Subject: [Asrg] Answering a lot of questions about e-postage in a few sentences

From: Barry Shein <[email-masked]>
Date: Fri, 23 Apr 2004 14:12:29 -0400 (EDT)

Yes you can equate e-postage to just rate-limiting etc. Why that
seemingly simple thought just hasn't saved the day would seem to beg
its own analysis.

The problem is that spam has a huge social and economic component.

I have noticed that money and the prospect of making some tends to
cause changes in behavior. I'm trying to figure out how to make it
profitable for those who can make a difference to not spam or tolerate
spammers. Some mechanism, metering etc, might facilitate that new
order.

The only way we're going to fight spam is not with a little technical
frill because you'd still have the whole problem of policy, of getting
ISPs et al to adopt it. 

That's why I have little to zero faith in purely technical approaches
that lack social/economic and even legal perception.

It's like listening to someone equate masturbation with successful
child-rearing; surely there are necessary if not sufficient critical
commonalities between the two but let's be frank jerking off is just
jerking off.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 23 Apr 2004 18:15:35 -0400

> that lack social/economic and even legal perception.

Barry,

You are correct! Only a combination of policy with technology or policy 
by itself can help. However, I think that there are other possibilities 
to achieve the same effect without end-to-end e-postage.

The basic thought behind e-postage is that resources that are being used 
should be charged for. Today we already have one such system which is 
working sucessfully every day - the Internet. ISPs charge each other for 
uplink and downlink bandwidth and resources used. Now, lets say 
hypothetically speaking that all ISPs would charge their customers extra 
for lets say more than 1000 emails/day. Would it achieve the same effect 
as e-postage? Why isn't this model working today?

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Some lies are easier to believe than the truth" (Dune)
-------

---

From: Philip Miller <[email-masked]>
Date: Fri, 23 Apr 2004 19:10:55 -0400

Yakov Shafranovich wrote:
> [snip Barry's words and YS's policy comment]

Hypothetically, it works in the sense that each step upstream (in 
connectivity, not mail transmission) is charging those immediately 
downstream for messages transmitted. This means that even if spammers 
establish their own ISP, they will be charged by their uplink provider.
However, this doesn't rectify the essential flaw that receivers bear the 
cost burden of email, not senders. Even if this raises the cost to send 
imposed on the sender, it in no way reduces the cost to the receiver.

Philip Miller

---

From: Barry Shein <[email-masked]>
Date: Fri, 23 Apr 2004 22:17:02 -0400

No activity towards establishing some reliable standards for metering
et al. It'd be difficult for a non-neutral party to just assert
standards in an area like this. It'd be better to outline some
potential standards and then get feedback from those with a reasonable
interest, the usual building of consensus cycle.

Whatever happened to MS's "caller-id"? Is that dead or did it
disappear into another group? Seemed there was a lot of talk about it
and since I've heard nothing. Did they ever manage to get a completed
example installed for their own domains?

	-b

---

From: Philip Miller <[email-masked]>
Date: Sat, 24 Apr 2004 00:12:08 -0400

> interest, the usual building of consensus cycle.

Sounds reasonable.

> example installed for their own domains?

MS's point man on C-ID, Harry Katz, is very active on the MARID WG list, 
ietf-mxcomp AT imc.org

The records for their domain include a number of hosts identified by IP 
address, as well as their MX's. Aside from a single IP with NXDOMAIN rDNS, 
all of the listed IPs have .microsoft.com PTR records. From that, plus the 
naming in those PTR records, I'm pretty sure their C-ID records do not 
include other corporations that send mail on their behalf. However, that 
doesn't mean that such mail would not be accepted by C-ID, because of it's 
header check ordering.

Philip Miller

---

From: cw <[email-masked]>
Date: Sat, 24 Apr 2004 14:56:53 +0100

Hi folks,
I have been doing a lot of digging around with various anti-spam proposals and one thing that crossed my mind is in relation to IM2000. (http://cr.yp.to/im2000.html)
Incase there is anyone here unaware, IM2000 essentially proposes pushing the message queues back to the sender so that people closer to the recipient do not have to pay and those closer to the sender are given more motivation for doing something about the sender.
The proposal would require some significant infrastructure overhaul as would many to get it implemented, but (and I am just thinking on my feat at the moment) would it be possible to overlay something based on this onto the existing infrastructure?

