 2b. Two new drafts on blacklists Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 19:16:02 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Two new ASRG drafts have been published on blacklists. The first draft documents the protocols used in blacklists, the second proposes a set of best current practices for managing blacklists. The documents can be found here: http://www.ietf.org/internet-drafts/draft-irtf-asrg-dnsbl-00.txt http://www.ietf.org/internet-drafts/draft-irtf-asrg-bcp-blacklists-00.txt Yakov ------- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "And this too shall come to pass" ------- _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 20:54:31 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA08062 for ; Wed, 28 Apr 2004 20:54:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzb7-0004Gy-TH for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 20:40:18 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T0eH5k016421 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 20:40:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzYs-0003Mq-08 for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 20:37:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07481 for ; Wed, 28 Apr 2004 20:37:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIzYo-0002cP-I1 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 20:37:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIzXo-0002Vy-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 20:36:52 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIzXG-0002QA-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 20:36:18 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzU5-00028B-EU; Wed, 28 Apr 2004 20:33:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzNy-0000Mt-3L for asrg@optimus.ietf.org; Wed, 28 Apr 2004 20:26:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA06894 for ; Wed, 28 Apr 2004 20:26:40 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIzNu-0001eU-KP for asrg@ietf.org; Wed, 28 Apr 2004 20:26:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIzMu-0001Zz-00 for asrg@ietf.org; Wed, 28 Apr 2004 20:25:36 -0400 Received: from rwcrmhc11.comcast.net ([204.127.198.35]) by ietf-mx with esmtp (Exim 4.12) id 1BIzMK-0001SM-00 for asrg@ietf.org; Wed, 28 Apr 2004 20:25:00 -0400 Received: from [192.168.0.3] (h00095b86f221.ne.client2.attbi.com[24.128.50.188]) by comcast.net (rwcrmhc11) with SMTP id <2004042900243001300i4mrre>; Thu, 29 Apr 2004 00:24:31 +0000 Message-Id: <92A44BE3-9973-11D8-84E6-00039380F1B6@pobox.com> X-Habeas-Swe-6: email in exchange for a license for this Habeas X-Habeas-Swe-3: like Habeas SWE (tm) Subject: Re: [Asrg] Re: the e-postage argument X-Habeas-Swe-8: Message (HCM) and not spam. Please report use of this From: mathew X-Habeas-Swe-5: Sender Warranted Email (SWE) (tm). The sender of this X-Habeas-Swe-2: brightly anticipated In-Reply-To: <200404230307.i3N37uE04247@panix5.panix.com> References: <200404220121.i3M1Lu022626@panix5.panix.com> <8D34D8AA-94CF-11D8-BE9A-00039380F1B6@pobox.com> <200404230307.i3N37uE04247@panix5.panix.com> To: asrg@ietf.org X-Habeas-Swe-7: warrant mark warrants that this is a Habeas Compliant Mime-Version: 1.0 (Apple Message framework v613) X-Habeas-Swe-4: Copyright 2002 Habeas (tm) Content-Type: text/plain; charset=US-ASCII; format=flowed X-Habeas-Swe-1: winter into spring Content-Transfer-Encoding: 7bit X-Habeas-Swe-9: mark in spam to . X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 20:24:26 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.1 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Apr 22, 2004, at 23:07, Seth Breidbart wrote: > mathew wrote: >> On Apr 21, 2004, at 21:21, Seth Breidbart quoted someone: >>>> How come SSL certificates in HTTPS transactions can work? Aren't >>>> they >>>> reasonably analogous? >>> >>> No; anybody can generate one. Somebody who wanted billions of valid >>> ones could just spend a little CPU time. >> >> No, it doesn't work like that. If it did, SSL would be useless. > > No, SSL encrypts. SSL with certificates can also authenticate, and that's the kind of functionality that's needed for e-postage. > >> Sure, I can generate a self-signed SSL certificate, but that's not >> going to get me anywhere. > > It does for a number of stores I shop at. > > After all, what value does having a certificate signed by Verisign > actually provide? It provides assurance that the system you are connecting to is one approved by Verisign. So, what value does e-postage signed by Verisign have? Well, it might hypothetically have the value that Verisign will redeem it for cash. Now, I notice you deleted my challenge, so let me re-state it. If you think SSL certificates are worthless and easily bypassed, let's see you generate one which my browser will accept without throwing up a warning that it's bogus. >> Ask yourself why phishing sites don't use SSL. > > Why should they bother? Would it increase their success ratio? It would if they could get the certificate to be accepted without any warning, the connection to show as secure, and the certificate to state that they really are the institution they're pretending to be. If they could do that, they might fool people like me. But they can't, which is the entire point. mathew _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 21:06:25 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA08469 for ; Wed, 28 Apr 2004 21:06:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzpV-0006VX-7b for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 20:55:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T0t9bS025009 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 20:55:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzo5-0005q6-Le for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 20:53:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA08053 for ; Wed, 28 Apr 2004 20:53:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIzo2-0003vV-1h for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 20:53:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIzn8-0003r6-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 20:52:42 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BIzmt-0003mU-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 20:52:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzat-00041z-Fa; Wed, 28 Apr 2004 20:40:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BIzWe-0002nY-0D for asrg@optimus.ietf.org; Wed, 28 Apr 2004 20:35:40 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA07376 for ; Wed, 28 Apr 2004 20:35:38 -0400 (EDT) From: john.oppler@gm.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BIzWa-0002O1-Fi for asrg@ietf.org; Wed, 28 Apr 2004 20:35:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BIzVf-0002K1-00 for asrg@ietf.org; Wed, 28 Apr 2004 20:34:40 -0400 Received: from ahgmler1.imr.gm.com ([192.85.154.101]) by ietf-mx with esmtp (Exim 4.12) id 1BIzV1-0002Fr-00 for asrg@ietf.org; Wed, 28 Apr 2004 20:33:59 -0400 Received: from ahgmlir2.imr.gm.com (ahgmlir2-2.imr.gm.com [192.85.154.170]) by ahgmler1.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T0Y08J017393 for ; Wed, 28 Apr 2004 20:34:00 -0400 Received: from ahgmlir2.imr.gm.com (localhost [127.0.0.1]) by ahgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T0XBBw006142 for ; Wed, 28 Apr 2004 20:33:11 -0400 Received: from usabhmg02.mail.gm.com (USABHMG02.mail.gm.com [164.56.166.171]) by ahgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T0X6Uq006125 for ; Wed, 28 Apr 2004 20:33:06 -0400 Subject: Re: [Asrg] E-postage/hashcash - the future To: John Levine Cc: asrg@ietf.org X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: X-MIMETrack: Serialize by Router on USABHMG02/G/GMSERVER/GMC(Release 5.0.11GM5 |January 20, 2004) at 04/28/2004 08:33:06 PM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 11:33:01 +1100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL,NO_REAL_NAME autolearn=no version=2.60 >>With that said, then a 'pay for email' system must work, right? Well I >>think it will but think a bit further into the future. >Hmmn. I think you need to keep my note about the water powered car in >mind. GM has multi-billion dollar R&D resources. Why haven't they >built a water powered car? Well, that's pretty much why we're not going >to build an e-postage system. >Regards, >John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY >http://www.taugh.com > Well, it is interesting that you seem to _know_ that GM hasn't already built a water powered car LOL In any case, I do see your point, but was just trying to express my opinion as to what I think will happen if email is chargeable John _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 21:52:06 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10347 for ; Wed, 28 Apr 2004 21:52:06 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0eZ-0000qN-Pm for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 21:47:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T1ltdo003239 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 21:47:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0eL-0000fx-UV for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 21:47:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10181 for ; Wed, 28 Apr 2004 21:47:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ0eH-00015A-QB for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 21:47:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ0dQ-00010O-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 21:46:45 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ0d0-0000vS-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 21:46:18 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0Yr-0007nw-UU; Wed, 28 Apr 2004 21:42:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0Vh-0006L9-8H for asrg@optimus.ietf.org; Wed, 28 Apr 2004 21:38:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA09756 for ; Wed, 28 Apr 2004 21:38:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ0Vd-00006q-5v for asrg@ietf.org; Wed, 28 Apr 2004 21:38:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ0Uk-00001r-00 for asrg@ietf.org; Wed, 28 Apr 2004 21:37:47 -0400 Received: from bolt.sonic.net ([208.201.242.18] ident=root) by ietf-mx with esmtp (Exim 4.12) id 1BJ0UU-0007kY-00 for asrg@ietf.org; Wed, 28 Apr 2004 21:37:30 -0400 Received: from satellite.vo.cnchost.com (IDENT:root@localhost [127.0.0.1]) by bolt.sonic.net (8.12.10/8.12.1) with ESMTP id i3T1bVrB016579 for ; Wed, 28 Apr 2004 18:37:31 -0700 Message-Id: <6.0.0.10.0.20040428181556.05405998@127.0.0.1> X-Sender: jcdill%vo.cnchost.com@127.0.0.1 (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.10 (Beta) To: asrg@ietf.org From: JC Dill Subject: Re: [Asrg] E-postage/hashcash - the future In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 18:35:24 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 At 05:33 PM 4/28/2004, john.oppler@gm.com wrote: >In any case, I do see your point, but was just trying to express my opinion >as to what I think will happen if email is chargeable It's about as useful as expressing an opinion as to what will happen when cars run on water. You have to look at the obstacles to making it happen. Thinking about how nice it will be "when it happens" is a waste of time if it ain't never gonna happen. The first obstacle to making it happen is getting the first 1/2 of the mail clients/servers on the 'net to sign-on to whatever plan we propose and implementing the necessary changes first, before there is any hope of payoff. The second obstacle is getting end users to agree to cut-off the last 1/2 of the mail clients/servers on the 'net (including aunt Sally with her old win95 box that can't be upgraded to a newer message system) once "critical mass" has been achieved, to force all the older clients/servers to upgrade or die so that the new system has 100% of the message traffic on the 'net. Both of these are *big* obstacles, and adding ePostage ON TOP OF THIS makes it considerably harder because we add a complicated payment scheme on top of a complicated system upgrade. If it were easy it would have happened already by now. And we would all be driving cars powered by water. jc _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 22:11:23 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA10927 for ; Wed, 28 Apr 2004 22:11:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0o1-0002N7-OY for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 21:57:46 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T1vfu8009113 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 21:57:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0n7-000283-0y for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 21:56:45 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10498 for ; Wed, 28 Apr 2004 21:56:42 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ0n2-0001wY-P2 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 21:56:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ0m9-0001rK-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 21:55:46 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ0lg-0001lv-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 21:55:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0ei-0000r7-Sr; Wed, 28 Apr 2004 21:48:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ0eL-0000fl-GO for asrg@optimus.ietf.org; Wed, 28 Apr 2004 21:47:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA10178 for ; Wed, 28 Apr 2004 21:47:38 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ0eH-000155-4u for asrg@ietf.org; Wed, 28 Apr 2004 21:47:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ0dP-00010G-00 for asrg@ietf.org; Wed, 28 Apr 2004 21:46:44 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BJ0ct-0000tM-00 for asrg@ietf.org; Wed, 28 Apr 2004 21:46:11 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id 1A8CDA4307; Thu, 29 Apr 2004 11:15:35 +0930 (CST) Received: from rebel (ppp43-226.lns1.adl1.internode.on.net [150.101.43.226]) by mail.chariot.net.au (Postfix) with SMTP id E79B55F77B; Thu, 29 Apr 2004 11:15:33 +0930 (CST) From: "Chris" To: "Barry Shein" Cc: "John Levine" , , Subject: [Asrg] My take on e-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <16528.7239.854384.602331@world.std.com> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 11:14:55 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit in reply > > > So if we take that into consideration what is the limit on the > > number of > > emails for free or charged 10,20 per day ? > > One would imagine it'd become a marketing issue, just like the monthly > price of a connection and how fast that is, etc. > Marketing drives cost down, not up. take a look at bandwidth charges now and 5 years ago. If I was to sell a hosting service and wanted to beat the competition I might say "email at only 10c per 10,000 or get your hosting here and we will throw in free email! if you have to "imagine" something perhaps you have not considered all possibilities. > > > Who polices that level. what about China who polices it there? > > Again, the market. > Perhaps I was not clear enough. I was talking about e-mail spewing out of places like China. Do you think they will stop it? and if they do a hundred other countries will take it up. do we wholesale block entire countries? Does that become censorship? > > I will start writing one as soon as e-postage looks inevitable! > > Yeah well you could also try setting up your own phone and postage > systems and tell us how it works out. > Take a look at all the other p2p programs, e-mail could become irrelevant. If you don't think a lone group of programmers can introduce such a system look at the software you use everyday especially open source, Linux and Apache are two prime examples. To compare an e-mail style system with a bricks, mortar, hardware and employee system is simply trying to fool the more gullible of us, there is simply no comparison. Furthermore the bricks and mortar and hardware are all in place. all you need is the enthusiasm. add a fee to e-mail and overnight you create the enthusiasm. Many Many programmers would see such fees as an attack on the freedom of the internet. an attempt by governments to shut down the free flow of information under the GUISE of spam control. > Who suggested $.20? Who suggested it'd be recipient-pays? > > > And who pays for the duplicates we all receive? > > Who suggested it'd be recipient-pays? I wasn't in general, but for a list such as this it is inevitable. does the ASRG pay? of course not. For a list like this it must be recipient pays. Who else would? Regards Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of Barry > Shein > Sent: Thursday, 29 April 2004 6:34 AM > To: Chris > Cc: John Levine; asrg@ietf.org; william@elan.net > Subject: RE: [Asrg] My take on e-postage > > > > Well, for starters I want to thank you for being brutally honest about > the concerns regarding e-postage because I think what you say is > behind every other criticism. That said... > > On April 28, 2004 at 14:07 asrg@rebel.com.au (Chris) wrote: > > > > An e-postage system would need to account for the every day person. why > > should they be charged for sending what is currently free? > > Because the current totally free system isn't working very well as > evidenced by our convening here (that is, spam!) > > Unlimited free resources tend to get abused if there's some way to > profit from that use. And that's about where we are right now. > > > So if we take that into consideration what is the limit on the > number of > > emails for free or charged 10,20 per day ? > > One would imagine it'd become a marketing issue, just like the monthly > price of a connection and how fast that is, etc. > > > Who polices that level. what about China who polices it there? > > Again, the market. > > As to China, this is probably the least of China's problems. Do we > really think we can solve all of China's problems right here or should > even take them into account? > > How about the fact that all the e-mail headers and SMTP etc not to > mention the RFCs are in English? Don't you think that poses some > disadvantage to the average Chinese person? How would you like it if > all that were in Chinese? > > It's not somewhere we're really set up to go here. > > > Ok set the level at zero. the average Joe will cop it sweet if > it keeps spam > > out of their mail box. > > > > Does anyone here think e-mail will survive beyond a fee ? > > If the fee is reasonable, like zero for most common, personal usage, > etc, yes. > > > If so go ahead and introduce a fee. see how long it takes before an > > alternative becomes available. > > > > I will start writing one as soon as e-postage looks inevitable! > > Yeah well you could also try setting up your own phone and postage > systems and tell us how it works out. > > > > > Regards > > Chris > > > > P.S. How many of you would subscribe to this list if it was > going to cost > > $0.20 every time > > Who suggested $.20? Who suggested it'd be recipient-pays? > > > And who pays for the duplicates we all receive? > > Who suggested it'd be recipient-pays? > > -- > -Barry Shein > > Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 22:49:23 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12212 for ; Wed, 28 Apr 2004 22:49:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1aC-0002Np-Lr for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 22:47:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T2lSjM009152 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 22:47:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1Xn-0001l0-TW for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 22:45:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12041 for ; Wed, 28 Apr 2004 22:44:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1Xj-0006XN-Cb for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 22:44:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1Wk-0006Nu-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 22:43:55 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BJ1Vw-0006GN-01 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 22:43:04 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BJ1OA-0005Sg-9Z for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 22:35:02 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1JK-0007tX-FP; Wed, 28 Apr 2004 22:30:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1H9-0007Hb-6i for asrg@optimus.ietf.org; Wed, 28 Apr 2004 22:27:47 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11627 for ; Wed, 28 Apr 2004 22:27:43 -0400 (EDT) From: john.oppler@gm.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1H4-0004y6-Me for asrg@ietf.org; Wed, 28 Apr 2004 22:27:42 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1G8-0004sL-00 for asrg@ietf.org; Wed, 28 Apr 2004 22:26:44 -0400 Received: from plgmler3.imr.gm.com ([199.228.142.103]) by ietf-mx with esmtp (Exim 4.12) id 1BJ1FS-0004mx-00; Wed, 28 Apr 2004 22:26:02 -0400 Received: from plgmlir2.imr.gm.com (plgmlir2-2.imr.gm.com [199.228.142.170]) by plgmler3.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T2Q2S9015338; Wed, 28 Apr 2004 22:26:04 -0400 Received: from plgmlir2.imr.gm.com (localhost [127.0.0.1]) by plgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T2PVgo017014; Wed, 28 Apr 2004 21:25:31 -0500 Received: from usabhmg02.mail.gm.com (USABHMG02.mail.gm.com [164.56.166.171]) by plgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T2PVOb017008; Wed, 28 Apr 2004 21:25:31 -0500 Subject: Re: [Asrg] E-postage/hashcash - the future To: JC Dill Cc: asrg@ietf.org, asrg-admin@ietf.org X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: X-MIMETrack: Serialize by Router on USABHMG02/G/GMSERVER/GMC(Release 5.0.11GM5 |January 20, 2004) at 04/28/2004 10:25:31 PM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 13:25:01 +1100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL,NO_REAL_NAME autolearn=no version=2.60 >>In any case, I do see your point, but was just trying to express my opinion >>as to what I think will happen if email is chargeable >It's about as useful as expressing an opinion as to what will happen when >cars run on water. Well, thank you for suggesting my opinion was useless >You have to look at the obstacles to making it happen. Thinking about how >nice it will be "when it happens" is a waste of time if it ain't never >gonna happen. I don't _have_ to do anything thank you! I certainly was not suggesting a way to make the situation better, I fully admit that, I simply I posted my opinion, which is based on what _I_ think will happen next, regardless of which pay ' system' you plan to introduce. >The first obstacle to making it happen is getting the first 1/2 of the mail >clients/servers on the 'net to sign-on to whatever plan we propose and >implementing the necessary changes first, before there is any hope of >payoff. The second obstacle is getting end users to agree to cut-off the >last 1/2 of the mail clients/servers on the 'net (including aunt Sally with >her old win95 box that can't be upgraded to a newer message system) once >"critical mass" has been achieved, to force all the older clients/servers >to upgrade or die so that the new system has 100% of the message traffic on >the 'net. Both of these are *big* obstacles, and adding ePostage ON TOP OF >THIS makes it considerably harder because we add a complicated payment >scheme on top of a complicated system upgrade. The only way to stop spam is at the delivery point. The certificates and/or payment schemes need to be a ISP level, not at the user level. The user should not be involved at all. In my opinion this is an industry problem, not a problem than needs any action by the user. >If it were easy it would have happened already by now. And we would all be >driving cars powered by water. Please, please, please stop using cheesy analogies. There are already cars that use water for fuel. The reason they are not released for the general public may not be obvious to you. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 23:07:50 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12805 for ; Wed, 28 Apr 2004 23:07:50 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1lA-0004r4-W2 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 22:58:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T2wm9w018658 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 22:58:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1k7-0004gd-Lh for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 22:57:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12479 for ; Wed, 28 Apr 2004 22:57:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1k3-000033-0y for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 22:57:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1j7-0007lH-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 22:56:42 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ1iH-0007g7-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 22:55:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1fZ-0003pl-2u; Wed, 28 Apr 2004 22:53:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1bQ-0002kD-Tp for asrg@optimus.ietf.org; Wed, 28 Apr 2004 22:48:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12190 for ; Wed, 28 Apr 2004 22:48:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1bM-0006wk-7h for asrg@ietf.org; Wed, 28 Apr 2004 22:48:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1aP-0006qc-00 for asrg@ietf.org; Wed, 28 Apr 2004 22:47:42 -0400 Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx with esmtp (Exim 4.12) id 1BJ1ZX-0006ke-00 for asrg@ietf.org; Wed, 28 Apr 2004 22:46:47 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 78932981B5 for ; Wed, 28 Apr 2004 22:46:43 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3T2khU25635; Wed, 28 Apr 2004 22:46:43 -0400 (EDT) Message-Id: <200404290246.i3T2khU25635@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <92A44BE3-9973-11D8-84E6-00039380F1B6@pobox.com> (message from mathew on Wed, 28 Apr 2004 20:24:26 -0400) Subject: Re: [Asrg] Re: the e-postage argument References: <200404220121.i3M1Lu022626@panix5.panix.com> <8D34D8AA-94CF-11D8-BE9A-00039380F1B6@pobox.com> <200404230307.i3N37uE04247@panix5.panix.com> <92A44BE3-9973-11D8-84E6-00039380F1B6@pobox.com> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 22:46:43 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 mathew wrote: > On Apr 22, 2004, at 23:07, Seth Breidbart wrote: >> mathew wrote: >>> On Apr 21, 2004, at 21:21, Seth Breidbart quoted someone: >>>>> How come SSL certificates in HTTPS transactions can work? Aren't >>>>> they >>>>> reasonably analogous? >>>> No; anybody can generate one. Somebody who wanted billions of valid >>>> ones could just spend a little CPU time. >>> No, it doesn't work like that. If it did, SSL would be useless. >> No, SSL encrypts. > > SSL with certificates can also authenticate, and that's the kind of > functionality that's needed for e-postage. It _can_, but it doesn't for https necessarily. >>> Sure, I can generate a self-signed SSL certificate, but that's not >>> going to get me anywhere. >> It does for a number of stores I shop at. >> After all, what value does having a certificate signed by Verisign >> actually provide? > > It provides assurance that the system you are connecting to is one > approved by Verisign. And what value is "approval by Verisign"? Aren't they the company that once generated a bogus Microsoft certificate? How much effort do they put into validating anyone who tries to buy a certificate? > So, what value does e-postage signed by Verisign have? Well, it might > hypothetically have the value that Verisign will redeem it for cash. How do you prevent re-use? Every recipient would have to query Verisign immediately before accepting the email. Do you really think they could handle it? > Now, I notice you deleted my challenge, so let me re-state it. If you > think SSL certificates are worthless and easily bypassed, let's see you > generate one which my browser will accept without throwing up a warning > that it's bogus. Why should I bother? >>> Ask yourself why phishing sites don't use SSL. >> Why should they bother? Would it increase their success ratio? > > It would if they could get the certificate to be accepted without any > warning, the connection to show as secure, and the certificate to state > that they really are the institution they're pretending to be. If they > could do that, they might fool people like me. But they can't, which is > the entire point. Sure they could. That's why they register domains that sort of look like the company they're phishing. Look at, for instance, ebaysecurity.com; do you really think ebay registered a domain using "freeservers.com"? Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 23:23:08 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13580 for ; Wed, 28 Apr 2004 23:23:08 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ27J-0001A7-QN for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:21:41 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T3LfNG004445 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:21:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1zs-0007oc-0x for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 23:14:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13066 for ; Wed, 28 Apr 2004 23:13:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1zm-0001hq-My for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:13:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1yk-0001ay-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:12:52 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ1xl-0001V6-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:11:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1uC-0006AM-LH; Wed, 28 Apr 2004 23:08:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1m4-0004rf-Qf for asrg@optimus.ietf.org; Wed, 28 Apr 2004 22:59:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12585 for ; Wed, 28 Apr 2004 22:59:40 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1m0-0000FY-0e for asrg@ietf.org; Wed, 28 Apr 2004 22:59:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1l6-0000AB-00 for asrg@ietf.org; Wed, 28 Apr 2004 22:58:44 -0400 Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx with esmtp (Exim 4.12) id 1BJ1kv-00004N-00 for asrg@ietf.org; Wed, 28 Apr 2004 22:58:33 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id 515A99851B for ; Wed, 28 Apr 2004 22:58:34 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3T2wY126542; Wed, 28 Apr 2004 22:58:34 -0400 (EDT) Message-Id: <200404290258.i3T2wY126542@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: <200404281709.AA25690228@messagelevel.com> (bill.mcinnis@messagelevel.com) Subject: Re: [Asrg] Death, taxes and E-Postage. References: <200404281709.AA25690228@messagelevel.com> Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 22:58:34 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 "Bill Mcinnis" wrote: > Regardless of which route you go, you need to > establish some sort of message level info in a queryable form, > something will need to keep track of who sent what, from where. > Once you have set that up, why not just use that check to validate > if a message came from where it said it did, by going back to the > purported originating system and see if they have the origination > record. So why can't the spammer-controlled box lie about that (or, actually, tell the truth)? Some spamware uses the DNS or rDNS of the box it runs on as its HELO string even now. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 23:23:38 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13608 for ; Wed, 28 Apr 2004 23:23:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ27K-0001Ac-Ly for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:21:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T3LgDK004493 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:21:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ21X-000834-AW for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 23:15:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13121 for ; Wed, 28 Apr 2004 23:15:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ21S-0001uJ-3m for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:15:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ20V-0001nf-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:14:40 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ1zV-0001dO-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:13:37 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1w1-0006qA-Mm; Wed, 28 Apr 2004 23:10:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1rR-0005PH-2v for asrg@optimus.ietf.org; Wed, 28 Apr 2004 23:05:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12767 for ; Wed, 28 Apr 2004 23:05:12 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1rK-0000kE-Oo for asrg@ietf.org; Wed, 28 Apr 2004 23:05:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1py-0000eg-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:03:47 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BJ1pX-0000ZO-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:03:19 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3T33JV2015680; Wed, 28 Apr 2004 23:03:19 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id XAA17146; Wed, 28 Apr 2004 23:03:18 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.28789.942044.465136@world.std.com> To: "Chris" Cc: "Barry Shein" , "John Levine" , , Subject: Re: [Asrg] My take on e-postage In-Reply-To: References: <16528.7239.854384.602331@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 23:03:17 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 29, 2004 at 11:14 asrg@rebel.com.au (Chris) wrote: > in reply > > > > > > So if we take that into consideration what is the limit on the > > > number of > > > emails for free or charged 10,20 per day ? > > > > One would imagine it'd become a marketing issue, just like the monthly > > price of a connection and how fast that is, etc. > > > > Marketing drives cost down, not up. take a look at bandwidth charges now and > 5 years ago. (Just to be picky, by "costs" you mean "prices", right?) Well, if you said "in the case of bandwidth marketing drove the prices down, not up" perhaps I'd agree, but I'd be hard-put to agree that's some sort of universal principle, that it always drives prices down. For example, in the case of MS their aggressive marketing gave them enough of an effective monopoly in some software areas that they could raise prices (and costs.) That's not too obscure an example is it? > If I was to sell a hosting service and wanted to beat the competition I > might say "email at only 10c per 10,000 or get your hosting here and we will > throw in free email! Unless there were costs, something akin to settlement, where you had to pay for the amount of email that flowed through your system and, presumably, somehow pass those costs on to your customers. Obviously if we're giving away free stamps then it ultimately doesn't matter much what stamp you stick on something, may as well print your own. > > > Who polices that level. what about China who polices it there? > > > > Again, the market. > > > > Perhaps I was not clear enough. I was talking about e-mail spewing out of > places like China. > Do you think they will stop it? and if they do a hundred other countries > will take it up. > do we wholesale block entire countries? Does that become censorship? Well, it'd certainly be reasonable, after some transition period, to only accept e-mail with a valid e-postage stamp. Is that censorship? I dunno. Is forcing them to use SMTP censorship? > > > > I will start writing one as soon as e-postage looks inevitable! > > > > Yeah well you could also try setting up your own phone and postage > > systems and tell us how it works out. > > > > Take a look at all the other p2p programs, e-mail could become irrelevant. If we could start by re-inventing the entire e-mail system from scratch then I don't think solving the spam problem is all that difficult. I believe most everyone agrees with that. But you've got this little problem like a billion or two computers out there who already do e-mail this way, and firewalls and corporate policies and routers and servers etc. One nice thing about e-postage is that it could, in theory, be slipped right w/o particularly interfering with end-users. For example, for an entire corp it could be done at the edge server, or at the ISP by some agreement. It's not unique in that regard, but it's useful to keep in mind that this is a very important kind of quality for a proposed solution. > If you don't think a lone group of programmers can introduce such a system > look at the software you use everyday > especially open source, Linux and Apache are two prime examples. No problem with that. Um, what are they gonna do when they're flooded with spam through this new system? How does painting the car yellow make it run faster? etc. > To compare an e-mail style system with a bricks, mortar, hardware and > employee system is simply trying to fool the more gullible of us, there is > simply no comparison. > > Furthermore the bricks and mortar and hardware are all in place. all you > need is the enthusiasm. add a fee to e-mail and overnight you create the > enthusiasm. > > Many Many programmers would see such fees as an attack on the freedom of the > internet. an attempt by governments to shut down the free flow of > information under the GUISE of spam control. You do understand the difference between free as in beer and free as in speech, right? Does having to affix postage to your letters constitute an infringement on your freedom? > > > > Who suggested $.20? Who suggested it'd be recipient-pays? > > > > > And who pays for the duplicates we all receive? > > > > Who suggested it'd be recipient-pays? > > I wasn't in general, but for a list such as this it is inevitable. does the > ASRG pay? of course not. For a list like this it must be recipient pays. > > Who else would? The sender? -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 23:33:25 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14090 for ; Wed, 28 Apr 2004 23:33:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2FJ-0002Xs-96 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:29:57 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T3TveY009779 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:29:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ27c-0001LN-CT for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 23:22:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13470 for ; Wed, 28 Apr 2004 23:21:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ27X-0002bS-GS for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:21:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ26c-0002U7-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:20:59 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ25w-0002NI-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:20:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1yw-0007TI-LB; Wed, 28 Apr 2004 23:13:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1v3-0006Wt-P2 for asrg@optimus.ietf.org; Wed, 28 Apr 2004 23:09:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12874 for ; Wed, 28 Apr 2004 23:08:57 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1ux-00019D-K3 for asrg@ietf.org; Wed, 28 Apr 2004 23:08:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1t6-0000wm-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:07:02 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BJ1r8-0000jS-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:04:58 -0400 Received: from pcls1.std.com ([192.74.137.141] helo=TheWorld.com) by mx2.foretec.com with esmtp (Exim 4.24) id 1BJ1aq-0005dy-9I for asrg@ietf.org; Wed, 28 Apr 2004 22:48:08 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3T2lXbr020102; Wed, 28 Apr 2004 22:47:33 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id WAA21785; Wed, 28 Apr 2004 22:47:32 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.27844.324796.238684@world.std.com> To: "Roger B.A. Klorese " Cc: Barry Shein , "Hallam-Baker, Phillip" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) In-Reply-To: <409031A9.2010809@queernet.org> References: <16528.11346.656296.255405@world.std.com> <409031A9.2010809@queernet.org> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 22:47:32 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Then I would suggest not designing the it like that. Why is there this prevalent belief that if one doesn't like an approach, for some other reason, the right thing to do is to propose a really bad design for it and then assert that those design flaws make the original idea untenable? I can't imagine, for example, anyone ever having approved the original DNS proposals if this were the atmosphere. And that was back in, what, 1983? Imagine! A series of query-response transactions down through a tree of hosts just to map a host name to an IP number! Couldn't ever work! Do you have any idea how many host names, between mail and ftp and everything else people do, are looked up *per second*?! etc etc etc. Anyhow, does anyone else see how futile it is if a proposal is immediately jumped on with "Too many computrons!!!", unless there's something terribly inherent to the proposal, like you have to break a significant crypto code to send mail? I don't think mere recordkeeping, authorization, etc qualifies as a priori sort of too many computrons. On April 28, 2004 at 15:35 rogerk@queernet.org (Roger B.A. Klorese ) wrote: > Barry Shein wrote: > > >E-mail transactions, philip, that was the original assertion I was > >responding to, not my assertion. What you are responding to is > >anybody's guess. > > > > > > > The idea, Barry, is that the business transaction (as in database and > application interaction -- you know, what 99% of the IT world thiks of > when you say "transaction") that is needed to support postage is likely > to be much heavier-weight than the protocol interaction that is required > to deliver the message itself. