Subject: RE: spam

From: "Michel Py" <[email-masked]>
Date: Tue, 27 May 2003 07:59:15 -0700

> i'm wasting my time because i want this problem looked
> at more broadly.

Are you in agreement with what Noel wrote earlier WRT involving some
money in sending email is the only deterrent that spammers that pollute
our inbox and now our mailing list would understand?

Michel.

---

From: Paul Vixie <[email-masked]>
Date: 27 May 2003 18:56:45 +0000

[email-masked] ("Michel Py") writes:

> > i'm wasting my time because i want this problem looked at more broadly.
> 

no.  that's one possible avenue but i reject the word "only".  to put it
another way, the problem isn't deterring spammers or even preventing abuse,
but rather designing a new interpersonal batch communications system (ibcs?)
which allows a receiving party to accept or reject inbound traffic with some
kind of confidence in the identity of the sender, the intent of the relay or
proxy, and the value (to the sender) of the reception.

i've heard several calls to move this discussion elsewhere.  since my goal
is to get ietf to take this seriously (and if you think the asrg is serious
then you are not paying attention or you don't understand the issues) and do
another turn of the same crank that produced mime and esmtp.  the industry
has the talent, especially companies like sendmail and projects like postfix,
to design an "ibcs" that's suitable for today's diverse internet population.

to give y'all an idea of what's technically and philosophically unworkable
about the smtp model, look at the isoid "mua/mta" split and note that the
idea of an mta working on an mua's behalf but operating asynchronously (and
therefore accepting and locally queuing inbound or outbound traffic without
reference to the mua policy of the sender and especially the recipient) is
just flat out unworkable, no matter how it might've looked on a whiteboard.

my own ideas have to do with trustbrokers, certificates for both mailboxes
and transfer/relay agents, and provable confidence in subjective values.
but maybe all that's just crap, and what's actually necessary and
sufficient would have a completely different look/feel to it than anything
i've yet considered.

we (the e-mail producing/consuming community) have the technology, we have
the collective wit and wisdom, we have the proven commercial value of the
service.  what we lack, dear ietf, is simply: leadership.
-- 
Paul Vixie

---

From: "Anthony Atkielski" <[email-masked]>
Date: Tue, 27 May 2003 22:22:56 +0200

Paul writes:

> ... the problem isn't deterring spammers or even
> preventing abuse, but rather designing a new
> interpersonal batch communications system (ibcs?)
> which allows a receiving party to accept or reject
> inbound traffic with some kind of confidence in
> the identity of the sender, the intent of the relay or

Designing one is easy.  Getting a billion people around the world to all
implement the system, once designed, is very, very hard.

Additionally, nobody would be willing to accept a single design.  Someone
would claim patent infringement.  Different companies would want to turn it
into a money-making adventure, which would instantly make it unworkable for
most of the world.  Other companies would change the design slightly and
then try to force their own versions as the "true" standard, in order to
make commercial profits.  It would take forever to do.

Whatever the technical solution might be, I think it would have to be
something that requires only action at the receiving end, not the sending
end.  If you require action at both ends, you lock out 95% of the world's
Internet users at the push of a button.  It's like coming up with a solution
that requires everyone to upgrade to a new version of Windows with a certain
service pack.  It's not going to happen.

As always, be conservative in what you expect, and liberal in what you
accept.

> my own ideas have to do with trustbrokers ...

Trusted third parties are tempting, but that notion opens a tremendous can
of worms.  Personally, there isn't anyone I'd trust as a certification
authority even for strangers.  A PGP model is more tempting, but it would
require more sophistication on the part of users than can reasonably be
expected for 99% of the world's Internet citizens.  Indeed, any trustbroker
plan has this same problem.

Even if the certification is limited to mailers, you still have the above
problem, only with slightly reduced magnitude.

> we (the e-mail producing/consuming community) have
> the technology ...

We can rebuild it.  We can make it better.

Nah.  The Internet acquires more inertia with each passing day.  And the
more inertia it develops, the harder it is to implement any active technical
change (i.e., any change that requires actual modification of multiple
systems around the world).  Kind of like moving everyone to IPv6.

> what we lack, dear ietf, is simply: leadership.

No, we lack a genius who can come up with something that will work without
requiring a change on one billion computers around the world.  Preferably a
genius who won't file a patent on it, too.