To expand, if your incoming mailserver rejects all inbound messages with a transient error and notifies the recipient. The recipient can then elect to allow any similar messages through if the remote server tries again within a set period of time.
This may have to second guess how many times the remote server will retry before giving up, and either allow or reject the message with a permanent error if the recipient does not express their will in time.

Either way, if the message is legitimate but ends up being bounced, a clear message could indicate why and recommend trying again or contacting the user via other means to arrange to allow the message through.

What are the implications of running a system like this other than having to develop a frontend for local users?
Regards,
Colin.

---

From: Devdas Bhagat <[email-masked]>
Date: Sat, 24 Apr 2004 20:12:15 +0530

On 24/04/04 14:56 +0100, cw wrote:
> Hi folks,
> I have been doing a lot of digging around with various anti-spam proposals
> and one thing that crossed my mind is in relation to IM2000.
> (http://cr.yp.to/im2000.html)
> Incase there is anyone here unaware, IM2000 essentially proposes pushing
> the message queues back to the sender so that people closer to the
> recipient do not have to pay and those closer to the sender are given
> more motivation for doing something about the sender.
> The proposal would require some significant infrastructure overhaul as
> would many to get it implemented, but (and I am just thinking on my feat
> at the moment) would it be possible to overlay something based on this
> onto the existing infrastructure?
What about offline hosts? And when does the local copy get deleted?

> 
> To expand, if your incoming mailserver rejects all inbound messages with
> a transient error and notifies the recipient. The recipient can then
> elect to allow any similar messages through if the remote server tries
> again within a set period of time.
A variant on greylisting with human intervention.

> This may have to second guess how many times the remote server will retry
> before giving up, and either allow or reject the message with a permanent
> error if the recipient does not express their will in time.
A (mis)feature which greylisting avoids by allowing mail through on the
second try.

> 
> Either way, if the message is legitimate but ends up being bounced, a
> clear message could indicate why and recommend trying again or contacting
> the user via other means to arrange to allow the message through.
> 
> What are the implications of running a system like this other than
> having to develop a frontend for local users?
Avoid the frontend by using greylisting. The effect that this has had is
that spammers use full fledged SMTP servers to spam, rather than open
proxies. It hasn't had much real benefit, but greylisting was useful.

Devdas Bhagat

---

From: cw <[email-masked]>
Date: Sat, 24 Apr 2004 16:31:24 +0100

> What about offline hosts? And when does the local copy get deleted?

I don't quite understand your question. If it is something on the specifics of IM2000 then it would be best directed at the IM2000 mailing list as I have only done a brief review of the principals and am not involved with that project.

*snip stuff on greylisting*

I am aware of greylisting, though I hadn't considered what potential benefits over greylisting such an approach would provide. Off the top of my head, I think of viruses as an example.
If these are sent as normal messages, then they will pass greylisting as the legitimate servers will call back. Adding the layer of human intervention would potentially be able to allow viruses to be rejected. Thinking further though, it would be difficult to identify some virus messages from legitimate messages without scanning the body.
I guess it would also prevent abandoned mailboxes that someone forgot to delete from growing in size and taking up more than zero bytes of storage, but good housekeeping should limit the effect of that anyway.

It is just an idea, if there aren't any real benefits over greylisting (and my head is too full of Trust management systems at the moment to think about it too much) then that is that. If someone can think of reasons why it would be beneficial as opposed to greylisting then at least the idea is out there.

>It hasn't had much real benefit, but greylisting was useful.

With regards to this specific line, do you have any specific links or other evidence to support that statement? It would be useful for the report I am writing at the moment.
Regards,
Colin.