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 23:34:25 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14204 for ; Wed, 28 Apr 2004 23:34:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2G0-0002Zy-Ub for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:30:41 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T3Uej0009907 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:30:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ28Y-0001Sp-IJ for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 23:22:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13559 for ; Wed, 28 Apr 2004 23:22:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ28T-0002jC-HJ for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:22:53 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ27Y-0002bd-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:21:56 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ26h-0002UM-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:21:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1yz-0007VH-7c; Wed, 28 Apr 2004 23:13:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ1vz-0006mm-1L for asrg@optimus.ietf.org; Wed, 28 Apr 2004 23:09:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA12908 for ; Wed, 28 Apr 2004 23:09:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ1vt-0001Gd-U3 for asrg@ietf.org; Wed, 28 Apr 2004 23:09:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ1un-00018r-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:08:47 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BJ1sx-0000wA-00; Wed, 28 Apr 2004 23:06:51 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3T36qV2023950; Wed, 28 Apr 2004 23:06:52 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id XAA29268; Wed, 28 Apr 2004 23:06:52 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16528.29004.245020.258810@world.std.com> To: john.oppler@gm.com Cc: JC Dill , asrg@ietf.org, asrg-admin@ietf.org Subject: Re: [Asrg] E-postage/hashcash - the future In-Reply-To: References: X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 23:06:52 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 29, 2004 at 13:25 john.oppler@gm.com (john.oppler@gm.com) wrote: > Please, please, please stop using cheesy analogies. There are already cars > that use > water for fuel. The reason they are not released for the general public > may not be obvious to you. Sure, because as fate would have it they're only available in Saudi Arabia where gasoline is cheap and fresh water is very expensive. -b _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Wed Apr 28 23:56:37 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15579 for ; Wed, 28 Apr 2004 23:56:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2WR-0006uT-PZ for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:47:39 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T3ld9s026559 for asrg-archive@odin.ietf.org; Wed, 28 Apr 2004 23:47:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2IO-0003J6-I9 for asrg-web-archive@optimus.ietf.org; Wed, 28 Apr 2004 23:33:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA14055 for ; Wed, 28 Apr 2004 23:33:04 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ2IJ-0003pr-FL for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:33:03 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ2HT-0003hs-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:32:12 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ2GV-0003Xm-00 for asrg-web-archive@ietf.org; Wed, 28 Apr 2004 23:31:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ28b-0001Sz-2D; Wed, 28 Apr 2004 23:23:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ26S-0000tV-HU for asrg@optimus.ietf.org; Wed, 28 Apr 2004 23:20:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA13371 for ; Wed, 28 Apr 2004 23:20:44 -0400 (EDT) From: john.oppler@gm.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ26N-0002Si-HH for asrg@ietf.org; Wed, 28 Apr 2004 23:20:43 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ25S-0002Lg-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:19:46 -0400 Received: from plgmler4.imr.gm.com ([199.228.142.104]) by ietf-mx with esmtp (Exim 4.12) id 1BJ24j-0002FX-00; Wed, 28 Apr 2004 23:19:01 -0400 Received: from plgmlir2.imr.gm.com (plgmlir2-2.imr.gm.com [199.228.142.170]) by plgmler4.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T3J1DY018732; Wed, 28 Apr 2004 23:19:03 -0400 Received: from plgmlir2.imr.gm.com (localhost [127.0.0.1]) by plgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T3IYSB030335; Wed, 28 Apr 2004 22:18:34 -0500 Received: from usabhmg02.mail.gm.com (USABHMG02.mail.gm.com [164.56.166.171]) by plgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T3IYAr030330; Wed, 28 Apr 2004 22:18:34 -0500 Subject: Re: [Asrg] E-postage/hashcash - the future To: Barry Shein Cc: asrg@ietf.org, asrg-admin@ietf.org, JC Dill X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: X-MIMETrack: Serialize by Router on USABHMG02/G/GMSERVER/GMC(Release 5.0.11GM5 |January 20, 2004) at 04/28/2004 11:18:34 PM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 14:18:29 +1100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL,NO_REAL_NAME autolearn=no version=2.60 > Please, please, please stop using cheesy analogies. There are already cars > that use > water for fuel. The reason they are not released for the general public > may not be obvious to you. >Sure, because as fate would have it they're only available in Saudi >Arabia where gasoline is cheap and fresh water is very expensive Still cheesy, but at least funny and insightful, thanks John _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 00:09:22 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA16272 for ; Thu, 29 Apr 2004 00:09:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2qT-0002xN-BK for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 00:08:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T48LwO011361 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 00:08:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2m6-0001rD-FI for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 00:03:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA16056 for ; Thu, 29 Apr 2004 00:03:45 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ2m1-0007db-0C for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:03:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ2lH-0007XH-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:03:00 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ2kj-0007Q7-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:02:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2fZ-0008Nf-6n; Wed, 28 Apr 2004 23:57:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2Zf-0007LU-BQ for asrg@optimus.ietf.org; Wed, 28 Apr 2004 23:50:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15219 for ; Wed, 28 Apr 2004 23:50:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ2ZZ-0005yA-UA for asrg@ietf.org; Wed, 28 Apr 2004 23:50:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ2Yh-0005qc-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:50:00 -0400 Received: from bolt.sonic.net ([208.201.242.18] ident=root) by ietf-mx with esmtp (Exim 4.12) id 1BJ2YC-0005jy-00 for asrg@ietf.org; Wed, 28 Apr 2004 23:49:28 -0400 Received: from satellite.vo.cnchost.com (IDENT:root@localhost [127.0.0.1]) by bolt.sonic.net (8.12.10/8.12.1) with ESMTP id i3T3nRrB025925 for ; Wed, 28 Apr 2004 20:49:28 -0700 Message-Id: <6.0.0.10.0.20040428201507.05935c80@127.0.0.1> X-Sender: jcdill%vo.cnchost.com@127.0.0.1 (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.10 (Beta) To: asrg@ietf.org From: JC Dill Subject: Re: [Asrg] E-postage/hashcash - the future In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 20:46:32 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 At 07:25 PM 4/28/2004, john.oppler@gm.com wrote: > >>In any case, I do see your point, but was just trying to express my > >>opinion as to what I think will happen if email is chargeable > > >It's about as useful as expressing an opinion as to what will happen when > >cars run on water. > >Well, thank you for suggesting my opinion was useless Those are your words, not mine. > >You have to look at the obstacles to making it happen. Thinking about how > >nice it will be "when it happens" is a waste of time if it ain't never > >gonna happen. > >I don't _have_ to do anything thank you! > >I certainly was not suggesting a way to make the situation better, Well, the topic of this mailing list is to RESEARCH ANTI-SPAM solutions. If you aren't going to suggest ways to make the situation better, perhaps there are other lists that would be better places for your musings. >I fully admit that, I simply I posted my opinion, which is based on what >_I_ think will happen next, regardless of which pay ' system' you plan to >introduce. I don't plan to introduce any "pay system" because I don't think they will be adopted enough to become successful. These proposals are too cumbersome and rely on centralized systems. We will never get widespread adoption when decentralized and simple solutions are available. For instance, the only reason iTunes is successful instead of Napster is because most of the content on Napster is/was protected by copyright, one can't legally exchange copyright protected songs or software via Napster. Take away the legal restrictions, and the Napster model is clearly superior to the iTunes model which is why the free market created Napster when the RIAA refused to create a system for delivering songs over the Internet. Instead of songs we have messages, and you see why people want a free system to exchange messages. > >The first obstacle to making it happen is getting the first 1/2 of the mail > >clients/servers on the 'net to sign-on to whatever plan we propose and > >implementing the necessary changes first, before there is any hope of > >payoff. The second obstacle is getting end users to agree to cut-off the > >last 1/2 of the mail clients/servers on the 'net (including aunt Sally with > >her old win95 box that can't be upgraded to a newer message system) once > >"critical mass" has been achieved, to force all the older clients/servers > >to upgrade or die so that the new system has 100% of the message traffic on > >the 'net. Both of these are *big* obstacles, and adding ePostage ON TOP OF > >THIS makes it considerably harder because we add a complicated payment > >scheme on top of a complicated system upgrade. > >The only way to stop spam is at the delivery point. If 100% of the spam that was injected into the system got 99% of the way to the recipient and then was dropped on the floor, it would still stop 100% of the spam. Yes, this is more *costly* than stopping it at the delivery point, but it is still EFFECTIVE. You can't ignore other solutions just because they aren't your preferred solution. This is why filtering is one model that is presently economically effective, people are paying Brightmail and Postini etc. to filter out spam and deliver the non-spam. >The certificates and/or payment schemes need to be a ISP >level, not at the user level. The user should not be involved at all. That is but one solution, but by no means the only solution. It might be the best solution, or the worst solution. You have to look at the problems with implementing your proposed solution, and with the alternatives, before you can tell if this is the best solution and if it's likely to succeed. >In my opinion this is an industry problem, not a >problem than needs any action by the user. You are aware that most spam today is being sent by "the user" right? (Trojan-infected zombie computers on broadband.) > >If it were easy it would have happened already by now. And we would all be > >driving cars powered by water. > >Please, please, please stop using cheesy analogies. There are already cars >that use water for fuel. The reason they are not released for the general >public >may not be obvious to you. If it were easy, and cheap, they would be out there. The fact that they aren't means that it isn't easy and cheap. The spam problem is a difficult one to solve. I've been actively fighting it for 7 years now, and I've seen the problems we have had with getting much simpler solutions put into place: 1) Open relays still exist, open proxies followed and are abundant. 2) Pink contracts were frequently written to sell to spammers, now they simply get IP offshore and the networks sell international lines to the offshore networks, having a "hands off" method of continuing to get the revenue. 3) UDP-type action against networks that sell to spammers has been ineffective because too many really large networks are selling with the above "hands off" methods. 4) DDoSs and lawsuits against BL sites. 5) Domain registrars sell domains to spammers, DNS providers sell DNS services, offshore hosts host the spamvertized sites, etc. 6) Trojans trick end users into installing zombie software so spammers can spam from millions of end user locations. 7) Etc. Anti-spam forces have tried one by one to stop each of these problems as they developed, without much success. Numerous proposed solutions for fixing many of these prior problems were suggested, all MUCH simpler to implement than the ePostage scheme, yet they were not widely adopted or implemented and all of these problems continue today. BTW, I have a Millicent coin in my drawer from ~1996 when Digital Equipment Corp (DEC, remember them? They created AltaVista...) thought that micropayments would be the way everyone would pay for web content. Do you see anyone paying for web content today? How much have you paid in micropayments for content today? This week? This month? This year? How much has your ISP paid on your behalf and then bundled the charge into your ISP bill? Zero, zip, zilch, nothing, nada, not one single red cent? Then why do you suddenly think that a payment system for email will be adopted when one for web content (which cost billions of dollars to produce) hasn't been adopted? Come up with a convincing argument for why the entire Internet should and will adopt a complicated ePostage payment system to replace today's present simple and free email system when we can't even get widespread adoption of a free existing system that produces an end-to-end audit trail (authenticated SMTP between client and server and between all servers) of all email messages thru the net. jc p.s. please don't send me cc's of your replies. reply to me, or to the list, as you prefer. But not both. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 00:48:29 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17892 for ; Thu, 29 Apr 2004 00:48:29 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3Nw-00020n-FI for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 00:42:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T4gumB007729 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 00:42:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3H9-0000Gt-Bc for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 00:35:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17375 for ; Thu, 29 Apr 2004 00:35:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3H3-0003Zr-MK for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:35:49 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3G5-0003Sc-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:34:50 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3FE-0003LY-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:33:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ38X-0006pD-18; Thu, 29 Apr 2004 00:27:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ2vp-0004w9-Tt for asrg@optimus.ietf.org; Thu, 29 Apr 2004 00:13:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA16530 for ; Thu, 29 Apr 2004 00:13:48 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ2vk-00017K-Ax for asrg@ietf.org; Thu, 29 Apr 2004 00:13:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ2ur-000111-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:12:54 -0400 Received: from bsdsgr04.sagres.com.br ([200.140.134.134]) by ietf-mx with esmtp (Exim 4.12) id 1BJ2uB-0000u4-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:12:12 -0400 Received: from ntsgr07.sagres.com.br (NTsgr07.sagres.com.br [10.0.17.7]) by BSDsgr04.sagres.com.br (8.12.10/8.12.10) with ESMTP id i3T1Hn7U056759; Thu, 29 Apr 2004 01:17:49 GMT (envelope-from saurwein@uniwares.com) Received: from BSDsgr01.sagres.com.br ([200.103.113.172]) by ntsgr07.sagres.com.br (Lotus Domino Release 5.0.12) with SMTP id 2004042901214263:1588 ; Thu, 29 Apr 2004 01:21:42 -0300 Message-Id: <6.0.3.0.0.20040429010821.01bbbec0@mail.uniwares.com> X-Sender: saurwein.uniwares@mail.uniwares.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.3.0 To: JC Dill , asrg@ietf.org From: Andreas Saurwein Subject: Re: [Asrg] E-postage/hashcash - the future? In-Reply-To: <6.0.0.10.0.20040428201507.05935c80@127.0.0.1> References: <6.0.0.10.0.20040428201507.05935c80@127.0.0.1> Mime-Version: 1.0 X-MIMETrack: Itemize by SMTP Server on ntsgr07/SAGRES(Release 5.0.12 |February 13, 2003) at 29/04/2004 01:21:42, Serialize by Router on ntsgr07/SAGRES(Release 5.0.12 |February 13, 2003) at 29/04/2004 01:21:44, Serialize complete at 29/04/2004 01:21:44 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 01:12:00 -0300 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.7 required=5.0 tests=AWL autolearn=no version=2.60 At 29/4/2004 00:46 Thursday, you wrote: >For instance, the only reason iTunes is successful instead of Napster is >because most of the content on Napster is/was protected by copyright, one >can't legally exchange copyright protected songs or software via >Napster. Take away the legal restrictions, and the Napster model is >clearly superior to the iTunes model which is why the free market created >Napster when the RIAA refused to create a system for delivering songs over >the Internet. Instead of songs we have messages, and you see why people >want a free system to exchange messages. Well, then your analogy raises the question, will people accept pay mail system over "free" mail systems when it is 100% spam free, always, forever? It doesnt have the same legal consequences, yet still its intriguing because of its benefit. Andreas _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 00:55:20 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA18247 for ; Thu, 29 Apr 2004 00:55:20 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3U9-0003Tm-DG for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 00:49:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T4nLuU013369 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 00:49:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3Pr-0002No-5w for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 00:44:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17730 for ; Thu, 29 Apr 2004 00:44:49 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3Pl-0004f7-GI for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:44:49 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3On-0004Yb-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:43:50 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3Oc-0004S6-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:43:38 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3HF-0000Lh-Hz; Thu, 29 Apr 2004 00:36:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3CE-0007TY-Cv for asrg@optimus.ietf.org; Thu, 29 Apr 2004 00:30:50 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17223 for ; Thu, 29 Apr 2004 00:30:45 -0400 (EDT) From: john.oppler@gm.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3C8-0002zP-KA for asrg@ietf.org; Thu, 29 Apr 2004 00:30:44 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3BD-0002tO-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:29:48 -0400 Received: from plgmler4.imr.gm.com ([199.228.142.104]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3AT-0002nU-00; Thu, 29 Apr 2004 00:29:01 -0400 Received: from plgmlir1.imr.gm.com (plgmlir1-2.imr.gm.com [199.228.142.169]) by plgmler4.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T4T3DM014205; Thu, 29 Apr 2004 00:29:03 -0400 Received: from plgmlir1.imr.gm.com (localhost [127.0.0.1]) by plgmlir1.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T4SeKf031027; Wed, 28 Apr 2004 23:28:40 -0500 Received: from usabhmg02.mail.gm.com (USABHMG02.mail.gm.com [164.56.166.171]) by plgmlir1.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T4SdSS031022; Wed, 28 Apr 2004 23:28:40 -0500 Subject: Re: [Asrg] E-postage/hashcash - the future To: asrg@ietf.org, asrg-admin@ietf.org X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: X-MIMETrack: Serialize by Router on USABHMG02/G/GMSERVER/GMC(Release 5.0.11GM5 |January 20, 2004) at 04/29/2004 12:28:40 AM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 15:28:34 +1100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL,NO_REAL_NAME autolearn=no version=2.60 Just for the sake of clarification as my original message seems to have been misinterpreted. All I was saying was that _if_ a payment system of any kind was introduced it would certainly stop the spam that is a plague today. What I warned was that if this is the course that is followed then a new scourge would quickly follow. That scourge would be similar to the junk paper mail we now receive, sent by legitimate businesses That's all my initial message concerned. Since then I now find I am being attacked and insulted for just having that opinion. I will just go back to lurking I think as some of you are just not interested in any new discussion. Cheers John > >>In any case, I do see your point, but was just trying to express my > >>opinion as to what I think will happen if email is chargeable > > >It's about as useful as expressing an opinion as to what will happen when > >cars run on water. > >Well, thank you for suggesting my opinion was useless Those are your words, not mine. > >You have to look at the obstacles to making it happen. Thinking about how > >nice it will be "when it happens" is a waste of time if it ain't never > >gonna happen. > >I don't _have_ to do anything thank you! > >I certainly was not suggesting a way to make the situation better, Well, the topic of this mailing list is to RESEARCH ANTI-SPAM solutions. If you aren't going to suggest ways to make the situation better, perhaps there are other lists that would be better places for your musings. >I fully admit that, I simply I posted my opinion, which is based on what >_I_ think will happen next, regardless of which pay ' system' you plan to >introduce. I don't plan to introduce any "pay system" because I don't think they will be adopted enough to become successful. These proposals are too cumbersome and rely on centralized systems. We will never get widespread adoption when decentralized and simple solutions are available. For instance, the only reason iTunes is successful instead of Napster is because most of the content on Napster is/was protected by copyright, one can't legally exchange copyright protected songs or software via Napster. Take away the legal restrictions, and the Napster model is clearly superior to the iTunes model which is why the free market created Napster when the RIAA refused to create a system for delivering songs over the Internet. Instead of songs we have messages, and you see why people want a free system to exchange messages. > >The first obstacle to making it happen is getting the first 1/2 of the mail > >clients/servers on the 'net to sign-on to whatever plan we propose and > >implementing the necessary changes first, before there is any hope of > >payoff. The second obstacle is getting end users to agree to cut-off the > >last 1/2 of the mail clients/servers on the 'net (including aunt Sally with > >her old win95 box that can't be upgraded to a newer message system) once > >"critical mass" has been achieved, to force all the older clients/servers > >to upgrade or die so that the new system has 100% of the message traffic on > >the 'net. Both of these are *big* obstacles, and adding ePostage ON TOP OF > >THIS makes it considerably harder because we add a complicated payment > >scheme on top of a complicated system upgrade. > >The only way to stop spam is at the delivery point. If 100% of the spam that was injected into the system got 99% of the way to the recipient and then was dropped on the floor, it would still stop 100% of the spam. Yes, this is more *costly* than stopping it at the delivery point, but it is still EFFECTIVE. You can't ignore other solutions just because they aren't your preferred solution. This is why filtering is one model that is presently economically effective, people are paying Brightmail and Postini etc. to filter out spam and deliver the non-spam. >The certificates and/or payment schemes need to be a ISP >level, not at the user level. The user should not be involved at all. That is but one solution, but by no means the only solution. It might be the best solution, or the worst solution. You have to look at the problems with implementing your proposed solution, and with the alternatives, before you can tell if this is the best solution and if it's likely to succeed. >In my opinion this is an industry problem, not a >problem than needs any action by the user. You are aware that most spam today is being sent by "the user" right? (Trojan-infected zombie computers on broadband.) > >If it were easy it would have happened already by now. And we would all be > >driving cars powered by water. > >Please, please, please stop using cheesy analogies. There are already cars >that use water for fuel. The reason they are not released for the general >public >may not be obvious to you. If it were easy, and cheap, they would be out there. The fact that they aren't means that it isn't easy and cheap. The spam problem is a difficult one to solve. I've been actively fighting it for 7 years now, and I've seen the problems we have had with getting much simpler solutions put into place: 1) Open relays still exist, open proxies followed and are abundant. 2) Pink contracts were frequently written to sell to spammers, now they simply get IP offshore and the networks sell international lines to the offshore networks, having a "hands off" method of continuing to get the revenue. 3) UDP-type action against networks that sell to spammers has been ineffective because too many really large networks are selling with the above "hands off" methods. 4) DDoSs and lawsuits against BL sites. 5) Domain registrars sell domains to spammers, DNS providers sell DNS services, offshore hosts host the spamvertized sites, etc. 6) Trojans trick end users into installing zombie software so spammers can spam from millions of end user locations. 7) Etc. Anti-spam forces have tried one by one to stop each of these problems as they developed, without much success. Numerous proposed solutions for fixing many of these prior problems were suggested, all MUCH simpler to implement than the ePostage scheme, yet they were not widely adopted or implemented and all of these problems continue today. BTW, I have a Millicent coin in my drawer from ~1996 when Digital Equipment Corp (DEC, remember them? They created AltaVista...) thought that micropayments would be the way everyone would pay for web content. < http://seminars.seyboldreports.com/1997_san_francisco/EditorsAnalysis/IP020312.HTM > Do you see anyone paying for web content today? How much have you paid in micropayments for content today? This week? This month? This year? How much has your ISP paid on your behalf and then bundled the charge into your ISP bill? Zero, zip, zilch, nothing, nada, not one single red cent? Then why do you suddenly think that a payment system for email will be adopted when one for web content (which cost billions of dollars to produce) hasn't been adopted? Come up with a convincing argument for why the entire Internet should and will adopt a complicated ePostage payment system to replace today's present simple and free email system when we can't even get widespread adoption of a free existing system that produces an end-to-end audit trail (authenticated SMTP between client and server and between all servers) of all email messages thru the net. jc p.s. please don't send me cc's of your replies. reply to me, or to the list, as you prefer. But not both. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 01:06:22 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA18865 for ; Thu, 29 Apr 2004 01:06:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3hi-0005aC-5O for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:03:22 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T53MbQ021452 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:03:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3Xu-0004HM-1E for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 00:53:14 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA18153 for ; Thu, 29 Apr 2004 00:53:08 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3Xo-0005k2-6T for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:53:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3Wp-0005az-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:52:08 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3Vr-0005RO-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 00:51:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3Ru-0002uW-P6; Thu, 29 Apr 2004 00:47:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3Jx-0001Fd-Ty for asrg@optimus.ietf.org; Thu, 29 Apr 2004 00:38:49 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17550 for ; Thu, 29 Apr 2004 00:38:44 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3Jr-0003zV-Sa for asrg@ietf.org; Thu, 29 Apr 2004 00:38:43 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3Ir-0003qf-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:37:42 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3Hq-0003bA-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:36:38 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id 62E2DA3B63; Thu, 29 Apr 2004 14:06:07 +0930 (CST) Received: from rebel (ppp43-226.lns1.adl1.internode.on.net [150.101.43.226]) by mail.chariot.net.au (Postfix) with SMTP id 9D94B5F702; Thu, 29 Apr 2004 14:06:05 +0930 (CST) From: "Chris" To: "Barry Shein" Cc: "John Levine" , , Subject: RE: [Asrg] My take on e-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <16528.28789.942044.465136@world.std.com> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 14:05:28 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > (Just to be picky, by "costs" you mean "prices", right?) just to be equally picky outside of a monopoly, prices follow costs. > > For example, in the case of MS their aggressive marketing gave them > enough of an effective monopoly in some software areas that they could > raise prices (and costs.) That's not too obscure an example is it? > So you are proposing a monopoly to control pricing? Where are the market forces you spoke of previously, you cannot have it both ways. > > do we wholesale block entire countries? Does that become censorship? > > Well, it'd certainly be reasonable, after some transition period, to > only accept e-mail with a valid e-postage stamp. > well if we are going to implement that sort of infrastructure then why not just identify the sender with a digest of some sort why make it a "cost" item > If we could start by re-inventing the entire e-mail system from > scratch then I don't think solving the spam problem is all that > difficult. > > I believe most everyone agrees with that. Yes > > But you've got this little problem like a billion or two computers out > there who already do e-mail this way, and firewalls and corporate > policies and routers and servers etc. Billions? one or two in five for every head of the population. more exageration I'd say > > One nice thing about e-postage is that it could, in theory, be slipped > right w/o particularly interfering with end-users. For example, for an > entire corp it could be done at the edge server, or at the ISP by some > agreement. > Isnt that re-inventing the mail system. admittedly not for the "billions" of end users but the same goes for every other system > > Many Many programmers would see such fees as an attack on the > freedom of the > > internet. an attempt by governments to shut down the free flow of > > information under the GUISE of spam control. > > You do understand the difference between free as in beer and free as > in speech, right? > any implementation of a charge would be considered as an impediment to free speech. I didn't say it had to make sense. But I can assure you many people would think this way. its more about resistance to change. > > Um, what are they gonna do when they're flooded with spam through this > new system? > > How does painting the car yellow make it run faster? etc. > perhaps the new software would be designed to eliminate spam See your own comments above. (Red is the faster colour by the way) > > I wasn't in general, but for a list such as this it is > inevitable. does the > > ASRG pay? of course not. For a list like this it must be > recipient pays. > > > > Who else would? > > The sender? the sender *is* the ASRG or at least the list manager I send one email, the ASRG then distributes it to all recipients. Are you saying I should attach an open cheque to my email and say "charge this with as many recipients as you have on the list"? or perhaps you are saying that one charge one email regardless of the number of recipients? There is a slight flaw there. Regards Chris > -----Original Message----- > From: Barry Shein [mailto:bzs@world.std.com] > Sent: Thursday, 29 April 2004 12:33 PM > To: Chris > Cc: Barry Shein; John Levine; asrg@ietf.org; william@elan.net > Subject: Re: [Asrg] My take on e-postage > > > > On April 29, 2004 at 11:14 asrg@rebel.com.au (Chris) wrote: > > in reply > > > > > > > > > So if we take that into consideration what is the limit on the > > > > number of > > > > emails for free or charged 10,20 per day ? > > > > > > One would imagine it'd become a marketing issue, just like > the