Subject: Re: spam

From: "J. Noel Chiappa" <[email-masked]>
Date: Tue, 27 May 2003 20:51:19 -0400

> From: Dean Anderson <[email-masked]>

    > Shannon's theorem still stands.
    > ...
    > In terms of spam, this means that it is impossible to construct a
    > protocol that cannot be abused
    > ...
    > No protocol can ever be constructed that is spam-free.
    > ...
    > All abusers are the customer of some ISP, somewhere. There are no
    > outsiders. The spammers are in fact authorized users of some ISP that
    > are authorized to send email. They remain authorized to send email
    > until they lose service with that ISP.

Which is precisely why I say that the solution to spam is to charge for
email. It avoids the whole question of defining what is and is not spam.

More specifically, change the email protocol so that when email arrives from
an entity which is not on the "email from these entities is free" list, the
email is rejected unless is accompanied by a payment for $X (where X is set
by a knob on the machine).

(And yes, I know there are issues with relays, etc.)

If all spam arrives with a $1 bill, I'd be happy to let spammers send me as
much spam as they want.

	Noel

---

From: Peter Deutsch <[email-masked]>
Date: Tue, 27 May 2003 19:28:52 -0700

g'day,

"J. Noel Chiappa" wrote:
...
> by a knob on the machine).

You probably know this already, but for those who don't, Brad Templeton
proposed this scheme a while ago, based upon am micropayments model and
called it "estamps". See:

    http://www.templetons.com/brad/spam/estamps.html

He's also got a summary page on the topic of spam at:

    http://www.templetons.com/brad/spam/

He's since repudiated the idea, but it's been taken up and worked on in
the context of the hashcash system, which seeks to impose a measureable
computation cost on the sender in lieu of processing a micropayment.

Although Brad himself has repudiated the idea, I believe that the
general approach of automating the accounting and imposition of cost (as
is done in Hashcash) shows some promise, but what I actually think we
need is an automatic way to extend trust and build trust relationships.
Paul Vixie alluded to a "trusted-introducer model similar in concept to
pgp but more market-ready" a couple of postings ago, which I actually
think is the way to go.

So, okay, this discussion needs to move off the ietf general list, but
again I agree with Paul. Where is the direction about where we should be
heading with this?

				- peterd

-- 
---------------------------------------------------------------------
    Peter Deutsch                       [email-masked]
    Gydig Software

                        "Bungle..."
               "That's an 'i', you idiot..."
                  "Oh, right. 'Bingle..."

                            - Red versus Blue...

---------------------------------------------------------------------

---

From: Dean Anderson <[email-masked]>
Date: Tue, 27 May 2003 22:58:07 -0400 (EDT)

You already have that in some ways: Its called a blacklist.

And Type 1 spammers can sue the blacklist for anti-trust violations.

But the other problem is that charging for email (and I take you to mean
charging everyone a some fee, like a nickle for every message, so that
bulk mailers would pay more) would raise issues of gouging and price
fixing and unfair competition, and anti-trust issues.  A large company
can't fix different prices for the same commodity service, to different
customers.

		--Dean

---

From: S Woodside <[email-masked]>
Date: Wed, 28 May 2003 00:36:18 -0400

> by a knob on the machine).

This would be unfortunate for people who do not have a lot of money. 
Even if the payment were miniscule, 0.01$ or whatever, the payment 
system might require a bank account, or a credit card, etc., to 
participate in. That would effectively block out a substantial 
percentage of the earth's population, people who use community centres, 
libraries, schools, etc. for free access or internet cafes for cheap 
occasional access.

simon

--
www.simonwoodside.com -- 99% Devil, 1% Angel

---

From: "Rebecca L. Page" <[email-masked]>
Date: Wed, 28 May 2003 09:15:56 -0400

I really find your solution to be appalling, especially when I look at 
your email address -> Yahoo! -> probably a free account.  I pay a 
premium price for a legitimate set of IPs and a space on a Server.  

The correct solution is to enforce masking techniques so we as users can 
screen our email, much like phone calls via caller ID, which also needs 
 work to prevent making a phone number.  

