Subject: [Asrg] Usefulness of wholesale blocking of attachments for SMTP?

From: Jim Witte <[email-masked]>
Date: Mon, 12 Apr 2004 19:46:59 -0500

I mail-server I use regularly (Indiana University) has taken, in 
response to worms and other malware useing .pif. zip, exe, etc 
attachments to spread their damage, has taken the (IMO) rather drastic 
step of blocking almost *all* attachments (except for pdf, doc, and a 
few others), including MacOSX extensions (pbproj and saver) even though 
there are no viruses currently which try to use OSX extensions (and 
they wouldn't work either, as Windows would not try to run a xx.saver 
file as an executable).

   I would argue that if one wants to block EXE files - fine - but block 
them by looking for the base-64 encoded 'TVq' signature of EXE files 
(the 'MZ' signature when encoded).  The current policy of blocking a 
great many different attachments, not only makes it more difficult for 
people who do want to send legitimate attachments (but not too much - I 
just remove the extension), if adopted on a large-scale (which I doubt 
it will be), such a "draconian" policy will push mal-ware-writers to 
move to other ways of sending their worms - Word macro viruses, Excel 
macro viruses, HTML with mal-ware JS and Java code, or whatever 
(there's almost always another hole to exploit).

   This same mail-server is going to shortly be implementing a 
system-wide spam filtering solution (probably based on SpamAssasin), 
which will as a matter of course be scanning all data coming through 
the relay.  Since all data will be scanned already, scanning for EXE 
files or other known signatures of malware should not be terribly more 
computationally intensive.

   The solution proposed by 'gep2' would seem to address this, but it 
seems to me that it would have an incredible computation scaling 
problem (if filtering on a per-user basis is done on the receiving 
end), and/or require a global change to the email system (if a sending 
server would query a receiving server for every email).

Jim

> From: [email-masked]
> Date: Tue, 06 Apr 2004 21:47:13 -0500
> If we're ever going to REALLY get a handle on this problem, I still 
> believe that
> what matters more is:
>
> 1)  putting the quash on unexpected attachments (especially if they are
> executables);  [..]
> 2)  likewise, making support for HTML-burdened E-mail (which can 
> contain all [..]
> I believe that the most significant way to hugely improve both of these
> situations is the ability of the recipient to whitelist individual 
> specific
> senders with SPECIFIC rights to:
>   a)  send them attachments (and subapprove based on the class of the
> attachments)
>   b)  send them HTML (and POSSIBLY subapprove based on categories of 
> HTML tags
> allowed).

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 13 Apr 2004 01:45:47 -0400

Jim Witte wrote:

> it will be),

It's already implemented in a very large scale.  .scr, .pif, etc.  Many 
of those have no business in email anyway.

Note also that while the TVq et.al. signatures are _very_ useful, they 
don't do the whole job.  Ie: zip'd .exe.  TVq (and the two other 
rotations of Base64'd "MZ") helps, but (a) you have to make the 
signature a lot longer than "TVq", and (b) zip file name lengths can 
push the (longer) signature over a Base64 line boundary, and filtering 
abruptly becomes a lot harder.

Once you've decided to nuke .exes in all forms, about the only 
problematic attachment type that most people would be blocking would be 
wav files (because of Klez).  It's the only attachment type we get FPs 
on. I should research whether the magic string check is sufficient.

> such a "draconian" policy will push mal-ware-writers to 
> macro viruses, HTML with mal-ware JS and Java code, or whatever (there's 
> almost always another hole to exploit).

That's a little like telling everyone to take off their bullet-proof 
vests because it'll just encourage poison gas.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris" <[email-masked]>
Date: Tue, 13 Apr 2004 16:05:54 +0930

> > almost always another hole to exploit).

thats why most viruses come zipped these days. and I am getting more than
ever

> vests because it'll just encourage poison gas.

wholesale blocking of attachments is a nuisance I often send things via
email. for very legitimate reasons

The problem could/should be solved by using a sandbox arrangement

anything to do with the internet should be run in a sandbox so it cannot
alter any part of the users computer.

that is to say not only email but any other software that has the potential
to run downloaded apps or scripts

e.g. IM's P2P Browsers etc.

I have often wondered how hard it would be to make a sandbox.

does anyone know of any open source sandboxes?

Regards
Chris

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Chris
> Lewis
> Sent: Tuesday, 13 April 2004 3:16 PM
> Cc: [email-masked]
> Subject: Re: [Asrg] Usefulness of wholesale blocking of attachments for
> SMTP?
>
>
> Jim Witte wrote:
>

---

From: Philip Miller <[email-masked]>
Date: Tue, 13 Apr 2004 07:49:57 -0400

Chris wrote:
>[snip prior message]

User Mode Linux is about as strong as you'll get. The BSD's jail system, a 
more advanced chroot, is also very good.

Philip Miller

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 13 Apr 2004 10:23:58 -0400

Jim Witte <[email-masked]> wrote:
> step of blocking almost *all* attachments ...

  Coincidentally, another list I'm on had a post from the admin of a
local university, talking about spam.  Here's what he said.

(quote)
   I don't support any Windows systems, yet I seem to spend a huge amount
of time dealing with problems relating to Windows non-security.  During the
fall/winter term we had to deal with

   1) When students returned to Residence in September, at least half of
      their machines were infected.
   2) Anemic Internet connectivity because our commercial traffic shaper
      would go bonkers trying to maintain state on connections initiated by
      network virus infected machines.
   3) Overloaded Internet pipe due to coordinated DOS attack from trojan
      infected machines.  It's amazing how much traffic an infected, recent
      model Intel machine with a switched 100Mbps connection can generate!
   4) Infected Windows machines are now a major source of spam.  After
      doubling the performance of our mail server in August we were
      astonished to find only a few months later that it was being pounded
      into the ground by the growing stream of spam related mail.
   5) Spammers frequently use bogus @UNIVERSITY addresses on their mail
      and so all undeliverable messages are bounced to us.  We are typically
      receiving over 1 million such bounce messages every day!  Since the
      spam mail that is the source of this problem originates from thousands
      of infected machines there is no solution other than to throw more
      hardware at it.
   6) When my desktop Windows machine at work was upgraded to Windows XP
      the machine was infected before the installation was finished.  It
      took four full virus scans and three reboots before it was clean.
(end quote)

  See #5.  The deployment of RMX/SPF would make a huge difference to
this site.  The bounce messages from forged spam could be
automatically scanned and discarded.

  This situation is not unique.  Spam (and insecure Windows machines)
constitute a clear and present danger to the net.  I'm saddened to see
my prediction of 3 years ago fulfilled: Everyone else's email systems
will end up looking like mine; overloaded and useless due to the
overwhelming flood of spam.

  Alan Dekok.

---

From: "Chris" <[email-masked]>
Date: Wed, 14 Apr 2004 09:38:15 +0930

Sorry I should have been more specific

> more advanced chroot, is also very good.

I should have said... does anyone know of any open source sandboxes for
windows?

Windows being the major source of infections cause by a total lack of
"useable" security.

What security there is available being in effect rendered useless by its
difficulty to implement. thus putting itself far beyond the average user.

a good program that leads a user through the steps required might be
helpful. but windows 98 etc are without any form of security and a sandbox
is the better choice.

The ones you mentioned above are probably good case studies to see what is
needed in such a system.

Regards
Chris

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Philip Miller
> Sent: Tuesday, 13 April 2004 9:20 PM
> To: Chris
> Cc: [email-masked]
> Subject: [Asrg] Re: Usefulness of wholesale blocking of attachments for
> SMTP?
>
>
> Chris wrote:
> >[snip prior message]

---

From: mathew <[email-masked]>
Date: Thu, 15 Apr 2004 09:43:31 -0500

On Apr 13, 2004, at 00:45, Chris Lewis wrote:
> It's already implemented in a very large scale.  .scr, .pif, etc.  
> Many of those have no business in email anyway.

Indeed. As someone who has no Windows systems at all, at home or at 
work, I automatically bounce anything from the Internet that has any 
kind of Windows or Microsoft file attachment--including .exe, .pif, 
.scr, .doc, .xls, and anything that has a character set of 
"WINDOWS-1252". I also bounce anything claiming to be from MSDN, 
Microsoft or MSN, because nobody I know uses addresses there.

I think ultimately Microsoft's failure to deal with their systems' 
insecurity might start having a negative effect on their business as 
Windows systems are locked out of more and more areas of the net.

I'm quite prepared to bounce .zip files too, though at the moment my 
mail host's virus checker is successfully stripping all those.

Nevertheless, bounces caused by Windows viruses are the #1 problem in 
my inbox now. The commercial spam thing is largely under control; it's 
the millions of bounces from viruses joe-jobbing me that are hard to 
deal with.

Is there an active proposal to require that bounce messages include a 
standard header with the message-ID of the message being bounced?

mathew

---

From: Lane Sharman <[email-masked]>
Date: Fri, 16 Apr 2004 15:03:59 -0700

Hi Alan:

A couple of years ago, the writing was on the wall about the writing on 
the net was clear.

Currently, I offer a POP and SMTP solution. The latter is a good 
heat-shield for an SMTP server. Basically, the smtp server instead of a 
port firewall value of 25/* is now 25/{single class c}. The problem has 
become so large that we have to maintain approximately 1000 servers to 
protect our clients.

What interests me is point of origin detection, identification and 
blocking. In other words, what addition to the SMTP protocol would make 
it possible to identify, for example, "unstamped email being sent out in 
bulk mode". Statistically, isn't it possible to identify an instance of 
a bulk email event on the net?

Anyway, I am doing my share to block spam as close to the point of 
origin as possible but I am still not happy. Just today, I was at a 
friends office and my outgoing email was blocked because 
cliff.concentric.net is now on a spam list.

Lane Sharman

-- 
Lane Sharman
Providing Private and SPAM-Free Email
http://www.opendoors.com
858-755-2868

---

From: Lane Sharman <[email-masked]>
Date: Fri, 16 Apr 2004 22:12:57 -0700

Hi Yakov,

It seems to me that there would be some of the following in a bulk email 
solution. Because, for sure, there are a lot of legit bulk emailers.

a) an accreditation process which would include certification of a legit 
sender. The sender has to present himself/herself before a physical post 
office for example.
b) a bulk stamp purchase agreement is executed and paid for by the 
originator.
c) a set of designated relay servers would be designated to "affix the 
stamp" on behalf of the originator, the bulk sender.
d) any relay could verify that a stamp instance as valid with a remote 
lookup; forgeries would be thwarted because the stamp expires and other 
characteristics.

-Lane

Yakov Shafranovich wrote:

> Lane Sharman wrote:
>> blocking. In other words, what addition to the SMTP protocol would 
>> make it possible to identify, for example, "unstamped email being 
>> sent out in bulk mode". Statistically, isn't it possible to identify 
>> an instance of a bulk email event on the net?
>
>
> DCC (http://www.rhyolite.com/anti-spam/dcc/) tries to detect bulk 
> emails as do some other projects. This is not something that requires 
> addition to SMTP and is an separate protocol.
>
> Of course we must remember that bulk email is not necessarily bad. 
> There are many instances of legit bulk email (e.g. acceptance letters 
> from a college, bank statement notifications, etc.). So knowing that a 
> specific email is bulk is only half the problem, once you know it is 
> bulk there needs to be a determination as to whether it is legit or not.
>
> This is what Project Lumus, TEOS and some other mechanisms try to do - 
> whitelist or accredit legit bulk emailers. Of course, a single unified 
> framework of standard for the entire Internet on exchanging 
> accreditation and reputation data is something that might solve this 
> as well, so far there hasn't been sufficient interest in that area 
> (the SMTP-VERIFY subgroup was looking into it as some point).
>
> Yakov
>

---

From: John Levine <[email-masked]>
Date: 17 Apr 2004 05:55:11 -0000

>sender. The sender has to present himself/herself before a physical post 

Right.  There's a bunch of possibile reputation systems here, from
ISIPP's IADB o the proposed .mail domain

>lookup; forgeries would be thwarted because the stamp expires and other 

You're conflating two unrelated things here.  Authenticating senders is
a fine idea.  That's what proposals such as SPF and Domain Keys do, with
no stamps needed.

E-postage is a horrible idea because it introduces more problems than
it is supposed to solve.  See my white paper at http://www.taugh.com
for a longer discussion of the insoluble problems with e-postage.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Lane Sharman <[email-masked]>
Date: Sat, 17 Apr 2004 08:34:45 -0700

>for a longer discussion of the insoluble problems with e-postage.
Thanks for the link. I will digest this over the next few days and 
possibly reply offline.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 16 Apr 2004 18:32:05 -0400

> a bulk email event on the net?

DCC (http://www.rhyolite.com/anti-spam/dcc/) tries to detect bulk emails 
as do some other projects. This is not something that requires addition 
to SMTP and is an separate protocol.