monthly > > > price of a connection and how fast that is, etc. > > > > > > > Marketing drives cost down, not up. take a look at bandwidth > charges now and > > 5 years ago. > > (Just to be picky, by "costs" you mean "prices", right?) > > Well, if you said "in the case of bandwidth marketing drove the prices > down, not up" perhaps I'd agree, but I'd be hard-put to agree that's > some sort of universal principle, that it always drives prices down. > > For example, in the case of MS their aggressive marketing gave them > enough of an effective monopoly in some software areas that they could > raise prices (and costs.) That's not too obscure an example is it? > > > If I was to sell a hosting service and wanted to beat the competition I > > might say "email at only 10c per 10,000 or get your hosting > here and we will > > throw in free email! > > Unless there were costs, something akin to settlement, where you had > to pay for the amount of email that flowed through your system and, > presumably, somehow pass those costs on to your customers. > > Obviously if we're giving away free stamps then it ultimately doesn't > matter much what stamp you stick on something, may as well print your > own. > > > > > Who polices that level. what about China who polices it there? > > > > > > Again, the market. > > > > > > > Perhaps I was not clear enough. I was talking about e-mail > spewing out of > > places like China. > > Do you think they will stop it? and if they do a hundred other > countries > > will take it up. > > do we wholesale block entire countries? Does that become censorship? > > Well, it'd certainly be reasonable, after some transition period, to > only accept e-mail with a valid e-postage stamp. > > Is that censorship? I dunno. Is forcing them to use SMTP censorship? > > > > > > > I will start writing one as soon as e-postage looks inevitable! > > > > > > Yeah well you could also try setting up your own phone and postage > > > systems and tell us how it works out. > > > > > > > Take a look at all the other p2p programs, e-mail could become > irrelevant. > > If we could start by re-inventing the entire e-mail system from > scratch then I don't think solving the spam problem is all that > difficult. > > I believe most everyone agrees with that. > > But you've got this little problem like a billion or two computers out > there who already do e-mail this way, and firewalls and corporate > policies and routers and servers etc. > > One nice thing about e-postage is that it could, in theory, be slipped > right w/o particularly interfering with end-users. For example, for an > entire corp it could be done at the edge server, or at the ISP by some > agreement. > > It's not unique in that regard, but it's useful to keep in mind that > this is a very important kind of quality for a proposed solution. > > > If you don't think a lone group of programmers can introduce > such a system > > look at the software you use everyday > > especially open source, Linux and Apache are two prime examples. > > No problem with that. > > Um, what are they gonna do when they're flooded with spam through this > new system? > > How does painting the car yellow make it run faster? etc. > > > To compare an e-mail style system with a bricks, mortar, hardware and > > employee system is simply trying to fool the more gullible of > us, there is > > simply no comparison. > > > > Furthermore the bricks and mortar and hardware are all in > place. all you > > need is the enthusiasm. add a fee to e-mail and overnight you > create the > > enthusiasm. > > > > Many Many programmers would see such fees as an attack on the > freedom of the > > internet. an attempt by governments to shut down the free flow of > > information under the GUISE of spam control. > > You do understand the difference between free as in beer and free as > in speech, right? > > Does having to affix postage to your letters constitute an > infringement on your freedom? > > > > > > > > Who suggested $.20? Who suggested it'd be recipient-pays? > > > > > > > And who pays for the duplicates we all receive? > > > > > > Who suggested it'd be recipient-pays? > > > > I wasn't in general, but for a list such as this it is > inevitable. does the > > ASRG pay? of course not. For a list like this it must be > recipient pays. > > > > Who else would? > > The sender? > > -- > -Barry Shein > > Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 01:25:45 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19907 for ; Thu, 29 Apr 2004 01:25:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3xd-0001Bk-L9 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:19:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T5JnQa004569 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:19:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3kG-0006qK-62 for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 01:06:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA18827 for ; Thu, 29 Apr 2004 01:05:56 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3kA-0007RO-8U for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:05:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3jE-0007IX-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:04:56 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3iW-0007B8-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:04:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3Ze-0004ZZ-8F; Thu, 29 Apr 2004 00:55:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3Ti-0003LQ-Eq for asrg@optimus.ietf.org; Thu, 29 Apr 2004 00:48:54 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA17944 for ; Thu, 29 Apr 2004 00:48:49 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3Tc-00058f-Kb for asrg@ietf.org; Thu, 29 Apr 2004 00:48:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3Sh-00052H-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:47:51 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BJ3SR-0004vi-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:47:35 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BJ3SS-0000MM-2H; Thu, 29 Apr 2004 05:47:36 +0100 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <55F67296-9998-11D8-A28E-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] HashCash To: gep2@terabites.com X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 05:47:36 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > Hashcash and signatures are non-starters (or deserve to be) for the > simple and > immutable reason that compromised spambot zombies will pump out large > numbers of > hashcash-certified, signature-carrying spams. > > AGAIN, THIS DOES NOT SOLVE THE PROBLEM. It only makes the system more > complicated and expensive. I don't buy this argument, because the "large numbers" of mail will be significantly smaller than the "massive numbers" we're seeing today. Instead of each zombie being limited only by it's pipe, it'll be limited by it's CPU, so the resource pool available to spammers will be orders of magnitude smaller than it is today. Since when is that such a weak argument? I added the idea of a simple signature because it's clear that PGP and S/MIME haven't taken off - so are they too complex and/or intrusive for Joe User? We need *something* to whitelist against. Each signature, incidentally, will be valuable only for the number of recipients who have whitelisted it, which for Joe User will normally be quite a small window. The signature will not say anything about the contents of the message, merely where it's stamp came from. Once a machine has been compromised, of course, it needs a new signing key after being cleaned up, but that's easy to arrange. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 01:36:37 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20554 for ; Thu, 29 Apr 2004 01:36:37 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ456-0003WN-2V for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:27:32 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T5RWtJ013536 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:27:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3zi-0001yH-Cy for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 01:21:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19728 for ; Thu, 29 Apr 2004 01:21:54 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3zc-0001j3-9l for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:21:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3yd-0001ak-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:20:53 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3yD-0001Tf-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:20:25 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3kI-0006qo-OA; Thu, 29 Apr 2004 01:06:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3eO-0004vE-CH for asrg@optimus.ietf.org; Thu, 29 Apr 2004 00:59:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA18543 for ; Thu, 29 Apr 2004 00:59:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3eI-0006fi-Cc for asrg@ietf.org; Thu, 29 Apr 2004 00:59:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3dQ-0006Z2-00 for asrg@ietf.org; Thu, 29 Apr 2004 00:58:57 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3cy-0006S9-00; Thu, 29 Apr 2004 00:58:29 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id AD49FA3F11; Thu, 29 Apr 2004 14:28:00 +0930 (CST) Received: from rebel (ppp43-226.lns1.adl1.internode.on.net [150.101.43.226]) by mail.chariot.net.au (Postfix) with SMTP id 045E35F742; Thu, 29 Apr 2004 14:27:59 +0930 (CST) From: "Chris" To: , , Subject: RE: [Asrg] E-postage/hashcash - the future Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 14:27:21 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > > Since then I now find I am being attacked and insulted for just > having that > opinion. > > I will just go back to lurking I think as some of you are just not > interested in any new discussion. > You are right, some people cannot stand having their views challenged The internet is thought of as a level playing field. where the mighty and the minor can stand shoulder to shoulder e-postage delivers the internet back to the mighty (read rich) as you have so rightly pointed out. We must stop the abuse of e-mail by spammers without delivering what the large corporations want. Which is total control. Those who are in the employ of large corporations will always rigorously decry any suggestion that deviates from that plan Regards Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of > john.oppler@gm.com > Sent: Thursday, 29 April 2004 1:59 PM > To: asrg@ietf.org; asrg-admin@ietf.org > Subject: Re: [Asrg] E-postage/hashcash - the future > > > > Just for the sake of clarification as my original message seems to have > been misinterpreted. > > All I was saying was that _if_ a payment system of any kind was introduced > it would certainly stop > the spam that is a plague today. What I warned was that if this is the > course that is followed then a new scourge > would quickly follow. That scourge would be similar to the junk > paper mail > we now receive, sent by legitimate businesses > > That's all my initial message concerned. > > Since then I now find I am being attacked and insulted for just > having that > opinion. > > I will just go back to lurking I think as some of you are just not > interested in any new discussion. > > Cheers > > > John > > > > > > > >>In any case, I do see your point, but was just trying to express my > > >>opinion as to what I think will happen if email is chargeable > > > > >It's about as useful as expressing an opinion as to what will happen > when > > >cars run on water. > > > >Well, thank you for suggesting my opinion was useless > > Those are your words, not mine. > > > >You have to look at the obstacles to making it happen. Thinking about > how > > >nice it will be "when it happens" is a waste of time if it ain't never > > >gonna happen. > > > >I don't _have_ to do anything thank you! > > > >I certainly was not suggesting a way to make the situation better, > > Well, the topic of this mailing list is to RESEARCH ANTI-SPAM > solutions. If you aren't going to suggest ways to make the situation > better, perhaps there are other lists that would be better places for your > musings. > > >I fully admit that, I simply I posted my opinion, which is based on what > >_I_ think will happen next, regardless of which pay ' system' > you plan to > >introduce. > > I don't plan to introduce any "pay system" because I don't think they will > be adopted enough to become successful. These proposals are too > cumbersome > > and rely on centralized systems. We will never get widespread adoption > when decentralized and simple solutions are available. > > For instance, the only reason iTunes is successful instead of Napster is > because most of the content on Napster is/was protected by copyright, one > can't legally exchange copyright protected songs or software via > Napster. Take away the legal restrictions, and the Napster model is > clearly superior to the iTunes model which is why the free market created > Napster when the RIAA refused to create a system for delivering songs over > the Internet. Instead of songs we have messages, and you see why people > want a free system to exchange messages. > > > >The first obstacle to making it happen is getting the first 1/2 of the > mail > > >clients/servers on the 'net to sign-on to whatever plan we propose and > > >implementing the necessary changes first, before there is any hope of > > >payoff. The second obstacle is getting end users to agree to cut-off > the > > >last 1/2 of the mail clients/servers on the 'net (including aunt Sally > with > > >her old win95 box that can't be upgraded to a newer message > system) once > > >"critical mass" has been achieved, to force all the older > clients/servers > > >to upgrade or die so that the new system has 100% of the > message traffic > on > > >the 'net. Both of these are *big* obstacles, and adding > ePostage ON TOP > OF > > >THIS makes it considerably harder because we add a complicated payment > > >scheme on top of a complicated system upgrade. > > > >The only way to stop spam is at the delivery point. > > If 100% of the spam that was injected into the system got 99% of > the way to > > the recipient and then was dropped on the floor, it would still stop 100% > of the spam. Yes, this is more *costly* than stopping it at the delivery > point, but it is still EFFECTIVE. You can't ignore other solutions just > because they aren't your preferred solution. > > This is why filtering is one model that is presently economically > effective, people are paying Brightmail and Postini etc. to > filter out spam > > and deliver the non-spam. > > >The certificates and/or payment schemes need to be a ISP > >level, not at the user level. The user should not be involved at all. > > That is but one solution, but by no means the only solution. It might be > the best solution, or the worst solution. You have to look at > the problems > > with implementing your proposed solution, and with the > alternatives, before > > you can tell if this is the best solution and if it's likely to succeed. > > >In my opinion this is an industry problem, not a > >problem than needs any action by the user. > > You are aware that most spam today is being sent by "the user" > right? (Trojan-infected zombie computers on broadband.) > > > >If it were easy it would have happened already by now. And we > would all > be > > >driving cars powered by water. > > > >Please, please, please stop using cheesy analogies. There are already > cars > >that use water for fuel. The reason they are not released for > the general > > >public > >may not be obvious to you. > > If it were easy, and cheap, they would be out there. The fact that they > aren't means that it isn't easy and cheap. > > The spam problem is a difficult one to solve. I've been actively fighting > it for 7 years now, and I've seen the problems we have had with getting > much simpler solutions put into place: > > 1) Open relays still exist, open proxies followed and are abundant. > 2) Pink contracts were frequently written to sell to spammers, now they > simply get IP offshore and the networks sell international lines to the > offshore networks, having a "hands off" method of continuing to get the > revenue. > 3) UDP-type action against networks that sell to spammers has been > ineffective because too many really large networks are selling with the > above "hands off" methods. > 4) DDoSs and lawsuits against BL sites. > 5) Domain registrars sell domains to spammers, DNS providers sell DNS > services, offshore hosts host the spamvertized sites, etc. > 6) Trojans trick end users into installing zombie software so > spammers can > > spam from millions of end user locations. > 7) Etc. > > Anti-spam forces have tried one by one to stop each of these problems as > they developed, without much success. Numerous proposed solutions for > fixing many of these prior problems were suggested, all MUCH simpler to > implement than the ePostage scheme, yet they were not widely adopted or > implemented and all of these problems continue today. > > BTW, I have a Millicent coin in my drawer from ~1996 when Digital > Equipment > > Corp (DEC, remember them? They created AltaVista...) thought that > micropayments would be the way everyone would pay for web content. > > < > http://seminars.seyboldreports.com/1997_san_francisco/EditorsAnaly sis/IP020312.HTM > Do you see anyone paying for web content today? How much have you paid in micropayments for content today? This week? This month? This year? How much has your ISP paid on your behalf and then bundled the charge into your ISP bill? Zero, zip, zilch, nothing, nada, not one single red cent? Then why do you suddenly think that a payment system for email will be adopted when one for web content (which cost billions of dollars to produce) hasn't been adopted? Come up with a convincing argument for why the entire Internet should and will adopt a complicated ePostage payment system to replace today's present simple and free email system when we can't even get widespread adoption of a free existing system that produces an end-to-end audit trail (authenticated SMTP between client and server and between all servers) of all email messages thru the net. jc p.s. please don't send me cc's of your replies. reply to me, or to the list, as you prefer. But not both. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 01:48:37 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA21084 for ; Thu, 29 Apr 2004 01:48:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4DT-0004s2-0M for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:36:11 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T5aAiC018717 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:36:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ44j-0003LC-0M for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 01:27:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20001 for ; Thu, 29 Apr 2004 01:27:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ44c-0002T4-QU for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:27:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ43f-0002Kh-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:26:03 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ43I-0002Cy-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:25:40 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3xr-0001Ex-CK; Thu, 29 Apr 2004 01:20:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3kE-0006qG-SF for asrg@optimus.ietf.org; Thu, 29 Apr 2004 01:05:59 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA18819 for ; Thu, 29 Apr 2004 01:05:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3k8-0007RD-Pt for asrg@ietf.org; Thu, 29 Apr 2004 01:05:52 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3jC-0007II-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:04:55 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BJ3iV-0007B5-00; Thu, 29 Apr 2004 01:04:11 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BJ3iX-0000Rw-7Z; Thu, 29 Apr 2004 06:04:13 +0100 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org, JC Dill , asrg-admin@ietf.org From: Jonathan Morton Subject: Re: [Asrg] E-postage/hashcash - the future To: john.oppler@gm.com X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 06:04:13 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >> If it were easy it would have happened already by now. And we would >> all be >> driving cars powered by water. > > Please, please, please stop using cheesy analogies. There are already > cars that use water for fuel. The reason they are not released for > the general public may not be obvious to you. Just for the record, please distinguish between cars that use water as a fuel, and those that use water merely as an agent or catalyst in a reaction powered from another source. If you consider a hydrogen fuel cell to be "water power", then 18th-century steam carriages also count. In both cases, the water isn't really the fuel. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 01:48:44 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA21121 for ; Thu, 29 Apr 2004 01:48:44 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4F2-00059G-Fd for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:37:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T5bmHt019786 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:37:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ46S-0003mQ-LE for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 01:28:56 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20152 for ; Thu, 29 Apr 2004 01:28:52 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ46M-0002kK-HM for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:28:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ45Y-0002c5-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:28:00 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ44g-0002Tj-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:27:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3yw-0001iO-AU; Thu, 29 Apr 2004 01:21:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ3qx-0000Ey-AB for asrg@optimus.ietf.org; Thu, 29 Apr 2004 01:12:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19289 for ; Thu, 29 Apr 2004 01:12:51 -0400 (EDT) From: john.oppler@GM.COM Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ3qr-0000a3-95 for asrg@ietf.org; Thu, 29 Apr 2004 01:12:49 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ3pz-0000Sk-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:11:56 -0400 Received: from ahgmler2.imr.gm.com ([192.85.154.102]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3p5-0000LK-00; Thu, 29 Apr 2004 01:10:59 -0400 Received: from ahgmlir2.imr.gm.com (ahgmlir2-2.imr.gm.com [192.85.154.170]) by ahgmler2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T5B12X004239; Thu, 29 Apr 2004 01:11:01 -0400 Received: from ahgmlir2.imr.gm.com (localhost [127.0.0.1]) by ahgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T5AGap022610; Thu, 29 Apr 2004 01:10:16 -0400 Received: from usabhmg02.mail.gm.com (USABHMG02.mail.gm.com [164.56.166.171]) by ahgmlir2.imr.gm.com (8.12.10/8.12.10) with ESMTP id i3T5AGq3022605; Thu, 29 Apr 2004 01:10:16 -0400 Subject: RE: [Asrg] E-postage/hashcash - the future To: asrg@ietf.org, asrg-admin@ietf.org X-Mailer: Lotus Notes Release 5.0.11 July 24, 2002 Message-ID: X-MIMETrack: Serialize by Router on USABHMG02/G/GMSERVER/GMC(Release 5.0.11GM5 |January 20, 2004) at 04/29/2004 01:10:16 AM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 16:10:06 +1100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.3 required=5.0 tests=AWL,NO_REAL_NAME autolearn=no version=2.60 >You are right, some people cannot stand having their views challenged Oh, you were challenging my views. My apologies then! >The internet is thought of as a level playing field. where the mighty and >the minor can stand shoulder to shoulder >e-postage delivers the internet back to the mighty (read rich) as you have >so rightly pointed out. >We must stop the abuse of e-mail by spammers without delivering what the >large corporations want. >Which is total control. >Those who are in the employ of large corporations will always rigorously >decry any suggestion that deviates from that plan Glad that you then agree with my opinion. John _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 02:03:43 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA26452 for ; Thu, 29 Apr 2004 02:03:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4Yr-0000uG-J2 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:58:17 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T5wHCX003482 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 01:58:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4Sa-0007z0-08 for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 01:51:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA21731 for ; Thu, 29 Apr 2004 01:51:43 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ4ST-00064G-LH for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:51:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ4QF-0005f4-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:49:24 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ4OK-0005CT-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:47:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ49U-0004Mh-AE; Thu, 29 Apr 2004 01:32:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ41p-0002W5-G8 for asrg@optimus.ietf.org; Thu, 29 Apr 2004 01:24:09 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19843 for ; Thu, 29 Apr 2004 01:24:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ41j-000243-AI for asrg@ietf.org; Thu, 29 Apr 2004 01:24:03 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ40q-0001uw-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:23:08 -0400 Received: from mailbox.onlinepolicy.net ([64.62.161.194]) by ietf-mx with esmtp (Exim 4.12) id 1BJ3zs-0001cD-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:22:08 -0400 Received: by mailbox.onlinepolicy.net (Postfix, from userid 504) id A8835189189; Wed, 28 Apr 2004 22:11:43 -0700 (PDT) Received: from [10.10.2.133] (wsip-24-120-30-164.lv.lv.cox.net [24.120.30.164]) by mailbox.onlinepolicy.net (Postfix) with ESMTP id 75D61189188; Wed, 28 Apr 2004 22:11:42 -0700 (PDT) Message-ID: <409090DF.4010409@queernet.org> From: "\"Roger B.A. Klorese \" " User-Agent: Mozilla Thunderbird 0.6b (Windows/20040427) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Barry Shein Cc: "Hallam-Baker, Phillip" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) References: <16528.11346.656296.255405@world.std.com> <409031A9.2010809@queernet.org> <16528.27844.324796.238684@world.std.com> In-Reply-To: <16528.27844.324796.238684@world.std.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 22:21:35 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: >Do you have any idea how many host names, between mail and ftp >and everything else people do, are looked up *per second*?! > Lookups are cheap. Atomic multi-record updates are expensive. DNS is 99.99+% read-only. Postage is heavily update-biased. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 02:13:47 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA06235 for ; Thu, 29 Apr 2004 02:13:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4b1-0001cS-AC for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:00:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T60VVW006216 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:00:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4XX-0000Hi-5A for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 01:56:55 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA22335 for ; Thu, 29 Apr 2004 01:56:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ4XQ-0006xi-M9 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:56:48 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ4WW-0006qD-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:55:52 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ4Vf-0006iX-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:54:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4Pt-0007M0-Gk; Thu, 29 Apr 2004 01:49:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4AQ-0004ZV-BC for asrg@optimus.ietf.org; Thu, 29 Apr 2004 01:33:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20330 for ; Thu, 29 Apr 2004 01:32:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ4AK-0003KS-44 for asrg@ietf.org; Thu, 29 Apr 2004 01:32:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ49O-00039v-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:31:59 -0400 Received: from sierra.rtfm.com ([198.144.203.251]) by ietf-mx with esmtp (Exim 4.12) id 1BJ48Q-0002tL-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:30:58 -0400 Received: from romeo.rtfm.com (romeo.rtfm.com [198.144.203.242]) by sierra.rtfm.com (Postfix) with ESMTP id D604B7171; Wed, 28 Apr 2004 22:32:11 -0700 (PDT) Received: by romeo.rtfm.com (Postfix, from userid 556) id 1D2EB44AE7; Wed, 28 Apr 2004 22:30:23 -0700 (PDT) To: Barry Shein Cc: "Chris" , "John Levine" , , Subject: Re: [Asrg] My take on e-postage Reply-To: EKR References: <20040428035609.906.qmail@xuxa.iecc.com> <16528.7239.854384.602331@world.std.com> From: Eric Rescorla In-Reply-To: <16528.7239.854384.602331@world.std.com> (Barry Shein's message of "Wed, 28 Apr 2004 17:04:07 -0400") Message-ID: User-Agent: Gnus/5.1006 (Gnus v5.10.6) XEmacs/21.4 (Reasonable Discussion, berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Wed, 28 Apr 2004 22:30:23 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Barry Shein writes: > On April 28, 2004 at 14:07 asrg@rebel.com.au (Chris) wrote: > > So if we take that into consideration what is the limit on the number of > > emails for free or charged 10,20 per day ? > > One would imagine it'd become a marketing issue, just like the monthly > price of a connection and how fast that is, etc. I don't think that this argument works. We've got an activity (e-mail marketing) which is profitable for individuals to engage in but produces a large negative externality (principally the load on people's mailboxes and the costs they bear to filter out the spam). The e-postage solution is basically a Pigouvian tax on spamming, forcing forcing the spammers to bear the cost externality rather than letting them impose it on the rest of us. Purely for the purpose of illustration, imagine we imposed an actual tax on every e-mail sent. In order to discourage spamming [0], each e-mail sender has to actually pay for each message. Obviously, your ISP can pre-pay the tax and then bundle it as part of your service, but someone has to pay the tax. If not, it doesn't properly discourage the activity. In that respect, I don't think that e-postage is any different. -Ekr [0] Technically speaking, to have an efficiently level of spamming, but I think most people expect that would be close to zero. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 02:15:39 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA06483 for ; Thu, 29 Apr 2004 02:15:39 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4gp-0004cI-3a for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:06:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T66UKc017742 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:06:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4Zb-00013Z-PG for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 01:59:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA22450 for ; Thu, 29 Apr 2004 01:58:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ4ZV-0007Gr-DC for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:58:57 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ4YW-00077V-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:57:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ4Xy-0006zD-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 01:57:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4Qq-0007an-KC; Thu, 29 Apr 2004 01:50:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4Jw-0005ni-2n for asrg@optimus.ietf.org; Thu, 29 Apr 2004 01:42:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA20817 for ; Thu, 29 Apr 2004 01:42:48 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ4Jp-0004a3-OU for asrg@ietf.org; Thu, 29 Apr 2004 01:42:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ4Ir-0004T0-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:41:46 -0400 Received: from mail3.sa.chariot.net.au ([203.87.94.14]) by ietf-mx with esmtp (Exim 4.12) id 1BJ4Hs-0004Fs-00; Thu, 29 Apr 2004 01:40:44 -0400 Received: from mail.chariot.net.au (mail.chariot.net.au [203.87.95.38]) by mail3.sa.chariot.net.au (Postfix) with ESMTP id 6CD0CA3C05; Thu, 29 Apr 2004 15:10:14 +0930 (CST) Received: from rebel (ppp43-226.lns1.adl1.internode.on.net [150.101.43.226]) by mail.chariot.net.au (Postfix) with SMTP id BB86A5F726; Thu, 29 Apr 2004 15:10:13 +0930 (CST) From: "Chris" To: , , Subject: RE: [Asrg] E-postage/hashcash - the future Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 15:09:36 +0930 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > > >You are right, some people cannot stand having their views challenged > > Oh, you were challenging my views. My apologies then! > You are on the defensive. the above was my first response to you. I was saying that *you* were challenging *their* views. Its very easy to go on the defensive and misinterpret someones intent. in this (and other) discussion lists. especially when you are new. I know I did as well. I was pushing pulling (grin) and got slammed. but such is life. pull has as many problems/faults as EVERY other method. Because nothing is obviously perfect, there are plenty of people willing to highlight the faults We all do, you did. I just happen to agree with your slightly off center view. Regards Chris > -----Original Message----- > From: asrg-admin@ietf.org [mailto:asrg-admin@ietf.org]On Behalf Of > john.oppler@GM.COM > Sent: Thursday, 29 April 2004 2:40 PM > To: asrg@ietf.org; asrg-admin@ietf.org > Subject: RE: [Asrg] E-postage/hashcash - the future > > > > > >You are right, some people cannot stand having their views challenged > > Oh, you were challenging my views. My apologies then! > > > >The internet is thought of as a level playing field. where the mighty and > >the minor can stand shoulder to shoulder > >e-postage delivers the internet back to the mighty (read rich) > as you have > >so rightly pointed out. > > >We must stop the abuse of e-mail by spammers without delivering what the > >large corporations want. > > >Which is total control. > > >Those who are in the employ of large corporations will always rigorously > >decry any suggestion that deviates from that plan > > > Glad that you then agree with my opinion. > > John > > > > _______________________________________________ > Asrg mailing list > Asrg@ietf.org > https://www1.ietf.org/mailman/listinfo/asrg _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 02:30:45 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA07769 for ; Thu, 29 Apr 2004 02:30:45 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ52Q-0007ws-Uk for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:28:51 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T6SoAw030554 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:28:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4ts-0004Gh-5I for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 02:20:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA07031 for ; Thu, 29 Apr 2004 02:19:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ4tl-0002tJ-Gs for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 02:19:53 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ4so-0002lN-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 02:18:55 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ4s4-0002dk-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 02:18:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4oA-0000sx-IK; Thu, 29 Apr 2004 02:14:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ4ab-0001HD-Vd for asrg@optimus.ietf.org; Thu, 29 Apr 2004 02:00:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA22553 for ; Thu, 29 Apr 2004 02:00:01 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ4aV-0007RV-5v for asrg@ietf.org; Thu, 29 Apr 2004 01:59:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ4Zh-0007Id-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:59:10 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BJ4Yq-00075X-00 for asrg@ietf.org; Thu, 29 Apr 2004 01:58:16 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc12) with SMTP id <2004042905574801200ng1u7e>; Thu, 29 Apr 2004 05:57:48 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Thu, 29 Apr 2004 00:56:40 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Thu, 29 Apr 2004 01:06:54 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] HashCash To: Jonathan Morton , gep2@terabites.com Cc: asrg@ietf.org In-Reply-To: <55F67296-9998-11D8-A28E-000393863768@chromatix.demon.co.uk> X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 01:06:54 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Thu, 29 Apr 2004, Jonathan Morton wrote: >> Hashcash and signatures are non-starters (or deserve to be) for the >> simple and >> immutable reason that compromised spambot zombies will pump out large >> numbers of >> hashcash-certified, signature-carrying spams. >> AGAIN, THIS DOES NOT SOLVE THE PROBLEM. It only makes the system more >> complicated and expensive. >I don't buy this argument, Hey, suit yourself. >because the "large numbers" of mail will be >significantly smaller than the "massive numbers" we're seeing today. I don't think that's assured. >Instead of each zombie being limited only by it's pipe, it'll be >limited by it's CPU, so the resource pool available to spammers will be >orders of magnitude smaller than it is today. The statistics recently reported regarding spammer zombie recruitment pointed out that spammers tend to favor using more recently recruited zombies, since those are less likely to be filtered