Charging the user is like the Internet Taxation Issue, it hurts one of 
the only semi viable markets in our deplorable economy.  Making the end 
user have restrictions and costs due to our inability to control  a 
problem internally, shows how quick we as a society are willing to hand 
over our rights to a group, such as Homeland Security of a commercial 
unit, so that we can  brush an issue under the rug!!   A good working 
solution requires understanding the issues,  architectural and 
conceptual design and development resulting from appropriate research, 
alpha/beta implementation, testing and cooperative implementation 
planning, as well as appropriate communication to users and training.

I thought IETF was founded on the idea of working through issues, not on 
being reactionary!

Rebecca L. Page
Teris Consulting Group
Saline, MI
734-944-1177
[email-masked]

S Woodside wrote:

> percentage of the earth's population, people who use community 
> centres, libraries, schools, etc. for free access or internet cafes 
> for cheap occasional access.
>
> simon
>
> --

---

From: David Morris <[email-masked]>
Date: Wed, 28 May 2003 10:42:19 -0700 (PDT)

Simon,

The proposals haven't been to eliminate free email, only to provide an
alternative which folks can require be used to send them email if they
haven't established a free relationship with the sender.

In the USA today, it costs $.37 to send a physical mail. I don't think it
unreasonable for someone sending me mail to pay a similar fee and
conversely for me to pay such a fee for each of my posts to the IETF list,
even though I would expect the list to use a free channel to distribute
the result.

I don't believe there is any right to free mail or email service so I
don't see a reason to be overly concerned that a user of a community
computer can't send free email. In addition to the free email channel
which would have to continue to exist, providers of 'no charge' email
services such as the bottom end Yahoo service could offer some number of
free stamps per month combined with credits I suggested for receiveing
postage paid mail, folks with marginal economic situations should be able
to participate in email.

Dave Morris

On Wed, 28 May 2003, S Woodside wrote:

> _______________________________________________
> This message was passed through [email-masked], which is a sublist of [email-masked]. Not all messages are passed. Decisions on what to pass are made solely by Raffaele D'Albenzio.
>

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 28 May 2003 20:48:35 +0200

David writes:

> In the USA today, it costs $.37 to send a physical
> mail. I don't think it unreasonable for someone
> sending me mail to pay a similar fee ...

You can pay me via PayPal.  Looking at my inbox, you owe me $1.48 already.

> ... conversely for me to pay such a fee for each
> of my posts to the IETF list ...

Who would pay the fee for the sending of each post to each list member?
Shouldn't you be paying for that, too, since it is your post?

Looks like the bill is up to $20,000 or so now.  Will that be cash, card, or
check?

> ... even though I would expect the list to use a
> free channel to distribute the result.

Why?  If you want people to pay you, why shouldn't you pay everyone else?

---

From: Einar Stefferud <[email-masked]>
Date: Wed, 28 May 2003 13:04:51 -0700

Hello Dave Morris ---

It would be helpful if you would explain how this payment system of 
yours might actually work in real life.

Perhaps like TELEX worked before it died, with settlements between 
the first posing ISP to the last receiving ISP, with "settlement" 
payments spread across all ISPs in between.

Of course this leads to bilateral agreements among al the thousands of 
ISPs, and collective agreements among the mass of global ISPs.

Now, consider the cost of such arrangements, to cover the frictional 
costs of just being in business, plus the required profit margins that
accrue to any such massive payment shuffling.

Everyone here advocating payments do not seem to understand the overhead costs of collecting and distributing the money. 

Be careful of what you wish for! -- You just might get it!

Cheers...\Stef

---

From: S Woodside <[email-masked]>
Date: Wed, 28 May 2003 18:34:32 -0400

> even though I would expect the list to use a free channel to distribute

Really? I email with people who would not be able to afford $.37 to 
send me an email. (They live developing nations.)

> computer can't send free email.

But consider that the internet today is based on widely available free 
email. There would be major changes to the whole email dynamic if that 
changed. Besides people who have different economics at work, Another 
that comes to mind is people who use email interfaces to websites, 
maybe because they're firewalled at work, or they can only use a 
store-and-forward system if they on a sufficiently remote / slow link 
(in a very remote area, this could include researchers as well as 
people who simply live in a very rural place).

simon

---

From: David Morris <[email-masked]>
Date: Wed, 28 May 2003 15:47:57 -0700 (PDT)

> yours might actually work in real life.