Of course we must remember that bulk email is not necessarily bad. There 
are many instances of legit bulk email (e.g. acceptance letters from a 
college, bank statement notifications, etc.). So knowing that a specific 
email is bulk is only half the problem, once you know it is bulk there 
needs to be a determination as to whether it is legit or not.

This is what Project Lumus, TEOS and some other mechanisms try to do - 
whitelist or accredit legit bulk emailers. Of course, a single unified 
framework of standard for the entire Internet on exchanging 
accreditation and reputation data is something that might solve this as 
well, so far there hasn't been sufficient interest in that area (the 
SMTP-VERIFY subgroup was looking into it as some point).

Yakov

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 19 Apr 2004 16:24:24 -0400

> to SMTP and is an separate protocol.

  Let's be aware, though, that many content filtering schemes and
black-lists have been caught adding entries to the list which do NOT
meet the publicly stated criteria.

  To put it another way, if you don't know what the criteria are, the
system is oben to abuse by insiders.

  Alan Dekok.

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 19 Apr 2004 16:50:48 -0400

> meet the publicly stated criteria.

That's a bit of a non-sequitor.  DCC and it's detection system is 100% 
automated.  It doesn't work by "adding entries" to a list.  Or, at 
least, you can't subvert it by "adding entries", because you'd have to 
predict in advance what the hash signature was.

> system is oben to abuse by insiders.

DCC source is freely available, so the algorithms and procedures are 
well known (to those who bother to look).

Doesn't stop the DCC owner from fudging the query system, but that's 
possible with _any_ anti-spam solution that relies on anyone else for 
decisions.  Subversion is a risk with _all_ anti-spam solutions except 
those you write yourself.  And perhaps not even those ;-)

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 19 Apr 2004 17:49:13 -0400

"Chris Lewis" <[email-masked]> wrote:
> automated.  It doesn't work by "adding entries" to a list. 

  At one point last year, Hadmut tried emailing Vernon off-list to
continue an on-list conversation.  The message was rejected, and
appeared to have been submitted to the DCC.  Vernon then admitted on
this list that he was blocking Hadmut's off-list messages, and
submitting that information to the DCC.

  That's censorship, not anti-spam filtering.

  On the subject of blacklists, I don't think I have to re-iterate the
political wars between blacklist maintainers, who cross-list each
other.

> well known (to those who bother to look).

  Yes, but only the checksums are distributed, not the reasons why a
message resulted in a checksum being distributed.  It's run on trust:
You have to trust that other members of the system don't abuse it.
This trust problem is the same for any distributed system.

> those you write yourself.  And perhaps not even those ;-)

  I agree.  Systems like spamassassin are slightly better from the
trust perspective. but may catch less spam than the DCC.  Spamassassin
distributes the rules to each user, who then can configure it to tell
him which rules were matched.

  Alan DeKok.

---

From: Barry Shein <[email-masked]>
Date: Mon, 19 Apr 2004 16:06:35 -0400

My opinion:

This sort of summary (repeated below) lays out very well how much
we're heading straight towards a sort of regulatory heat death.

Who is going to "certify"? On what grounds? How corruptible are they
going to be? Who gets to clarify and modify standards.

The point is that I'm not usually one of these free-market nuts, but
in this case I think anything but assessing some sort of charge is
total madness and doomed to failure. Ten years of going round and
round trying to come up with some way to beat what appears to nearly
be a law of physics has convinced me of that. That is, it's almost as
if we're talking about how inconvenient gravity is, crashes planes,
makes things heavy increasing energy consumption etc, so we should
form an IRTG group and vote for better regulation of gravity.

You'd just be creating a target of opportunity for the highest bidder,
basically, some sort of corruptible, content-oriented regulatory
bureaucracy which has to operate in an international arena.

Personally I think this group would probably have done their job if
they could unanimously or near-unanimously or at least with some
amount of force of conviction just tell the public we've studied the
matter and basically we're trying to do the impossible which is
regulate a free, valuable resource by some unworkable set of rules
either implemented via software or some unnamed vehicle of human fiat
(i.e., regulation, legislation, big men with sticks...)

As such, the only chance of beginning to tackle the spam problem
requires some sort of postage, simple charging, to simply make
resource usage reflect costs. For everyone. Analogous to paper postal
systems with, perhaps, some creative twists to reflect the low cost of
common usage, preferably thrown back to the ISPs et al.

Any other approach, upon some examination, seems to be an exercise in
trying to re-create, this time successfully, what 75 years of the
Soviet Union and other Marxist countries failed to accomplish (I
really don't mean to come off like some kind of right-wing ranter but
for the purpose of discussion and short-hand symbols the metaphor
seemed apt but I wouldn't suggest repeating it in a press release!)

	-b

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Barry Shein <[email-masked]>
Date: Mon, 19 Apr 2004 16:54:32 -0400

My reactions to e-postage paper:

      http://www.taugh.com

1. Citing the failure in the 1980s of MCIMail et al is a strawman.

That was a very different time and their charges were outrageous and
presumed they had a certain type of monopoly that their customers
would have to pay to use. That is, e-mail was rare at the time outside
of the research/acadmic world, so MCIMail reflected the pricing of a
special purpose business service not a universal model.

This would be like studying car phone services prior to 1980 (I
believe the first car phones were introduced in the 1930's) to draw
conclusions about current-day mobile phone service. It was all just
too exotic and rare at the time to draw any meaningful conclusions vis
a vis the relative ubiquity and technology advancements of today.

2. Hashcash is just psychotic for so many reasons let's drop that one
   right here and never mention it again. We should call it the
   sphinxification of e-mail (but first, answer me a riddle...) Better
   left in ancient mythologies than built into modern e-mail systems.

3. The whole micropayments issue is a straw man.

Other systems can be described which don't require "micropayments".

The problem is you're way too hung up on spam from the point of view
the end-users, which, as dramatic and annoying as it is, is of course
the least economically portentous way to look at all this just due to
the sheer numbers and nano-value of individual transactions, hence the
straw man

The solution to a problem where some sort of micropayment system seems
inappropriate is to aggregate the problem, not declare it intractable!

You settle at the ISP level who in turn can do whatever they want with
that cost factor: Pass it on to customers directly by adding $.27 for
203 msgs this month (whatever) to their bill, not a big deal really,
or add $1 to the base cost and consider it a cost of doing business
(perhaps up to some limit if they're wise.)

Why don't we just argue, e.g., about whether the IETF should bless
unlimited versus pay per minute versus some service included then pay
for overage internet dial-up services?

Howsabout the whole damned phone system? Isn't that essentially a
"micropayments" system in many aspects?

Don't people feel a little silly arguing that the entire phone system
as currently constituted among several billion people world-wide
represents a charging/payment model which is easily (in a few pages of
this paper, apparently) ``proven'' to be completely untenable because
someone, somewhere might defraud it etc?

Now perhaps you're going to drop back to things you dislike about,
e.g., long-distance phone charges or how there have been trends
towards flat-rate systems etc.

SPARE US!

The claim was that charging per phone call, metaphorically, or per
e-mail, literally, was on the surface impossible and unworkable
etc. yet for the past, I dunno, 75 years, such a system has been in
place and in use by the majority of the world's population and remains
one of the most viable industries on the planet.

But this paper seeks to disprove that the bumblebee cannot possibly
fly!?

How much more arrogant can one get? To completely ignore the entire
world-wide phone system because it's inconvenient to the point being
professed?

This is intellectual slovenliness akin to the Augean Stables!

HOWEVER, this group shouldn't care about any such exact details or
whether they reflect on some sort of universally accepted indisputable
moral goodness right down to possible paper cuts end-users might get
paying their bills and subsequent deaths from gangrene.

Only that a "game", in the game-theoretic sense, is created which can
play itself out and seems inherently tractable and likely to gain some
acceptance (no one loves paying for anything but that can hardly be
offered as a proof positive that toll booths, taxes, phone systems,
etc cannot possibly be made to work!)

4. Counterfeiting et al wouldn't be such a problem if there were some
sort of economic value involved. It'd be a simple theft of service or
similar.

The problem right now is that e-mail has been created as a system with
basically zero claim of transaction value and in fact it has about
zero value right now.

So, under the current system, who exactly is supposed to get excited
and spend millions or billions of dollars to defend this non-value?

No one.

THERE'S NO MONEY IN IT, directly. And, frankly, little money in it
marginally.

So of course there's little interest or expense invested in things
like counterfeiting.

5. Therefore, the true costs are unknown.

Sure, and the true costs of spam are unknown, etc.

I don't think that's a good disproof, it would apply equally to just
about any proposal, it's nearly content-free.

6. Anyhow, since I consider micropayments a straw man there's no need
to deal with the idea that users hate micropayments except to point
out that the average person hates a lot of things like long-distance
charges or bridge tolls or parking meters but that hardly argues that
these are therefore impossible or even undesirable!

In fact I think that's the entire lesson to be learned from the
current spam situation. Devise a system that is utopian for everyman
and look what happens!

As I've said elsewhere, in years past I often wondered why the Boston
(and other but I live in Boston) transit systems aren't just free. How
much trouble must it be to collect the $1 etc, what good would come
out of free transit, people would leave the their cars home or at the
periphery of the city, etc., etc., etc.

Well, after dealing with spam THE SCALES HAVE FALLEN FROM MINE EYES!

That said, I will also add that regardless of whether there is some
sort of e-postage I'd strongly recommend to ISPs, as an ISP myself,
that they NOT manage that charging in a way that causes their
customers to hate them.

That would not be good for business.

Sheesh!

Seriously, it's been ten years, a lot of really smart people have come
up with absolutely nothing, technically, that even works a tiny little
bit.

It's time to go for an e-postage system that simply reflects the
resources being used.

And don't ask me what about "white hat" bulk e-mailers, I DON'T CARE,
the post office won't deliver their stuff for free, there's a reason
for that, why would this new regime be able to do any different?

-- 
        -Barry Shein

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 19 Apr 2004 19:28:59 -0400

> My reactions to e-postage paper:
...

> It's time to go for an e-postage system that simply reflects the

My single concern with e-postage is that in the real world bulk mailers 
do not break into post offices and dump their mail in, nor do they bribe 
people to go to the post office and put mail in for them. Because the 
Internet serves as a pervasive communications medium, it is very easy to 
steal or assume someone else's identity - much easier than any phone or 
real world postal system. Of course stolen phone and credit cards have 
always been an issue, but there are laws in place and sufficient 
disincentive exists to discourage it. That is not true in the digital 
world - stealing accounts is very easy because everyone is connected and 
many people don't know how to secure their computers.

I am refering to the issue of hijacked computers. With an e-postage 
system nothing stops a spammer from stealing Aunt Mary's computer via a 
virus and sending out spam with her e-postage account. Who is going to 
pay in that case? The usual response to that example is that her 
e-postage account will run out. This is basically the same as rate 
limiting and can be done today without resorting to e-postage. But rate 
limiting is not always possible such as when an ISP rents out the 
underlying connectivity from a third party. There was also a suggestion 
in one of the subgroups to write up a BCP describing how to do rate 
limiting.

In any case, while I am not a big fan of e-postage, there are people 
including some group members (David Nicol, etc.) who are working on 
e-postage systems. If there is a sufficient interest in the industry and 
the community at large, and workable systems exist that require 
interoperability, the IETF can step in and set standards for that. 
Otherwise, I do not see what the ASRG or the IETF can do for or against 
e-postage - it is simply not within the scope of standards at this point.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 19 Apr 2004 19:50:35 -0400

> (i.e., regulation, legislation, big men with sticks...)

Some time ago I wrote an unpublished draft on this specific topic 
(http://www.shaftek.org/asrg/draft-irtf-asrg-ietf-role-in-fighting-spam-00.txt). 
In particular, my opinion expressed at that time was:

"Unlike the belief of many parties, both inside and outside the IETF,
the role of the IETF in addressing the spam problem is limited. Being
that the problem is fundamentally non-technical in nature, there aren't
many technical solutions possible to solve it. Even technical solutions
that address different aspects of the spam problem are not necessarily
relevant to the IETF's core mission as a standards organization unless
these solutions involve changes to existing standards or creation of
new standards. While the IETF has historically provided a forum for
discussion of many issues related to the Internet, and facilitated
various technical efforts, its primary missions remains to be
a standards organization and not the body responsible for solving
every single problem on the Internet."

Examples of standards work that can help with the spam problem somewhat 
are standards to let ISPs talk to each other easier and in more 
automated ways including abuse reporting standards and notifications of 
blocking; BCPs; etc. There are many other examples of things we can do 
but trying to solve the spam problem is not something that is possible 
in this group alone. However, we can still do standards work that can 
address parts of the problem.