yet. But as the "burst rate" of each zombie is reduced, it's likely to not be detected and filtered as quickly... so spammers might find that they can use each recruited zombie longer. Anyhow, the rate of recruitment continues to accelerate. I really don't believe that the solution to the spam problem involves making E-mail harder or more costly to send. I think a much better solution involves making it (if unwanted) *far* less likely to actually be delivered... such that the spammer realizes that the effort is probably futile. Likewise, we HAVE to work on cutting down the ease of zombie recruitment, and I believe that my attachments (and HTML!) permissions list idea (basically a fine-resolution whitelist) is a *major* step in the right direction there. >Since when is that such a weak argument? Well, maybe always, in part since it ignores the very legitimate needs of organizations like Yahoogroups and other major outbound mailers to send millions and millions of pieces of mail a day. What determines whether a piece of E-mail is wanted or not (and whether it's spam or not) is NOT whether it got sent out in large quantities, or whether the sender paid or not to send it, or even who sent it out. What determines whether it's spam or not is whether the RECIPIENT wants it and authorized the sender to send it to them, and whether the content of the mail is remotely like what the recipient(s) expect and want to receive from that sender. >I added the idea of a simple signature because it's clear that PGP and >S/MIME haven't taken off - so are they too complex and/or intrusive for >Joe User? We need *something* to whitelist against. Why do you think that it's not enough to simply use the E-mail characteristics (type of content, HTML classes used, type of attachments, size maybe) in combination with the sender and the list of permissions granted to that sender by the recipient? And if you DO want something more, why is a "passcode" or something freely made available by the recipient (perhaps in large number of variant forms, so to make life difficult for address harvesters) and included in (say) the Subject or a special header line perhaps, not enough? Again, do note that unanticipated/unwhitelisted E-mail (presuming that it does not include HTML or attachments, which would immediately t-can or at least reroute it, for example during the breakin period) would also need to be vetted by some kind of SpamAssassin-like antispam content filter prior to presentation to the addressee. > Each signature, >incidentally, will be valuable only for the number of recipients who >have whitelisted it, which for Joe User will normally be quite a small >window. So what happens if they HAVE NOT whitelisted it? I think that many (most if not all!) types of users NEED to have SOME kind of way to receive legitimate, unanticipated E-mails (consumer feedback to manufacturers, people responding to the business card they have from you, etc etc.) Obviously they don't want those to be spam. My solution to this is that those E-mails have to be plain ASCII text (and therefore _much_ more effectively content-filtered, and much less likely to contain malicious content). >The signature will not say anything about the contents of the >message, merely where it's stamp came from. Again, I think this is fairly useless because when it comes to spam/virus/worms, the CONTENT of the mail (in conjunction with who it came from, perhaps, and the express wishes of the recipient in that regard) is the ONLY thing which truly guarantees whether it's spam/virus/worm or not. Signatures, like E-postage, SPF, and all these other schemes, are really solutions in search of a problem. THAT is the REAL reason why PGP never caught on... it simply was too complicated and too much hassle to use it, and most people simply didn't think it was worth it. To now try to pretend that each of these "pet solutions in search of a problem" is the key to the spam problem is like claiming that attacking Iraq is the key to the international war on terrorism... in each case, someone with a vested interest is trying to impose an agenda on the rest of the world that has nothing to do with the problem they're proposing it for, just because they're trying to twist strong concern over the problem into support for something else that's truly unrelated. >Once a machine has been compromised, of course, it needs a new signing >key after being cleaned up, but that's easy to arrange. I think my solution is better here, too. If a machine is compromised and suddenly starts sending spam, the spam is most likely **immediately** blocked simply because it no longer "looks" like what the recipient expects to receive from the sender it's coming from. Now it "looks" like spam. You don't have to "arrange" anything new at all. If I suddenly get an E-mail containing an executable attachment from one of the newsletters or Yahoogroups discussion lists I subscribe to, it's virtually GUARANTEED that it's bogus. I could care less whether it's got an E-stamp on it, or has a "certificate", or whether the sender thought about it a long time before sending it, or anything else. I can tell based on what it is and who it claims to be from that it doesn't look like what that person sends to me. Therefore, I don't want it. If I get a message claiming to be from a newsletter company, and that I happen to know includes HTML formatting codes in their messages, if I suddenly find that it comes in and uses ActiveX or scripting, then that's clearly not within the purview of what I expect from that sender. If I get an E-mail from my clueless Aunt Millie (millie@aol.com) I might expect it to have that stupid AOL-style formatting BS, and she might even send me a JPG now and again, but if suddenly I get a message from her containing a .PIF attchment or that contains HTML hyperlinks, or something like that, I can be pretty confident that my dear sweet aunt didn't originate it. Or for that matter, maybe this is someone I gave a business card to on a cruise ship several years back and they're finally getting back to me about something they ran across that might be interesting. I'm probably glad to hear from them, but if I'm out of town this week (maybe on a cruise again) and their (inept?) message is going to chew up 95% of my ISP-provided Inbox, then chances are pretty good that I'd rather not receive it and have the rest of my E-mails bounce all week long until I can get back. Who really cares about signing keys, or certificates, or all these SPF-like mods to DNS which don't solve the problem, or E-postage and all the new opportunities for fraud, abuse, extra costs and hassles? I sure don't. All I'm concerned about is dumping spam in the trash so I don't have to deal with it. I don't see any point of E-mailing back (to who? AS IF there were a real return address!) and telling them what to do to get past my checks!!?? Riiiiiiiight. No, a big part of the whole key to this thing is that the legitimate senders know that their current behavior is acceptable (perhaps JUST!) and that they may run into problems if they stray too far from that standard (and different recipients may have set their filters and permissions standards for the same material VERY differently!). Even if one of those familiar senders WERE to get zombie-ized, the fact that suddenly they're not behaving (SOMETIMES!) the way I expect them to behave is enough to cause the irregular mail to be zapped, EVEN THOUGH the real stuff they still occasionally send me legitimately will still sail through to me just the way it always has. A spambot zombie probably won't be able to guess what the rules are to get mail through to given recipients, and just because the machine they've overtaken has lots of permissions... for SOME folks... won't help at all for e-mailing to other people, or for mailing (even to the SAME people!) different types of stuff. AND for the case (the typical case) where the sender is only sending plain ASCII text, without attachments, then NO amount of HTML-obscured deviousness or scripted decryption or misrepresented hyperlinks or seductive ruses to try to get the recipient to decode and launch some evil attachment is going to get the spam or virus or worm stuff past my permissions list. It's simply as futile as arguing with a vending machine about the change it gave you (or didn't). Those bogus things simply disappear down a black hole, giving the spambot (or the spammer controlling it) no indication at all about what it might more profitably try for the next time. Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 03:02:57 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA09563 for ; Thu, 29 Apr 2004 03:02:57 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ5WL-00079j-0I for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:59:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T6xinm027504 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 02:59:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ5Qj-0005ua-Js for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 02:53:57 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA08964 for ; Thu, 29 Apr 2004 02:53:52 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ5Qc-0007fV-Q3 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 02:53:50 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ5Pk-0007X1-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 02:52:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ5Op-0007OU-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 02:51:59 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ5Ly-0004ib-ST; Thu, 29 Apr 2004 02:49:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ5DC-0002c6-Cz for asrg@optimus.ietf.org; Thu, 29 Apr 2004 02:39:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA08348 for ; Thu, 29 Apr 2004 02:39:53 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ5D5-0005js-EH for asrg@ietf.org; Thu, 29 Apr 2004 02:39:51 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ5CI-0005c1-00 for asrg@ietf.org; Thu, 29 Apr 2004 02:39:03 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BJ5Bh-0005Tb-00 for asrg@ietf.org; Thu, 29 Apr 2004 02:38:25 -0400 Received: (qmail 6204 invoked by uid 100); 29 Apr 2004 06:38:21 -0000 Message-ID: <20040429063821.6203.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org In-Reply-To: <16528.27844.324796.238684@world.std.com> Organization: I.E.C.C., Trumansburg NY USA Subject: [Asrg] E-postage from first principles Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 29 Apr 2004 06:38:21 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 What's the point of e-postage? All the e-mail systems I know would have no trouble handling their incoming mail if they only got mail that their users wanted, even with a little unwanted mixed in. This tells me that the goal of e-postage is some combination of compensating recipients and deterring or at least rate limiting senders. If you're going to compensate recipients, you either need a single central post office (or a cartel of post offices that trust each other, which amounts to the same thing), or else you need settlements to get the money from the sender's stamp provider to the recipient's. We presumably agree that we don't want a central post office to meter the mail as it's injected into the system. I have a pretty good idea of what it would cost to build a transaction infrastructure big enough to count the stamps to get the raw data needed for settlements, which tells me that settlements aren't going to happen, either. So let's think about rate limiting or deterring senders. Perhaps I'm suffering from a failure of imagination, but I don't see useful rate limiting without some cooperation from the recipients. This is for two reasons: one is that recipients don't want to rate limit the mail they want, and the other is that without some way for the recipients to audit the rate limiting, naughty senders will lie and claim they're rate limiting when they aren't. There's a minor exception here to the cooperation rule for for ISPs and their customers. If I were an ISP, I would rate limit my customers' outgoing mail since anyone who sends a whole lot of mail and hasn't told me they're running mailing lists is a zombie. Although I can imagine various ways to rate limit by charging by the message, it seems a lot easier and more effective to rate limit by rate limiting, either slowing down senders or just firewalling them until they fix their problem. If you charge, you'll have trouble collecting (credit card companies aren't thrilled about penalties other than their own) and spammees won't find the fact that you made extra money from the spam your users sent them very reassuring. Receipient rate limiting might take the form of hashcash, although that seems too easily circumvented so long as the bad guys have zombies to do their hashing. With better authentication, recipients might be more able to count mail by sender and tell the overeager senders to back off. With agreements a la Bonded Sender, recipients might demand consideration to accept mail from dubious sources, but then you're back to a cartel or settlements to make the demands stick. So where does this leave e-postage? Other than as a clumsy way to get people to fix their zombie machines, nowhere I can see. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 03:54:21 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11611 for ; Thu, 29 Apr 2004 03:54:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ6La-0001gQ-Hf for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 03:52:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T7qgmJ006471 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 03:52:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ6BH-0007rj-MB for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 03:42:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11066 for ; Thu, 29 Apr 2004 03:41:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ6BA-0006xv-B3 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 03:41:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ6AO-0006la-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 03:41:09 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BJ69f-0006bd-02 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 03:40:23 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BJ67o-0000KR-Rd for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 03:38:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ5xw-0004l2-Gj; Thu, 29 Apr 2004 03:28:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ5tp-0003f0-7V for asrg@optimus.ietf.org; Thu, 29 Apr 2004 03:24:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA10443 for ; Thu, 29 Apr 2004 03:23:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ5th-0004Jt-Ur for asrg@ietf.org; Thu, 29 Apr 2004 03:23:54 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ5sm-0004C2-00 for asrg@ietf.org; Thu, 29 Apr 2004 03:22:57 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BJ5sN-00043y-00 for asrg@ietf.org; Thu, 29 Apr 2004 03:22:31 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BJ5sO-0001Nc-Og; Thu, 29 Apr 2004 08:22:32 +0100 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] HashCash To: gep2@terabites.com X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 08:22:32 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> AGAIN, THIS DOES NOT SOLVE THE PROBLEM. It only makes the system >>> more >>> complicated and expensive. > >> I don't buy this argument, > > Hey, suit yourself. > >> because the "large numbers" of mail will be >> significantly smaller than the "massive numbers" we're seeing today. > > I don't think that's assured. Please justify this statement. I've taken some numbers provided by a poster, and indicated the difference in the quantity of resources available - even assuming the spammers can use a significantly larger fraction of their zombie pool to make stamps than send mail. I'll even summarise here: At present, spammers use fresh zombies for an average of 4 days after infection - this pool is about 100,000 machines at present. The total zombie pool is about 1,500,000 machines at present, depending who you ask and how they collected their data. This is about 15x the number of active spewers. Assumption: It presently takes about 4000 times as long for a typical zombie (1.0GHz P6 or K7 class CPU with a 128Kbit DSL uplink) to mint a 20-bit hashcash stamp as to send out an unstamped, 5KB mail. Given that spammers can recruit the entire horsepower of their zombie army, compared to only a fraction of the bandwidth, this still marks a reduction in overall spamming capacity of about 200 times. And this assumes the zombies' CPUs aren't being used for anything else, such as games. > I really don't believe that the solution to the spam problem involves > making > E-mail harder or more costly to send. I think a much better solution > involves > making it (if unwanted) *far* less likely to actually be delivered... > such that > the spammer realizes that the effort is probably futile. > > Likewise, we HAVE to work on cutting down the ease of zombie > recruitment, and I > believe that my attachments (and HTML!) permissions list idea > (basically a > fine-resolution whitelist) is a *major* step in the right direction > there. How is your proposal incompatible with mine? I can't see any particular way. Just for reference, I turned up the score for MICROSOFT_EXECUTABLE in my SpamAssassin filter long ago. Now I don't get any of the usual viruses, but I get the encrypted ZIP archives instead. I'm sure SpamAssassin could easily be modified to handle everything you propose - so why don't you talk to them instead of shooting me down all the time? >> Since when is that such a weak argument? > > Well, maybe always, in part since it ignores the very legitimate needs > of > organizations like Yahoogroups and other major outbound mailers to > send millions > and millions of pieces of mail a day. Did I say that every piece of mail needed a 20-bit hashcash stamp? No, I said that whitelisted senders get to use smaller, even computationally trivial stamps. Subscribing to a mailing list should include making a whitelist entry at each end of the transaction. I also said, at some point, that if a message is addressed to a mailing list and the stamp matches the mailing list's address, then if the recipient is subscribed to the mailing list he should accept the stamp as valid. This caters for listserv software that doesn't (yet) understand stamping, signatures and whitelists. Here's my point, since you seem to have missed it up until now: Hashcash and signatures work in concert! One covers some situations, the other covers the rest. Please stop taking them in isolation to make straw men. > What determines whether it's spam or not is whether the RECIPIENT > wants it and authorized the sender to send it to them, and whether the > content of the mail is remotely like what the recipient(s) expect and > want to receive from that sender. Content filters only work to a point. SpamAssassin actually has filters set up to detect most content-disguise mechanisms already - stuff like an excessive number of HTML tags, FONT COLOR="white", etc. Spam *still* gets past it occasionally. As for whether the recipient authorised the sender... without any widely deployed authentication mechanism, how do you avoid spoofing on the whitelist entries? >> I added the idea of a simple signature because it's clear that PGP and >> S/MIME haven't taken off - so are they too complex and/or intrusive >> for >> Joe User? We need *something* to whitelist against. > > Why do you think that it's not enough to simply use the E-mail > characteristics > (type of content, HTML classes used, type of attachments, size maybe) > in > combination with the sender and the list of permissions granted to > that sender > by the recipient? Because we already have that general type of filtering, and it isn't working well enough. > And if you DO want something more, why is a "passcode" or > something freely made available by the recipient (perhaps in large > number of > variant forms, so to make life difficult for address harvesters) and > included in > (say) the Subject or a special header line perhaps, not enough? Because that's too much effort for most users - it's "intrusive". I have seen people using it, but they're distinctly in the minority. >> Each signature, incidentally, will be valuable only for the number of >> recipients who have whitelisted it, which for Joe User will normally >> be quite a small window. > > So what happens if they HAVE NOT whitelisted it? I think that many > (most if not > all!) types of users NEED to have SOME kind of way to receive > legitimate, > unanticipated E-mails... Then they mint hashcash for it. It only takes a few seconds of CPU time for most people. If they happen not to have the CPU resources available to do it themselves, they have the option of paying a third party to do it for them. The signature is merely a way to bypass the CPU expenditure for regular correspondents - friends, family, regular business contacts, mailing list subscriptions, etc. Nothing more. > Who really cares about signing keys, or certificates, or all these > SPF-like mods > to DNS which don't solve the problem, or E-postage and all the new > opportunities > for fraud, abuse, extra costs and hassles? I sure don't. All I'm > concerned > about is dumping spam in the trash so I don't have to deal with it. Then implement your filter for yourself. It sounds like something you can implement and gain benefits from on an individual basis, so you shouldn't really have any trouble with it. If it works for you, come back and tell us about your experience. But don't just pan everyone else's ideas while your own is still theory. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 05:09:03 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA15286 for ; Thu, 29 Apr 2004 05:09:03 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ7Ti-0001v4-El for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 05:05:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3T95AhT007379 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 05:05:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ7Ri-0001Vm-UO for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 05:03:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA15018 for ; Thu, 29 Apr 2004 05:03:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ7Ra-0004sm-SI for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 05:02:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ7Qe-0004hQ-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 05:02:01 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ7Pm-0004W6-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 05:01:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ7H5-0007Jn-5C; Thu, 29 Apr 2004 04:52:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ7FA-0006uc-6p for asrg@optimus.ietf.org; Thu, 29 Apr 2004 04:50:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA14486 for ; Thu, 29 Apr 2004 04:50:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ7F2-0002fB-34 for asrg@ietf.org; Thu, 29 Apr 2004 04:50:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ7E0-0002TM-00 for asrg@ietf.org; Thu, 29 Apr 2004 04:48:57 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BJ7Cv-0002Ae-00 for asrg@ietf.org; Thu, 29 Apr 2004 04:47:49 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BJ7Cx-0001vn-6S; Thu, 29 Apr 2004 09:47:51 +0100 In-Reply-To: <20040429063821.6203.qmail@xuxa.iecc.com> References: <20040429063821.6203.qmail@xuxa.iecc.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] E-postage from first principles To: John Levine X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 09:47:50 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit A good summary, John. > Receipient rate limiting might take the form of hashcash, although > that seems too easily circumvented so long as the bad guys have > zombies to do their hashing. This is a quantitative rather than qualitative argument against hashcash, which is easily answered by increasing the bit count demanded by the recipient, if it seems it's not having enough effect. This is a measure that can be implemented by individual recipients who feel it necessary, rather than needing to be implemented unilaterally. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 07:15:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA20360 for ; Thu, 29 Apr 2004 07:15:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ9RW-0003zC-Rh for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 07:11:03 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TBB2AX015323 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 07:11:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ9Mp-0002Vn-9y for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 07:06:11 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA20014 for ; Thu, 29 Apr 2004 07:06:04 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ9Mf-0003O9-Vl for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 07:06:02 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ9Lm-0003E3-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 07:05:07 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJ9L8-00033Y-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 07:04:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ9C3-000132-3l; Thu, 29 Apr 2004 06:55:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJ96T-0008HX-K7 for asrg@optimus.ietf.org; Thu, 29 Apr 2004 06:49:17 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA19533 for ; Thu, 29 Apr 2004 06:49:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJ96K-0000MQ-Ju for asrg@ietf.org; Thu, 29 Apr 2004 06:49:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJ95H-0000Bj-00 for asrg@ietf.org; Thu, 29 Apr 2004 06:48:04 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BJ956-000011-00 for asrg@ietf.org; Thu, 29 Apr 2004 06:47:53 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Thu, 29 Apr 2004 10:54:01 +0100 From: "Tom Thomson" To: "Barry Shein" Cc: Subject: RE: [Asrg] My take on e-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) In-Reply-To: <16528.5816.592078.439061@world.std.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal X-OriginalArrivalTime: 29 Apr 2004 09:54:01.0406 (UTC) FILETIME=[E60935E0:01C42DCF] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 11:47:53 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > Before 1989 you couldn't buy a connection to the internet unless you > could show some bona-fide usage (defense contracting, and towards the > very end of that era, being a university), and then if you were > approved hook-up was basically free. Strange. I was using the internet (the network interconnecting arpanet, nfsnet, janet, and various other xxxnets) about the end of 1985 or beginning of 1986 wearing neither a defence contractor nor a university hat. The universities were certainly in at the beginning of the period (via nfsnet and other nets in the USA, janet in the UK, earnet in the UK and much of the rest of Europe, and various other nets). Connection was not free - you needed a link to an node or gateway somewhere near you, and that link cost money. In the US, links from your local net to the internet were typically 40.8kbits/sec (or some multiple), in Europe 48kbits/sec and 64kbits/sec and multiples were both common); on both sides of the pond these links were usually leased lines (although there were packet-switched paid by traffic volume networks too, mostly left of the pond), and the various universities, defence contractors, research institutes (both government and non-government), and defence agencies paid the telecommunication providers a pretty large sum for them. Of course a University or a research institute wouldn't charge its faculty members and research students for use in the course of their work, any more than a defence contractor or a government agency would charge its employess for use in the course of their work and maybe that's what you mean when you claim it was free; but that's a bit like saying that because I don't pay for the desk I sit at to do my work, or the chair I sit on, or the office they are located in, the desk, chair, and office are free when clearly they are not - my employer pays for them. The various agencies (Universities, research institutes, companies) which provided the component networks on internet paid for the communication lines forming those too. They also paid for the (much faster) local networks (typically 10Mbit/sec within a small group of buildings) but that of course was much cheaper than the longer connections. > When I first began getting the general public onto the net for merely > having $20 to spend in 1989 yes, people raved that it was outrageous > that what was previously free was now being charged for, where would > this lead!? I realy don't understand this. You must have come across a bunch of idiots. It had never been free. Of course if you were offereing some outfit like a university or a research agency or a defence contractor the opportunity to pay $20 per employee in addition to paying for the communications infrastructure needed to supply a decent high-speed connection they might have though it a little outrageous. > I think it all worked out mostly ok, regardless of the protestations > of the demagogues who insisted that the net should be free and they > alone should have the power to decide who gets access to that free > resource. Do you have any evidence (apart from your own assertion) that such demagogues ever existed? There was discussion and disputation about opening up the internet to a wider community, because those who paid for the expensive (and in those days they were very expensive) long distance links like for example the transatlantic link between janet and nfsnet (with its two ends at UKC and MIT in the early days, if I recall correctly) thought that as they were paying they had the right to excercise some control over use of the facility - particularly since bandwidth on those long links was pretty limited and allowing everyone on would take bandwidth away from what the links were intended for. So the argument was about who should get access to resources paid for by agencies like NFS, SERC, CERN, DARPA, MoD, and so on; those organisations most certainly did NOT regard their very expensive communications capabilities as a "free resource" - and no-one but those organisations had any effective say in the matter. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 12:40:26 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12959 for ; Thu, 29 Apr 2004 12:40:25 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJETA-0002pT-4m for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 12:33:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TGX43o010875 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 12:33:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJDyS-00086P-1q for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 12:01:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA10863 for ; Thu, 29 Apr 2004 12:01:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJDyN-0000FJ-HX for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 12:01:15 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJDxP-0007n8-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 12:00:16 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJDwO-0007WC-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 11:59:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJDpg-0005qq-IT; Thu, 29 Apr 2004 11:52:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJDPd-00072b-Dq for asrg@optimus.ietf.org; Thu, 29 Apr 2004 11:25:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08972 for ; Thu, 29 Apr 2004 11:25:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJDPZ-00069r-5s for asrg@ietf.org; Thu, 29 Apr 2004 11:25:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJDOa-0005te-00 for asrg@ietf.org; Thu, 29 Apr 2004 11:24:17 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BJDNl-0005Oc-00 for asrg@ietf.org; Thu, 29 Apr 2004 11:23:25 -0400 Received: from fda.zemos.net ([69.141.77.58]) by comcast.net (sccrmhc12) with ESMTP id <2004042915225801200nn2pve>; Thu, 29 Apr 2004 15:22:58 +0000 Received: from localhost (fda [127.0.0.1]) by fda.zemos.net (Postfix) with ESMTP id AA78418680; Thu, 29 Apr 2004 11:22:56 -0400 (EDT) Received: from fda.zemos.net ([127.0.0.1]) by localhost (fda [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 19066-10; Thu, 29 Apr 2004 11:22:56 -0400 (EDT) Received: from zemos.net (phil [10.0.0.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by fda.zemos.net (Postfix) with ESMTP id 502211867F; Thu, 29 Apr 2004 11:22:56 -0400 (EDT) Message-ID: <40911DCE.60400@zemos.net> From: Philip Miller User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040413 Debian/1.6-5 X-Accept-Language: en, en-us MIME-Version: 1.0 To: gep2@terabites.com Cc: asrg@ietf.org References: <55F67296-9998-11D8-A28E-000393863768@chromatix.demon.co.uk> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at fda.zemos.net Content-Transfer-Encoding: 7bit Subject: [Asrg] The utility of SPF/RMX/LMAP with Gordon's 'email ACLs' (was Re: HashCash) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 11:22:54 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Gordon, I'm just going to pick out a few little points here about how LMAP is complementary to your permissions system. Note that I agree with the general principles of least privilege for email senders. 1. Reducing zombie population > Likewise, we HAVE to work on cutting down the ease of zombie recruitment, > and I believe that my attachments (and HTML!) permissions list idea > (basically a fine-resolution whitelist) is a *major* step in the right > direction there. I agree with you here. This goal is very compatible with implementing an LMAP system, because it means you have an authenticated ISP to send (automated) complaints and abuse reports to, and if they're on the ball, the user part will have been authenticated by them, so it becomes a matter of economics for them to clean up their network, to reduce complaints or to avoid black-listing because they are abusive to the Internet as a whole. 2. Preventing forgeries getting you infected > Even if one of those familiar senders WERE to get zombie-ized, the fact > that suddenly they're not behaving (SOMETIMES!) the way I expect them to > behave is enough to cause the irregular mail to be zapped, EVEN THOUGH > the real stuff they still occasionally send me legitimately will still > sail through to me just the way it always has. If one of your legitimate correspondents catches a virus, there are a couple things that could happen. If they send you a mail directly, odds are it gets blocked by your ACLs. But imagine that the virus instead forges all of the N^2 combinations of To and From using the addresses in the infected users address book. There a chance (however slim) that you have a common acquaintance from whom you'll accept an email that will infect you. Now add authentication back into the mix: If the 'vulnerable from' happens to be in another domain, the message will be rejected at the recipient edge MTA as forged. If it's in the same domain as the already infected person, then the ISP should be authenticating it. Looks like a win-win proposition to me. 3. Sending back bounces to legitimate senders telling them that they were out of line. > I don't see any point of E-mailing back (to who? AS IF there were a real > return address!) and telling them what to do to get past my checks!!?? > Riiiiiiiight. No, a big part of the whole key to this thing is that the > legitimate senders know that their current behavior is acceptable > (perhaps JUST!) and that they may run into problems if they stray too far > from that standard (and different recipients may have set their filters With LMAP, this works better. You will have a validated return path to send a bounce back to, even after the message has been delivered locally. Thus, if one of your legitimate senders just steps over the line (maybe attaches a JPG that's 1K over what would have been tolerated), they'll get a bounce saying it wasn't delivered, rather than wondering why you never responded. Philip Miller _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 14:03:59 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17457 for ; Thu, 29 Apr 2004 14:03:59 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJFpd-0000im-9U for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 14:00:21 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TI0LHE002772 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 14:00:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJFff-0006q8-1E for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 13:50:03 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA16513 for ; Thu, 29 Apr 2004 13:50:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJFfZ-0006x2-Hb for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 13:49:57 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJFeQ-0006as-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 13:48:46 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJFde-0006Gm-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 13:47:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJFFp-00073g-6R; Thu, 29 Apr 2004 13:23:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJF7D-0004sr-1V for asrg@optimus.ietf.org; Thu, 29 Apr 2004 13:14:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA14358 for ; Thu, 29 Apr 2004 13:14:25 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJF77-0004gz-PP for asrg@ietf.org; Thu, 29 Apr 2004 13:14:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJF68-0004RA-00 for asrg@ietf.org; Thu, 29 Apr 2004 13:13:20 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BJF5B-0004BB-00 for asrg@ietf.org; Thu, 29 Apr 2004 13:12:21 -0400 Received: (qmail 12314 invoked by uid 100); 29 Apr 2004 17:12:24 -0000 Message-ID: <20040429171224.12313.