---

From: JC Dill <[email-masked]>
Date: Sat, 24 Apr 2004 11:41:55 -0700

>imposed on the sender, it in no way reduces the cost to the receiver.

Here is the underlying problem with the ePostage proposal:

         In order for this to work, everyone has to implement it.

If we get everyone to implement ANY new proposal that makes it harder (more 
costly, harder to prove you are a legitimate sender, whatever) to send bulk 
email, it goes a long way towards solving spam (sent in bulk).  We don't 
need some ePostage scheme to make this work, we need a new protocol that 
everyone agrees to use, and a system for transitioning between the existing 
SMTP protocol and the new protocol, and widespread agreement to implement 
the new protocol.  Trying to add ePostage on top of all of this adds an 
additional layer of complexity for no useful (spam stopping) gain.

Then we can expect to see spammers move towards sending spam "not in bulk" 
by increasing use of zombie PCs, having millions of zombies sending 1 email 
an hour.

jc

---

From: Barry Shein <[email-masked]>
Date: Sun, 25 Apr 2004 14:50:54 -0400

>          In order for this to work, everyone has to implement it.

Ultimately? Perhaps.

Incrementally, certainly.

I'd imagine a period where the numbers are just sent around to begin
to get a feel for what it'll be like and then individuals or
organizations or ISPs begin to just block or otherwise treat as
potential spam any e-mail w/o legitimate postage and slowly crank up
the "volume".

I think the same sort of evolution gets proposed with schemes such as
caller-id etc. where at first it's only advisory and then slowly but
surely as most sites comply becomes more and more mandatory which can
be incremental in and of itself (warning sent, marked as possible
spam, quarantined automatically, finally blocked.) Not that I like
caller-id, but the concept is fairly common to the various proposals.

I'd imagine the economic incentives for e-postage could make for a
fairly rapid deployment but that doesn't imply that babies must be
thrown out with the bathwater.

-- 
        -Barry Shein

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 25 Apr 2004 15:41:02 -0400

[Replying to multiple messages]

Philip Miller wrote:
>> The basic thought behind e-postage is that resources that are being 
>> used should be charged for. Today we already have one such system 
>> which is working sucessfully every day - the Internet. ISPs charge 
>> each other for uplink and downlink bandwidth and resources used. Now, 
>> lets say hypothetically speaking that all ISPs would charge their 
>> customers extra for lets say more than 1000 emails/day. Would it 
>> achieve the same effect as e-postage? Why isn't this model working today?
> 
> 

A few comments on this.

First a hierarchy structure for e-postage must solve the settlement 
problem although I don't know how the business side of it will work it. 
For example, if each receiving ISP would let the uplink provider 
negotiate on their behalf, and the uplink provider would combine the 
total e-postage costs for their customers and negotiate on their behalf 
with other provider, that might reduce the problem. Or maybe not.

But in any case, you basic distinction is correct - the receivers bear 
the cost burden. However, IMHO it is not only the receivers - the 
senders and the intermediate systems do as well. However, the cost of 
processing unwanted email versus simple bandwidth costs is much greater 
on the receiver's side. In other systems cited as examples, there is no 
concept that the receiver can charge for resources consumed. The closest 
example is inter-phone company, or inter-post office settlements, but 
the individual receivers have no power to charge. Therefore, were the 
bandwidth costs of postal service minimal to allow marketing companies 
to deluge your mailbox, I am not sure if the receivers would be able to 
do much.

> Jonathan Morton wrote:
>> First things first.  The resource being consumed/abused is the 
>> recipient's inbox.  Therefore we need to make any charge a condition of 
>> entry into a participating recipient's inbox.  That means the recipient 
>> is the one who needs to decide whether a stamp is needed, and whether 
>> any given stamp is sufficiently valid.
>> 

What makes it more interesting is that existing postal, phone and fax 
systems do not operate this way. Under normal circumstances, the sender 
alone pays for resources consumed during the transport of his message. 
If postal service would charge 1c for transporting junk mail, nothing 
stops companies from sending thousands of mailings to your house since 
there is no charge for entry into your mailbox. On the Internet however, 
the transport charges for bandwidth are so minimal that it makes it 
worthwhile for spammers to deluge your mailbox.