> common usage, preferably thrown back to the ISPs et al.

People do not hack phones or fax machines in the real world - it is 
simply not possible with the same ease as it is in the digital world. 
Another issue is convincing people to switch - the unlimited/free 
pricing scheme has been embedded into the psyche of Internet users to 
such extend, that it will very hard to convince people to switch. Even 
if you float the "no spam" flag, the first few pieces of spam arriving 
in their inbox, be it paid or hijacked, will break that idea very quickly.

ISPs also have to be convinced to spend money on supporting and 
participating in the e-postage infrastructure. Given the low profit 
margins they are getting today and the uncertain benefit that will be 
gained via e-postage, they will not run towards the idea so fast. This 
is why people have suggested to add some benefit to the mix such as 
"registered" mail, etc.

However, there are some people including group members that are working 
on the idea. If standards are required for e-postage interoperability at 
some point, the IETF can develop them. But to get to that point requires 
a workable e-postage system with many technical issues addressed, 
support from the ISP and IT communities, and users who are willing to 
pay for it and use it.

I would suggest that those who are interested in the idea put their 
heads together to address the technical issues, and start poking the 
industry to see if there is interest. So far, I am not aware of a single 
group that is working on e-postage, possibly because of lack of support 
in the industry and the community.

Yakov

---

From: Barry Shein <[email-masked]>
Date: Mon, 19 Apr 2004 21:48:51 -0400

> people to go to the post office and put mail in for them. Because the 

Weaknesses such as these do not necessarily suggest an alternative
solution, other than perhaps doing nothing because nothing was
perfect.

 > many people don't know how to secure their computers.

I think one result would be that this sort of thing would become a
commercial crime with actual, measurable value, like toll fraud,
rather than the vagaries of time wasted or hassle/embarrassment/etc.

A widely deployed e-postage system would begin to create an economics
around spam fighting, something it sorely lacks now.

 > in one of the subgroups to write up a BCP describing how to do rate 

Similar answer. Right now if a spammer hijacks Aunt Mary's computer
and uses it to spew spam well, that's too bad, but so what (as far as
Ms Mary is concerned)? Other than some embarrassment etc.

Obviously one would hope that ISPs et al, someone in the loop, would
help and help forgive particularly in the beginning.

But as time goes on perhaps, finally, Aunt Mary will cease to find not
securing her computer just a source of funny stories to tell at work
about how some jerk used it to send 1M spams over the weekend until
she figured out what was the problem.

Yes, you have to assert some sort of appropriate value and tangible
loss, trying to be humane, in order for the public to take it
seriously, which may well be software vendors and ISPs taking it
seriously first (``sorry, we sense your system is not at a sufficient
patch level to send email safely, please contact our customer
support...'')

Who makes things right if Aunt Mary leaves her keys in the ignition of
her car and takes it out for a joy ride?

Well, insurance cos etc a little, but the cost and hassle is
sufficient that, unlike getting your computer hijacked, she's probably
pretty careful with her keys wherever this is even a small
possibility.

Anyhow, my point is, it's push/pull.

If we keep saying it has to be free and painless to be a victim then
interest in avoiding being a victim will be limited accordingly.

 > e-postage - it is simply not within the scope of standards at this point.

Eventually there has to be some agreement on what the most tenable
solution is, or admission of failure to find anything worth anyone's
time pursuing.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Mon, 19 Apr 2004 21:58:43 -0400

My major concern vis a vis e-postage is that everywhere we turn, from
so-called public opinion to rarified technical groups such as this to
journalistic exercises etc we see nothing but the tragedy of the
commons which is basically no one would "vote" for e-postage because
they'd rather have it free, period.

And everything else said on the subject, by most, is just working
backwards from that pre-conceived result. Fiddling while Rome burns.

If you think groups like this have a possibly unreasonable problem
with e-postage talk to computer/network trade magazine people. They're
making big bucks off all this free e-mail sending out alerts and ads
and newsletters (all with paid content) to their subscriber base (which
may include tens if not hundreds of thousands of former subscribers.)

Just wait until some of these proposals try to see the light of day in
a press gluttonizing on the status quo...

I've personally had trade mag editors call me for advice about what to
do about upwards of 25-35%, and rising, of their e-mailings being
blocked by ISPs et al.

I said, howsabout paying someone who has to carry your traffic to
which they snort, mutter how it's all opt-in (the words "opt-in" now
mean "you get whatever you want for free") and abruptly end the call.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Mon, 19 Apr 2004 22:14:14 -0400

> simply not possible with the same ease as it is in the digital world. 

Perhaps you are too young to remember blueboxing?

Small boxes built from a few parts available at any Radio Shack or
similar which could be used to completely by-pass long-distance tolls,
in their more sophisticated versions could even be used to put long
distance charges onto others, typically companies' 800 lines, if you
knew the right incantations.

These boxes went around college dorms, for starters, like wildfire,
and this was in a day when having a boyfriend or girlfriend back home
could easily cost you hundreds of dollars per month in toll charges,
it was much more expensive than today so the appeal was enormous.

They were a big disaster for the phone system, millions if not
billions of dollars were lost, people were arrested and the system
eventually redesigned and a much changed system deployed on a rather
rapid schedule.

But one difference was that there was real, measurable money involved.

Another is that the phone system is somewhat more mature than the
internet.

 > in their inbox, be it paid or hijacked, will break that idea very quickly.

What convinced people to pay for long-distance calling or for toll
booths on highways?

I think your sense of consent is touching but not acknowledging how
such resource charging comes into being.

Given the opportunity the public would probably "vote" for free
broadband cable etc. Why not?! And no doubt, as you imply, make the
big pouty face at any suggestion otherwise.

But that's the point, the reality of economics has to penetrate
somehow.

My suspicion is that the way things are going either something is
done, or the RBOCs (and equivalent, PTTs etc) will own e-mail,
everyone else having gone broke on spam etc, and we'll be paying
15c/message just like SMS.

I bet your phone co won't give a lot of creedance to the big pouty
face about being charged for email.

Maybe I'm the only one, but I just don't think people realize how
close we are to the whole thing collapsing like that. And the RBOCs
etc not only can taste that victory, they consider it their natural
destiny.

Anyhow, it's something to consider as one fritters away time because
every suggestion is just not quite perfect.

I think the expression is: Rearranging deck chairs on the Titanic.

 > is why people have suggested to add some benefit to the mix such as 

Well, as an ISP it's interesting to hear you speak on my behalf.

I think the possibility of conforming resource demands (and consequent
costs) to resource usage would have a certain appeal.

-- 
        -Barry Shein

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 19 Apr 2004 23:24:56 -0400

[was Re: [Asrg] Usefulness of wholesale blocking of attachments for SMTP?]

...

Touche, I forgot about the multi-flavored boxes, the Anarchy Cookbox and 
my BBS days come to mind :)

> I think the expression is: Rearranging deck chairs on the Titanic.

With the current state of affairs I simply do not see how any kind of 
e-postage system would take off at all within a reasonable span of time 
even once all of the technical issues have been addressed. The same goes 
for any proposal calling for a major infrastructure overhaul - there 
simply isn't enough monetary or non-monetary incentive for network 
operators, software providers and governments to make a major change of 
that scale. It may very well be that the system may collapse due to that 
(which I personally do not think will happen).

However, lets step aside for a second. You are advocating e-postage, and 
  there are some group members as well as others in the industry that 
are doing the same. Practically speaking, would do you suggest? There 
have been technical problems raised by several members which have to be 
addressed in detail. Some of them may not be addressable until there is 
working code.

There is at least one group member (David Nicol) who is working on a 
e-postage system (pay2send.com). There is also BondedSender which is 
close to real e-postage. Would it be viable for all of the parties 
interested in e-postage to get together and start working together 
including addressing the issues raised and testing code, instead of just 
discussing the idea?

> costs) to resource usage would have a certain appeal.

Obviously I am not refering to you :) I was refering to other ISPs - I 
have not seen interest in e-postage from a sizable proportion of the ISP 
community. Of course Microsoft is interested in it as per Bill Gates's 
speech but they are also a software provider, so their interest may have 
a different motivation.

Yakov

---

From: der Mouse <[email-masked]>
Date: Tue, 20 Apr 2004 07:05:53 -0400 (EDT)

> system nothing stops a spammer from stealing Aunt Mary's computer via
> a virus and sending out spam with her e-postage account.  Who is
> going to pay in that case?

Aunt Mary.

There _has_ to be a nontrivial cost to running a grossly insecure
system, or it will continue to be near-universally done.

Same as if Aunt Mary doesn't lock her car and someone swipes it for a
joyride; Aunt Mary pays (in various ways, not all monetary, and not
necessarily equal any damage done, but she pays).

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: der Mouse <[email-masked]>
Date: Tue, 20 Apr 2004 07:11:23 -0400 (EDT)

[bzs, mostly just being bzs, but a few points seem worth replying to]
> What convinced people to pay for long-distance calling or for toll

Because the company owning the long-distance network refused to let it
be used without payment.  Because the governments building the highways
decided to impose the toll booths.

More generally, because the owner of the infrastructure demanded the
payment before letting it be used that way.

The same mechanism is paying for email right now.  (Whether the fee
structure in use - which, for most people, makes email _incrementally_
free - is appropriate is a separate issue.)

> 15c/message just like SMS.

You're forgetting the major difference that makes your analogy invalid:
with email the underlying infrastructure (the Internet) is used for
_many_ other things, whereas the highways, the long-distance networks,
did not have many other concurrent uses in place.

It is not the Internet that is in danger of imminent collapse, only
email.  (I'm actually not sure even email is, but I'm letting you have
that, arguendo.)

The telcos won't "own" email unless they lock down the Internet links
and require that only traffic they can identify is carried, and demand
payment for email.

> close we are to the whole thing collapsing like that.

I don't think "the whole thing" is in any danger of imminent collapse.
At least not unless your "whole thing" is the "anyone to anyone,
anything, anytime" email system - and in that case, it's already dead.

> I think the expression is: Rearranging deck chairs on the Titanic.

Indeed.  So what are _you_ doing about it?  Or are you joining us in
rearranging the deck chairs while criticizing us for it?

> I think the possibility of conforming resource demands (and
> consequent costs) to resource usage would have a certain appeal.

It does.  Unfortunately, in forms like e-postage (even going so far as
to grant its possibility) it has the even bigger (at least for me)
negative appeal of breaking most of the things that make email so
valuable to me.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: "John R Levine" <[email-masked]>
Date: 20 Apr 2004 03:56:34 -0400

Hi.  It's me, Mr. epostage-can't-work.

I need to keep rewriting my epostage paper to make the fundamental points
clearer.  The three big issues are transaction costs, settlements, and
identity.  Another is that no postage scheme in the history of mankind has
existed to deter use rather than to pay delivery costs, but let's skip
that one and decide to innovate.

The transaction cost issue is the simplest: any kind of e-postage system
is going to need a transaction per message to check the stamps.  Spammers
are going to put bogus e-postage on their mail, and the only way to see if
an e-stamp is valid is to check with the issuer.  Even if you use a crypto
signature scheme to see if the stamp is real, you still need to ask issuer
if it's already been used somewhere else.  I have yet to see a faintly
plausible plan that would build and pay for a transaction system big
enough to handle the world's e-mail.  I'm not talking about settlements
here, just whether the stamp is OK.  The biggest transaction system to
date is the one for Master Card and Visa, and it's both too small and too
expensive by several orders of magnitude each.

> You settle at the ISP level ...

Settlements: You run an ISP, you tell us.  There are something like 5000
ISPs in the U.S. and probably at least that many outside the U.S.  Are you
going to send out 5000 checks every month for your settlements?  (Or net
it out with each, so it's on average only 2500.)  How are you going to
keep track of whether the other ISPs have paid up, and if they don't, what
will you do about it?  You can't wave these issues away, these are the
nuts and bolts that make a payment system work or not, and if you don't
shut down the deadbeats, the e-postage stops being real money.

If the ISPs do the settlements on behalf of their customers, the ISPs are
acting as banks, with all of the fraud and default problems that regular
banks have, and which they spend a lot of money to handle.  Real banks
handle the clearing problem with centralized clearing systems they all
join, Mastercard/Visa for credit cards, NYCE, Cirrus, and PLUS for ATM
transactions, and the Federal Reserve for checks.  These all cost a lot
more per transaction than any likely e-postage system will collect, and
are designed in a world where the vast majority of transactions are OK and
you handle the bad ones as exceptions, which doesn't impress me as a good
model for an environment where spam is 80% of all mail and growing.

Even worse, what about the ISPs that aren't in the US?  How do you send
50 cents to each of five ISPs in Bangladesh?  Credit cards?