One model exists in the postal service operated 'by' each country. Stamps
exist, procedures exist for sharing revenue or whatever when, say, a US
Stamp is used to get mail delivered in Germany. Using the new protocols,
my MUA would drop the mail in the local post box ... the SMTPnew server I
use to send mail. That server would need to authenticate me and verify
that I have money or credit available. That server would be resonsible to
a local epostal clearing house for payment and would initiate delivery
transfer of the post paid email. Could be that an electronic stamp token
is included, generated with the servers private PKI key. It is possibly
reasonable in the current network to insist that all mail delivery be
point to point, but if not, intervening MXlike servers just move the
bundle along.  The final destination SMTPnew server verifies that the
proper postage is attached, mostly a PKI decryption exercise. The stamp
tokens are recorded in a database. Periodically, stamps would be
bundled and sent to the epostoffice, perhaps along with cash, to
get the local epostage meter recharged. Depending on the epostal cost
structure, perhaps each received stamp would be worth 1/2 of a to send
stamp. Based on local SMTPnew operator policy, end users might get 1/4 of
a stamp credit for each received email.

> payments spread across all ISPs in between.

As implied above, one or a few organizations per nation would provide
clearing services.

> ISPs, and collective agreements among the mass of global ISPs.

No, only between the ISPs (where ISP means SMTPnew operator) and the
chosen epostal service. And then tiered between epostal services. Millions
of businesses today use postage meters, humble folks just by stamps.

> accrue to any such massive payment shuffling.

Of course, there is a cost. And if you will, friction. A new PKI based
trust system will also have added 'frictional' costs to create and
support. My general approach provides a funding mechanism to pay those
costs on a per use basis.

>
> Everyone here advocating payments do not seem to understand the
> overhead costs of collecting and distributing the money.

I think I understand the costs quite well. One of the protocol design
challenges will to be minimize costs. Probably by appropriate tiering of
responsiblity and granularity of transactions recharging meters.

> Be careful of what you wish for! -- You just might get it!

Hooray!

---

From: David Morris <[email-masked]>
Date: Wed, 28 May 2003 16:05:07 -0700 (PDT)

Simon,

I have repeatedly asserted that the current free SMTP service or
equivalent would be preserved. You could choose with any degree of
filtering you choose to accept postage free mail. You could choose to
only accept free mail or all free mail.

I frankly don't see random free mail as an important part of the internet
dynamic. People who who send email from work for personal perposes are
often violating published AUP, even if it is not enforced. They are often
using work time to do personal work. One of the 'hidden' costs of the
internet revolution which is likely to receive more focus over time. I
don't see any reason why protocol design should accomadate theft or
other violations of employer policies.

> changed. Besides people who have different economics at work, Another

You mean, no more spam? You mean the employers will have a better return
on their investment in payroll? You mean more thought before sticking ones
foot in the electronic mouth?

The point of this proposal is to change the dynamic of email by
associating a small but significant cost with sending mail to folks with
whom one has no established relationship.

> people who simply live in a very rural place).

They have bigger problems than a charge for email, but if the web site
email server chooses, it can accept free email ... qed ... no problem.

Dave Morris

---

From: John C Klensin <[email-masked]>
Date: Wed, 28 May 2003 22:06:26 -0400

Since Stef has chimed in here, let me point out one other aspect 
of payment systems, one that is more or less the corollary to 
his observation about bilateral agreements.  It is an 
interesting and useful property of the Internet email 
environment that we have SMTP servers all over the place, some 
of them operated at rather large scale and others operated at 
fairly small scale.   In general, anyone can send mail to anyone 
else.

But, as soon as one institutes either charging schemes or 
collections of bilateral agreements, there are huge incentives 
to created "hub systems" or "carriers" -- entities whose 
business it is to make agreements with lots of local 
providers/servers (whom they will come to call "customers") and 
bilateral agreements with each other.  Without that, everyone 
who wants to run a mail server has to either establish bilateral 
agreements with everyone else, or a regulatory regime becomes 
necessary to make the sequential settlement arrangements work. 
Economies of scale, if only in agreement-making, imply few 
enough, and large enough, carriers for governments to start 
taking interest on a "competition" or "anti-trust" or "consumer 
protection" basis.   Sorry to be pessimistic about this, but I 
think it quickly takes us where we don't want to go.