What we are talking about introducing an ability for the receiver to 
charge for entry into his inbox like Jonathan is saying above. A similar 
notion of interrupt rights and charging for them was floated in a 
research paper recently. What is interesting is that such notion does 
not exist in the postal system aside from inter-post office settlements 
where still the post offices of each countries are not charging for 
interrupt rights BUT are charging for the transport costs to deliver the 
message to the postal boxes of customers.

While the idea sounds swell in theory, it needs more work in practice, 
especially the part about costs vs. benefits. Of course the recipient is 
always free to do whatever he wants, so a distributed system where the 
recipient gets to decide if he can charge for entry to his inbox can 
work if there are standards in place for negotiating that.

> Philip Miller wrote:

IRTF activities are usually not geared toward making standards, rather 
toward long term research in outlining some potential standards. When we 
get an idea sufficiently congealed with enough interested stakeholders 
and enough community interest, we pass it on to the IETF for standards 
development.

Therefore, if you want to start outlining some potential work, go right 
ahead. BUT keep in mind that along for such outline it needs to be shown 
that the idea in question will provide enough anti-spam benefits vs. the 
costs of implementation.

Yakov

-------

---

From: Barry Shein <[email-masked]>
Date: Sun, 25 Apr 2004 16:09:10 -0400

> with other provider, that might reduce the problem. Or maybe not.

Why? Why do you imagine this?

For example, when the USPS puts postage bound for France on a United
Airline flight then, you imagine, they buy stamps from United Airlines
for each letter or somehow resolve the sharing of postage with them in
some complex piece by piece method?

Nonsense! They pay the airline for space or weight or something
similar.

Much like an ISP would pay the next tier up for bandwidth to deliver
the email injected into the system by their customers.

I'm not saying it's impossible that there might be some other charging
method sensitive to per-piece costs, but I am saying that there is NO
other way is nonsense. Nonsense because given the way other analogous
media is handled it's the least likely way e-postage would be handled.

So it's a pure straw man. They'd have to do this, this is unworkable,
so the idea is unworkable. Nonsense, they don't have to "do this"
as your antecedent demands.[q

 > the cost burden. However, IMHO it is not only the receivers - the 

No, it's not correct.

If that were the case you'd be charging your ISP for the privilege of
letting you have an internet connection.

Huh?

 > on the receiver's side. In other systems cited as examples, there is no 

First, "much greater" does not equate with "insignificant" (to the
other side), or ignorable.

Second, at this point for every spam you see probably 100,000 or
thereabouts are being processed due to the number being filtered out
on plausibility grounds (e.g. refusing mail with no legitimate domain
or rdns) and the non-stop, high-powered spew of essentially dictionary
and similar attacks.

So, when you begin to figure in the lower cost per piece you actually
ever see in your mailbox and the relative cost versus the flood of
millions per day you don't see maybe those costs begin to come more
closely into line.

At any rate, no system I can think of outside of e-mail is purely
geared towards resolving some sort of receiver pays other than some
much-maligned, relatively recent cell-phone systems and even on those
there's much activity to either block or change the charging for
marketing calls.

But telephone in general, postal, sender pays.

This fiction seems to only exist on this list.

It makes me wonder what the actual agenda is when there's such
strenuous advocacy for a model which is so far disconnected from
reality.

-- 
        -Barry Shein

---

From: der Mouse <[email-masked]>
Date: Sun, 25 Apr 2004 16:22:30 -0400 (EDT)

> But telephone in general, postal, sender pays.

This is because no other system outside of e-mail has the same
underlying cost structure that e-mail does.  The phone system perhaps
comes cloest - and, surprise surprise, that's the system where the
analogue of spam is most hated and most acted against.

> This fiction seems to only exist on this list.