Identity: lots of people have pointed out the zombie problem, that
spammers will hijack Aunt Betsy's computer and charge the postage to her.
The response I usually hear from epostage enthusiasts is that Aunt Betsy
won't let the zombies on her PC once she's had to pay a few hundred bucks
in spam epostage.  Based on my observation of the real world, that's not
gonna happen.  Every month you see the predictable story about some loser
whose PC got misconfigured or got a Moldavian dialer installed or
something, and was shocked to get a thousand dollar phone bill.  Do they
actually pay the thousand bucks?  Never.  They negotiate it down, stiff
the phone company, or something.  ISPs would be stuck in a no-win
situation where their customers will hate them if they try to collect, and
their e-mail peers will hate them if they don't.

> "micropayments" system in many aspects?

In some, yes, in others, no.  It differs from e-mail in that it's a closed
system, with relatively few players, rather stringent barriers to entry
and really complicated financial settlements that start with the
difference between "bill and keep" and "reciprocal compensation" and get
worse from there, with the ITU, an impenetrable government
meta-bureacracy, in the middle.

> someone, somewhere might defraud it etc?

You must have read some other paper than the one I wrote, because I never
said or implied that.

Here's a thought experiment: imagine that you run a store in some part of
the wild west, and 90% of the cash that people offer you to pay for stuff
is bogus.  How are you going to handle transactions?  How long will you
spend examining each coin?  Will you refuse to do business with anyone
who's offered you bogus money?  What about people who've gotten it in
change somewhere else and didn't notice?  This is the environment
e-postage has to face, not a little fraud, but vastly more bogus
transactions (at least attempted ones) than real ones.  I don't know of
any financial system that works in an environment like that.

> It's time to go for an e-postage system that simply reflects the

OK, so build one.  I don't know how to build one where the transaction
costs aren't 10 times greater than the costs that the transactions are
supposed to cover, despite a decade of micropayment research, but maybe
we've overlooked something.  I think we all agree that it's not going to
sit on top of SMTP mail, so someone should take a tip from the phone
system, build a closed system that you can only get into by spending a
hundred grand and being approved by the club that runs it, and give the
end users a nice point and click program that runs on Redmond Crudware yet
isn't going to be instantly subverted through the weekly egregious system
security hole.  People will rush to use it.  Right?

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 20 Apr 2004 11:10:33 -0400

> But one difference was that there was real, measurable money involved.

  Which meant that the maintainers of the phone system had an
incentive to change the system.

> Another is that the phone system is somewhat more mature than the

  The "maturation" of the phone system involved separating control &
data paths.  Captain Crunch whistles can be blown into a handset until
your face turns red, and nothing will happen.

  It's difficult to change the Internet now, to separate control &
data paths.  As if the billions of dollars required isn't enough, the
underlying philosophy of "end-to-end" communication means that any
such attempt will be strongly opposed.

  Think of the Internet as a phone system where almost anyone can hook
up a switch, where blue boxes come standard with most payphones, and
where most payphones have a button labelled "press here to dial
without inserting a quarter".  No one should be surprised that the
resulting system is a mess of abuse and fraud.

> broadband cable etc. Why not?! 

  It's called "free bread and circuses".  It goes back to the Roman
days.

  In contrast, the phone systems could be upgraded not only for the
reasons stated above, but also because they were owned by the phone
company, there were relatively few switches, and the switch<->payphone
protocol didn't have to be changed when the switches were upgraded.

  Alan DeKok.

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 20 Apr 2004 14:29:11 -0400

>   That's censorship, not anti-spam filtering.

No.  DCC doesn't work like you think it does.  Vernon is using more than 
just the DCC for blocking - he's got lots of lists (domains etc) which 
are run for his personal email independently of DCC.

"Submitting something to the DCC" is like submitting something to Bayes 
training.  It's only bulk (and blocked) if the signatures match others 
(in DCC) or if the training is "strong enough to matter" (in Bayes).

One-to-one email isn't going to trip DCC, and unlikely to trip Bayes.

> political wars between blacklist maintainers, who cross-list each

The only deliberate one I know of was when one blacklist was acting 
abusively (unrestricted relay scanning) generating lots of complaints, 
the other listed it for acting abusively, and the first well, retaliated 
- it was acting abusively in the first place, right?

The first blacklist was subsequently proven in a court of law to be 
acting abusively.  And isn't running any more.  He just whines a lot 
after having fled the country.

I don't really think one corner case can be generalized into a blanket 
statement.  But more importantly, it's not interesting from the ASRG 
perspective.

> him which rules were matched.

My point is that your point that such systems are 
"originator-subvertible" is an uninteresting one from a broader 
perspective such as what ASRG is tasked with.  _Everything_ is 
subvertible at that level.  _Any_ spam solution that you implement has 
to be evaluated from a perspective of how much you trust the "supplier".

Even if you're the supplier (in a corporate sense) where the spam 
meister may have a different viewpoint of what spam _is_, relative to 
say, the CEO.  I don't think maundering ( ;-) on about that sort of 
thing is useful for ASRG.  ASRG should be more concerned with making 
sure that once the user of the filter has decided to _use_ a given 
technology that he actually gets what the supplier provides, and is 
given enough information to make reasonable choices.

As long as the DNSBL user is adequately informed, it ain't any of our 
business how capriciously the DNSBL is operated.  Truth in advertising 
is the key.  Not bans against capriciousness.

Say, Yakov, you still waiting on Matt for DNSBL BCP publication?

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 20 Apr 2004 15:54:35 -0400

"Chris Lewis" <[email-masked]> wrote:
> No.  DCC doesn't work like you think it does.

  I will admit I have little idea how DCC works.  My opinion of the
events is based on the message posted to ASRG by Hadmut:

http://www1.ietf.org/mail-archive/working-groups/asrg/current/msg04365.html

> One-to-one email isn't going to trip DCC, and unlikely to trip Bayes.

  Maybe it won't trip DCC, but individuals appear to be free to submit
non-spam messages they dislike to DCC.  This makes it more likely that
others will end up blocking similar messages, due to one individuals
desire to censor.

> given enough information to make reasonable choices.

  I agree.  When we design systems, we *know* they're going to be
arbitrary and capricious.  So the solution isn't to ban that behavior.
The solution is to make users of the system accountable.  This limits
the negative impact of the political-layer flaws.

  My focus, therefore, has been on systems which enable people to
claim accountability, and to be verified to be accountable by others.

> is the key.  Not bans against capriciousness.

  Exactly.  Look at cbl.abuseat.org.  There's *no* information as to
how an IP gets listed, other than "trust us".  It's arbitrary and
capricous, but immediately responsive to complaints (as the designers
obviously understand these issues.)

  So my concern with content filtering systems is that unless it's
possible to tell *who* submitted some data, users of the system end up
using rules for which no one is accountable.  That can be an avenue
for abuse.

  Alan DeKok.

---

From: Seth Breidbart <[email-masked]>
Date: Tue, 20 Apr 2004 18:13:24 -0400 (EDT)

>  I will admit I have little idea how DCC works.

The idea is that _every_ message gets submitted (once).  DCC reports
the number of copies it has received.  For a message sent a single
time, this doesn't matter at all; nobody ever checks it again.  For a
message with a few recipients, it might be found, but only a few
copies, so it doesn't matter.  For spam, there will be a lot of copies
seen, so it gets rejected.  (This latter is also why legitimate
subscribed-to mailinglists must be whitelisted, since DCC only knows
about volume.)

> non-spam messages they dislike to DCC.

_All_ messages received are supposed to be submitted.  (If you wait
until a person sees the message, a lot of spam will be accepted in the
meantime.)

Besides, suppose I submitted a non-spam message that I didn't like;
what effect would it have?

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 20 Apr 2004 19:00:50 -0400

> until a person sees the message, a lot of spam will be accepted in the

  OK.  I would have preferred to have this explanation during the
original discussion, but having it now is better than nothing.

  Alan DeKok.

---

From: Barry Shein <[email-masked]>
Date: Tue, 20 Apr 2004 22:32:04 -0400

> even once all of the technical issues have been addressed. The same goes

Isn't this the canned, applies to anything, response?

It's been nearly ten years and no one has come up with anything,
perhaps it's time to put the "that would take too long to be accepted"
on the back burner and discuss other aspects?
 
 > (which I personally do not think will happen).

It (e-postage) doesn't require much any infrastructure overhaul.

Maybe some ways of imagining it being implemented do, but maybe the
goal should be to say well, if we do it that way it'd require a major
infrastructure haul, can we do it some other way.

In brief how about:

   A) Each ISP creates stamps according to some accepted method,
   probably some cryptographic approach. Think SSL certificates or
   some similar precedent.

   B) They attach a stamp to mail according to some policy such
   as e-mail originating from their customers.

   C) Stamps can be allocated according to any policy they choose, at
   least at first. For example, give each customer 1,000 stamps per
   month and charge for excess, whatever, that's a marketing decision.

   D) However, other ISPs can choose to transit or not email with
   particular stamps.

   E) Unstamped mail could be accepted for a while and then ISPs can
   choose to reject it.

Ok, maybe it needs work. But it's hardly off-the-wall, and it doesn't
require major infrastructure nor would take years and years. If a few
major players said this is the way we're going, here's some software
to do this, and we'd be off and running.

I don't propose that as a worked-out solution, only as an example that
one can approach the problem more positively, and to point out that
ready-made, all-purpose blow-offs like "it would take too long" really
don't improve the quality of discussion, except perhaps when posed as
questions rather than assertions.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Tue, 20 Apr 2004 23:06:40 -0400

On April 20, 2004 at 03:56 [email-masked] (John R Levine) wrote:
 > identity.

Some critical thought as to why a particular model which supports an
objection might just be a bad model would be useful also. Straw men
and all that.

  Another is that no postage scheme in the history of mankind has
 > that one and decide to innovate.

Really? So you figure if paper postage were free it wouldn't have the
effect of increasing volume? Or is that an unconscious or accidental
result? There's something about willfulness in that assertion which
has me confused.

 > expensive by several orders of magnitude each.

Again, you're describing a particular model which is easy for you to
object to, a straw man.

How come SSL certificates in HTTPS transactions can work? Aren't they
reasonably analogous?

 > going to send out 5000 checks every month for your settlements?  (Or net

Sounds like a great job for a service organization, if that's the way
it's done at all. Send in your numbers, they can generate the n-way
settlements and send out a single bill or check to each client.

That doesn't sound too hard.

 > shut down the deadbeats, the e-postage stops being real money.

So you shut them down, refuse their mail, cancel their stampmaking
ability (revoke their certificate.)

But why in the world would you be worried about collections issues in
a forum like this, except inasmuch as you think you can use it to
raise another objection.

It makes wonder how in the heck can ISPs like me possibly charge
customers to connect to other ISP's customers web sites etc? Why don't
the settlements etc drive us to drink? How can we collect?

Well, it's not really a problem, is it.

Maybe there are no settlements, who told you there have to be
settlements?

Again, you're arguing with a model which you made up (or chose)
because it's easy to argue with.

 > banks have, and which they spend a lot of money to handle.  Real banks

So now banks can't work?

 > model for an environment where spam is 80% of all mail and growing.

Well, then it wouldn't be wise to design it like that, would it?

 > 50 cents to each of five ISPs in Bangladesh?  Credit cards?

You're just inventing this awful model and running with it as far as
you can aren't you?

 > their e-mail peers will hate them if they don't.

Hmm, it seems to me what you're saying is that the phone companies
have already developed a completely workable model for handling these
hard cases which the ISPs might consider adopting.

Where's the objection, other than their tone.

You're right, as an ISP I strive to not have my customers hate me, so
I guess that other model would be better, some forgiveness and
education.

 > meta-bureacracy, in the middle.

But it works, within reason, right? So what exactly is your point?
That you personally find it too complicated?

 > You must have read some other paper than the one I wrote, because I never

Well, you did say that charging per usage can't work.

 > the wild west, and 90% of the cash that people offer you to pay for stuff

Wait, people did run stores in the wild west, didn't they?

 > is bogus.  How are you going to handle transactions?  How long will you

And I think that's the context from which came the familiar American
expression "Don't take any wooden nickels!"

Didn't everyone have an uncle who'd say that all the time when you
were a kid?

 > who's offered you bogus money?  What about people who've gotten it in

Sure, wouldn't you refuse bogus money? Don't take any wooden nickels!

 > any financial system that works in an environment like that.

Only when you get to set up the straw man.

 > costs aren't 10 times greater than the costs that the transactions are

On this we agree.

 > supposed to cover, despite a decade of micropayment research, but maybe

Yeah well I'd avoid micropayments because they don't solve the
problem, as you've pointed out.

 > security hole.  People will rush to use it.  Right?

I dunno, what's your take, that people don't use Microsoft software?

At any rate, this is just more straw men.