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org Subject: Re: [Asrg] E-postage from first principles In-Reply-To: Organization: I.E.C.C., Trumansburg NY USA Cc: chromi@chromatix.demon.co.uk Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 29 Apr 2004 17:12:24 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >A good summary, John. Thanks. >> Receipient rate limiting might take the form of hashcash, although >> that seems too easily circumvented so long as the bad guys have >> zombies to do their hashing. > >This is a quantitative rather than qualitative argument against >hashcash, which is easily answered by increasing the bit count demanded >by the recipient, if it seems it's not having enough effect. The problem is that if you increase the bit count demanded from the bad guys, you also increase the bit count demanded from the good guys. Since the bad guys have more computers at their disposal than the good guys do, if you demand a big enough hash from the bad guys to deter them, you're going to lock out the good guys altogether, e.g., demand a hash from Aunt Sadie that will limit her 486 to one e-mail message a week. You might want to demand larger hashes from bad guys from good guys, but if you could tell which was which, you could reject the bad guys' mail outright and dispense with the hashes. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 15:42:35 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA23792 for ; Thu, 29 Apr 2004 15:42:35 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJHA5-0005vd-Vo for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 15:25:34 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TJPX1S022789 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 15:25:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJH4J-0002W1-VR for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 15:19:36 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA21862 for ; Thu, 29 Apr 2004 15:19:32 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJH4D-0003ob-I4 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:19:29 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJH3L-0003lR-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:18:36 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJH2z-0003hS-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:18:13 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJGhv-00048h-CY; Thu, 29 Apr 2004 14:56:27 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJFpn-0000jH-Ux for asrg@optimus.ietf.org; Thu, 29 Apr 2004 14:00:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17237 for ; Thu, 29 Apr 2004 14:00:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJFpi-0002I9-9l for asrg@ietf.org; Thu, 29 Apr 2004 14:00:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJFom-00021X-00 for asrg@ietf.org; Thu, 29 Apr 2004 13:59:28 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BJFoG-0001lA-00 for asrg@ietf.org; Thu, 29 Apr 2004 13:58:56 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BJFoI-0005J6-91; Thu, 29 Apr 2004 18:58:58 +0100 In-Reply-To: <20040429171224.12313.qmail@xuxa.iecc.com> References: <20040429171224.12313.qmail@xuxa.iecc.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Jonathan Morton Subject: Re: [Asrg] E-postage from first principles To: John Levine X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 18:58:57 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> Receipient rate limiting might take the form of hashcash, although >>> that seems too easily circumvented so long as the bad guys have >>> zombies to do their hashing. >> >> This is a quantitative rather than qualitative argument against >> hashcash, which is easily answered by increasing the bit count >> demanded >> by the recipient, if it seems it's not having enough effect. > > The problem is that if you increase the bit count demanded from the > bad guys, you also increase the bit count demanded from the good guys. > Since the bad guys have more computers at their disposal than the good > guys do, if you demand a big enough hash from the bad guys to deter > them, you're going to lock out the good guys altogether, e.g., demand > a hash from Aunt Sadie that will limit her 486 to one e-mail message a > week. > > You might want to demand larger hashes from bad guys from good guys, > but if you could tell which was which, you could reject the bad guys' > mail outright and dispense with the hashes. Note that SHA-1 is noticeably more computationally expensive on x86 than most RISC platforms (or, probably, AMD64), which automatically makes the present incarnation of hashcash biased against the current crop of Wintel zombies. As a point of comparison, it takes about 2500 cycles per hash on an Athlon-XP, versus only 1000 on a PowerPC G3 or G4. This has positive implications for third-party vendors - see below. I've partially worked out a scheme which offers two solutions to this problem: - Users with low-end machines (including handhelds) may buy hashcash tokens from a stand-alone third party vendor. This doesn't require the micropayment infrastructure that full-blown e-postage needs. Hashcash vendors need only recoup their own costs, thus a competitive market is easy to achieve without any need for regulation. - The stamp optionally includes a signature to facilitate whitelisting. This can reduce the hashcash demanded from regular correspondents to as low as 8 bits, which is computationally trivial - thus even low-end users will not normally need to buy tokens regularly. Unlike existing high-confidence schemes like PGP and S/MIME, it is only for reasonable-confidence identification of regular correspondents, and as such is considerably more lightweight and doesn't require anything of the message body. Can anyone shed some light on how many cycles a Z80 processor would take to handle a typical SHA-1 hash cycle? Since derivatives of the Z80 may still be used in a few of the lowest-end handhelds, I'd like to have a handle on how long it would take for it to generate the "computationally trivial" 8-bit hashcash token that the signature requires. If nobody happens to have a Z80 and a compiler to hand, I'll put in some work and try it for the 6502 instead - I have a handful of old BBC Micros lying around. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 15:42:43 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA23830 for ; Thu, 29 Apr 2004 15:42:43 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJHAd-00068r-FP for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 15:26:07 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TJQ757023604 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 15:26:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJH63-0004N5-4T for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 15:21:23 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA21976 for ; Thu, 29 Apr 2004 15:21:19 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJH5w-0003wg-Rc for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:21:16 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJH51-0003rb-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:20:21 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJH46-0003nW-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:19:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJGkM-00050D-5y; Thu, 29 Apr 2004 14:58:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJFzP-0002ox-CF for asrg@optimus.ietf.org; Thu, 29 Apr 2004 14:10:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17682 for ; Thu, 29 Apr 2004 14:10:24 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJFzJ-00053P-Jm for asrg@ietf.org; Thu, 29 Apr 2004 14:10:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJFyL-0004n4-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:09:22 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BJFxL-0004HJ-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:08:19 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc12) with SMTP id <2004042918075101200nh9eke>; Thu, 29 Apr 2004 18:07:52 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Thu, 29 Apr 2004 13:07:38 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Thu, 29 Apr 2004 13:17:49 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] HashCash To: Jonathan Morton , gep2@terabites.com Cc: asrg@ietf.org In-Reply-To: X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 13:17:49 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=AWL,NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit >>> because the "large numbers" of mail will be >>> significantly smaller than the "massive numbers" we're seeing today. >> I don't think that's assured. >Please justify this statement. I've taken some numbers provided by a >poster, and indicated the difference in the quantity of resources >available - even assuming the spammers can use a significantly larger >fraction of their zombie pool to make stamps than send mail. I'll even >summarise here: > >At present, spammers use fresh zombies for an average of 4 days after >infection - this pool is about 100,000 machines at present. > >The total zombie pool is about 1,500,000 machines at present, depending >who you ask and how they collected their data. This is about 15x the >number of active spewers. > >Assumption: It presently takes about 4000 times as long for a typical >zombie (1.0GHz P6 or K7 class CPU with a 128Kbit DSL uplink) to mint a >20-bit hashcash stamp as to send out an unstamped, 5KB mail. > >Given that spammers can recruit the entire horsepower of their zombie >army, compared to only a fraction of the bandwidth, this still marks a >reduction in overall spamming capacity of about 200 times. And this >assumes the zombies' CPUs aren't being used for anything else, such as >games. 1) The reason the zombie pool is "only" at 1.5 million machines is largely because that number is largely sufficient for spammers needs. If they needed more, they'd infect/recruit more. 2) The zombie pool is clearly not cranking out spam at anything like its potential capacity... even the last four days worth of infected machines are probably not producing spam at anything like their total capability. >> I really don't believe that the solution to the spam problem involves >> making >> E-mail harder or more costly to send. I think a much better solution >> involves >> making it (if unwanted) *far* less likely to actually be delivered... >> such that >> the spammer realizes that the effort is probably futile. >> Likewise, we HAVE to work on cutting down the ease of zombie >> recruitment, and I >> believe that my attachments (and HTML!) permissions list idea >> (basically a >> fine-resolution whitelist) is a *major* step in the right direction >> there. >How is your proposal incompatible with mine? I can't see any >particular way. It doesn't HAVE to be mutually exclusive to make hashcash a bad idea. >Just for reference, I turned up the score for MICROSOFT_EXECUTABLE in >my SpamAssassin filter long ago. Now I don't get any of the usual >viruses, And that's fine, but it goes back to the not-fine-grained approach that my proposal specifically doesn't use... where these values would be individually specifiable by a given recipient for EACH SENDER. I *do* happen to occasionally want to receive executable attachments... it's just that they're from a VERY small percentage of my correspondents, and the receipt of the executable attachments is NEVER unexpected. >but I get the encrypted ZIP archives instead. I'm sure >SpamAssassin could easily be modified to handle everything you propose Sure, as could any kind of good E-mail filter. SpamAssassin is fine, functionally speaking (it would have been (probably MUCH) better if it had been written in SPITBOL, but that's another story). SpamAssassin is a good step in the right direction (and perhaps the best thing of its sort out there today). I don't happen to think it's good enough, AND I think that most of the protection against spams/viruses/worms, to be meaningful and effective worldwide, needs to be BY DEFAULT... thus built in either to the OS, or the mail client software (say, Outlook/Outlook Express/etc) that "most" people use. And not an independent addon program, which is unlikely to be widely used enough to be as effective as this kind of thing wants to be. (My approach DOES _immediately_ benefit those adopting it, but in order to really make a difference in spam we see on the net worldwide, a lot of people should be using it.) Clearly, though, you're right in that SpamAssassin needs to be able to treat ZIP archives (and with or without encryption) as "dangerous" and as one of the available filter criteria. >- so why don't you talk to them instead of shooting me down all the >time? The people who I'd *like* to see[/help them] solve the problem would be Microsoft, since if they solve it at their level then truly a *large* number of folks around the world will benefit from the improvement. As for shooting you down all the time, please don't take it personally. There are a lot of people pushing for a lot of harebrained and ultimately not-very-clever "solutions" for these problems, and most of the ideas simply aren't very good. Before we go off halfcocked racing down a path to a future that isn't very well thought out, we need to ALL consider these proposals and EVERYONE try to foresee what's wrong with them. Otherwise, we're going to go way far down a road towards a costly, unworkable "solution" which is going to leave everybody wondering "What the hell were those guys thinking?" We should be able to do better than that. >>> Since when is that such a weak argument? >> Well, maybe always, in part since it ignores the very legitimate needs >> of >> organizations like Yahoogroups and other major outbound mailers to >> send millions >> and millions of pieces of mail a day. >Did I say that every piece of mail needed a 20-bit hashcash stamp? No, >I said that whitelisted senders get to use smaller, even >computationally trivial stamps. Subscribing to a mailing list should >include making a whitelist entry at each end of the transaction. I don't like that. First, because I don't think the sender should have to do ANYTHING different on a recipient-by-recipient basis (other than, perhaps, deciding who will tolerate bulky HTML-burdened E-mail (that's if the sender REALLY wants that kind, rather than just using ASCII) and who wants plain ASCII text instead...) I don't like two-ended solutions, since it invariably seems to involve coordinating things that end up being hard to coordinate, and ends up forcing mutual concurrence on things where it's often hard to get agreement. Secondly, it means that the recipient has to whitelist a *lot* more of the senders that they get mail from than they should have to whitelist. If you have a reasonable policy for default mail permissions, then most of the senders you get mail from (even unexpectedly) shouldn't be affected by your filter. The goal of my scheme is a fine-grained sieve putting the RECIPIENT in control, and which lets as much of your legitimate mail as possible through but which turns aside virtually all the spam, and without significant negative implications on legitimate and responsible senders. And, all this without having to change the basic worldwide Internet E-mail infrastructure, or significantly increasing the fixed/incremental cost of that infrastructure. >I also said, at some point, that if a message is addressed to a mailing >list and the stamp matches the mailing list's address, then if the >recipient is subscribed to the mailing list he should accept the stamp >as valid. This caters for listserv software that doesn't (yet) >understand stamping, signatures and whitelists. But you presume that everyone SENDING to that mailing list is going to go along with your "stamp" and signatures proposal and deal with the hassles, right? Again, I don't much like proposals that force EVERYBODY around the world to change their behavior. And it's bad enough when it's TWO people that e-mail each other directly; it's much worse when you have third parties (like Yahoogroups) involved and you end up creating this kind of great scism between communities. >Here's my point, since you seem to have missed it up until now: >Hashcash and signatures work in concert! One covers some situations, >the other covers the rest. Please stop taking them in isolation to >make straw men. Both of them require components to be installed EVERYWHERE, both to generate them and to check for them. I don't object to multifaceted solutions (hey, I specifically endorsed a SpamAssassin-like content filter working in conjunction with my permissions lists.) But if I don't like attempts to increase the cost of mailing by hashcash, and don't like cumbersome "signature" or "certificate" approaches, I don't know why you'd imagine that I'd like a solution better that involves the combined disadvantages of EACH of those. >> What determines whether it's spam or not is whether the RECIPIENT >> wants it and authorized the sender to send it to them, and whether the >> content of the mail is remotely like what the recipient(s) expect and >> want to receive from that sender. >Content filters only work to a point. SpamAssassin actually has >filters set up to detect most content-disguise mechanisms already - >stuff like an excessive number of HTML tags, FONT COLOR="white", etc. >Spam *still* gets past it occasionally. Sure. But in conjunction with my permissions lists, there will be many fewer ways to deceive and bypass it, while still getting the things through that you occasionally need to receive from SOME selected few of your correspondents. Presently, setting your filter settings tight enough means that you're filtering out some stuff that OCCASIONALLY you need and want to receive from SOME folks. I don't suggest that SpamAssassin is perfect. It *looks* pretty good. It would be *better* if it didn't have quite such a difficult job to try to do (and my permissions list makes its job a LOT less daunting). If SpamAssassin were written in SPITBOL, they'd have far more powerful pattern recognition capabilities available to them at the core programming-language-level, and it would be a lot harder for spam to slip past it. But I also don't think that the spam filter HAS to be absolutely 100% effective. It's probably enough that the spam problem is reduced to an occasional nuisance. It's perhaps true, though, that by the time we t-can that much of the spam, combined with making it MUCH MUCH harder to recruit spambot zombies, that a lot of the spammers will simply go look for more promising ways to pursue their scams. We haven't seen the worst of spam, yet. But eventually the tide will crest and we'll start seeing an improvement. >As for whether the recipient authorised the sender... without any >widely deployed authentication mechanism, how do you avoid spoofing on >the whitelist entries? Spoofing only helps if the permissions assigned by a given recipient for the sender you're spoofing helps you send the stuff you're (as a spammer) trying to send. In general, you simply don't know that it does... you don't know WHO you want to spoof, and you don't know WHO has assigned them the "advanced" permissions that apparently you're hoping to benefit from. If ultimately the majority of recipients have VERY few people with advanced "whitelisted" permissions, then your odds of hitting one at random are very small. >> Why do you think that it's not enough to simply use the E-mail >> characteristics >> (type of content, HTML classes used, type of attachments, size maybe) >> in >> combination with the sender and the list of permissions granted to >> that sender >> by the recipient? >Because we already have that general type of filtering, and it isn't >working well enough. No. 1) We don't have that on the basis of a sender/recipient pairing; 2) We don't have the kind of fine-grained control based on the types of HTML codes present and the types of attachments in use; 3) Gratuitous HTML provides a lot of underbrush for spammers and abusers to hide in. Far too many people presume that they can send HTML mail and that it will be unquestioningly accepted by "everybody". 4) Far too few people have even the "general" kind of filtering that you're talking about implemented. Even if *I* implement completely all of my ideas, and use them here, the fact that they only help ME is still going to run afoul of your "it isn't working well enough" condemnation. There are a variety of commonly recurring types of spam that still make it through my present incoming mail filter. In part that's simply because it's small enough in volume (so far) that I haven't busied myself to make the appropriate improvements to the filter to detect and t-can those types. >> And if you DO want something more, why is a "passcode" or >> something freely made available by the recipient (perhaps in large >> number of >> variant forms, so to make life difficult for address harvesters) and >> included in >> (say) the Subject or a special header line perhaps, not enough? >Because that's too much effort for most users - it's "intrusive". I >have seen people using it, but they're distinctly in the minority. It's certainly less intrusive than having to buy E-postage or computing "hashcash". And this would work with basicaly all existing E-mail programs. I do agree though that I like single-ended solutions better in principle. (I'll point out that, unless I'm mistaken, NONE of the other solutions we've been discussing here are single-ended, other than my permissions list idea). >>> Each signature, incidentally, will be valuable only for the number of >>> recipients who have whitelisted it, which for Joe User will normally >>> be quite a small window. >> So what happens if they HAVE NOT whitelisted it? I think that many >> (most if not >> all!) types of users NEED to have SOME kind of way to receive >> legitimate, >> unanticipated E-mails... >Then they mint hashcash for it. It only takes a few seconds of CPU >time for most people. If they happen not to have the CPU resources >available to do it themselves, they have the option of paying a third >party to do it for them. Again, complicated and it increases the cost, while not solving the problem. Besides, anything keyed to "consuming processor time" is inherently a decaying thing, as processor speeds increase. >The signature is merely a way to bypass the CPU expenditure for regular >correspondents - friends, family, regular business contacts, mailing >list subscriptions, etc. Nothing more. Signatures require a concurrence at both ends on the type of signature to be employed, and much existing E-mail software (including embedded apps that generate and send E-mails) obviously don't generate mail containing them. Again, you're talking about changing the world's E-mail infrastructure. Possible, maybe, eventually, but not right away and not without a lot of grief in the meanwhile. >> Who really cares about signing keys, or certificates, or all these >> SPF-like mods >> to DNS which don't solve the problem, or E-postage and all the new >> opportunities >> for fraud, abuse, extra costs and hassles? I sure don't. All I'm >> concerned >> about is dumping spam in the trash so I don't have to deal with it. >Then implement your filter for yourself. Fine, and I've done much of that. As I said, I continue to refine my filter... I'm currently up to revision 1.43 (since 2002 when I first wrote and started using it) and in general it works pretty well. The present filter is 1742 lines of (fairly heavily commented) 32-bit SPITBOL source code. (It does a LOT more than just antispam filtering). It works in conjunction with a couple of "helper" apps and a variety of data files (including dictionaries) and produces a variety of log and audit trail files. The current version was written with multiuser features to support enterprise use, although nobody except me is presently using it on a daily basis. >It sounds like something you >can implement and gain benefits from on an individual basis, Can, have, and do! :-) What I presently have here doesn't fully implement my proposal, but that's because it's presently "close enough" to solving enough of my own personal spam problem that I don't feel a pressing need to implement the rest (not for myself, anyhow). The framework I have would probably support all of the things I'm talking about. >so you >shouldn't really have any trouble with it. If it works for you, come >back and tell us about your experience. That's largely why I'm here. :-) I've been observing the problem for a long time, and particularly in the context of seeing what I already have and what things one could do to pick up on the remaining "problem" spams. >But don't just pan everyone else's ideas while your own is still theory. I think that: 1) My ideas are a LOT more than just "theory". 2) My ideas hardly require any kind of dramatic technological breakthroughs that would call into question their implementability. In fact, of the ideas being discussed here, mine involve a whole let less "waving of hands" and "blue-skying" than hashcash, OR E-postage, OR signatures, OR certificates, or global changes to the Internet's DNS infrastructure, or indeed just about any of the other ideas that we're discussing. So I think it's pretty silly to condemn anybody's ideas here as "just theory". By definition, this is an "asRg" and the R stands for RESEARCH! Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 15:52:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24499 for ; Thu, 29 Apr 2004 15:52:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJHKE-00087N-7n for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 15:36:02 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TJa2Th031198 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 15:36:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJH9Q-0005o7-FL for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 15:24:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA22329 for ; Thu, 29 Apr 2004 15:24:48 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJH9K-0004Jo-3b for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:24:46 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJH8I-0004DA-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:23:43 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJH7Q-000472-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 15:22:48 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJGlD-0005Hw-7Q; Thu, 29 Apr 2004 14:59:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJGaI-0001xQ-Ft for asrg@optimus.ietf.org; Thu, 29 Apr 2004 14:48:34 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA19291 for ; Thu, 29 Apr 2004 14:48:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJGaC-00009c-8P for asrg@ietf.org; Thu, 29 Apr 2004 14:48:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJGZF-0007fU-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:47:29 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BJGYI-0007No-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:46:30 -0400 Received: from [217.160.230.50] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BJGYH-0005yE-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:46:29 -0400 Received: from [68.246.214.102] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BJGYG-0007T0-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:46:29 -0400 Message-ID: <40914D7E.8050206@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: perfora.net abuse@perfora.net auth:7051a7fa85b96745770cd89fa6d27f10 Content-Transfer-Encoding: 7bit Subject: [Asrg] 0. Administrative - Reminder on Posting Guidelines Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 14:46:22 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit The posting guidelines for the ASRG lists can be found here: http://asrg.sp.am/about/lists.shtml ----------------------------------------------------------------------- Posting Guidelines for the Discussion List All conversation on the main discussion list (asrg@ietf.org) must be regarding one of the work items outlined in the ASRG Research Agenda document. The subject of each email should begin with the number of the appropriate work item. For example, "1c. - Spam Measurement Survey Requirements" or "3 - Proposal for hash-based traceback system". Items that do not fit into any of those categories should be marked as "0. General - ". The list volume makes it difficult to follow individual conversations and to filter the noise, and following these guidelines helps to eliminate both problems. This is a research group. If you have constructive feedback, please share it in an appropriate manner. If you just feel like saying that "spam can not be stopped" or "this group will fail because I said so", then you should state those things elsewhere. NOTE: ASRG subgroups may have additional posting guidelines and policies for their lists. Additional information is listed at the homepage of each subgroup. ----------------------------------------------------------------------- Yakov -- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "And this too shall come to pass" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 17:45:23 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04463 for ; Thu, 29 Apr 2004 17:45:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJJDu-0004Z6-4d for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 17:37:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TLbcUU017539 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 17:37:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJJ0M-0008GG-WA for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 17:23:39 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03236 for ; Thu, 29 Apr 2004 17:23:33 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJJ0F-00000T-Hv for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 17:23:31 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJIxP-0007Jg-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 17:20:37 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJItT-0006po-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 17:16:31 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJIjK-0008JB-3t; Thu, 29 Apr 2004 17:06:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJIEi-0003ZX-SC for asrg@optimus.ietf.org; Thu, 29 Apr 2004 16:34:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27581 for ; Thu, 29 Apr 2004 16:34:20 -0400 (EDT) From: gep2@terabites.com Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJIEb-0001g0-QH for asrg@ietf.org; Thu, 29 Apr 2004 16:34:17 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJIDd-0001aM-00 for asrg@ietf.org; Thu, 29 Apr 2004 16:33:18 -0400 Received: from sccrmhc12.comcast.net ([204.127.202.56]) by ietf-mx with esmtp (Exim 4.12) id 1BJICf-0001Tn-00 for asrg@ietf.org; Thu, 29 Apr 2004 16:32:17 -0400 Received: from WinProxy.anywhere (c-67-164-154-5.client.comcast.net[67.164.154.5]) by comcast.net (sccrmhc12) with SMTP id <2004042920315001200nj6r9e>; Thu, 29 Apr 2004 20:31:50 +0000 Received: from 192.168.0.30 by 192.168.0.1 (WinProxy); Thu, 29 Apr 2004 15:31:08 -0600 Received: from 192.168.0.240 (unverified [192.168.0.240]) by nts1.terabites.com (EMWAC SMTPRS 0.83) with SMTP id ; Thu, 29 Apr 2004 15:41:20 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: Philip Miller , gep2@terabites.com Cc: asrg@ietf.org In-Reply-To: <40911DCE.60400@zemos.net> X-Mailer: SPRY Mail Version: 04.00.06.17 Content-Transfer-Encoding: 7bit Subject: [Asrg] Re: The utility of SPF/RMX/LMAP with Gordon's 'email ACLs' (was Re: HashCash) Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 15:41:20 -0500 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=1.8 required=5.0 tests=NO_REAL_NAME,RATWARE_EMWAC autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On Thu, 29 Apr 2004, Philip Miller wrote: >Gordon, >I'm just going to pick out a few little points here about how LMAP is >complementary to your permissions system. Note that I agree with the general >principles of least privilege for email senders. Thanks! I'll reply with my comments on the items you've noted. >1. Reducing zombie population >> Likewise, we HAVE to work on cutting down the ease of zombie recruitment, >> and I believe that my attachments (and HTML!) permissions list idea >> (basically a fine-resolution whitelist) is a *major* step in the right >> direction there. >I agree with you here. Thanks. I think this is simply the BIGGEST improvement that can be made the FASTEST to solving this TERRIBLE problem. >This goal is very compatible with implementing an >LMAP system, because it means you have an authenticated ISP to send >(automated) complaints and abuse reports to, and if they're on the ball, the >user part will have been authenticated by them, so it becomes a matter of >economics for them to clean up their network, to reduce complaints or to >avoid black-listing because they are abusive to the Internet as a whole. Well, sort of. I wouldn't say it's "very compatible with"... the way I'd characterize it is that WITHOUT a fine-resolution whitelist to block virtually all executable attachments and other malicious E-mail content, that LMAP and its ilk are fairly useless (as, indeed, are most of these other ideas such as E-postage, certificates, SPF, and the like)... simply because spambot zombies mean that actual spammers never pay E-postage, generate hashcash, deal with stamps or certificates, or deal with any of these other restrictions that supposedly are being designed to put a crimp in their operations. The question then becomes... once the permissions list solves the great majority of the zombie spambot problem, and removes most of the HTML deceptions, and antispam content filters resolve most of the rest... how much of a problem really still remains, and would it justify the time, hassle, and expense of these more intrusive, controversial, and costly schemes? As for finding the right person to complain to... I still send complaints to the various Nigerian/lottery spammer ISPs, and although I'm sure I'm not the only person griping about it, and although CLEARLY there's no question about who is hosting the fraudster's E-mail boxes, the same small number of ISPs keep getting implicated with disturbing regularity. So I'm less convinced than you seem to be that flooding them with automated complaints and abuse reports really accomplishes anything; it seems that their own defensive automated abuse-report-discarders are just as efficient! :-( Ultimately, most of these abuse reports and complaint letters (and the ISP's automated responses to them) just make the "wasted bandwidth" problem worse than if the original objectionable material just went down a black hole. >2. Preventing forgeries getting you infected >> Even if one of those familiar senders WERE to get zombie-ized, the fact >> that suddenly they're not behaving (SOMETIMES!) the way I expect them to >> behave is enough to cause the irregular mail to be zapped, EVEN THOUGH >> the real stuff they still occasionally send me legitimately will still >> sail through to me just the way it always has. >If one of your legitimate correspondents catches a virus, there are a couple >things that could happen. If they send you a mail directly, odds are it gets >blocked by your ACLs. But imagine that the virus instead forges all of the >N^2 combinations of To and From using the addresses in the infected users >address book. There a chance (however slim) that you have a common >acquaintance from whom you'll accept an email that will infect you. First, basically *no* E-mails will infect me, simply because my preferred E-mail client doesn't encourage that to happen. But I've seen a lot of infection mails arrive here, and I've investigated them enough to see how other folks get infected. :-) The fact is that the great majority of people simply have no reason to EVER whitelist ANYBODY to send them an EXE file type as an E-mail attachment; fewer still would whitelist ANYBODY to send them a PIF file. Few people similarly ever need to accept an encrypted ZIP file! Secondly, the likely overlap in the E-mail address books (regarding people I'd be likely to whitelist to send EXEs) is likely to be the null set, or pretty close to it. And even THOSE people I'm not likely to accept unexpected/unsolicited executables from. (Obviously, Outlook or whatever E-mail client wants to make it VERY ominous-sounding before they let anyone turn these permissions on... so people won't let themselves be hoodwinked or wheedled by a bogus E-mail that tries to talk them into dropping their shields.) So anyhow, I think that your scenario is VERY VERY farfetched. >Now add authentication back into the mix: >If the 'vulnerable from' happens to be in another domain, the message will >be rejected at the recipient edge MTA as forged. ...And that is a BIG "if". Especially now with Internet accesses concentrating around a relatively small number of big players... Comcast, SWBELL, SBC, AOL, etc etc. And in fact, that's a big reason why the "domain-approved authorized mail server IP address" concept (regardless of which variant you're talking about) is so terribly flawed (aside from the issue regarding personal domain names, mailing lists, etc etc). There are literally MILLIONS of SBC users, MILLIONS of Comcast users, close to ten million AOL users, etc etc. So someone infecting an SBC or Comcast user's machine can forge any of a million or more other addresses which will NOT be detected by these schemes as forged. And that's true even if they originate the mail from one of hundreds of other mail servers used elsewhere nationwide by that big ISP. >If it's in the same domain >as the already infected person, then the ISP should be authenticating it. Some do, some don't. Again, SMTP authenticating becomes problematical when people are using their own personal domain names, mailing lists, etc etc. Many ISPs refuse to let people forward mail to their domain name supplier's mail servers, etc. >Looks like a win-win proposition to me. And if you ignore the folks who lose big, you'd almost be right. >3. Sending back bounces to legitimate senders telling them that they were >out of line. >> I don't see any point of E-mailing back (to who? AS IF there were a real >> return address!) and telling them what to do to get past my checks!!?? >> Riiiiiiiight. No, a big part of the whole key to this thing is that the >> legitimate senders know that their current behavior is acceptable >> (perhaps JUST!) and that they may run into problems if they stray too far >> from that standard (and different recipients may have set their filters >With LMAP, this works better. You will have a validated return path to send >a bounce back to, even after the message has been delivered locally. You're presuming (and this is NOT necessarily a valid presumption) that the SMTP and POP mail paths are parallel and coherent. Not everybody uses the same outgoing mail path as they use for their incoming mail path. The other question is to decide if it even makes sense to try to send the bounce. I'm not at all sure that it does. >Thus, >if one of your legitimate senders just steps over the line (maybe attaches a >JPG that's 1K over what would have been tolerated), they'll get a bounce >saying it wasn't delivered, rather than wondering why you never responded. If they write me and inquire, I can probably tell them I didn't get it. And remember that (depending on what they sent me) it's entirely possible that the BOUNCE ITSELF will be filtered out by THEIR permission list, since it's entirely possible that the 'mailbot' sending the bounce won't be whitelisted at their end, either. :-) (This can occur even today... let's say that they send me an E-mail which is 4.9Mb, and by the time the various Received: headers are added it JUST exceeds a 5Mb maximum E-mail supported by my domain supplier. If they try to bounce it back along with an explanatory header, chances are good that the ORIGINATING E-mail inbox won't accept it, either. Or, they might already have 3.5Mb of mail queued there already, and doesn't have adequate room to hold the bounced mail. Anyhow, you can't always guarantee that a bounce will be received.) Gordon Peterson http://personal.terabites.com/ 1977-2002 Twenty-fifth anniversary year of Local Area Networking! Support free and fair US elections! http://stickers.defend-democracy.org 12/19/98: Partisan Republicans scornfully ignore the voters they "represent". 