It's not a fiction.  It's a fundamental difference between e-mail and
all those analogies people seem to like so much, a difference that is
in large part why the analogies are flawed.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Jonathan Morton <[email-masked]>
Date: Sun, 25 Apr 2004 22:23:46 +0100

>> there's much activity to either block or change the charging for

I don't think anyone's suggesting the recipient should pay for e-mail.  
What we do want is for the sender to pay the recipient's costs, because 
the recipient's costs are much greater than those due to mere 
transport.

--------------------------------------------------------------
from:     Jonathan "Chromatix" Morton
mail:     [email-masked]
website:  http://www.chromatix.uklinux.net/
tagline:  The key to knowledge is not to rely on people to teach you it.

---

From: Barry Shein <[email-masked]>
Date: Sun, 25 Apr 2004 17:29:08 -0400

> analogue of spam is most hated and most acted against.

Electricity too cheap to meter!

GE used to use that slogan, in the 1960's, to sell the idea of nuclear
power plants.

It's always suspect, tho not a priori false, and certainly suspect
here, for the very reason we're here; it becomes abused.

 > in large part why the analogies are flawed.

I'm not sure using the two words "fundamental difference" as an
emphasizer clinches it, maybe "literally" different, nah that grates,
um, ...

It's not "fundamentally different", it's mostly different as a matter
of a degree, different costs, which would seem to argue "fundamentally
the same".

Amazing what a slippery thing the truth is.

But, an infrastructure capable of carrying millions/billions of
individual communications events etc at a relatively low-cost to the
end-users, which can be flooded by abuse.

Fundamentally the same, different cost factors, but the same can be
said about a lot of similar things.

-- 
        -Barry Shein

---

From: der Mouse <[email-masked]>
Date: Sun, 25 Apr 2004 17:45:56 -0400 (EDT)

> GE used to use that slogan, in the 1960's, to sell the idea of
> nuclear power plants.

> here, for the very reason we're here; it becomes abused.

I know someone who has phone service with, effectively, a
continent-wide local calling area.  (That is, one flat fee per month
(USD 40.00 is what I recall) covers all calls within North America.)

I gather it's new and thus relatively experimental, but people don't do
such things unless they have reason to think they will succeed
commercially.

>> It's not a fiction.  It's a fundamental difference between e-mail
>> and all those analogies people seem to like so much, a difference
>> that is in large part why the analogies are flawed.
> of a degree, different costs, which would seem to argue
> "fundamentally the same".

It is a fundamental difference in that it is a difference at the
foundation (the "fundament").  It is a quantitative, rather than
qualitative, difference, yes, but it is still fundamental.  (Actually,
given how much of the reason it matters is social, I think a good case
could be made that it is a quantitative difference large enough to have
become qualitative.  I'm not going to more than mention it, though,
bceause I don't think it really matters whether it's thought of as
qualitative or quantitative: it's drastic enough either way.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: John Levine <[email-masked]>
Date: 26 Apr 2004 02:12:09 -0000

>Electricity too cheap to meter!

Actually, telephony has become too cheap to meter.  Every local
service provider from Verizon to Vonage has an unmetered plan that
they're trying to get people to buy.

The possiblities of abuse are limited, since the number of phone calls
you can make is limited by the fact that you only have one mouth to
speak out of, and the most annoying kinds of phone overusage abuse,
telemarketing and junk faxes, are already heavily regulated or
illegal.

This tells me that it really is a poor analogy for e-mail, since one
of the things that makes spam possible is that you can send a whole
lot of mail from a modest IP connection.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Barry Shein <[email-masked]>
Date: Mon, 26 Apr 2004 17:14:49 -0400

> such things unless they have reason to think they will succeed

Where, in this particular case, success may be measured in gaining
enough market-share by driving your competition into bankruptcy that
you can then charge whatever you like.

Ask them for a 10 year or 25 year guarantee on flat-rate service, even
w/o any pricing guarantee and tell us how they answer.

Well, ok, unfair question because you'd never get an answer for other
reasons of course.

But I think you get my point: This very new pricing regimen from long
distance carriers may not be indicative of anything other than a
frothy marketplace.

-- 
        -Barry Shein