Why don't you be a little more honest: You don't like the idea of
e-postage probably because it sounds like maybe you'd have to pay for
something you don't have to pay for now, and your reasoning works
backwards from that desired conclusion.

Tragedy of the commons and all that.

-- 
        -Barry Shein

---

From: "Tom Thomson" <[email-masked]>
Date: Wed, 21 Apr 2004 10:57:22 +0100

[snip]

HTTPS transactions aren't remotely analogous to postage. You don't have to
check whether that certificate has been used before (using a certificate
many times is normal, but a stamp can only be used once).

However, a "pay for what you post" model (as opposed to a "stamp" model,
which is just one particular type of "pay for what you post" model) can be
quite simple, and can be fairly analogous to HTTP.  Basically have the ISP
sign a digest of each outgoing message (signing a digest covers the re-use
issue quite nicely, unless the spammers are clever enough to generate digest
collisions).  That means that every outgoing message has to be routed
through the ISP, and the ISP meeds to verify who is sending it (so he knows
who to bill) so the real cost of email will be increased and the email
system will cease to be end-to-end.

For most users, all outgping email is already routed through the ISP's
outgoing mail servers, so the extra costs they cause are limited to the cost
of generating the digest and signing it. For most emails, outgpoing email is
not routed through the ISP's servers, so there is also the additional cost
of accepting, storing, and forwarding the email. A charging model which
allows say 50 emails per day free will probably leave email free to the
average consumer (and there's nothing to stop massmarket ISPs adopting a
range of charging models, in the way that mobile phone operators have - pay
a higher subscription and get more free outgoing emails, or a lower
subscription and get fewer). There are some problems with mailing lists,
since they add headers, unless the digest is only of the mail body and
doesn't include the RFC 822 headers, unless eachmessage is payed for twice
(once when sent to the list server, again when relayed by the list server).
We have to think about the effect on organisations like the ACM and the BCS
(which provide permanet address capabilities for their members through
adress mapping realys) as well.

There is no need to introduce inter-ISP payments for handling each-other's
email traffic distinct from any payments already used for providing
bandwidth and/or handling general internet traffic. The european postal
union certainly deosn't have such transfer payments between its members, why
should an email system?

In order for the charges to have a deterrent effect on spammers, they have
to be high. Much higher than the extra costs incurred by the ISPs.   It's
not going to deter spammers if we merely double the cost of an email, we
have to raise the cost to a level where their operation is no longer
profitable.  This is where the trouble starts.  The costs have to be high
enough that it's worth going to the trouble of settting up your own ISP to
avoid them, even if you are a legitimate business that doesn't use
significant amounts of bulk email. That's what spammers will do - set up
their own ISPs. This could perhaps be avoided by bringing in those transfer
payments - and now we have all the complexity that Levine was complaining
about, and it's probably neccessary to introduce a central clearing house -
or rather a hierarchy of clearing houses, as in the banking system.  Since
these clearing houses will be dealing with the transfer of serious amounts
of money, they will be subject to government regulation (regulations to
prevent money-laundering, regulations to prevent fraud, regulations for this
that and the other) and the email system will be tied up in a vast
bureaucracy.

The vast bureaucracy may not be too great a price to pay to eliminate spam.
Government control of our email (through government regulation of the
clearing houses) may not be too great a price to pay.  After all, the
alternative to getting a handle on spam may be to do without email at all.
Personally, I'd prefer to carry on searching for a better solution.

Tom

---

From: der Mouse <[email-masked]>
Date: Wed, 21 Apr 2004 07:14:42 -0400 (EDT)

>    probably some cryptographic approach. Think SSL certificates or

How do you stop spammers from acting as ISPs and issuing stamps to
themselves for free, without also cutting out individual and other very
small sites (like two-person SOHOs) running their own mailservers?

All this looks like to me is whitelisting based on signatures (and all
that really has over whitelisting based on outgoing mailhost is that it
works through multiple hops), and does nothing at all to help people
decide which signatures to whitelist (which is the hard part of such
whitelisting, because it's the part that has major scaling issues).  If
you have only a few stamp issuers, it becomes a slightly odd flavour of
sender certification, and rather weak sender certification at that.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 21 Apr 2004 07:44:42 -0400 (EDT)

Paid email is unlikely to come about because of a joint agreement among
ISPs or lawmakers. But it might easily come about (without settlements) in
the following way.

Somewhere some ISP will decide to allocate abuse desk costs among the
divisions. The dial-up manager will then change his policy from unlimited
free email for each account, to perhaps "1,000 free messages per month".
His marketing person will advise him that to the average dolt, "1,000"
seems like MORE than "unlimited", since the average person is not too good
with numbers. Once this limitation is imposed, his share of the abuse desk
will drop to near zero, and he may even collect a few bucks for additional
message (perhaps at $1/1000). 

Then the T1 division, seeing this, will decide that for new accounts only
100,000 messages on port 25 go with each T1 each month, and any more need
to be paid for, at perhaps $1/10,000 messages.  This is also a success,
and within a year the abuse desk can be reduced to a part timer. Other
ISPs will follow suit, but what about ISPs that don't have an abuse desk
expense? Won't spammers just end up with them? Yes, and they will end up
on blacklists. That is a fine equilibrium.

No settlements, no public spirit, just better accounting. (And an MTA that
can keep some records).

---

From: John Levine <[email-masked]>
Date: 21 Apr 2004 13:31:34 -0000

>   E) Unstamped mail could be accepted for a while and then ISPs can

This is a fine plan.  In fact, it already has a name -- it's domain
keys (with an implementation tweak that ISPs rate limit their retail
customers' mail, which is a reasonable idea on its own).  Each domain
signs its own mail, the keys to check the signatures are in the DNS,
and recipients can do whatever they want with mail signatures.

Regards,

---

From: "John R Levine" <[email-masked]>
Date: 21 Apr 2004 00:26:19 -0400

> objection might just be a bad model would be useful also. Straw men

I entirely agree.  But there are bad models all around.  I also understand
that a lot of the details of any e-postage system are not interesting to
you or to a lot of other people (frequently including me), but boring
isn't the same as easy or cheap.  When I write someone a check, I don't
care about the details of how the check gets from his bank back to my bank
(or the check's picture more likely these days) or how the money goes out
of my account at my bank through some bank version of cyberspace into his
bank and his account, and all the other things that happen if there isn't
money in my account to pay the check.  But someone had to work it out, and
there are large, expensive, complex back office systems making it all
happen.

Since an e-postage transaction does basically the same things as any other
financial transaction, if you're going to claim that it's not like all the
other kinds of transactions, you really have to do more than wave your
hands.  Even the simplest kind of transactions, where you hand me a
quarter to buy a paper, have to be backed up by a credible issuer of the
quarters and some way I can turn the quarter into money that's useful for
something else.

> Maybe there are no settlements, who told you there have to be

You did.  You said that we need an e-postage system to rebalance the costs
of e-mail.  Settlements are the way that the money gets from the senders
to the recipients who bear the costs.  In the absence of settlements, only
the senders' ISPs or maybe the banks who sell them the stamps make any
money.

I gather from the rest of your message that you have a model of e-postage
that doesn't do settlements, doesn't have double spending problems, and
will work fine in the face of floods of mail with fake postage.  Don't
leave us in suspense.  Tell us about it.  If you know how to prevent
double spending of stamps without checking with the issuer, I know a whole
lot of micropayment researchers who'd like to talk to you, since that's a
problem that they've been thinking about for at least a decade.

Regards,

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 21 Apr 2004 10:19:29 +0100

> Say, Yakov, you still waiting on Matt for DNSBL BCP publication?

Yes he is. I got back from a two week holiday on Monday so I'm still in 
catchup mode, but I intend to get back to Yakov today with a couple of 
minor edits.

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 21 Apr 2004 10:33:10 +0100

>    E) Unstamped mail could be accepted for a while and then ISPs can

Stamps buy you nothing in this scenario. ISPs are already free to 
reject mail from ISPs they don't like, and throttle their customers to 
only be able to send N mails per day.

But they don't do it (some throttle, but hardly any reject based on 
ISP, unless that ISP happens to be a spammer masquerading as an ISP). 
As an ISP perhaps you can answer why they don't do it?

Matt.

---

From: Barry Shein <[email-masked]>
Date: Wed, 21 Apr 2004 19:41:20 -0400

> and recipients can do whatever they want with mail signatures.

The critical thing to add is metering all around.

    -b

---

From: Barry Shein <[email-masked]>
Date: Wed, 21 Apr 2004 19:59:07 -0400

> only be able to send N mails per day.

This adds objectivity to the process, you're sending me mail with
invalid stamps so I dropped it all (either due to counterfeiting or
revocation.)

That's a lot better than "I think you host spammers".

 > As an ISP perhaps you can answer why they don't do it?

Well, I won't completely agree that hardly any reject based on ISP,
it's not often advertised. But SPEWS for example approached this, so
one could check who used SPEWS.

That said, one concern is collateral damage and the other is lack of
objectivity so one tends to act cautiously before it becomes an
all-out shooting war.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Wed, 21 Apr 2004 19:53:38 -0400

> small sites (like two-person SOHOs) running their own mailservers?

You wouldn't honor them.

Small sites would probably get any such credentials from their
provider, something like a postage meter.

 > sender certification, and rather weak sender certification at that.

More like the latter, or at least to the degree that SSL certs might
be, and the objection is?

The critical aspect is to get the metering working, to let parties
begin to know, as a regular part of doing business, what's going on.

Remember that old adage about "Mechanism, Not Policy"?

Part of the problem with the e-postage discussion is that people are
trying to imagine every aspect of policy to see if they still like the
idea.

That's very hard and, for those so inclined, easily leads to
objections:

    So, Mr Ford, you're going to manufacture and sell everyone one of
    these automobiles! And where exactly are they going to drive them?
    What roads would they use? The current roads seem inadequate for
    motor-driven vehicles. And what's to become of our thriving horse
    and buggy industry? Civilization has done just fine for 10,000
    years without these noisy things, why should we be interested?

Policy should probably be developed as a consensual act among ISPs and
others.

Mechanism should be discussed here.

Although I agree that some discussion of policy etc is very useful
just for plausibility and impact, but the limitations of such
discussions have to be kept in mind.

-- 
        -Barry Shein

---

From: mathew <[email-masked]>
Date: Wed, 21 Apr 2004 21:13:46 -0400

On Apr 19, 2004, at 19:28, Yakov Shafranovich wrote:
> My single concern with e-postage is that in the real world bulk 
> mailers do not break into post offices and dump their mail in, nor do 
> they bribe people to go to the post office and put mail in for them.

They would, if screwing with the USPS wasn't a felony that gets you 
jail time.

You'll notice that casual phone phreaking dropped off real fast once 
Kevin Mitnick and a bunch of other hackers were sent to federal prison.

> - stealing accounts is very easy because everyone is connected and 

If it started costing them a few hundred dollars a month to remain 
ignorant, I bet they'd learn real fast or get off the net. And frankly, 
I don't care which, because the buffoons we're talking about are the 
ones bombarding me with megabytes of spam and viruses.

> a virus and sending out spam with her e-postage account. Who is going 
> to pay in that case? The usual response to that example is that her 
> limiting and can be done today without resorting to e-postage. But 
> rate limiting is not always possible such as when an ISP rents out the 
> underlying connectivity from a third party. There was also a 
> suggestion in one of the subgroups to write up a BCP describing how to 
> do rate limiting.

Your logic here seems to be "having a limited supply of funds to be 
used for e-postage is a bit like rate limiting, and rate limiting is 
sometimes difficult, hence limiting e-postage funds is difficult". 
Needless to say, that doesn't follow at all. A dolphin is a bit like a 
fish, and fish can't breathe air, therefore dolphins can't breathe air.

People do this kind of money-based spending limiting all the time. They 
set up debit accounts they can use on the net with minimal balances, so 
that if the account gets hacked the thief can only steal a small 
amount. They buy Starbucks cards and phone cards with $20 of coffee or 
telephone calls in, so if a thief steals the easily-stolen and 
anonymous card, they're only out $20. They get the credit card company 
to lower their credit lines.

Hell, if theft via computer hijacking without the user noticing really 
turns out to be that much of a problem, we can sell e-postage on $10 
plastic cards at the corner store, and computers could be fitted with a 
$20 card reader. No need to have an associated account that can be 
drained. If you swipe the card and the postage all vanishes, you know 
you've been 0wN3d and call the cops. The technology is cheap and easy.

> Otherwise, I do not see what the ASRG or the IETF can do for or 
> against e-postage - it is simply not within the scope of standards at 
> this point.

Well, it might be useful to set out some requirements. Or is that not 
within the IETF's remit? (Serious question.)

> such extend, that it will very hard to convince people to switch.

That's why I think one important requirement is that the receiver be 
allowed to waive or refund the postage fee at his discretion.