12/09/00: the date the Republican Party took down democracy in America. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 18:10:22 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA06035 for ; Thu, 29 Apr 2004 18:10:22 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJJfK-0005Qi-El for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 18:06:01 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TM5wNw020872 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 18:05:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJJRJ-00088q-TZ for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 17:51:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04659 for ; Thu, 29 Apr 2004 17:51:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJJRC-0001Rs-6v for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 17:51:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJJQG-0001QE-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 17:50:25 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BJJPq-0001OQ-01 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 17:49:58 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BJJN7-000230-9b for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 17:47:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJJEi-000518-JR; Thu, 29 Apr 2004 17:38:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJJ11-000051-1B for asrg@optimus.ietf.org; Thu, 29 Apr 2004 17:24:19 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03401 for ; Thu, 29 Apr 2004 17:24:13 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJJ0t-00006y-I2 for asrg@ietf.org; Thu, 29 Apr 2004 17:24:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJIyd-0007WF-00 for asrg@ietf.org; Thu, 29 Apr 2004 17:21:52 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BJIvN-0006zJ-00 for asrg@ietf.org; Thu, 29 Apr 2004 17:18:29 -0400 Received: (qmail 10900 invoked by uid 100); 29 Apr 2004 21:18:32 -0000 Message-ID: <20040429211832.10899.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org In-Reply-To: <20040429180403.GI22336@mail> Organization: I.E.C.C., Trumansburg NY USA Cc: david@vex.net Subject: [Asrg] Re: Consent protocols - was E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 29 Apr 2004 21:18:32 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >Now several things can happen in the state graph. > >a. Sender has no more msgs to devlier anyway. >b. Sender has more, and follows Recip's desired 1/h > - At some point, Recip decides that Sender has been faithful, > and may be allowed a higher rate. >c. Sender has more, and ignores Recip's desired 1/h > - Sender is blacklisted. > >Optionally: > >d. Sender has more, and requests a higher rate allowance by providing > an accreditation, hashcash, 'introduction protocol' referral ID, > etc. >e. Sender provides a one-time, or reusable key that was provided out of > band by recipient - i.e. when signing up for a mailing list - > which entitles Sender to a higher rate limit. f. Sender pretends to be 300 other people and sends you buckets of spam. Bad guys won't play by your rules. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 19:41:19 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11249 for ; Thu, 29 Apr 2004 19:41:19 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJL2u-0001d8-DY for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 19:34:24 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TNYO1S006267 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 19:34:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJKvI-0000cL-QI for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 19:26:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10607 for ; Thu, 29 Apr 2004 19:26:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJKvD-0000I1-W7 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 19:26:28 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJKuO-0000F2-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 19:25:37 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJKtx-0000Bb-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 19:25:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJKm5-0006y8-2m; Thu, 29 Apr 2004 19:17:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJFue-00023m-2o for asrg@optimus.ietf.org; Thu, 29 Apr 2004 14:05:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17563 for ; Thu, 29 Apr 2004 14:05:29 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJFuY-0003k3-C0 for asrg@ietf.org; Thu, 29 Apr 2004 14:05:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJFtj-0003TY-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:04:36 -0400 Received: from h210.c136.b246.tor.eicat.ca ([66.246.136.210] helo=shell.vex.net) by ietf-mx with esmtp (Exim 4.12) id 1BJFtC-0003CP-00 for asrg@ietf.org; Thu, 29 Apr 2004 14:04:02 -0400 Received: from smaug.vex.net (smaug.vex.net [66.246.136.211]) by shell.vex.net (Postfix) with ESMTP id DA147FB12; Thu, 29 Apr 2004 14:04:03 -0400 (EDT) Received: from mail.crlf.net (mail.crlf.net [216.126.92.195]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (No client certificate requested) by smaug.vex.net (Postfix) with ESMTP id 4B0CC2F534; Thu, 29 Apr 2004 14:04:02 -0400 (EDT) From: David Maxwell To: John Levine Cc: asrg@ietf.org Message-ID: <20040429180403.GI22336@mail> References: <16528.27844.324796.238684@world.std.com> <20040429063821.6203.qmail@xuxa.iecc.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040429063821.6203.qmail@xuxa.iecc.com> User-Agent: Mutt/1.4.2i Subject: [Asrg] Consent protocols - was E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 14:04:03 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Thu, 29 Apr 2004, John Levine wrote: > So let's think about rate limiting or deterring senders. Perhaps I'm > suffering from a failure of imagination, but I don't see useful rate > limiting without some cooperation from the recipients. This is for > two reasons: one is that recipients don't want to rate limit the mail > they want, and the other is that without some way for the recipients > to audit the rate limiting, naughty senders will lie and claim they're > rate limiting when they aren't. This sounds like it's begging for a consent protocol implementation. Sender: Hello, I have mail for you. Recip: I have no record of talking to you before. I'll accept 1msg/h Sender: Understood. 1msg/h. Here's a msg. Now several things can happen in the state graph. a. Sender has no more msgs to devlier anyway. b. Sender has more, and follows Recip's desired 1/h - At some point, Recip decides that Sender has been faithful, and may be allowed a higher rate. c. Sender has more, and ignores Recip's desired 1/h - Sender is blacklisted. Optionally: d. Sender has more, and requests a higher rate allowance by providing an accreditation, hashcash, 'introduction protocol' referral ID, etc. e. Sender provides a one-time, or reusable key that was provided out of band by recipient - i.e. when signing up for a mailing list - which entitles Sender to a higher rate limit. Well known senders gradually receive high rate limits. New spammer domains recieve low limits, and are blacklisted due to content (possibly by distributed blacklists) before they can deliver a significant amount of spam. A variation of this scheme could be used between users and their ISP. P.S. My idle speculation is that you might be able to implement this without changing SMTP, by using SIP to arrange the connections. -- David Maxwell, david@vex.net|david@maxwell.net --> All this stuff in twice the space would only look half as bad! - me _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 19:41:50 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11330 for ; Thu, 29 Apr 2004 19:41:50 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJL3V-0001ki-Vf for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 19:35:01 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3TNZ1bM006728 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 19:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJKwC-0000mY-Dm for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 19:27:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10647 for ; Thu, 29 Apr 2004 19:27:27 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJKw7-0000Kz-HN for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 19:27:23 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJKv9-0000HO-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 19:26:23 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJKuA-0000C3-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 19:25:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJKm5-0006zC-K9; Thu, 29 Apr 2004 19:17:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJJZ3-00017D-0o for asrg@optimus.ietf.org; Thu, 29 Apr 2004 17:59:29 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04798 for ; Thu, 29 Apr 2004 17:59:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJJYv-0001hB-7R for asrg@ietf.org; Thu, 29 Apr 2004 17:59:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJJY0-0001f9-00 for asrg@ietf.org; Thu, 29 Apr 2004 17:58:25 -0400 Received: from h210.c136.b246.tor.eicat.ca ([66.246.136.210] helo=shell.vex.net) by ietf-mx with esmtp (Exim 4.12) id 1BJJX9-0001dL-00 for asrg@ietf.org; Thu, 29 Apr 2004 17:57:31 -0400 Received: from smaug.vex.net (smaug.vex.net [66.246.136.211]) by shell.vex.net (Postfix) with ESMTP id 3CE5FF95C; Thu, 29 Apr 2004 17:57:32 -0400 (EDT) Received: from mail.crlf.net (mail.crlf.net [216.126.92.195]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (No client certificate requested) by smaug.vex.net (Postfix) with ESMTP id E3A082F724; Thu, 29 Apr 2004 17:57:27 -0400 (EDT) From: David Maxwell To: John Levine Cc: asrg@ietf.org Message-ID: <20040429215730.GK22336@mail> References: <20040429180403.GI22336@mail> <20040429211832.10899.qmail@xuxa.iecc.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040429211832.10899.qmail@xuxa.iecc.com> User-Agent: Mutt/1.4.2i Subject: [Asrg] Re: Consent protocols - was E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 17:57:30 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Thu, 29 Apr 2004, John Levine wrote: > f. Sender pretends to be 300 other people and sends you buckets of spam. > > Bad guys won't play by your rules. That's not an assumption in the example. Sender can't pretend to be a different Src IP. -- David Maxwell, david@vex.net|david@maxwell.net --> All this stuff in twice the space would only look half as bad! - me _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 22:10:56 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA18386 for ; Thu, 29 Apr 2004 22:10:56 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNRU-0007pl-4N for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 22:07:56 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3U27usZ030108 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 22:07:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNLd-0006Oy-23 for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 22:01:53 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA17960 for ; Thu, 29 Apr 2004 22:01:49 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJNLW-0004ZY-PK for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:01:46 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJNKi-0004U3-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:00:56 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJNJu-0004NL-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:00:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJN9E-0004bV-Qa; Thu, 29 Apr 2004 21:49:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJN6t-00042T-A7 for asrg@optimus.ietf.org; Thu, 29 Apr 2004 21:46:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA17294 for ; Thu, 29 Apr 2004 21:46:36 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJN6n-0003Fe-3N for asrg@ietf.org; Thu, 29 Apr 2004 21:46:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJN62-0003C2-00 for asrg@ietf.org; Thu, 29 Apr 2004 21:45:47 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BJN5W-00037B-00 for asrg@ietf.org; Thu, 29 Apr 2004 21:45:14 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3U1j4dN019737; Thu, 29 Apr 2004 21:45:05 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id VAA09565; Thu, 29 Apr 2004 21:45:04 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16529.44960.141923.272661@world.std.com> To: "\"Roger B.A. Klorese \" " Cc: Barry Shein , "Hallam-Baker, Phillip" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) In-Reply-To: <409090DF.4010409@queernet.org> References: <16528.11346.656296.255405@world.std.com> <409031A9.2010809@queernet.org> <16528.27844.324796.238684@world.std.com> <409090DF.4010409@queernet.org> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 21:45:04 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.4 required=5.0 tests=AWL,US_DOLLARS_3 autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Atomic multi-record updates? How about just a log which is processed asynchronously? Why in the world would this have to be kept in perfect sync in real-time? And, that said, do the main dns servers keep log files? Seems that'd be similar. Besides, all you're saying is that it'd probably take more computrons to run an e-postage system, given various assumptions about how it might work, than the current dns system does. Ok. But there still are many similarities, particularly in distribution and scale and need for organization. Anyhow, that's very different than showing that too many computrons are required to be reasonable. $1,000 computers are today over 1,000 x as fast as $1,000,000 computers were when DNS was designed. -b On April 28, 2004 at 22:21 rogerk@queernet.org ("\"Roger B.A. Klorese \" ") wrote: > Barry Shein wrote: > > >Do you have any idea how many host names, between mail and ftp > >and everything else people do, are looked up *per second*?! > > > > > Lookups are cheap. Atomic multi-record updates are expensive. DNS is > 99.99+% read-only. Postage is heavily update-biased. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 22:48:07 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19675 for ; Thu, 29 Apr 2004 22:48:07 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNrU-00030N-Ai for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 22:34:48 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3U2YmJf011545 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 22:34:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNqS-0002od-0l for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 22:33:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19219 for ; Thu, 29 Apr 2004 22:33:40 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJNqL-0007Ob-8R for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:33:37 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJNpP-0007Jd-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:32:40 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJNoh-0007FE-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:31:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNjy-0001rU-Ps; Thu, 29 Apr 2004 22:27:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNay-0000d4-DA for asrg@optimus.ietf.org; Thu, 29 Apr 2004 22:17:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA18704 for ; Thu, 29 Apr 2004 22:17:40 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJNar-00063q-Tk for asrg@ietf.org; Thu, 29 Apr 2004 22:17:38 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJNa7-0005zZ-00 for asrg@ietf.org; Thu, 29 Apr 2004 22:16:51 -0400 Received: from pcls2.std.com ([192.74.137.142] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BJNZJ-0005uJ-00 for asrg@ietf.org; Thu, 29 Apr 2004 22:16:01 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3U2G1GU004516; Thu, 29 Apr 2004 22:16:01 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id WAA10671; Thu, 29 Apr 2004 22:16:01 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16529.46816.947167.853927@world.std.com> To: John Levine Cc: asrg@ietf.org Subject: Re: [Asrg] E-postage from first principles In-Reply-To: <20040429063821.6203.qmail@xuxa.iecc.com> References: <16528.27844.324796.238684@world.std.com> <20040429063821.6203.qmail@xuxa.iecc.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 22:16:00 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit I don't find compensating recipients interesting or relevant so that's a straw man. Does the post office charge postage soas to pay recipients? W/o stretching the point? Anyhow, e-postage is a way to make the price reflect the usage. Here's another simple outline that would not be subject to all these straw man arguments: 1. A stamp is a cryptographic signature identifying the ISP affixed to e-mail. 2. The certificate for creating such stamps is bought by the ISP from approved certificate-issuing authorities, much like SSL certs at least in theory. 3. The cert is issued for some rough amount of email, 100K/day, 1M/day, etc. and the price reflects that. The ISP will in some industry-agreed upon way provide some basic evidence that the cert is probably about right. This can be verified via auditing, sampling, etc., basic business records might help (everyone knows AOL has whatever, 2.5m customers, no one would believe them if they said they only plan to send 100,000 mail msgs per month, etc.) Similar sampling-based methods (to keep things reaonably honest) have been used for over 75 years for radio music royalties, also similar systems are used for trade magazines subscription/ad ratios, etc. so if you're not familiar with examples such as those look into it because it would seem to be a rich source of ideas. The important point is that you don't have to be absolutely accurate, just accurate to a degree, i.e., not buy a 100K/day cert when intending to send 10M/day. Getting caught cheating should be fairly serious. Obviously a simple mistake can be fixed etc (oh don't jump on it there are many business contracts where you have to estimate/project usage and then settle up later.) 4. Recipient ISPs (and end-users for that matter, tho it's not necessary) can verify the authenticity of certs and if they like verify that a cert hasn't been revoked (one might do this with an authority server for every 100K uses or once a day or hour, the downside isn't all that serious usually.) 5. Recipient ISPs can choose to do what they like with email msgs without good certs. They might deliver them, but they might be advised to (after some transition period) reject them because that's what would make the system work. 6. ISPs may pass these costs along to their own customers however they like, that's a marketing decision. Most likely they'd allow some number of msgs "for free" (included in basic acct fee) and charge for usage beyond that. They might sell a mailing list package for $20/mo extra that includes another 100K msgs/mo, whatever. 7. But the important point is that ISPs would be highly motivated, assuming a reasonable cert price structure, not to allow customers to send millions of msgs per day unrestrained. How they handle accidents or break-ins would be their own choice of policy, but they might be well-advised to practice some leniency if they wish to keep their customers happy. I don't see any settlements, per-message real-time interactions, onerous book-keeping, etc in any of that. -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 23:04:37 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20408 for ; Thu, 29 Apr 2004 23:04:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJOE5-0006c3-7h for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 22:58:09 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3U2w953025414 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 22:58:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJO8n-0005kg-3l for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 22:52:41 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19842 for ; Thu, 29 Apr 2004 22:52:37 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJO8g-0001Gp-CG for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:52:34 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJO7d-0001Ab-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:51:30 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJO6f-00014U-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 22:50:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNrh-00031T-3F; Thu, 29 Apr 2004 22:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJNoU-0002P0-VX for asrg@optimus.ietf.org; Thu, 29 Apr 2004 22:31:42 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19165 for ; Thu, 29 Apr 2004 22:31:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJNoO-0007ED-CE for asrg@ietf.org; Thu, 29 Apr 2004 22:31:36 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJNnT-00079o-00 for asrg@ietf.org; Thu, 29 Apr 2004 22:30:40 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BJNnG-00075O-00 for asrg@ietf.org; Thu, 29 Apr 2004 22:30:26 -0400 Received: from world.std.com (root@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3U2UREF022856; Thu, 29 Apr 2004 22:30:28 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id WAA24425; Thu, 29 Apr 2004 22:30:27 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16529.47683.314126.859849@world.std.com> To: "Tom Thomson" Cc: "Barry Shein" , Subject: RE: [Asrg] My take on e-postage In-Reply-To: References: <16528.5816.592078.439061@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 22:30:27 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 29, 2004 at 11:47 tthomson@neosinteractive.com (Tom Thomson) wrote: > Barry Shein wrote: > > > Before 1989 you couldn't buy a connection to the internet unless you > > could show some bona-fide usage (defense contracting, and towards the > > very end of that era, being a university), and then if you were > > approved hook-up was basically free. > > Strange. I was using the internet (the network interconnecting arpanet, > nfsnet, janet, and various other xxxnets) about the end of 1985 or beginning Well, by nfsnet I assume you mean NSFNET, as in the US National Science Foundation, came into being in 1988, JANET first started IP service in 1991, and the rest of your note is just about as reliable for facts (which is to say, not at all.) But, fwiw, I probably should have said "internet via DARPAnet" rather than just internet although, as with the assertion above, you seem to have created a lot more interconnections than existed (the "very end of that era" was a reference to the 1988 NSFNET.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Thu Apr 29 23:14:15 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20692 for ; Thu, 29 Apr 2004 23:14:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJORi-0000MK-TH for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 23:12:15 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3U3CEjZ001380 for asrg-archive@odin.ietf.org; Thu, 29 Apr 2004 23:12:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJONs-000886-9e for asrg-web-archive@optimus.ietf.org; Thu, 29 Apr 2004 23:08:16 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA20516 for ; Thu, 29 Apr 2004 23:08:11 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJONk-0002bU-On for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 23:08:08 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJOM7-0002Re-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 23:06:28 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJOKe-0002LU-00 for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 23:04:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJOEx-0006gY-GO; Thu, 29 Apr 2004 22:59:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJOA5-0005zQ-W0 for asrg@optimus.ietf.org; Thu, 29 Apr 2004 22:54:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA19977 for ; Thu, 29 Apr 2004 22:53:57 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJO9z-0001Rc-91 for asrg@ietf.org; Thu, 29 Apr 2004 22:53:55 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJO97-0001KW-00 for asrg@ietf.org; Thu, 29 Apr 2004 22:53:01 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BJO8Z-0001Da-00 for asrg@ietf.org; Thu, 29 Apr 2004 22:52:27 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BJO8V-0005G6-00; Thu, 29 Apr 2004 22:52:23 -0400 Received: from [68.246.174.193] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BJO8U-00076p-00; Thu, 29 Apr 2004 22:52:23 -0400 Message-ID: <4091BF5D.7020204@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: Barry Shein CC: John Levine , asrg@ietf.org Subject: Re: [Asrg] E-postage from first principles References: <16528.27844.324796.238684@world.std.com> <20040429063821.6203.qmail@xuxa.iecc.com> <16529.46816.947167.853927@world.std.com> In-Reply-To: <16529.46816.947167.853927@world.std.com> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: perfora.net abuse@perfora.net auth:7051a7fa85b96745770cd89fa6d27f10 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 22:52:13 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry, This sounds like accreditation, not e-postage. Yakov Barry Shein wrote: > I don't find compensating recipients interesting or relevant so that's > a straw man. Does the post office charge postage soas to pay > recipients? W/o stretching the point? > > Anyhow, e-postage is a way to make the price reflect the usage. > > Here's another simple outline that would not be subject to all these > straw man arguments: > > 1. A stamp is a cryptographic signature identifying the ISP affixed to > e-mail. > > 2. The certificate for creating such stamps is bought by the ISP from > approved certificate-issuing authorities, much like SSL certs at least > in theory. > > 3. The cert is issued for some rough amount of email, 100K/day, > 1M/day, etc. and the price reflects that. The ISP will in some > industry-agreed upon way provide some basic evidence that the cert is > probably about right. This can be verified via auditing, sampling, > etc., basic business records might help (everyone knows AOL has > whatever, 2.5m customers, no one would believe them if they said they > only plan to send 100,000 mail msgs per month, etc.) > > Similar sampling-based methods (to keep things reaonably honest) have > been used for over 75 years for radio music royalties, also similar > systems are used for trade magazines subscription/ad ratios, etc. so > if you're not familiar with examples such as those look into it > because it would seem to be a rich source of ideas. > > The important point is that you don't have to be absolutely accurate, > just accurate to a degree, i.e., not buy a 100K/day cert when > intending to send 10M/day. Getting caught cheating should be fairly > serious. Obviously a simple mistake can be fixed etc (oh don't jump on > it there are many business contracts where you have to > estimate/project usage and then settle up later.) > > 4. Recipient ISPs (and end-users for that matter, tho it's not > necessary) can verify the authenticity of certs and if they like > verify that a cert hasn't been revoked (one might do this with an > authority server for every 100K uses or once a day or hour, the > downside isn't all that serious usually.) > > 5. Recipient ISPs can choose to do what they like with email msgs > without good certs. They might deliver them, but they might be advised > to (after some transition period) reject them because that's what > would make the system work. > > 6. ISPs may pass these costs along to their own customers however they > like, that's a marketing decision. Most likely they'd allow some > number of msgs "for free" (included in basic acct fee) and charge for > usage beyond that. They might sell a mailing list package for $20/mo > extra that includes another 100K msgs/mo, whatever. > > 7. But the important point is that ISPs would be highly motivated, > assuming a reasonable cert price structure, not to allow customers to > send millions of msgs per day unrestrained. How they handle accidents > or break-ins would be their own choice of policy, but they might be > well-advised to practice some leniency if they wish to keep their > customers happy. > > I don't see any settlements, per-message real-time interactions, > onerous book-keeping, etc in any of that. -- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "And this too shall come to pass" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 00:08:14 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22891 for ; Fri, 30 Apr 2004 00:08:14 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJPJ8-0007hT-CX for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 00:07:26 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3U47Q0g029591 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 00:07:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJPGd-0007CM-3X for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 00:04:51 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA22773 for ; Fri, 30 Apr 2004 00:04:47 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJPGX-0007iS-Bf for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 00:04:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJPFV-0007Vl-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 00:03:42 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BJPDv-00079X-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 00:02:03 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BJOyM-0008Sx-0B for asrg-web-archive@ietf.org; Thu, 29 Apr 2004 23:45:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJOqf-0003sm-GH; Thu, 29 Apr 2004 23:38:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJOpQ-0003Tv-Gj for asrg@optimus.ietf.org; Thu, 29 Apr 2004 23:36:44 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA21551 for ; Thu, 29 Apr 2004 23:36:41 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJOpL-00052g-4D for asrg@ietf.org; Thu, 29 Apr 2004 23:36:39 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJOoJ-0004w8-00 for asrg@ietf.org; Thu, 29 Apr 2004 23:35:36 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BJOnL-0004mq-00 for asrg@ietf.org; Thu, 29 Apr 2004 23:34:35 -0400 Received: (qmail 23085 invoked by uid 100); 30 Apr 2004 03:34:34 -0000 Message-ID: <20040430033434.23084.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org In-Reply-To: <20040429215730.GK22336@mail> Organization: I.E.C.C., Trumansburg NY USA Cc: david@vex.net Subject: [Asrg] Re: Consent protocols - was E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 30 Apr 2004 03:34:34 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >> f. Sender pretends to be 300 other people and sends you buckets of spam. >> >> Bad guys won't play by your rules. > >That's not an assumption in the example. Sender can't pretend to be a >different Src IP. The spam senders I know, withe their farms of zombies, don't have to pretend to be different source IPs, because each zombie has a separate IP all of its own. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 01:29:12 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA26772 for ; Fri, 30 Apr 2004 01:29:12 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJQY2-0006Bc-Qb for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 01:26:55 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3U5Qsms023764 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 01:26:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJQQA-0005QK-7i for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 01:18:46 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA26559 for ; Fri, 30 Apr 2004 01:18:44 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJQQ3-0007lx-TZ for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 01:18:40 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJQP8-0007gu-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 01:17:43 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJQOZ-0007bh-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 01:17:07 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJQMX-0004pE-Vv; Fri, 30 Apr 2004 01:15:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJQJU-0001vd-0R for asrg@optimus.ietf.org; Fri, 30 Apr 2004 01:11:52 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA26347 for ; Fri, 30 Apr 2004 01:11:50 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJQJN-000772-ML for asrg@ietf.org; Fri, 30 Apr 2004 01:11:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJQIi-000713-00 for asrg@ietf.org; Fri, 30 Apr 2004 01:11:05 -0400 Received: from mailbox.onlinepolicy.net ([64.62.161.194]) by ietf-mx with esmtp (Exim 4.12) id 1BJQHq-0006ps-00 for asrg@ietf.org; Fri, 30 Apr 2004 01:10:10 -0400 Received: by mailbox.onlinepolicy.net (Postfix, from userid 504) id 8B34C18807B; Thu, 29 Apr 2004 21:59:05 -0700 (PDT) Received: from queernet.org (c-67-170-27-226.client.comcast.net [67.170.27.226]) by mailbox.onlinepolicy.net (Postfix) with ESMTP id 928FB188064; Thu, 29 Apr 2004 21:59:03 -0700 (PDT) Message-ID: <4091DF9D.8030701@queernet.org> From: "Roger B.A. Klorese" User-Agent: Mozilla Thunderbird 0.6b (Windows/20040423) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Barry Shein Cc: "Hallam-Baker, Phillip" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) References: <16528.11346.656296.255405@world.std.com> <409031A9.2010809@queernet.org> <16528.27844.324796.238684@world.std.com> <409090DF.4010409@queernet.org> <16529.44960.141923.272661@world.std.com> In-Reply-To: <16529.44960.141923.272661@world.std.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Thu, 29 Apr 2004 22:09:49 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: > Atomic multi-record updates? How about just a log which is processed > asynchronously? Why in the world would this have to be kept in perfect > sync in real-time? Because it's the transfer of MONEY, Barry, which requires both exactness and atomicity. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 07:02:13 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10125 for ; Fri, 30 Apr 2004 07:02:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJVlo-0008LM-7R for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 07:01:28 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UB1Sl2032072 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 07:01:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJVkS-00089Q-Rl for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 07:00:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA09980 for ; Fri, 30 Apr 2004 07:00:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJVkL-0005qf-9w for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 06:59:57 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJVjM-0005gP-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 06:58:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJVic-0005XF-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 06:58:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJVcf-00078r-EL; Fri, 30 Apr 2004 06:52:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJVZq-0006sT-1N for asrg@optimus.ietf.org; Fri, 30 Apr 2004 06:49:06 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA09675 for ; Fri, 30 Apr 2004 06:49:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJVZi-00047a-CV for asrg@ietf.org; Fri, 30 Apr 2004 06:48:58 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJVYp-0003x4-00 for asrg@ietf.org; Fri, 30 Apr 2004 06:48:04 -0400 Received: from host217-35-105-169.in-addr.btopenworld.com ([217.35.105.169] helo=mail.neosinteractive.com) by ietf-mx with esmtp (Exim 4.12) id 1BJVXw-0003lF-00 for asrg@ietf.org; Fri, 30 Apr 2004 06:47:08 -0400 Received: from tthomson ([217.35.105.173] unverified) by mail.neosinteractive.com with Microsoft SMTPSVC(5.0.2195.6713); Fri, 30 Apr 2004 10:53:20 +0100 From: "Tom Thomson" To: Subject: RE: [Asrg] My take on e-postage Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) In-Reply-To: <16529.47683.314126.859849@world.std.