Quoting Stef, "be careful what you wish for..."

      john

--On Wednesday, 28 May, 2003 13:04 -0700 Einar Stefferud 
<[email-masked]> wrote:

> Hello Dave Morris ---
>
> It would be helpful if you would explain how this payment
> system of  yours might actually work in real life.
>
> Perhaps like TELEX worked before it died, with settlements
> between  the first posing ISP to the last receiving ISP, with
> "settlement"  payments spread across all ISPs in between.
>
> Of course this leads to bilateral agreements among al the
> thousands of  ISPs, and collective agreements among the mass
> of global ISPs.
>
> Now, consider the cost of such arrangements, to cover the
> frictional  costs of just being in business, plus the required
> profit margins that accrue to any such massive payment
> shuffling.
>
> Everyone here advocating payments do not seem to understand
> the overhead costs of collecting and distributing the money.
>

---

From: Einar Stefferud <[email-masked]>
Date: Wed, 28 May 2003 19:29:21 -0700

Thanks John for your support!

I think we should all be careful not to return to the good old days of Telex
bilateral agreements!

Cheers...\Stef

At 22:06 -0400 5/28/03, John C Klensin wrote:
>Since Stef has chimed in here, let me point out one other aspect of payment systems, one that is more or less the corollary to his observation about bilateral agreements.  It is an interesting and useful property of the Internet email environment that we have SMTP servers all over the place, some of them operated at rather large scale and others operated at fairly small scale.   In general, anyone can send mail to anyone else.
>
>But, as soon as one institutes either charging schemes or collections of bilateral agreements, there are huge incentives to created "hub systems" or "carriers" -- entities whose business it is to make agreements with lots of local providers/servers (whom they will come to call "customers") and bilateral agreements with each other.  Without that, everyone who wants to run a mail server has to either establish bilateral agreements with everyone else, or a regulatory regime becomes necessary to make the sequential settlement arrangements work. Economies of scale, if only in agreement-making, imply few enough, and large enough, carriers for governments to start taking interest on a "competition" or "anti-trust" or "consumer protection" basis.   Sorry to be pessimistic about this, but I think it quickly takes us where we don't want to go.
>
>--On Wednesday, 28 May, 2003 13:04 -0700 Einar Stefferud <[email-masked]> wrote:
>
>>Hello Dave Morris ---
>>

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 29 May 2003 06:36:42 +0200

David writes:

> One model exists in the postal service operated
> 'by' each country.

Have you really thought through how much this would cost in the Internet
world?  It would be a staggering burden, just as it already is for postal
mail.

A large part of what you pay in postage for a letter simply covers the cost
of collecting and verifying the postage for a letter.  And a large part of
the delay in getting the letter to its destination comes from the need to
collect and verify postage.

> As implied above, one or a few organizations
> per nation would provide clearing services.

Monopolies, you mean?  I can imagine the effect on prices.  Then again, I
don't have to imagine, since it has already been done in other domains.
That's another reason why sending a letter costs 37 cents--and that's a
price-controlled monopoly.

> Of course, there is a cost.

The cost is far beyond what you appear to be imagining.

> I think I understand the costs quite well.

I think not.  I hope your ideas are not too widespread.

> Probably by appropriate tiering of responsiblity
> and granularity of transactions recharging meters.

Transactions recharging meters.  With a billion computers talking to a
billion other computers a trillion times a day?

What you are suggesting is a bit like billing for telephone service based on
the content of a conversation, or billing for cable TV based on the stars in
the cast of the show you are watching.