Basically, what I want to see is that if you want to mail me, you have 
to put offer me a nickel as a show of good faith that your mail isn't 
spam. Obviously if your mail isn't spam, I don't have to take the 
nickel; and if I'm an ass and take it anyway, you're only out a nickel.

> participating in the e-postage infrastructure.

There are several options here.

One is that we could let them swipe a fraction of the e-postage; or 
rather, add it on to the top. So if I charge 5 cents and my ISP charges 
1 cent, you have to risk 6 cents, and will typically have to pay 1 
cent--unless you're a spammer, in which case you lose the entire 6 
cents.

Sure, some ISPs will price-gouge. The result will be that they'll lose 
customers, because nobody will want to e-mail their customers. 
Competition should do the rest.

Another option is that the ISP could take a fraction of the cash that 
would otherwise be credited to each user's account at the end of the 
month. So if a month's worth of e-mail would result in my getting $10 
from commercial junk mailers and spending $4 on sending mail myself, 
the net would be $6 in my favor, and the ISP would get (say) 5% of 
that. Again, market forces would punish ISPs who attempted to gouge. 
The end result would work almost exactly like the Amazon tip jar or 
eBay, both of which seem to be doing just fine.

And that's without even considering the potential savings from not 
having huge quantities of spam flowing through their servers.

As soon as there's an e-postage system like I discuss above (*) running 
in parallel with the current e-mail system, I for one will use it and 
encourage all my friends to do so. I'll also tell people who have 
trouble getting past my spam filters to use it, and if they refuse and 
get bitten by the filter, that's their problem and it has a <5 cent 
solution.

And after a while I'd probably whitelist all my family and friends, and 
tell everyone else to use the e-postage system.

So while I share some of Barry's skepticism about people being willing 
to go for e-postage, and about the vitriol and lies we'll hear from the 
press about it, ultimately I'm not sure that matters. If it works, 
it'll spread virally.

> Would it be viable for all of the parties interested in e-postage to 
> get together and start working together including addressing the 
> issues raised and testing code, instead of just discussing the idea?

Well, I'd be happy to make suggestions, test stuff, and maybe even help 
with documentation, but I only intermittently have spare time. Still, 
if there's a list I can join, I'm willing to pull out the outliner and 
come up with a first cut at what *I* think some of the requirements 
need to be.

> Of course Microsoft is interested in it as per Bill Gates's speech but 
> they are also a software provider, so their interest may have a 
> different motivation.

I don't think Microsoft is interested in e-postage as we discuss it; I 
think they're interested in a system where Microsoft gets a couple of 
cents every time you send an e-mail to or from a Windows system. I'll 
go without e-mail before I'll pay a penny to Microsoft, and I believe 
there are enough like-minded people that a pay-Microsoft-for-email 
system would fail as badly as Microsoft Passport has failed.

mathew
[ (*) In particular, with the "refund" functionality. ]

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 21 Apr 2004 21:21:56 -0400 (EDT)

"Tom Thomson" <[email-masked]> wrote:
(He didn't quote properly, so it isn't clear what he wrote.)

> How come SSL certificates in HTTPS transactions can work? Aren't they

No; anybody can generate one.  Somebody who wanted billions of valid
ones could just spend a little CPU time.

> For most users, all outgping email is already routed through the
> ISP's outgoing mail servers, so the extra costs they cause are
> limited to the cost of generating the digest and signing it. For
> most emails, outgpoing email is not routed through the ISP's
> servers, so there is also the additional cost of accepting, storing,
> and forwarding the email.

The reason for the discrepancy is probably just spam.

> A charging model which allows say 50 emails per day free will
> probably leave email free to the average consumer

What stops spammers from using ISPs that allow unlimited email, or
inventing their own "ISPs"?

> There is no need to introduce inter-ISP payments for handling
> each-other's email traffic distinct from any payments already used
> for providing bandwidth and/or handling general internet traffic.

Somebody who hosts a website generally doesn't much care how much
somebody else's customers look at that website (and somebody with
customers doesn't care what websites they look at or how much).  But
the whole problem here is that people _do_ care about how much email
gets received.

> The european postal union certainly deosn't have such transfer
> payments between its members, why should an email system?

If it doesn't, what stops a spammer from joining?

> The vast bureaucracy may not be too great a price to pay to
> eliminate spam.  Government control of our email (through government
> regulation of the clearing houses) may not be too great a price to
> pay.

It is for something that won't work.  (When has a government provided
anything else?)

Seth

---

From: mathew <[email-masked]>
Date: Wed, 21 Apr 2004 21:44:12 -0400

> that one and decide to innovate.

That last point is merely taking a narrow view of what constitutes a 
"cost". Ultimately, the purpose of communication is delivering a 
message from brain A to brain B. The cognitive cost of doing so is part 
of the total cost, and something which has a definite monetary 
equivalent value--if it didn't, good writing wouldn't be worth 
anything. In other words, the fact that e-mail has to get through the 
spam noise is part of its cost of delivery.

> if it's already been used somewhere else.

No you don't. Public key crypto is your friend. If the digital postage 
cash is minted by one of a number of known sources, you can make an 
initial test for validity by simply checking the signature against the 
list of public keys of recognized mints.

It's fundamentally no different to the way your browser verifies an SSL 
connection by checking the certificate presented by the remote site.

There are some issues around what you do if a mint's private key gets 
compromised, but they're solveable.

> I have yet to see a faintly plausible plan that would build and pay 
> for a transaction system big enough to handle the world's e-mail.  I'm 
> not talking about settlements here, just whether the stamp is OK.  The 
> biggest transaction system to date is the one for Master Card and 
> Visa, and it's both too small and too expensive by several orders of 
> magnitude each.

It's exactly the same problem as checking the signature on this e-mail. 
You seem to be arguing that it's uneconomical to solve. I think the 
people who use S/MIME every day would argue otherwise.

> shut down the deadbeats, the e-postage stops being real money.

My ISP has 3.3 million customers. Surely it's infeasible for them to 
send a bill to every single one of those customers, once every month? 
My god, how could they ever hope to do that, for a sum of money which 
might be as small as $30? Clearly this whole ISP thing is just totally 
impossible.

Come to think of it, the US has around 10,000 banks (or similar savings 
institutions). Is it really feasible that all those banks be somehow 
able to process small monetary transfers between each other, often many 
times a day? Ludicrous!  I mean, anyone could just set up a bank and 
send out fake checks and never pay up, and you'd never be able to do 
anything about it. Clearly checks are utterly impossible, in fact the 
entire banking system must be the product of a deranged imagination.

> transactions, and the Federal Reserve for checks.

However, none of those systems actually use cryptography for security, 
except incidentally for encrypting transmissions. There's no way to 
check the validity of a check or credit card without making a network 
connection, and that's what makes fraud easy and drives up the cost.

If credit card numbers were secured with SSL-like public key 
certificates, you'd wipe out all the current 'small transaction' scams 
involving generation of random credit card numbers for starters. Do the 
same with checks and there goes check fraud.

Sure, you'd still have the occasional Savings & Loan or BCCI scandal, 
but the average day-to-day fraud rate by random criminals would be far 
lower.

> 50 cents to each of five ISPs in Bangladesh?  Credit cards?

The idea that I should be able to phone Bangladesh is ridiculous. I 
mean, how is my 20 cents going to get to the Bangladesh phone company? 
Credit cards?

> the phone company, or something.

Have you seen any stories about people who have done that *repeatedly*?

I doubt it, because I expect after the second or third such incident 
they'd find it tough to get the phone company to continue to do 
business with them.

So maybe Aunt Betsy would be unable to get an ISP to do business with 
her, because of her chronic inability to either use a computer safely 
or pay the cost of her own incompetence. In which case, that's her 
problem.

> ISPs would be stuck in a no-win situation where their customers will 
> hate them if they try to collect, and their e-mail peers will hate 
> them if they don't.

One word: Pre-payment.

I purchase $20 of e-postage to last me a few months. If I lose it for 
whatever reason, the ISP doesn't have to spend any money collecting 
anything. Just like if I lose a book of stamps from my wallet or have 
it stolen, the Post Office doesn't have to chase me for the price of a 
book of stamps.

In fact, you even explain the system to the user in exactly those terms.

> any financial system that works in an environment like that.

That's easy: vending machines in colleges. Tiny transactions, no 
foolproof security, and a population rich in engineers who are short on 
cash and have lots of time for experimentation.

Clearly Coke and Pepsi will never find it cost-effective to put vending 
machines at MIT, for example.

> we've overlooked something.

Well, there are David Chaum's papers on the subject for starters. 
Digicash didn't fail because it was technically impossible; it failed 
because it didn't offer compelling benefits to the people who would 
have needed to implement it, the banks and merchants and governments. 
In fact, it had major negatives from their point of view, like offering 
anonymity for customers.

mathew

---

From: "Tom Thomson" <[email-masked]>
Date: Thu, 22 Apr 2004 12:55:59 +0100

Seth Breidbart <[email-masked]> wrote@

> (He didn't quote properly, so it isn't clear what he wrote.)

Maybe your MUA needs fixing. Or maybe you aren't aware of the convention
that the symbol ">" at the beginning of a line indicates that the line is
quoted, and the absence of that symbol indicates that it is not?

One practice that I don't indulge in is carefully selecting which parts I
quote in a way cleverly designed to suggest that the person quoted holds a
position opposite to that which he actually holds.  And a practice I do
indulge in is indicating where I have cut a quote with the conventional
"[snip]".  Perhaps that's what you mean when you say I "didn't quote
properly", since you appear to have adopted the opposite policy?

> ones could just spend a little CPU time.

I think it';s pretty clear here that you are answering Barry, not me. What
do you thing ">" at the beginning of a line means?

> The reason for the discrepancy is probably just spam.

No, it certainly isn't.  Most users are not savvy, are using dial-up (or
ADSL) connections, and all there stuff goes through the ISPs server (which
is where thir dial-up connection or their always-on DSL connection ends).
Most email comes from business users who use there own mail server, rather
than their ISP's mail server.  That's nothing to do with spam.  Certainly
spammers may have some influence on the size of the majority of email that
doesn't go through the IPS's server, but which direction is that influence -
some would claim they reduce it (lots of spam from hijacked machines,
probably on dial-up accounts which have to go through ISP's server).

> inventing their own "ISPs"?

Nothing, that's one of the resons the e-post idea won't work without
transfer payments (it's just a small generalisation of the "the spammer sets
up his own ISP" problem that I pointed out and you have conveniently
snipped).

> the whole problem here is that people _do_ care about how much email

If that's true, why haven't the ISPs already introduced such inter-ISP
payments to cover this thing they care about?  inter-ISP payments for email
volume might work extremely well as a means of reducing spam (since it would
encourage ISPs obliged to make the payments to crack down on it) if set at a
high enough level, and would certainly work better on their own without the
added complication of e-stamps or whatever involving the end users.

> If it doesn't, what stops a spammer from joining?

Nothing, except that if the stamp cost is low enough he has no incentive to
join.  Wasn't that the precise point I made before, and which you have
snipped?

> It is for something that won't work.  (When has a government provided

Are you agreeing with me vehemently, or something?  The sentence you snipped
here read "Personally, I'd prefer to carry on searching for a better
solution."

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 22 Apr 2004 08:57:14 -0400

...
> Your logic here seems to be "having a limited supply of funds to be used 
> for e-postage is a bit like rate limiting, and rate limiting is 

What I am trying to say is that if the whole intent of e-postage is to 
do rate-limiting, then just do rate limiting and skip the e-postage.

> within the IETF's remit? (Serious question.)

It is more of an IRTF issue at this point, so if sufficient people want 
to pursue discussion on it, we can spill it off into a separate ASRG list.

However, what I am really interest in seeing about e-postage is 
discussion on how it can stop spam. Perhaps we can look into why people 
think that e-postage will stop spam and carry over those principles into 
other proposals. I want to isolate the principles of why e-postage will 
help from the actual technical problems involved with making e-postage 
work such double-spending.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Some lies are easier to believe than the truth" (Dune)
-------

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 22 Apr 2004 09:08:04 -0400

> infrastructure haul, can we do it some other way.

Let me ask a different question - can you elaborate as to the specific 
reasons why e-postage will help with spam. Perhaps we can achieve those 
same reasons with other means as well.

>    D) However, other ISPs can choose to transit or not email with

There would be an issue of distributed trust. Your ISP has to establish 
trust with each ISP that issues stamps. A more viable solution would be 
using a few centralized authorities to issue certificates that can allow 
ISPs to issue stamps. But then you run into the question of what happens 
if a spammer operates an ISP. Today's CAs do not revoke certificates for 
policy reasons but that can probably be changed.