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal X-OriginalArrivalTime: 30 Apr 2004 09:53:20.0812 (UTC) FILETIME=[F840CEC0:01C42E98] Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 11:47:12 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > Barry Shein wrote: > Well, by nfsnet I assume you mean NSFNET, as in the US National > Science Foundation, came into being in 1988, JANET first started IP > service in 1991, and the rest of your note is just about as reliable > for facts (which is to say, not at all.) JANET startd internal use of IP in 1991, having used a variety of other protocols (mostly X25 over wide area, ECMA transport and various home-growns over local area) for a long time before that. But the "internet" didn't refer to the use of IP, but to the interconnection of the various networks, and connections between the Joint Academic Network and various other networks (including academic netwrorks in the US and elsewhere in Europe) was achieved using gateways which converted between different local network standards long before that date. If you mean "networks using the IP defined in RFC0791" then fine, your dates are right. If you mean the network which grew from the interconnection of a large collection of individual networks in various parts of the world your dates are completely wrong. When you said "internet" I assumed you meant the latter (the internet still has many subnets which are gatewayed with protocol converters, although it's now much more common to use IP over the top of the local network layer). > But, fwiw, I probably should have said "internet via DARPAnet" rather > than just internet although, as with the assertion above, you seem to > have created a lot more interconnections than existed (the "very end > of that era" was a reference to the 1988 NSFNET.) OK, NSFNET is 1988; there were plenty of Universities with access to Darpanet before then, and there were several inter-university networks before then, and there were various interconnections between those various inter-university netwroks before then. Whatever the dates, the main point remains: there was no "free resource" and none of the people who were paying for the (very) expensive network infrastructures that formed the internet (whether by that we mean the interconnecting network that had joined up all those individual networks, or the network pervaded by IP which it subsequently eveolved into) were interested in providing a free ride for non-contributors. Tom _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 07:35:40 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11132 for ; Fri, 30 Apr 2004 07:35:40 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJWD7-0003Ke-Op for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 07:29:42 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UBTfZ4012800 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 07:29:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJWAg-00032b-QG for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 07:27:10 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10908 for ; Fri, 30 Apr 2004 07:27:07 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJWAf-0002SZ-Sn for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 07:27:09 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJW9i-0002Im-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 07:26:11 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJW9N-00028x-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 07:25:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJW7d-0002bn-B8; Fri, 30 Apr 2004 07:24:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJW5h-0002J9-Ac for asrg@optimus.ietf.org; Fri, 30 Apr 2004 07:22:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10671 for ; Fri, 30 Apr 2004 07:21:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJW5g-0001cJ-Kv for asrg@ietf.org; Fri, 30 Apr 2004 07:22:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJW4g-0001Qu-00 for asrg@ietf.org; Fri, 30 Apr 2004 07:20:58 -0400 Received: from yellow.csi.cam.ac.uk ([131.111.8.67] ident=exim) by ietf-mx with esmtp (Exim 4.12) id 1BJW3i-0001Fb-00 for asrg@ietf.org; Fri, 30 Apr 2004 07:19:58 -0400 Received: from fanf2 (helo=localhost) by yellow.csi.cam.ac.uk with local-esmtp (Exim 4.12) id 1BJW3g-0000f6-00; Fri, 30 Apr 2004 12:19:56 +0100 From: Tony Finch X-X-Sender: fanf2@yellow.csi.cam.ac.uk To: johnl@taugh.com cc: asrg@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [Asrg] draft-irtf-asrg-dnsbl-00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 12:19:56 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Some comments and niggles: Section 2.1. "rDNS" is probably worth expanding to "in-addr.arpa reverse DNS". Section 2.3. probably worth replacing the comma with a colon to introduce the list of methods of representing multiple sublists. Also shouldn't DNSBLs be discouraged from using 127.0.0.1 as the target address of a blacklist record? Typo: "welll". The last paragraph of the section, on the topic of TTLs etc reads like it ought to be in a separate section. Section 4. Paragraph 3 is repeated in a different form at the end of paragraph 4. Also no full-stop before "Long-running". -- Tony Finch http://dotat.at/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 07:44:21 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11576 for ; Fri, 30 Apr 2004 07:44:21 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJWLX-0004RY-RC for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 07:38:23 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UBcNdC017074 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 07:38:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJWIG-0003qL-EG for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 07:35:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11105 for ; Fri, 30 Apr 2004 07:34:57 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJWIF-0003mK-Ot for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 07:34:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJWHF-0003c7-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 07:33:57 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJWGE-0003NA-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 07:32:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJWCT-0003A8-0L; Fri, 30 Apr 2004 07:29:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJW8b-0002k4-00 for asrg@optimus.ietf.org; Fri, 30 Apr 2004 07:25:01 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA10822 for ; Fri, 30 Apr 2004 07:24:57 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJW8a-00027c-CK for asrg@ietf.org; Fri, 30 Apr 2004 07:25:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJW7f-0001yN-00 for asrg@ietf.org; Fri, 30 Apr 2004 07:24:03 -0400 Received: from yellow.csi.cam.ac.uk ([131.111.8.67] ident=exim) by ietf-mx with esmtp (Exim 4.12) id 1BJW7A-0001pL-00 for asrg@ietf.org; Fri, 30 Apr 2004 07:23:32 -0400 Received: from fanf2 (helo=localhost) by yellow.csi.cam.ac.uk with local-esmtp (Exim 4.12) id 1BJW79-0000uZ-00 for asrg@ietf.org; Fri, 30 Apr 2004 12:23:31 +0100 From: Tony Finch X-X-Sender: fanf2@yellow.csi.cam.ac.uk To: asrg@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: [Asrg] draft-irtf-asrg-bcp-blacklists-00 Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 12:23:31 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 One comment: Section 2.2. MUST Have the Same Criteria for Listing and Delisting. This rule appears to be saying the wrong thing, when you consider sections 2.5 ... 2.7 which specify other less strict ways of being delisted. Perhaps 2.2 should say "Failing to meet the criteria for listing MUST be sufficient grounds for delisting". -- Tony Finch http://dotat.at/ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 09:52:32 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01708 for ; Fri, 30 Apr 2004 09:52:31 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYMS-00047Y-Ec for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 09:47:31 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UDlS50015837 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 09:47:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYGP-0003Ve-5g for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 09:41:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA01337 for ; Fri, 30 Apr 2004 09:41:08 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJYGM-00033D-VS for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 09:41:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJYFU-0002rv-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 09:40:16 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJYEX-0002hH-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 09:39:17 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJY8U-0001oE-Gg; Fri, 30 Apr 2004 09:33:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJY2j-0000zT-JO for asrg@optimus.ietf.org; Fri, 30 Apr 2004 09:27:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA00705 for ; Fri, 30 Apr 2004 09:27:00 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJY2h-0000YA-Sm for asrg@ietf.org; Fri, 30 Apr 2004 09:27:03 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJY1i-0000LN-00 for asrg@ietf.org; Fri, 30 Apr 2004 09:26:03 -0400 Received: from sc1.scconsult.com ([66.73.230.190] helo=toaster.scconsult.com) by ietf-mx with esmtp (Exim 4.12) id 1BJY0f-0007nK-00 for asrg@ietf.org; Fri, 30 Apr 2004 09:24:58 -0400 Received: from [192.168.254.12] (localhost [127.0.0.1]) by toaster.scconsult.com (Postfix) with ESMTP id 829511106E3 for ; Fri, 30 Apr 2004 09:24:52 -0400 (EDT) Mime-Version: 1.0 X-Sender: bill@fireproof.scconsult.com Message-Id: In-Reply-To: References: To: asrg@ietf.org From: Bill Cole Subject: Re: [Asrg] draft-irtf-asrg-bcp-blacklists-00 Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 09:24:49 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 At 12:23 PM +0100 4/30/04, Tony Finch wrote: >One comment: > >Section 2.2. MUST Have the Same Criteria for Listing and Delisting. > >This rule appears to be saying the wrong thing, when you consider sections >2.5 ... 2.7 which specify other less strict ways of being delisted. > >Perhaps 2.2 should say "Failing to meet the criteria for listing MUST be >sufficient grounds for delisting". I don't think that even makes sense. Neither has routinely been true of most widely-used DNSBL's. The clearest example of an almost completely non-controversial and extremely useful list that comes nowhere near symmetry in listing and delisting is the CBL. Listing and delisting are not simply asymmetric, but orthogonal: addresses go one for acting in ways that are common to compromised machines that emit spam, and delisting occurs purely for the asking. In many lists historically (notably the MAPS RBL and the Spamhaus SBL) the apparent delisting criteria have been quite a bit less than failing to meet the listing criteria, particularly for escalated listings. On the other side, it has been my experience in maintaining private blacklists that they tend in practice to be tilted the other way, with listings being based on rather minimal indication of a problem and delistings requiring not just an end to the triggering behavior, but some sort of assurance that it will not recur and that there is a positive benefit to delisting. My own explanation for this covering my own local blacklist is at http://www.scconsult.com/scbldetails.html, with the learest bit on that abpout 2/3 of the way down the page. I know that this document is not aimed at private blacklists and that private and public are inherently different, but it is worth considering that multiple varieties of blacklist seem to reliably fail to meet a standard of symmetry. In the end, a requirement for symmetry in a BCP doesn't really have any meaning. Existing lists are not managed that way in practice, but it is a fairly simple matter of formal logic to change their published criteria without changing actual practice so that there is formal symmetry. For example, the CBL could define its listing criteria as having acted like a compromised spam source more recently than having had a removal requested or a listing timeout. IOW: take the practical delisting criteria, negate them, and add them to the listing criteria. I believe that since Section 2.2 is not actually practiced in spirit recognizably anywhere, but that it could be formally met without any change in practice and simple adoption of more convoluted formal criteria. In short, Section 2.2 does not express 'best current practice' in any sense. I think it also may be better to approach the blacklist issue from a model focused on process rather then one concentrated on criteria. Every listing has a trigger event, and while that event may be triggering an evaluation of criteria, it may well be (as it seems to be with the CBL) that the event itself carries all the necessary information to evaluate the listing criteria, and that a delisting cannot possibly be a logical reverse of a listing. For example, one might want to list machines that have been seen to HELO with the IP address of the server to which they are connecting. That is grossly incorrect behavior that is done fairly frequently by spam-sending cracked machines. It is also a very good predictor of future spam from the same machine without the telltale bogus HELO, because the usual mode of compromise includes an open proxy on the machine, making it open to spammers of all intelligence levels and a wide range of HELO choices. It is logically impossible to reverse that basis for a listing: what is done is done. I believe that it makes more sense to recommend that lists define (as far as possible) their listing and delisting *processes* clarly, and forget about recommending some sort of symmetry for criteria. (Incidentally, I bring up the CBL for examples because I believe that by any measurable standard it is by far the best DNSBL ever published, and that any BCP which essentially defined it as mismanaged would be making a very harmful mistake.) -- Bill Cole bill@scconsult.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 10:29:11 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04531 for ; Fri, 30 Apr 2004 10:29:11 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYyn-00084b-4r for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 10:27:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UER5bt031028 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 10:27:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYp4-0005rf-PR for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 10:17:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03835 for ; Fri, 30 Apr 2004 10:16:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJYp2-0004qq-I7 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:17:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJYo5-0004o6-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:16:02 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJYnL-0004lp-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:15:15 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYgQ-0002OP-0s; Fri, 30 Apr 2004 10:08:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYeQ-0001SS-JB for asrg@optimus.ietf.org; Fri, 30 Apr 2004 10:06:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA02646 for ; Fri, 30 Apr 2004 10:05:59 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJYeO-0004QY-Gc for asrg@ietf.org; Fri, 30 Apr 2004 10:06:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJYdY-0004Q2-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:05:08 -0400 Received: from mail22.messagelabs.com ([62.231.131.211]) by ietf-mx with smtp (Exim 4.12) id 1BJYd5-0004N7-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:04:40 -0400 X-VirusChecked: Checked X-Env-Sender: msergeant@messagelabs.com X-Msg-Ref: server-20.tower-22.messagelabs.com!1083333844!8158249 X-StarScan-Version: 5.2.10; banners=messagelabs.com,-,- X-Originating-IP: [212.125.75.70] Received: (qmail 8118 invoked from network); 30 Apr 2004 14:04:04 -0000 Received: from smtp-1.star.net.uk (212.125.75.70) by server-20.tower-22.messagelabs.com with SMTP; 30 Apr 2004 14:04:04 -0000 Received: (qmail 5204 invoked from network); 30 Apr 2004 14:01:25 -0000 Received: from unknown (HELO matt-dev.int.star.co.uk) (195.216.14.9) by smtp-1.star.net.uk with SMTP; 30 Apr 2004 14:01:25 -0000 Received: (qmail 19246 invoked from network); 29 Apr 2004 13:51:03 -0000 Received: from unknown (HELO ?10.2.100.139?) (10.2.100.139) by matt?dev.int.star.co.uk with SMTP; 29 Apr 2004 13:51:03 -0000 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <3175C2FE-9AAF-11D8-BEA4-000A95AC67AA@messagelabs.com> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Matt Sergeant Subject: Re: [Asrg] draft-irtf-asrg-bcp-blacklists-00 To: Tony Finch X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 15:03:44 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On 30 Apr 2004, at 12:23, Tony Finch wrote: > > One comment: > > Section 2.2. MUST Have the Same Criteria for Listing and Delisting. > > This rule appears to be saying the wrong thing, when you consider > sections > 2.5 ... 2.7 which specify other less strict ways of being delisted. > > Perhaps 2.2 should say "Failing to meet the criteria for listing MUST > be > sufficient grounds for delisting". Yes, we tried to change the wording of this at the last minute to forward reference 2.5, but I still felt it wasn't entirely clear. The above wording seems better to me. Chris? Matt. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 11:01:24 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA06167 for ; Fri, 30 Apr 2004 11:01:24 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZN0-0003S6-8M for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 10:52:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UEq6WM013266 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 10:52:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZD2-0001hQ-1W for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 10:41:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05185 for ; Fri, 30 Apr 2004 10:41:44 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJZCz-00060p-LG for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:41:45 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJZBx-0005t7-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:40:41 -0400 Received: from [65.246.255.50] (helo=mx2.foretec.com) by ietf-mx with esmtp (Exim 4.12) id 1BJZAg-0005ja-01 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:39:23 -0400 Received: from optimus22.ietf.org ([132.151.6.22] helo=optimus.ietf.org) by mx2.foretec.com with esmtp (Exim 4.24) id 1BJYvQ-00020x-KV for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:23:37 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYo8-0005ZG-IC; Fri, 30 Apr 2004 10:16:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYkK-0003z6-6E for asrg@optimus.ietf.org; Fri, 30 Apr 2004 10:12:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03298 for ; Fri, 30 Apr 2004 10:12:04 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJYkI-0004eo-1x for asrg@ietf.org; Fri, 30 Apr 2004 10:12:06 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJYjN-0004dW-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:11:10 -0400 Received: from mail22.messagelabs.com ([62.231.131.211]) by ietf-mx with smtp (Exim 4.12) id 1BJYj6-0004bc-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:10:52 -0400 X-VirusChecked: Checked X-Env-Sender: msergeant@messagelabs.com X-Msg-Ref: server-14.tower-22.messagelabs.com!1083334219!8205989 X-StarScan-Version: 5.2.10; banners=messagelabs.com,-,- X-Originating-IP: [212.125.75.70] Received: (qmail 21049 invoked from network); 30 Apr 2004 14:10:19 -0000 Received: from smtp-1.star.net.uk (212.125.75.70) by server-14.tower-22.messagelabs.com with SMTP; 30 Apr 2004 14:10:19 -0000 Received: (qmail 11062 invoked from network); 30 Apr 2004 14:07:58 -0000 Received: from unknown (HELO matt-dev.int.star.co.uk) (195.216.14.9) by smtp-1.star.net.uk with SMTP; 30 Apr 2004 14:07:58 -0000 Received: (qmail 19275 invoked from network); 29 Apr 2004 13:57:36 -0000 Received: from unknown (HELO ?10.2.100.139?) (10.2.100.139) by matt?dev.int.star.co.uk with SMTP; 29 Apr 2004 13:57:36 -0000 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <1B6AB85D-9AB0-11D8-BEA4-000A95AC67AA@messagelabs.com> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Matt Sergeant Subject: Re: [Asrg] draft-irtf-asrg-bcp-blacklists-00 To: Bill Cole X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 15:10:17 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On 30 Apr 2004, at 14:24, Bill Cole wrote: > I don't think that even makes sense. Neither has routinely been true > of most widely-used DNSBL's. The clearest example of an almost > completely non-controversial and extremely useful list that comes > nowhere near symmetry in listing and delisting is the CBL. Delisting in the CBL complies perfectly with the RFC. It is a timeout (as per 2.5) or if the problem is cleared up (as per 2.2) or removal without question (as per 2.7). ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 11:08:15 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA06637 for ; Fri, 30 Apr 2004 11:08:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZTw-0004ia-8B for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 10:59:16 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UExGvV018131 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 10:59:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZHI-0002p7-RX for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 10:46:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05487 for ; Fri, 30 Apr 2004 10:46:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJZHG-0006Mu-Et for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:46:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJZGS-0006Ko-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:45:20 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJZFy-0006Hb-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:44:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZ0j-0008PU-W3; Fri, 30 Apr 2004 10:29:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJYwr-0007sw-K0 for asrg@optimus.ietf.org; Fri, 30 Apr 2004 10:25:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04351 for ; Fri, 30 Apr 2004 10:25:02 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJYwp-0005DW-F5 for asrg@ietf.org; Fri, 30 Apr 2004 10:25:03 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJYvw-0005Bu-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:24:09 -0400 Received: from mail22.messagelabs.com ([62.231.131.211]) by ietf-mx with smtp (Exim 4.12) id 1BJYvb-0005A1-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:23:47 -0400 X-VirusChecked: Checked X-Env-Sender: msergeant@messagelabs.com X-Msg-Ref: server-2.tower-22.messagelabs.com!1083334991!8196108 X-StarScan-Version: 5.2.10; banners=messagelabs.com,-,- X-Originating-IP: [212.125.75.70] Received: (qmail 11042 invoked from network); 30 Apr 2004 14:23:11 -0000 Received: from smtp-1.star.net.uk (212.125.75.70) by server-2.tower-22.messagelabs.com with SMTP; 30 Apr 2004 14:23:11 -0000 Received: (qmail 21661 invoked from network); 30 Apr 2004 14:20:51 -0000 Received: from unknown (HELO matt-dev.int.star.co.uk) (195.216.14.9) by smtp-1.star.net.uk with SMTP; 30 Apr 2004 14:20:51 -0000 Received: (qmail 19291 invoked from network); 29 Apr 2004 14:10:29 -0000 Received: from unknown (HELO ?10.2.100.139?) (10.2.100.139) by matt?dev.int.star.co.uk with SMTP; 29 Apr 2004 14:10:29 -0000 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Matt Sergeant Subject: Re: [Asrg] draft-irtf-asrg-bcp-blacklists-00 To: Bill Cole X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 15:23:10 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On 30 Apr 2004, at 14:24, Bill Cole wrote: > In many lists historically (notably the MAPS RBL and the Spamhaus SBL) > the apparent delisting criteria have been quite a bit less than > failing to meet the listing criteria, particularly for escalated > listings. According to the details at http://www.spamhaus.org/sbl/sbl-rationale.html this is not the case. In all escalations I've seen the SBL do, once the problem is cleared up on the escalated network the listing is removed. Do you have recent counter examples? I'm sure the SBL operators would be interested. I can't comment on the RBL as I haven't studied it enough. > On the other side, it has been my experience in maintaining private > blacklists that they tend in practice to be tilted the other way with > listings being based on rather minimal indication of a problem and > delistings requiring not just an end to the triggering behavior, but > some sort of assurance that it will not recur and that there is a > positive benefit to delisting. My own explanation for this covering my > own local blacklist is at http://www.scconsult.com/scbldetails.html, > with the learest bit on that abpout 2/3 of the way down the page. I > know that this document is not aimed at private blacklists and that > private and public are inherently different, but it is worth > considering that multiple varieties of blacklist seem to reliably fail > to meet a standard of symmetry. As you rightly point out, the BCP is specifically focussed on public blacklists, as detailed in section 2 "The Guidelines". Our aim with the BCP was not to fit it around _all_ current practices, but to fit it around best practices. If you have good reasons for going against the guidelines please state them and we can consider the modification of the BCP. > In the end, a requirement for symmetry in a BCP doesn't really have > any meaning. Existing lists are not managed that way in practice, but > it is a fairly simple matter of formal logic to change their published > criteria without changing actual practice so that there is formal > symmetry. For example, the CBL could define its listing criteria as > having acted like a compromised spam source more recently than having > had a removal requested or a listing timeout. IOW: take the practical > delisting criteria, negate them, and add them to the listing criteria. > I believe that since Section 2.2 is not actually practiced in spirit > recognizably anywhere, but that it could be formally met without any > change in practice and simple adoption of more convoluted formal > criteria. In short, Section 2.2 does not express 'best current > practice' in any sense. My gut feeling is it might not be worded right, or you've read it wrong, as the intent is in the right place, and it does in the authors' experience meet best current practices. > I think it also may be better to approach the blacklist issue from a > model focused on process rather then one concentrated on criteria. > Every listing has a trigger event, and while that event may be > triggering an evaluation of criteria, it may well be (as it seems to > be with the CBL) that the event itself carries all the necessary > information to evaluate the listing criteria, and that a delisting > cannot possibly be a logical reverse of a listing. This (I think) is your misreading. The BCP in no way means that 2.2 is the *only* delisting option. 2.5 is another option for delisting (which the CBL uses). > (Incidentally, I bring up the CBL for examples because I believe that > by any measurable standard it is by far the best DNSBL ever published, > and that any BCP which essentially defined it as mismanaged would be > making a very harmful mistake.) Indeed, and the authors agree. We do not thing we have done that. Matt. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 11:20:54 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07850 for ; Fri, 30 Apr 2004 11:20:54 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZcD-0006do-7O for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 11:07:49 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UF7nPa025518 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 11:07:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZTo-0004hE-CP for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 10:59:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA06001 for ; Fri, 30 Apr 2004 10:59:04 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJZTl-0006ur-RC for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:59:05 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJZT0-0006tV-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:58:18 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJZSP-0006rb-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 10:57:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZH7-0002oE-Uw; Fri, 30 Apr 2004 10:46:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZ3k-0000KO-QW for asrg@optimus.ietf.org; Fri, 30 Apr 2004 10:32:12 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04689 for ; Fri, 30 Apr 2004 10:32:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJZ3i-0005TY-FL for asrg@ietf.org; Fri, 30 Apr 2004 10:32:10 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJZ2m-0005RT-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:31:13 -0400 Received: from mail3.panix.com ([166.84.1.74]) by ietf-mx with esmtp (Exim 4.12) id 1BJZ28-0005PQ-00 for asrg@ietf.org; Fri, 30 Apr 2004 10:30:32 -0400 Received: from panix5.panix.com (panix5.panix.com [166.84.1.5]) by mail3.panix.com (Postfix) with ESMTP id AB016984C1 for ; Fri, 30 Apr 2004 10:30:31 -0400 (EDT) Received: (from sethb@localhost) by panix5.panix.com (8.11.6p2-a/8.8.8/PanixN1.1) id i3UEUVu24576; Fri, 30 Apr 2004 10:30:31 -0400 (EDT) Message-Id: <200404301430.i3UEUVu24576@panix5.panix.com> From: Seth Breidbart To: asrg@ietf.org In-reply-to: (message from Tony Finch on Fri, 30 Apr 2004 12:23:31 +0100) Subject: Re: [Asrg] draft-irtf-asrg-bcp-blacklists-00 References: Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 10:30:31 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 > Perhaps 2.2 should say "Failing to meet the criteria for listing MUST be > sufficient grounds for delisting". Why? I see no problem with a "sticky" list; for instance, to get listed an IP must send >X amount of spam in Y time, to get unlisted it must send <.1X in 10Y. Seth _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 11:40:36 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA09768 for ; Fri, 30 Apr 2004 11:40:36 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJa3x-0003QC-G6 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 11:36:29 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UFaTcm013152 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 11:36:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZyl-0002d6-WD for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 11:31:08 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08539 for ; Fri, 30 Apr 2004 11:31:05 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJZyl-0001Yw-23 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 11:31:07 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJZxt-0001VK-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 11:30:13 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJZx1-0001Re-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 11:29:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZr1-0000zA-Uj; Fri, 30 Apr 2004 11:23:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZhE-0007M5-QF for asrg@optimus.ietf.org; Fri, 30 Apr 2004 11:13:00 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA07115 for ; Fri, 30 Apr 2004 11:12:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJZhD-0000DA-Vr for asrg@ietf.org; Fri, 30 Apr 2004 11:13:00 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJZft-00000K-00 for asrg@ietf.org; Fri, 30 Apr 2004 11:11:38 -0400 Received: from smtp-out4.blueyonder.co.uk ([195.188.213.7]) by ietf-mx with esmtp (Exim 4.12) id 1BJZeo-0007f5-00 for asrg@ietf.org; Fri, 30 Apr 2004 11:10:30 -0400 Received: from beddo ([82.38.232.81]) by smtp-out4.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.5600); Fri, 30 Apr 2004 16:10:31 +0100 From: cw To: X-Mailer: PocoMail 3.0 (1640) - Licensed Version Message-ID: <2004430161136.525018@beddo> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-OriginalArrivalTime: 30 Apr 2004 15:10:31.0571 (UTC) FILETIME=[47782E30:01C42EC5] Content-Transfer-Encoding: quoted-printable Subject: [Asrg] Sender Authentication Lookup Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 16:11:36 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable In the process of writing a report that I am currently working on, I'm sure= I read somewhere on one of the lists or hundreds of documents that I have= read that someone mentioned a problem with having all these different= proposals. The problem is that the recipient has no way of knowing which sender= authentication scheme that the claimed sender supports if any. Would it be= sensible and viable to have a standard put to be 'suggested' in the most= forceful way to the different developers to include some common lookup= functionality. ie something along the lines of a single text record in the DNS zone of the= likes of "sender-authentication scheme: X" where X is a published unique= identifier for each technology. That would solve recipients having to guess or try all the different= technologies until they get a match. If the record doesn't exist then the= client should assume sender authentication is not supported on that= domain. Does that sound sensible? Regards, Colin. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 13:00:38 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA14623 for ; Fri, 30 Apr 2004 13:00:38 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJbLZ-00041J-5x for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 12:58:45 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UGwjgG015453 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 12:58:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJb9L-0001tq-BD for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 12:46:07 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA13664 for ; Fri, 30 Apr 2004 12:46:03 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJb9J-0007Lz-NA for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 12:46:05 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJb8L-0007IA-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 12:45:06 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJb7S-0007EV-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 12:44:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJayb-00072z-JP; Fri, 30 Apr 2004 12:35:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJan3-0004w8-HT for asrg@optimus.ietf.org; Fri, 30 Apr 2004 12:23:05 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12452 for ; Fri, 30 Apr 2004 12:23:02 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJan2-0005eK-2C for asrg@ietf.org; Fri, 30 Apr 2004 12:23:04 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJam3-0005Z2-00 for asrg@ietf.org; Fri, 30 Apr 2004 12:22:04 -0400 Received: from mail22.messagelabs.com ([62.231.131.211]) by ietf-mx with smtp (Exim 4.12) id 1BJal6-0005Ts-00 for asrg@ietf.org; Fri, 30 Apr 2004 12:21:04 -0400 X-VirusChecked: Checked X-Env-Sender: msergeant@messagelabs.com X-Msg-Ref: server-3.tower-22.messagelabs.com!1083342027!8081310 X-StarScan-Version: 5.2.10; banners=messagelabs.com,-,- X-Originating-IP: [212.125.75.70] Received: (qmail 31916 invoked from network); 30 Apr 2004 16:20:27 -0000 Received: from smtp-1.star.net.uk (212.125.75.70) by server-3.tower-22.messagelabs.com with SMTP; 30 Apr 2004 16:20:27 -0000 Received: (qmail 18724 invoked from network); 30 Apr 2004 16:18:06 -0000 Received: from unknown (HELO matt-dev.int.star.co.uk) (195.216.14.9) by smtp-1.star.net.uk with SMTP; 30 Apr 2004 16:18:06 -0000 Received: (qmail 19569 invoked from network); 29 Apr 2004 16:07:44 -0000 Received: from unknown (HELO ?10.5.102.168?) (10.5.102.168) by matt?dev.int.star.co.uk with SMTP; 29 Apr 2004 16:07:44 -0000 In-Reply-To: <200404301430.i3UEUVu24576@panix5.panix.com> References: <200404301430.i3UEUVu24576@panix5.panix.com> Mime-Version: 1.0 (Apple Message framework v613) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <49E0F0F9-9AC2-11D8-BEA4-000A95AC67AA@messagelabs.com> Content-Transfer-Encoding: 7bit Cc: asrg@ietf.org From: Matt Sergeant Subject: Re: [Asrg] draft-irtf-asrg-bcp-blacklists-00 To: Seth Breidbart X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 17:20:26 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On 30 Apr 2004, at 15:30, Seth Breidbart wrote: >> Perhaps 2.2 should say "Failing to meet the criteria for listing MUST >> be >> sufficient grounds for delisting". > > Why? I see no problem with a "sticky" list; for instance, to get > listed an IP must send >X amount of spam in Y time, to get unlisted it > must send <.1X in 10Y. Because this is confusing. However I don't think it's entirely incompatible with the BCP. The listing criteria could be as simple as "We have detected spam coming from this IP address". How you "detected" it (by spam levels exceeding a threshold) and how you "undetect" it is up to you. Matt. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 13:24:16 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA16176 for ; Fri, 30 Apr 2004 13:24:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJbhA-0008Gp-TF for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 13:21:05 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UHL4J9031783 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 13:21:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJbYb-0006r7-Ig for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 13:12:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15385 for ; Fri, 30 Apr 2004 13:12:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJbYZ-0001UD-NB for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 13:12:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJbXg-0001Pg-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 13:11:17 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJbWs-0001MG-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 13:10:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJbMr-0004Jk-9l; Fri, 30 Apr 2004 13:00:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJbK5-0003Mi-1v for asrg@optimus.ietf.org; Fri, 30 Apr 2004 12:57:13 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA14392 for ; Fri, 30 Apr 2004 12:57:09 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJbK3-0000MR-2r for asrg@ietf.org; Fri, 30 Apr 2004 12:57:11 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJbJ5-0000JV-00 for asrg@ietf.org; Fri, 30 Apr 2004 12:56:11 -0400 Received: from xuxa.iecc.com ([208.31.42.42]) by ietf-mx with esmtp (Exim 4.12) id 1BJbIE-0000HC-00 for asrg@ietf.org; Fri, 30 Apr 2004 12:55:18 -0400 Received: (qmail 4461 invoked by uid 100); 30 Apr 2004 16:55:18 -0000 Message-ID: <20040430165518.4460.qmail@xuxa.iecc.com> From: John Levine To: asrg@ietf.org In-Reply-To: <20040430152420.GN22336@mail> Organization: I.E.C.C., Trumansburg NY USA Cc: david@vex.net Subject: [Asrg] Re: Consent protocols - was E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: 30 Apr 2004 16:55:18 -0000 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 >> f. Sender pretends to be 300 other people and sends you buckets of spam. Sorry, that was supposed to be: f. Sender pretends to be 30,000 other people and sends you buckets of spam. >Now, if you like, add greylisting for unknown senders, so that those >300 msgs won't be accepted on the first try. Then, add a distributed >blacklist which you check your mailqueue against before delivery to >users' inboxes. Application of the blacklist can be part of whatever >other content spam filters the user has. DCC already does that. It works reasonably well, with no need to invent new consent protocols. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 17:36:41 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05649 for ; Fri, 30 Apr 2004 17:36:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfYk-0005mI-Fb for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:28:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ULSceU022206 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:28:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfOQ-00036s-PV for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 17:17:58 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03927 for ; Fri, 30 Apr 2004 17:17:55 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfOO-0002kd-Gp for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:17:56 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfLg-0002Ka-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:15:09 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJfK1-0001yy-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:13:25 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJf3B-0003zf-0s; Fri, 30 Apr 2004 16:56:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJZts-0001V7-Dl for asrg@optimus.ietf.org; Fri, 30 Apr 2004 11:26:04 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA08224 for ; Fri, 30 Apr 2004 11:26:01 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJZtr-00019N-Cm for asrg@ietf.org; Fri, 30 Apr 2004 11:26:03 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJZsx-000176-00 for asrg@ietf.org; Fri, 30 Apr 2004 11:25:07 -0400 Received: from h210.c136.b246.tor.eicat.ca ([66.246.136.210] helo=shell.vex.net) by ietf-mx with esmtp (Exim 4.12) id 1BJZsG-00015a-00 for asrg@ietf.org; Fri, 30 Apr 2004 11:24:24 -0400 Received: from smaug.vex.net (smaug.vex.net [66.246.136.211]) by shell.vex.net (Postfix) with ESMTP id 21243E544; Fri, 30 Apr 2004 11:24:27 -0400 (EDT) Received: from mail.crlf.net (mail.crlf.net [216.126.92.195]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (No client certificate requested) by smaug.vex.net (Postfix) with ESMTP id A4FA93584D; Fri, 30 Apr 2004 11:24:19 -0400 (EDT) From: David Maxwell To: John Levine Cc: asrg@ietf.org Message-ID: <20040430152420.GN22336@mail> References: <20040429215730.GK22336@mail> <20040430033434.23084.qmail@xuxa.iecc.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040430033434.23084.qmail@xuxa.iecc.com> User-Agent: Mutt/1.4.2i Subject: [Asrg] Re: Consent protocols - was E-postage Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 11:24:20 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 On Fri, 30 Apr 2004, John Levine wrote: > >> f. Sender pretends to be 300 other people and sends you buckets of spam. > >> > >> Bad guys won't play by your rules. > > > >That's not an assumption in the example. Sender can't pretend to be a > >different Src IP. > > The spam senders I know, withe their farms of zombies, don't have to > pretend to be different source IPs, because each zombie has a separate > IP all of its own. That's not a problem. Each IP is a new Source, since it has no reputation, it will be allocated 1msg/h (or whatever your initial setting is). That means that you're down to 300 spam/h received in your entire domain. Now, if you like, add greylisting for unknown senders, so that those 300 msgs won't be accepted on the first try. Then, add a distributed blacklist which you check your mailqueue against before delivery to users' inboxes. Application of the blacklist can be part of whatever other content spam filters the user has. Now, each zombie can be used roughly once, before it gets into the blacklist (they probably expire at some point). Spam sent from a blacklisted zombie won't affect anyone who checks the list. If you want some feedback to the zombie'd user, add a blacklist check to your webpage - replace normal content with "This web page can not be viewed by virus-infected client machines." - and maybe people would have cause to clean up their PCs. -- David Maxwell, david@vex.net|david@maxwell.net --> Unless you have a solution when you tell them things like that, most people collapse into a gibbering, unthinking mass. This is the same reason why you probably don't tell your boss about everything you read on BugTraq! - Signal 11 _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 17:38:23 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06015 for ; Fri, 30 Apr 2004 17:38:23 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfZP-0006FQ-O8 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:29:19 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ULTJfq024010 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:29:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfTd-00040V-Fa for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 17:23:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04739 for ; Fri, 30 Apr 2004 17:23:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfTb-0003fD-5D for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:23:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfSh-0003Y1-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:22:24 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJfRE-0003Ej-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:20:52 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJf95-0005Bg-KX; Fri, 30 Apr 2004 17:02:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJeOq-00066B-5r for asrg@optimus.ietf.org; Fri, 30 Apr 2004 16:14:20 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA27870 for ; Fri, 30 Apr 2004 16:14:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJeOo-00017j-Ey for asrg@ietf.org; Fri, 30 Apr 2004 16:14:18 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJeNt-00013p-00 for asrg@ietf.org; Fri, 30 Apr 2004 16:13:21 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BJeNb-0000zd-00 for asrg@ietf.org; Fri, 30 Apr 2004 16:13:03 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BJeNb-00070a-00 for asrg@ietf.org; Fri, 30 Apr 2004 16:13:03 -0400 Received: from [68.246.207.24] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BJeNa-0003HP-00 for asrg@ietf.org; Fri, 30 Apr 2004 16:13:03 -0400 Message-ID: <4092B33C.40006@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: ASRG X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: perfora.net abuse@perfora.net auth:7051a7fa85b96745770cd89fa6d27f10 Content-Transfer-Encoding: 7bit Subject: [Asrg] 0. News - Richter sues Spamcop Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 16:12:44 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit FYI: http://www.tomshardware.com/hardnews/20040430_112422.html -- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "Some lies are easier to believe than the truth" (Dune) _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 17:44:51 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06607 for ; Fri, 30 Apr 2004 17:44:51 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfhn-0000TN-01 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:37:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ULbwp0001813 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:37:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfZf-0006Fs-C5 for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 17:29:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05298 for ; Fri, 30 Apr 2004 17:29:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfZd-0004Xv-0l for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:29:33 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfYd-0004PH-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:28:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJfXc-0004Ex-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:27:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfM2-0002Dz-Ou; Fri, 30 Apr 2004 17:15:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJf4u-0004Ii-Be for asrg@optimus.ietf.org; Fri, 30 Apr 2004 16:57:48 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA02497 for ; Fri, 30 Apr 2004 16:57:45 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJf4s-0000Nq-1F for asrg@ietf.org; Fri, 30 Apr 2004 16:57:46 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJf48-0000FJ-00 for asrg@ietf.org; Fri, 30 Apr 2004 16:57:01 -0400 Received: from pcls3.std.com ([192.74.137.143] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BJf3H-00003M-00 for asrg@ietf.org; Fri, 30 Apr 2004 16:56:07 -0400 Received: from world.std.com (metrobb@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3UKu345018848; Fri, 30 Apr 2004 16:56:03 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id QAA24116; Fri, 30 Apr 2004 16:56:03 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16530.48483.56586.781154@world.std.com> To: "Roger B.A. Klorese" Cc: Barry Shein , "Hallam-Baker, Phillip" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) In-Reply-To: <4091DF9D.8030701@queernet.org> References: <16528.11346.656296.255405@world.std.com> <409031A9.2010809@queernet.org> <16528.27844.324796.238684@world.std.com> <409090DF.4010409@queernet.org> <16529.44960.141923.272661@world.std.com> <4091DF9D.8030701@queernet.org> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 16:56:03 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit On April 29, 2004 at 22:09 rogerk@queernet.org (Roger B.A. Klorese) wrote: > Barry Shein wrote: > > > Atomic multi-record updates? How about just a log which is processed > > asynchronously? Why in the world would this have to be kept in perfect > > sync in real-time? > > Because it's the transfer of MONEY, Barry, which requires both exactness > and atomicity. Nonsense, utter nonsense. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 17:58:49 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07220 for ; Fri, 30 Apr 2004 17:58:49 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfrJ-0003EJ-Mx for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:47:53 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ULlnCP012410 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:47:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfn2-00029U-0o for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 17:43:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06372 for ; Fri, 30 Apr 2004 17:43:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfmz-00066C-Gl for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:43:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfm2-0005wg-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:42:23 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJfl3-0005oH-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:41:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfaM-0006QW-MJ; Fri, 30 Apr 2004 17:30:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfT1-0003ii-Ay for asrg@optimus.ietf.org; Fri, 30 Apr 2004 17:22:43 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04670 for ; Fri, 30 Apr 2004 17:22:39 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfSy-0003Zf-W8 for asrg@ietf.org; Fri, 30 Apr 2004 17:22:41 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfRl-0003MB-00 for asrg@ietf.org; Fri, 30 Apr 2004 17:21:26 -0400 Received: from pcls4-e.std.com ([192.74.137.144] helo=TheWorld.com) by ietf-mx with esmtp (Exim 4.12) id 1BJfPW-0002w9-00 for asrg@ietf.org; Fri, 30 Apr 2004 17:19:06 -0400 Received: from world.std.com (bzs@world-e.std.com [69.38.147.5]) by TheWorld.com (8.12.8p1/8.12.8) with ESMTP id i3ULJ61o000509; Fri, 30 Apr 2004 17:19:06 -0400 Received: (from bzs@localhost) by world.std.com (8.9.3/8.9.3) id RAA08127; Fri, 30 Apr 2004 17:19:05 -0400 (EDT) From: Barry Shein MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16530.49865.618364.864525@world.std.com> To: "Tom Thomson" Cc: Subject: RE: [Asrg] My take on e-postage In-Reply-To: References: <16529.47683.314126.859849@world.std.com> X-Mailer: VM 7.07 under Emacs 21.2.2 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 17:19:05 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.4 required=5.0 tests=AWL,FOR_FREE autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Well anyhow the point which you seem to have lost, and which might have some possible relevance to this discussion, is really very simple: Prior to around the Summer of 1989, in The United States of America*, you could not buy a direct conection to the ARPAnet for money, such connections were not for sale to the general public. In order to get a connection, you had to be a qualifying institution which, prior to NSFnet in 1988, meant you had a demonstrable research need for a connection of interest to DARPA, and a sponsor. This mainly meant that you had to have some significant research contract or grant work with DARPA, ONR, or some other research branch of the US military. Occasionally an NSF grant would be declared as qualifying but usually that's because someone felt the tie-in to an approvable agency existed. Even the few non-US sites were justified under this requirement. If you were approved, the funds for hookup (other than whatever bits you needed to plug it into a computer or LAN on your end) were included in the approval. HENCE: You could only (in effect) get a connection to the ARPAnet for FREE (from the point of the recipient, applicant), you couldn't BUY your way in (BBN's CSNET X.25 hookup might be an arguable exception but it's not worth bickering, I think they managed to get maybe 4 customers of which only one, Apple, ever really paid.) OBVIOUSLY it wasn't free for DARPA or whomever was providing the actual funds for the connection but that's not interesting. Then NSFNET started providing hookups to Universities in the US. But you had to be a university. They might pay or not, it's a bit complicated and not worth going into here. The point was that you had to qualify. You couldn't just buy a connection. Which brings us to SPAM. If we don't devise a method to pay your way, such as e-postage, then the other choice is, like the ARPAnet, someone would have to vet whether you get access or not based on some other criteria. Now, granted (ahem) DARPA handled this quite well but then again it was a nearly unknown (to the general public) research network with around 200 member sites at its peak (pre-NSFNET.) The fear is that if you re-create that sort of environment in today's internet, for email, by coming up with some content-sensitive criteria for who can send mail and who can't and under what conditions you'll of necessity have to come up with some sort of vetting process, a bureaucracy, demagogues, who make the decision. Bear that in mind as others make proposals that wave their hands about what is spam and what is not. They are probably running for demagogue (or just lack the foresight to consider this inevitability.) * And I believe this was generally true elsewhere but you won't believe me so what the hell I'll limit my comment to the USA as it's just as valid. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo* _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 18:04:13 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07664 for ; Fri, 30 Apr 2004 18:04:13 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJg3C-0005gj-TV for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:00:06 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UM064B021859 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:00:06 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfwt-00040a-C2 for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 17:53:35 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07043 for ; Fri, 30 Apr 2004 17:53:31 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfwq-00079I-Pt for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:53:32 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfvr-00073J-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:52:31 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJfv6-0006xl-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:51:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfoc-0002dH-5D; Fri, 30 Apr 2004 17:45:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfhB-0008OJ-K0 for asrg@optimus.ietf.org; Fri, 30 Apr 2004 17:37:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05731 for ; Fri, 30 Apr 2004 17:37:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfh9-0005NV-4Y for asrg@ietf.org; Fri, 30 Apr 2004 17:37:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfgE-0005Ch-00 for asrg@ietf.org; Fri, 30 Apr 2004 17:36:23 -0400 Received: from smtp-out6.blueyonder.co.uk ([195.188.213.9]) by ietf-mx with esmtp (Exim 4.12) id 1BJffG-00054h-00 for asrg@ietf.org; Fri, 30 Apr 2004 17:35:22 -0400 Received: from beddo ([82.38.232.81]) by smtp-out6.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.5600); Fri, 30 Apr 2004 22:35:19 +0100 From: cw To: X-Mailer: PocoMail 3.0 (1640) - Licensed Version Message-ID: <2004430223625.542542@beddo> In-Reply-To: <2004430134115.146703@beddo> Subject: Re: [Asrg] Sender Authentication technology lookup Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-OriginalArrivalTime: 30 Apr 2004 21:35:19.0928 (UTC) FILETIME=[0933DF80:01C42EFB] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 22:36:25 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable Apologies for the double post. I assumed the first email wasn't going through as I sent it with the wrong= from address. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 18:22:04 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09505 for ; Fri, 30 Apr 2004 18:22:04 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJgEs-0004XR-0P for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:12:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UMC9iI017438 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:12:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJg9F-0001My-TH for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 18:06:21 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07911 for ; Fri, 30 Apr 2004 18:06:17 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJg9D-0000bC-5c for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:06:19 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJg8F-0000Wf-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:05:20 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJg7Y-0000Sg-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:04:36 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJg45-0006NY-TV; Fri, 30 Apr 2004 18:01:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfvk-0003tb-JL for asrg@optimus.ietf.org; Fri, 30 Apr 2004 17:52:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA07011 for ; Fri, 30 Apr 2004 17:52:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfvh-00072A-Vx for asrg@ietf.org; Fri, 30 Apr 2004 17:52:22 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfur-0006xU-00 for asrg@ietf.org; Fri, 30 Apr 2004 17:51:30 -0400 Received: from mout.perfora.net ([217.160.230.40]) by ietf-mx with esmtp (Exim 4.12) id 1BJfuV-0006sP-00 for asrg@ietf.org; Fri, 30 Apr 2004 17:51:07 -0400 Received: from [217.160.230.52] (helo=smtp.perfora.net) by mout.perfora.net with esmtp (Exim 3.35 #1) id 1BJfuT-0000aI-00; Fri, 30 Apr 2004 17:51:05 -0400 Received: from [68.246.207.24] (helo=solidmatrix.com) by smtp.perfora.net with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1BJfuS-0006zr-00; Fri, 30 Apr 2004 17:51:05 -0400 Message-ID: <4092CA36.9030101@solidmatrix.com> From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en, he, ru MIME-Version: 1.0 To: cw CC: asrg@ietf.org Subject: Re: [Asrg] Sender Authentication Lookup References: <2004430161136.525018@beddo> In-Reply-To: <2004430161136.525018@beddo> X-Enigmail-Version: 0.83.2.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: perfora.net abuse@perfora.net auth:7051a7fa85b96745770cd89fa6d27f10 Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 17:50:46 -0400 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit This was suggested by the SPF folks several times, and I believe that it is their general intent with renaming of SPF to "Sender Policy Framework". You can also take a look at the RESCAP group in the IETF which was active a few years ago, which pursued a similar initiative. However, considering that most of the authentication proposals have moded to MARID WG in the IETF, perhaps you should ask your question there as well. Yakov cw wrote: > In the process of writing a report that I am currently working on, > I'm sure I read somewhere on one of the lists or hundreds of > documents that I have read that someone mentioned a problem with > having all these different proposals. > > The problem is that the recipient has no way of knowing which sender > authentication scheme that the claimed sender supports if any. Would > it be sensible and viable to have a standard put to be 'suggested' in > the most forceful way to the different developers to include some > common lookup functionality. > > ie something along the lines of a single text record in the DNS zone > of the likes of "sender-authentication scheme: X" where X is a > published unique identifier for each technology. > > That would solve recipients having to guess or try all the different > technologies until they get a match. If the record doesn't exist then > the client should assume sender authentication is not supported on > that domain. > > Does that sound sensible? > > Regards, Colin. -- Yakov Shafranovich / asrg shaftek.org SolidMatrix Technologies, Inc. / research solidmatrix.com "And this too shall come to pass" _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 18:24:28 2004 Received: from optimus.ietf.org (iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05650 for ; Fri, 30 Apr 2004 17:36:41 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfYk-0005mW-I4 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:28:38 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3ULScfn022219 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 17:28:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJfOU-00036x-0l for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 17:18:02 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03930 for ; Fri, 30 Apr 2004 17:17:58 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJfOR-0002l5-Or for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:17:59 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJfLh-0002Kn-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:15:10 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJfK1-0001z6-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 17:13:25 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJf48-0004Au-Qy; Fri, 30 Apr 2004 16:57:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJXXA-0001Kb-6h for asrg@optimus.ietf.org; Fri, 30 Apr 2004 08:54:28 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA28366 for ; Fri, 30 Apr 2004 08:54:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJXLA-0007fM-2I for asrg@ietf.org; Fri, 30 Apr 2004 08:42:04 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJXKD-0007UP-00 for asrg@ietf.org; Fri, 30 Apr 2004 08:41:05 -0400 Received: from smtp-out6.blueyonder.co.uk ([195.188.213.9]) by ietf-mx with esmtp (Exim 4.12) id 1BJXJO-0007Kx-00 for asrg@ietf.org; Fri, 30 Apr 2004 08:40:14 -0400 Received: from beddo ([82.38.232.81]) by smtp-out6.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.5600); Fri, 30 Apr 2004 13:40:11 +0100 From: cw To: X-Mailer: PocoMail 3.0 (1640) - Licensed Version Message-ID: <2004430134115.146703@beddo> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-OriginalArrivalTime: 30 Apr 2004 12:40:11.0675 (UTC) FILETIME=[473146B0:01C42EB0] Content-Transfer-Encoding: quoted-printable Subject: [Asrg] Sender Authentication technology lookup Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 13:41:15 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable In the process of writing a report that I am currently working on, I'm sure= I read somewhere on one of the lists or hundreds of documents that I have= read that someone mentioned a problem with having all these different= proposals. The problem is that the recipient has no way of knowing which sender= authentication scheme that the claimed sender supports if any. Would it be= sensible and viable to have a standard put to be 'suggested' in the most= forceful way to the different developers to include some common lookup= functionality. ie something along the lines of a single text record in the DNS zone of the= likes of "sender-authentication scheme: X" where X is a published unique= identifier for each technology. That would solve recipients having to guess or try all the different= technologies until they get a match. If the record doesn't exist then the= client should assume sender authentication is not supported on that= domain. Does that sound sensible? Regards, Colin. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 18:39:47 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10552 for ; Fri, 30 Apr 2004 18:39:47 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJgRS-0001M4-Ln for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:25:10 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UMPAVj005208 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:25:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJgPo-0000vo-Sg for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 18:23:31 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09616 for ; Fri, 30 Apr 2004 18:23:24 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJgPm-0002GG-0h for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:23:26 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJgOz-0002BN-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:22:37 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJgOR-000257-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:22:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJgFh-00050J-Oz; Fri, 30 Apr 2004 18:13:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJg7K-0000a0-RT for asrg@optimus.ietf.org; Fri, 30 Apr 2004 18:04:22 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA07691 for ; Fri, 30 Apr 2004 18:04:18 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJg7H-0000RT-V0 for asrg@ietf.org; Fri, 30 Apr 2004 18:04:20 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJg6N-0000LF-00 for asrg@ietf.org; Fri, 30 Apr 2004 18:03:24 -0400 Received: from mailbox.onlinepolicy.net ([64.62.161.194]) by ietf-mx with esmtp (Exim 4.12) id 1BJg5R-0000AI-00 for asrg@ietf.org; Fri, 30 Apr 2004 18:02:25 -0400 Received: by mailbox.onlinepolicy.net (Postfix, from userid 504) id 5B65A1880E5; Fri, 30 Apr 2004 14:50:39 -0700 (PDT) Received: from [192.168.10.56] (dsl081-190-082.sea1.dsl.speakeasy.net [64.81.190.82]) by mailbox.onlinepolicy.net (Postfix) with ESMTP id 580B81880E2; Fri, 30 Apr 2004 14:50:38 -0700 (PDT) Message-ID: <4092CCD0.5010703@queernet.org> From: "\"Roger B.A. Klorese\" " User-Agent: Mozilla Thunderbird 0.6b (Windows/20040427) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Barry Shein Cc: "Hallam-Baker, Phillip" , John Levine , asrg@ietf.org, richard_willey@symantec.com Subject: Re: [Asrg] (no subject) References: <16528.11346.656296.255405@world.std.com> <409031A9.2010809@queernet.org> <16528.27844.324796.238684@world.std.com> <409090DF.4010409@queernet.org> <16529.44960.141923.272661@world.std.com> <4091DF9D.8030701@queernet.org> <16530.48483.56586.781154@world.std.com> In-Reply-To: <16530.48483.56586.781154@world.std.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 15:01:52 -0700 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit Barry Shein wrote: >Nonsense, utter nonsense. > > Your "utter nonsense" is utter nonsense. Especially since you're dealing with people with whom you DO NOT otherwise have an existing relationship, billing in arrears is impractical and unenforceable. It only makes sense for it to be immediate pay-as-you-go. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 18:58:48 2004 Received: from optimus.ietf.org (www.iesg.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA11625 for ; Fri, 30 Apr 2004 18:58:48 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJgrY-0006g7-Bw for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:52:08 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i3UMq8Kk025665 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 18:52:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJgps-0005wz-UZ for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 18:50:24 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA11108 for ; Fri, 30 Apr 2004 18:50:20 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJgpp-0004wZ-PC for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:50:21 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJgou-0004sR-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:49:25 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJgoP-0004ns-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 18:48:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJghk-0004Hh-V8; Fri, 30 Apr 2004 18:42:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJgYV-0002J4-1x for asrg@optimus.ietf.org; Fri, 30 Apr 2004 18:32:27 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10110 for ; Fri, 30 Apr 2004 18:32:22 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJgYR-00038H-Tc for asrg@ietf.org; Fri, 30 Apr 2004 18:32:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJgXY-00032Y-00 for asrg@ietf.org; Fri, 30 Apr 2004 18:31:28 -0400 Received: from smtp-out6.blueyonder.co.uk ([195.188.213.9]) by ietf-mx with esmtp (Exim 4.12) id 1BJgWh-0002wF-00 for asrg@ietf.org; Fri, 30 Apr 2004 18:30:35 -0400 Received: from beddo ([82.38.232.81]) by smtp-out6.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.5600); Fri, 30 Apr 2004 23:30:31 +0100 From: cw To: X-Mailer: PocoMail 3.0 (1640) - Licensed Version Message-ID: <2004430233137.832111@beddo> In-Reply-To: <4092CA36.9030101@solidmatrix.com> Subject: Re: [Asrg] Sender Authentication Lookup Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-OriginalArrivalTime: 30 Apr 2004 22:30:32.0006 (UTC) FILETIME=[BF5ADE60:01C42F02] Content-Transfer-Encoding: quoted-printable Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Fri, 30 Apr 2004 23:31:37 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60 Content-Transfer-Encoding: quoted-printable Content-Transfer-Encoding: quoted-printable On Fri, 30 Apr 2004 17:50:46 -0400, Yakov Shafranovich wrote: >=A0This was suggested by the SPF folks several times, and I believe >=A0that it is their general intent with renaming of SPF to "Sender >=A0Policy Framework". You can also take a look at the RESCAP group in >=A0the IETF which was active a few years ago, which pursued a similar >=A0initiative. Thanks for the info, as per usual every thing I have thought of along my way= has already been thought of though I'd completely missed that SPF suggested= such and haven't looked at RESCAP. Regards, Colin. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg From exim@www1.ietf.org Fri Apr 30 20:10:16 2004 Received: from optimus.ietf.org (optimus.ietf.org [132.151.1.19]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA14612 for ; Fri, 30 Apr 2004 20:10:15 -0400 (EDT) Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJi11-0004vX-Ij for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 20:05:59 -0400 Received: (from exim@localhost) by www1.ietf.org (8.12.8/8.12.8/Submit) id i4105xm9018939 for asrg-archive@odin.ietf.org; Fri, 30 Apr 2004 20:05:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJhwc-00049d-Ni for asrg-web-archive@optimus.ietf.org; Fri, 30 Apr 2004 20:01:26 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA14205 for ; Fri, 30 Apr 2004 20:01:23 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJhwa-000482-To for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 20:01:24 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJhvc-00041J-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 20:00:24 -0400 Received: from optimus.ietf.org ([132.151.1.19]) by ietf-mx with esmtp (Exim 4.12) id 1BJhvA-0003wK-00 for asrg-web-archive@ietf.org; Fri, 30 Apr 2004 19:59:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=www1.ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJhoV-0002hv-JV; Fri, 30 Apr 2004 19:53:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by optimus.ietf.org with esmtp (Exim 4.20) id 1BJhiC-0001VP-Gp for asrg@optimus.ietf.org; Fri, 30 Apr 2004 19:46:32 -0400 Received: from ietf-mx (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA13681 for ; Fri, 30 Apr 2004 19:46:28 -0400 (EDT) Received: from ietf-mx.ietf.org ([132.151.6.1] helo=ietf-mx) by ietf-mx with esmtp (Exim 4.32) id 1BJhiA-0002mw-Iv for asrg@ietf.org; Fri, 30 Apr 2004 19:46:30 -0400 Received: from exim by ietf-mx with spam-scanned (Exim 4.12) id 1BJhhH-0002hO-00 for asrg@ietf.org; Fri, 30 Apr 2004 19:45:35 -0400 Received: from chromatix.demon.co.uk ([80.177.102.173] helo=lithium.chromatix.org.uk) by ietf-mx with esmtp (Exim 4.12) id 1BJhga-0002bA-00 for asrg@ietf.org; Fri, 30 Apr 2004 19:44:52 -0400 Received: from arowana.chromatix.org.uk ([192.168.239.106]) by lithium.chromatix.org.uk with esmtp (Exim 4.31) id 1BJhga-0002wc-1o for asrg@ietf.org; Sat, 01 May 2004 00:44:52 +0100 Mime-Version: 1.0 (Apple Message framework v613) In-Reply-To: References: <20040429171224.12313.qmail@xuxa.iecc.com> Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <5F00A102-9B00-11D8-AC75-000393863768@chromatix.demon.co.uk> Content-Transfer-Encoding: 7bit From: Jonathan Morton Subject: Re: [Asrg] 3 (Message Verification) - Viability of hashcash-based signatures (was: E-postage from first principles) To: ASRG X-Mailer: Apple Mail (2.613) Content-Transfer-Encoding: 7bit Sender: asrg-admin@ietf.org Errors-To: asrg-admin@ietf.org X-BeenThere: asrg@ietf.org X-Mailman-Version: 2.0.12 Precedence: bulk List-Unsubscribe: , List-Id: Anti-Spam Research Group - IRTF List-Post: List-Help: List-Subscribe: , List-Archive: Date: Sat, 1 May 2004 00:44:50 +0100 X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on ietf-mx.ietf.org X-Spam-Status: No, hits=0.0 required=5.0 tests=AWL autolearn=no version=2.60 Content-Transfer-Encoding: 7bit Content-Transfer-Encoding: 7bit > - The stamp optionally includes a signature to facilitate > whitelisting. This can reduce the hashcash demanded from regular > correspondents to as low as 8 bits, which is computationally > trivial... > > ...If nobody happens to have a Z80 and a compiler to hand, I'll put in > some work and try it for the 6502 instead - I have a handful of old > BBC Micros lying around. To answer my own question, I've worked out that a 6502 can process an SHA-1 block in about 40000 cycles, which compares surprisingly well to the 68030 (and begs an investigation into precisely why the '030 is so inefficient). This is completely untested code - I didn't even type it into the machine, just worked out the timing piecemeal from the assembly manual - but the ballpark figure should be accurate. To put this in perspective, it means that my 1982-vintage BBC Micros (with 2MHz 6502 chips) should be able to mint 8-bit hashcash in about 5 seconds on average, and most other 8-bit accumulator machines (including the Z80 family) should be comparable. This, in turn, means that my whitelist-grade signature scheme should be computationally feasible for pretty much every "computer" capable of running a TCP/IP stack. This encourages me to continue working on a more detailed spec for discussion. Code size may be more of a problem, however, as the 40000-cycle performance assumes a fairly unrolled-loop code configuration, which consumes a significant portion of a 16-bit address space (exact size not calculated, but 4-8KB is possible). It also assumes a fixed area of RAM, including 25 bytes of zero page and 340 bytes elsewhere, is available and hard-coded into the program. For machines with a paged ROM system and a half-decent memory map, this shouldn't be a serious problem, but for some microcontrollers it may require a tradeoff of code size and/or position-independence against performance. In any case, it is certainly no problem for any truly 32-bit machine. -------------------------------------------------------------- from: Jonathan "Chromatix" Morton mail: chromi@chromatix.demon.co.uk website: http://www.chromatix.uklinux.net/ tagline: The key to knowledge is not to rely on people to teach you it. _______________________________________________ Asrg mailing list Asrg@ietf.org https://www1.ietf.org/mailman/listinfo/asrg