---

From: Paul Vixie <[email-masked]>
Date: 29 May 2003 06:24:36 +0000

[email-masked] (John C Klensin) writes:

> ..., as soon as one institutes either charging schemes or collections of
> bilateral agreements, there are huge incentives to created "hub systems"
> or "carriers" -- entities whose business it is to make agreements with
> lots of local providers/servers (whom they will come to call "customers")
> and bilateral agreements with each other.  Without that, everyone who
> wants to run a mail server has to either establish bilateral agreements
> with everyone else, or a regulatory regime becomes necessary to make the
> sequential settlement arrangements work.  Economies of scale, if only in
> agreement-making, imply few enough, and large enough, carriers for
> governments to start taking interest on a "competition" or "anti-trust"
> or "consumer protection" basis.  Sorry to be pessimistic about this, but
> I think it quickly takes us where we don't want to go.
> 

i'm not worried about this.  in fact, i'm *counting* on the existence of a
new class of businesses which i call "trust providers" or "trust brokers"
whose only claim to revenue is when they act as a trusted trust aggregator
so that i don't have to attend key signing parties in order to be able to
confidently accept mail based on reasonable certainty of the relay's intent,
the identity of the sender, and the value (to the sender) of the receipt.

will it be abused?  you betcha.  two ways off the top of my head.  first,
as jck says above, there's a lot of antitrust concern if for example verisign
decided to "trust-peer" with yahoo and noone else, and yahoo did likewise,
in hopes that the two of them could "pull a uunet" in terms of making everyone
else in the world their customer before a more diverse market can become
established.  fortunately we have the sherman act in the usa and similar
things elsewhere, so, unless microsoft itself decided to play, we're safe.

second, will be a class of trustbrokers who will try very hard to blur the
distinctions as to exactly what they are "promising about", so as to feed
you "gray spam" and reap both the transactional rewards associated with the
work AND kickbacks and bribes from the senders of the gray spam.  these folks
will have to be put out of business the old fashioned way, by poison reverse.
that is, a large number of consumers and other trustbrokers will have to
declare "gray promises" to have negative value, thus rendering them worthless.

all this goes to show is that there is no silver bullet, no one size fits all,
no magic pill or potion.  as long as we fit breitbart's "can be reached by
an ip packet from" notation, then we'll have the lower end of the humanity
scale nibbling at our resources, trying to take something and give nothing,
and so on.  however, even though unsolicited fax is dead, consider the
telemarketing field.  when my phone rings, there's a better than even chance
that it isn't a telemarketer.  it's not 100% but it's better than even.  if
we could get that for an ibcs that replaced smtp, i'd be singing in the aisles.

by the way mr. deutsch, there is no reference work available.  i've waved my
arms about this stuff and described it to no less than 1.5 dozen people in
the last six years, at varying levels of bakedness, but i don't want to have
to do the work myself and i met have no success in getting anybody else to
take it on.  therefore there's no formal design, not even a list of criteria,
and nothing's been wrote up, and there's no wheel for you to duplicate, so you
have a clear field and i encourage you to take advantage of the fact that the
rest of the world thinks this is just crackpot stupidity on the march.  please
put me on your friends and family list if you squeeze an IPO out of it, though.
-- 
Paul Vixie

---

From: Einar Stefferud <[email-masked]>
Date: Thu, 29 May 2003 01:36:36 -0700

I suggest that those who wish to more fully understand all this trust stuff might find it useful to look at http://mcg.org.br/.

Cheers...\Stef

---

From: Stephen Kent <[email-masked]>
Date: Fri, 30 May 2003 12:52:01 -0400

At 1:36 AM -0700 5/29/03, Einar Stefferud wrote:
>I suggest that those who wish to more fully understand all this 
>trust stuff might find it useful to look at http://mcg.org.br/.
>
>Cheers...\Stef
>
>

I would recommend this web site only to folks who want to see a very 
narrow view of what trust and certification are about, a view not 
consistent with most standards in the PKI arena, and one not shared 
by most legal experts, ...

Steve

---

From: Einar Stefferud <[email-masked]>
Date: Fri, 30 May 2003 15:10:42 -0700

Pity the poor Zealot; who, when he loses sight of his objective,
simply redoubles his efforts.

For sure, do not let any new ideas leak into the IETF!

Cheers...\Stef

At 12:52 -0400 5/30/03, Stephen Kent wrote:
>I would recommend this web site only to folks who want to see a very narrow view of what trust and certification are about, a view not consistent with most standards in the PKI arena, and one not shared by most legal experts, ...
>
>Steve