>    E) Unstamped mail could be accepted for a while and then ISPs can

There is really no way to restrict unstamped email unless it goes to the 
ISPs mail servers. I just want to point out this distinction - people 
would still be free to run their own email servers over whatever system 
they would like such as FreeNet.

> questions rather than assertions.

What I am really interested in discussing is why this would help. The 
issues of how e-postage would work can be left to be worked out but the 
interesting thing is how will e-postage help with spam?

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"
-------

---

From: "Tom Thomson" <[email-masked]>
Date: Thu, 22 Apr 2004 14:58:14 +0100

[snip]

> policy reasons but that can probably be changed.

Why do you think that can be changed?  The CAs are in the CA business to
make money.  Managing a revocation list and making it accessible is an
expense, and there appears to be no return on it.  The CA has maybe never
heard of a person who relies on a certificate, has no contractual
relationship with someone who relies on a certificate, so someone who relies
on the certificate has no come-back against the CA, the CA has no liability
for any loss incurred through reliance on its certificates.  On the other
hand, the CA has a clear contractual relationship with the person it
certifies (at least in the current model, where the person certified buys
the certificate from the CA), so if it revokes the certificate it may get
dragged through the courts (win or lose, being dragged through the courts is
a pain no-one wants).  So why would a CA set up an expensive reveocation
mechanism and risk court action against it by its customers in order to make
someone who has no connection at all with it a bit happier?

Tom

---

From: "Tom Thomson" <[email-masked]>
Date: Thu, 22 Apr 2004 16:05:32 +0100

> same reasons with other means as well.

Surely the argument is that if the cost of sending spam goes up to such a
level that sending spam ceases to be profitable, then no-one will do it any
more?

I don't fully believe this argument myself, or at least I don't believe it
can be achieved by e-postage, for a number of reasons.

First, we still see junk mail on paper.  Something like 65% of my paper mail
is junk. So the charge for paper mail hasn't eliminated spam.

Second, who pays the charge?  If a spammer "owns" a bunch of zombie machines
scattered round the world, they pay the email charge - he doesn't.  So it's
not much of a deterrent to him.  Of course it may encourage people to secure
their machines so that they don't end up paying, but I'm not certain that
that will produce a big reduction in volume - look at the number of critical
security problems published in the last year (by reliable bodies like CERT)
for *NIX systems, or the rather smaller number for Windows systems - and
look at the delays in availability of fixes.  There's plenty of window for
the attackers even if people are sufficiently clued up to keep their
machines "secure".  Of course it's possible to build very secure systems and
to use multiple layers of firewalls, but the average guy is not going to do
that because it's both extremely difficult with current platforms and very
expensive.

Third, there's one born every minute. The spammer can recruit people as
spam-mailers, people who believe they will make money by working for him and
won't stop sending spam on his behalf until they have lost a packet (some
won't even stop until they've gone bankrupt).  They make the losses, he
makes the profits.

Fourth, we don't know what the value (to the spammer) of spam is.  Obviously
different spams generate different returns. The gullibility and greed of
some people is so great that even with a high email price some spams will
remain profitable - and of course this relates to the first point above.  So
we don't know how high we have to set the price to get spam down to a
"reasonable" level, and setting the price too high is as bad as the spam -
my email is just as unusable if no-one can afford to email me as it is if I
have to spend too much time filtering out the spam. Maybe over time we can
find the right pricing level, if there is one, but maybe there isn't a right
pricing level to find.

Tom

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 22 Apr 2004 12:38:11 -0400 (EDT)

> quoted, and the absence of that symbol indicates that it is not?

Or maybe one paragraph read like a reply to the preceding one, but
neither was quoted.

> do you thing ">" at the beginning of a line means?

If you count, you'll notice that the single ">" in my message was
inserted by _me_; your message lacked it, which is why I believed you
quoted improperly.

> than their ISP's mail server.  That's nothing to do with spam.

I don't know how you conclude that there's more business than
individual email; however, according to those with the ability to
measure, the majority of email is spam.

In any case, for the purposes of this sort of structure, a business
might as well be considered an ISP.

> payments to cover this thing they care about?

There is no "the ISPs".  There are lots of individual ISPs.  They
don't cooperate all that well.

Guess what will happen to the first ISP that demands payments to
receive email.  If you guessed anything other than "it won't get any"
you lose.

>  inter-ISP payments for email volume might work extremely well as a
> means of reducing spam (since it would encourage ISPs obliged to
> make the payments to crack down on it) if set at a high enough
> level, and would certainly work better on their own without the

How do you set it up and enforce it?  You can't get there from here.

> join.

So a low enough stamp cost won't deter spammers, and a higher stamp
cost will get them to join and still not deter them.

Seth

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 22 Apr 2004 13:01:21 -0400 (EDT)

>> Today's CAs do not revoke certificates for
> make money.

Nobody is going to trust an irrevocable mailing certificate, so nobody
is going to buy them.

In any case, revocation per se isn't strictly necessary.  For
instance, issue (at a noticeable price) one-day certificates, which
can be renewed a day at a time for free if they aren't used to sign
spam.  Non-spammers pay a one-time fee (refundable, even); spammers
lose their deposit for a single day of spamming (and even that runs
into BLs of "don't trust this certificate" which could be run by third
parties).

Seth

---

From: "Tom Thomson" <[email-masked]>
Date: Thu, 22 Apr 2004 19:31:15 +0100

Seth Breidbart <[email-masked]> worte
> Nobody is going to trust an irrevocable mailing certificate, so nobody

But there are hordes of CAs out there making money of what are, in effect,
irevocable certificates. How are you going to get CAs to change their
behaviour?

> into BLs of "don't trust this certificate" which could be run by third

That's an interesting idea. Of course the CAs have the problem of managing
daily renewals, which isn't a zero cost operation, but if every user of
email in the world needs a ertificate there's a big enough market to make a
good profit on small margins.

But will Aunt Mary be able to work out how to generate a key-pair and send
the public half off for signing, and install the certificate when it comes
back and install a new certificate every day when it arrives?  How much of
this can be automated for Aunt Mary in the MUA?  Do have you a less
complicated certificate mechanism in mind?

A possible problem: sometimes mail is sent to a machine that is currently
off line, and gets held in some relay (the outgoing mail server) for some
days.  Lets hope that the next machine down the line checks the
certificate's valididity for the date in the first Received header, not the
date at which it receives the mail, or the certificate will appear out of
date.  On second thoughts, let's hope it doesn't - or I can just stick a
fake received by header at the front of my mail and that certificate that
never got renewed because it was used to send spam can be used for quite
some time - but then it becomes hard to send mail from a machine that's
often off line to another machine that's often off line - you have to find a
day when they are both on line. Of course if email were always a single
end-to-end transaction life would be much easier.

Tom

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 22 Apr 2004 14:41:52 -0400 (EDT)

> irevocable certificates. How are you going to get CAs to change their

In deciding which email to receive (or allow to bypass strong
filtration), would you trust an irrevocable certificate from TrustE?
How about one from Verislime?  How about a revocable certificate from
Spamhaus?

If you want your email to be received, which of those would you buy?

> But will Aunt Mary be able to work out how to generate a key-pair
> and send the public half off for signing, and install the
> certificate when it comes back and install a new certificate every
> day when it arrives?

No, but Aunt Mary doesn't know how to send mail other than through her
ISP's mail swerver, which will take care of all that stuff for her.

> off line, and gets held in some relay (the outgoing mail server) for some

One possible solution is to check the old certificate for revocation.

Or, any outgoing server should have its own certificate, so it can
re-sign the message when it comes back online.

Any incoming server should check the certificate upon receipt; if the
user doesn't trust his own incoming server, he has bigger problems.

Seth

---

From: Matthias Leisi <[email-masked]>
Date: Thu, 22 Apr 2004 21:06:13 +0200

> complicated certificate mechanism in mind?

The MUA can handle that process transparently. Besides, it's not 
necessary for Aunt Mary to get her certificate signed by the Root-CA - 
this can be delegated, most likely to her ISP. The ISP would then need 
to get a signing certificate signed by the CA et voilà.

Of course that's a very different business models for CAs. Established 
CAs will want to fight with ISPs over who gets what percentage of Aunt 
Marys monthly charges.

OTOH, there is no need that the "mailing CAs" are the same as the 
oligopolistic list embedded in webbrowsers.

> date.

PKIs can be designed to allow for such overlaps.

-- Matthias

-- 
Braindump-Blog                             http://matthias.leisi.net/

---

From: Philip Miller <[email-masked]>
Date: Thu, 22 Apr 2004 19:22:44 -0400

Yakov Shafranovich wrote:
[snip earlier context because it's no longer relevant]
> do rate-limiting, then just do rate limiting and skip the e-postage.

The purpose of E-postage, as I see such proposals, is to make the cost of 
indiscriminate spamming prohibitive. This does inherently rate-limit, but 
the intent is that spammers' customers won't see anything close to the 
current ROI of spamming.

> to pursue discussion on it, we can spill it off into a separate ASRG list.

I think it would be good to establish a separate list for discussion of this 
nature. There are many people with fine ideas, and it would help to collect 
them in a list which doesn't have have the denizens screaming that e-postage 
is evil.

> work such double-spending.

As I said above, e-postage removes the economic incentives to spam. I really 
think that further discussion on the general list is not too productive.

Philip Miller

---

From: Barry Shein <[email-masked]>
Date: Thu, 22 Apr 2004 19:56:33 -0400

> same reasons with other means as well.

1. A way to measure and charge for resources consumed.

2. An incentive for measuring such things (like, claiming your
settlements if it came to that.) It would be a nice first result if
some sort of awareness resulted, like if someone's PC is being
exploited by a spammer whenever their screen-saver runs and their ISP
hasn't really paid attention maybe seeing "you sent 134,377 emal
messages yesterday" on sign-up might pique their interest.

And if their ISP can't be bothered to even do that then maybe when
*their* next level up or whatever, perhaps some large service they
would rather not lose contact with who is on the ball, says "you sent
16,333,432 messages to our customers last month, 20M would be
considered excessive" and lazy ISP says wait, I only have 5,000
customers, that's over 3,000 msgs/customer/month or 100/customer per
day just to this one service THAT DOESN'T SEEM LIKELY maybe I'd better
pay attention before I hit that 20M...

3. Would/Could turn spam into a simple "theft-of-service" sort of
crime, where it's fraudulently sent.

4. Most importantly, would have the potential (start down the road)
for making the economics of spam as we know it, sending out tens of
millions of spams per day just to get a few nibbles, impossible.

 > they would like such as FreeNet.

And we can't decrement TTLs in IP packets unless the email or other
service does end-to-end w/ the ISP?

I don't think so.

Again, a straw man model.

 > interesting thing is how will e-postage help with spam?

Because the fundamental cause of spam is the absence of any
relationship between resources consumed and resources paid for, to an
astronomical sense. So much so that I assert spamming cannot exist
without criminal abuse of others' resources. But this sort of approach
will also help control a rich and reasonably honest mass advertiser.

But that resource reality includes victims of spammers such as people
who won't secure open proxies etc (with some appropriate leeway for
mercy.)

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Thu, 22 Apr 2004 20:13:52 -0400

> is junk. So the charge for paper mail hasn't eliminated spam.

So you're saying unless it's zero then it's useless? I think this is
called "making the best the enemy of the good".

 > their machines so that they don't end up paying, but I'm not certain that

That's all, you just answered your own question.

 > that because it's both extremely difficult with current platforms and very

So I assume you have a foolproof, perfect solution to spam?

Or you're just determined to wait until one comes along and let the
status quo be?

My assertion is that if people are abusing free resources in a big way
then charge for them, set up a charging mechanism that deters the
abusers w/o discouraging the honest!

How hard is that to understand?

 > won't even stop until they've gone bankrupt).  They make the losses, he

So?

At least their money, or lack thereof, places an upper-bound on the
damage they can do. When they run out of money, they stop spamming,
what a wonderful result.

Just how much of the human condition are you trying to fix via this
topic?

I'd be more concerned about something like child porn on the net, in
general (nothing to do with spam per se), than the possibility that
someone might get conned by a spammer into sending email and lose a
few bucks on the deal. Just as a f'rinstance.

 > find the right pricing level, if there is one, but maybe there isn't a right

Now you're way out of anything this list could rationally deal with
(unless you're posting from some country with a centralized pricing
board.)

You let the market decide.

Put another way, do you think you and your friends emailing is
comparable to a spammer's? The more noxious spammers probably send on
the order of tens of millions of messages per day. Do you even send
tens of messages per day, upwards of 100? If not, then we're looking
at a millionfold difference in volume, and probably a lot more (the
spammer does it 7 days a week) between your habits and a spammer's.

I suspect that in a millionfold difference there's some room for
pricing decisions.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Thu, 22 Apr 2004 20:01:49 -0400

> do rate-limiting, then just do rate limiting and skip the e-postage.

Why would anyone do rate-limiting so long as they can entice customers
by offering them unlimited, free access to YOUR mailbox?

It's beginning to install a charging mechanism and charges which will
impose realistic rate-limiting.

But a good first step would be creating mechanisms whereby everyone
(well, at least ISPs or sizeable corps etc) can easily know what the
situation is in cold, hard, numbers.

 > work such double-spending.

Because money talks and bullshit walks, Yakov, in as few words as is
probably possible.

We may not move it all to an idealized charging/settlement system in
one fell swoop.

But we can begin to move down that road by thinking about resource
accountability and mechanism to help with that.

Hell, you can do other things with the numbers, that's one underlying
confusion, mechanism versus policy.

-- 
        -Barry Shein

---

From: mathew <[email-masked]>
Date: Thu, 22 Apr 2004 22:40:15 -0400

> ones could just spend a little CPU time.

No, it doesn't work like that. If it did, SSL would be useless.

Sure, I can generate a self-signed SSL certificate, but that's not 
going to get me anywhere. See 
<URL:http://milliwaysconsulting.net/support/install_ca/mail.app.html> 
for example, for discussion of the lengths you have to go to to get 
Apple Mail to accept some random person's SSL cert.

I guess the spammers could cold-call Aunt Tillie on the phone and walk 
her through the process of importing their self-signed certificate so 
that their bogus postage would be accepted, but at least it would slow 
them down a bit, eh?  And if the postage verification was performed by 
her ISP, they'd have to persuade *them* to accept SSL certs signed by 
"Nigerian Opt-In Communications Inc." or whatever.

Ask yourself why phishing sites don't use SSL.

mathew

---

From: mathew <[email-masked]>
Date: Thu, 22 Apr 2004 22:58:14 -0400

> can be achieved by e-postage, for a number of reasons.

Well, look at it this way: The *worst possible case* is that e-postage 
completely fails to make any dent in the amount of spam I receive, but 
I now get (say) 5 cents per spam in e-postage.

Looking at this month's statistics, I'd be getting $20 a month free 
money from the spammers. That's enough to pay for a free Internet 
connection. Heck, if I make my postage 10 cents, they'll be buying me a 
free cable modem connection. Now, that's a worst case I'm prepared to 
live with!

> is junk. So the charge for paper mail hasn't eliminated spam.

Do you get 50 pieces of paper junk mail every day? I don't. Maybe 
e-postage won't eliminate spam, but I'll settle for spam dropping in 
volume by a factor of 10 as a worthy start.

> not much of a deterrent to him.

On the other hand, he's now committing actual theft from thousands of 
people, which may gain the interest of law enforcement.

> won't even stop until they've gone bankrupt).  They make the losses, he

Hey, if a spammer can find enough suckers to buy me free Internet, I'm 
not complaining.

> So we don't know how high we have to set the price to get spam down to 
> a
> have to spend too much time filtering out the spam.

You mean no-one can afford to *risk* e-mailing you and *risk* having 
you cash the postage, right? Because you don't *have* to cash the 
e-postage...

> Maybe over time we can find the right pricing level, if there is one, 
> but maybe there isn't a right pricing level to find.

Well, there's only one way to find out, because we sure as hell can't 
trust the spammers to tell us.

mathew

---

From: Seth Breidbart <[email-masked]>
Date: Thu, 22 Apr 2004 23:07:56 -0400 (EDT)

> No, it doesn't work like that. If it did, SSL would be useless.

No, SSL encrypts.

> going to get me anywhere.

It does for a number of stores I shop at.

After all, what value does having a certificate signed by Verisign
actually provide?  If it turns out to be bogus and you lose money,
will Verisign compensate you?  Does Verisign have any actual
responsibility to you, the truster of a certificate they issued?

Or do you just like the assurance that "This certificate was issued by
somebody who paid (somebody who paid)* to have a root certificate
pre-implanted in my browser"?

> Ask yourself why phishing sites don't use SSL.

Why should they bother?  Would it increase their success ratio?

Seth

---

From: John Levine <[email-masked]>
Date: 23 Apr 2004 05:05:51 -0000

> payments between its members, why should an email system?

I think it would be a good idea to look at this page:

http://www.upu.int/payment_compensation/en/index.html

You might want to take a look at http://www.upu.int in general.

Don't miss the page where it says that their new low-cost online
settlement clearing system costs betwen CH 1500 and CH 15000 per
year (CH == Swiss francs) depending on how big you are.

R's,
John

PS: I agree with everyone who says that rate limiting outbound mail
from customers you don't know well is a good idea.  But of course you
can do that without faux postage.

---

From: John Levine <[email-masked]>
Date: 23 Apr 2004 05:12:58 -0000

>I now get (say) 5 cents per spam in e-postage.

No, the worst possible case is that you get just as much spam as you
do now, you get paid nothing for your incoming spam becasue spammers
subvert the charging system, and your monthly ISP bill goes up to pay
for the overhead of the complex but useless e-postage system.

A common FUSSP error is to assume that spammers will play by your
rules.

Regards,

---

From: "Tom Thomson" <[email-masked]>
Date: Fri, 23 Apr 2004 11:22:44 +0100

> called "making the best the enemy of the good".

No, I'm saying that 65% is far too high.  I receive as much email in a day
as I receive paper mail in a month, and that higher volume burden of
tripling the mail volume with junk mail is much greater.  Currently I don't
see the proportion of spam in (free) email as being much different from the
proportion of spam in (paid, stamped) paper mail so it's not obvious that
switching to a paid, stamped system will improve things.  Other people will
have different experience, for example Alan De Kok seems to see a vastly
higher proportion of spam, whereas some of my colleagues (those who don't
post to ietf lists which publish email addresses of correspondents on a
public web page, for example) see a much lower proportion of spam.

So I would call it "making my self the enemy of something that will cause a
lot of pain and will probably have no useful effect on the problem".

> That's all, you just answered your own question.

No I didn't.  I made the point that the effect of people securing machines
will be marginal at best (unless thr providers of Unix and Windows systems
get their acts in order - and I'm not holding my breath for that).

> So I assume you have a foolproof, perfect solution to spam?

No. If I had I would publish it. At the moment the best approaches I can see
are (a) Seth Breidbarts's proposal for expensive 1 day certificates with
free renewals for non-spammers, (b) a means of source verification combined
with anti-spam legislation and enforcement of it, (c) getting ISPs to do
outgoing spam filtering in their smart-hosts (to eliminate a lot of zombie
spam), (d) getting ISPs to check stuff at their borders (the envelope From
address for something passing out should be inside the boundary), and (e)
getting ISPs to check that the From addresses in mail pushed through their
servers match the dial-up or ADSL connection it arrived on.  Of these, (c),
(d), and (e) have been proposed quite regularly for over a decade, but most
ISPs don't want to know because it solves someone else's problem not theirs,
so I'm not expecting any of those to happen quickly.

> Or you're just determined to wait until one comes along and let the

No. I want to see things like LDAP and Seth's proposal embodied in RFCs
(some of which will eventuially become standards track RFCs) and things like
items (C), (d), and (e) on my list embedded in BCPs for mail server
operators.  I would also like to see more solutions proposed and debated in
groups like this, so that we can get more proposals onto the standards
track.  Of course I#d also like to see secure bersions of %NIX and Windows,
to kill off zombie spam and zombie relays, but as I said I'm not holding my
breath on that one (thirtyfive years ago we knew how to build secure systems
and how to write operating systems in high level languages to avoid the sort
of flaws which we see so often today;  then came C and C++ and operating
systems written inthose languages, and we've no hope of building a secure
system).

> How hard is that to understand?

No, it's not hard to understand.  It would be nice if we could do it.  I
haven't seen a proposal that sets out a mechanism for doing it yet, though
(apart from Seth's that I proposal referred to above) - just some claims
that it's achievable by some variant of a stamp system.

> Just how much of the human condition are you trying to fix via this

You miss the point.  I don't much care if the idiots lose money.  what I
care about is that the spammer (the guy who persuades them to send out his
email for him) still makes money, so he will continue to spam.  If there
were few enough idiots in the world that switching some of them off by
bankrupting them would eliminate the spammer's supply of idiots who will
fall for his scam and send his mail for him, I would be supporting your
ideas instead of opposing them.  But as I said, there' one born ebery
minute - there are just too many.

> few bucks on the deal. Just as a f'rinstance.

Me too.  But it's completely off topic here.

> (unless you're posting from some country with a centralized pricing

You're now saying that the list can't rationally deal a pricing level for
email.  So are you being irrational when you say that the list should say
that that pricing level should higher than it is now?  I don't think you are
being irrational, and I don't believe that you think you are either, so I
have to conclude that you made that statement without thinking about what it
meant.

> You let the market decide.

The market decided about two decades ago. It decided that the marginal cost
of email should be zero, or as close to it as makes no matter.  The market
has grown since then, and changed in other ways of course, but it hasn't
changed this decision.

Tom

---

From: "Tom Thomson" <[email-masked]>
Date: Fri, 23 Apr 2004 12:40:22 +0100

> http://www.upu.int/payment_compensation/en/index.html

You're quite right.  I was relying on someones incorrect description of the
European Court of Justice decision against the German postal service in
cases C147/97 and C148/97.  Your email has made me go and look up the case,
and of course it turns out to be totally irrelevant to terminal charges
(which my informant told me had been abolished within the EU, citing these
cases as evidence for it). That'll teach me to check the references when
someone gives me news.  If I'd though about it properly, I would have
realised that operating without terminal charges within the EU would have
been impossible from 1 Jan 2003 anyway (when postal service liberalisation
was supposedly enforced).

Tom

---

From: Daniel Feenberg <[email-masked]>
Date: Fri, 23 Apr 2004 08:27:16 -0400 (EDT)

> year (CH == Swiss francs) depending on how big you are.

Traditionally (for 100 years or so) post offices exchanged first class
mail without the exchange of funds, but the rules always required that
such mail hav substantial postage affixed at the source, it is just that
the revenue was not shared with the receiving country PO.

Parcel post has always involved settlements, as far as I know.

Analogies do not make for strong arguments, and I can't tell if this one
favors e-postage or not. The situations are quite different and little is
to be learned by assuming the lessons of one are relevant to the other,
although certainly they can be a source of ideas or inspiration. It does
show that it is possible to have postage without settlements.

Daniel Feenberg

---

From: John Levine <[email-masked]>
Date: 23 Apr 2004 17:08:54 -0000

>the revenue was not shared with the receiving country PO.

Some sources claim that terminal dues weren't introduced until 1969,
others suggest that transit and terminal payments were always
collected.  Hardly matters for this argument.

>favors e-postage or not.

The main point I was making is that settlement schemes are very
complex, and are not cheap to implement.

I agree that we can exchange e-mail without settlements.  After all,
that's what we do now.  But in the absence of settlements, nobody's
ever offered a persuasive argument for e-postage other than rate
limiting.  If you want to rate limit, you should rate limit, no need
to pretend that stamps are involved.

Regards,

---

From: mathew <[email-masked]>
Date: Wed, 28 Apr 2004 20:24:26 -0400

>> No, it doesn't work like that. If it did, SSL would be useless.

SSL with certificates can also authenticate, and that's the kind of 
functionality that's needed for e-postage.

> actually provide?

It provides assurance that the system you are connecting to is one 
approved by Verisign.

So, what value does e-postage signed by Verisign have? Well, it might 
hypothetically have the value that Verisign will redeem it for cash.

Now, I notice you deleted my challenge, so let me re-state it. If you 
think SSL certificates are worthless and easily bypassed, let's see you 
generate one which my browser will accept without throwing up a warning 
that it's bogus.

> Why should they bother?  Would it increase their success ratio?

It would if they could get the certificate to be accepted without any 
warning, the connection to show as secure, and the certificate to state 
that they really are the institution they're pretending to be. If they 
could do that, they might fool people like me. But they can't, which is 
the entire point.

mathew

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 28 Apr 2004 22:46:43 -0400 (EDT)

> functionality that's needed for e-postage.

It _can_, but it doesn't for https necessarily.

> It provides assurance that the system you are connecting to is one 

And what value is "approval by Verisign"?  Aren't they the company
that once generated a bogus Microsoft certificate?

How much effort do they put into validating anyone who tries to buy a
certificate?

> hypothetically have the value that Verisign will redeem it for cash.

How do you prevent re-use?  Every recipient would have to query
Verisign immediately before accepting the email.  Do you really think
they could handle it?

> generate one which my browser will accept without throwing up a warning 

Why should I bother?

> could do that, they might fool people like me. But they can't, which is 

Sure they could.  That's why they register domains that sort of look
like the company they're phishing.  Look at, for instance,
ebaysecurity.com; do you really think ebay registered a domain using
"freeservers.com"?

Seth