Subject: RE: DNS Choices: Was: [ietf-dkim] Re: Last Call: 'DomainKeys

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 6 Dec 2006 08:30:52 -0800

> From: Jeffrey Hutzelman [mailto:[email-masked]] 

> As is my usual practice, I asked the post office to hold my 
> mail while I was away at IETF 67 (this is a standard service 
> offered by the US Postal Service at no charge).  I took some 
> time off after, so when I finally picked up my mail, it was 
> about 3 weeks worth.  I received a plastic shopping bag full 
> of mail, and after I sorted through it, I had several bills 
> and a grand total of three other pieces, all of which were 
> prearranged (an issue of QST, a newsletter, and an 
> invitation).  The rest of the bag was spam.

I agree that this demonstrates that the 'charge per email' schemes that people have don't work.

But if postal mail recipients could impose filters they would.

And there is in point of fact an entire police force tracking down scam artists using the postal mail.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: [email-masked]
Date: Wed, 6 Dec 2006 16:59:31 +0000

> scam artists using the postal mail.

It is rare for blatantly illegal scams to come through postal mail since 
in order to get bulk mail rates, the sender has to be identifiable and 
accountable.

The bulk of my unwanted postal mail is actually somewhat relevant since it 
is for products and services that are sold in England or my district of 
London. But I get lots of email for products in Russia, Canada, China, 
Korea and the USA which I could not possibly buy. 

Analogies can only take you so far.

I think the real lessons from postal mail come from a fairly abstract 
level. For instance, requiring more effort to send the mail means that 
there is less frivolous mail. Accountability of the sender reduces the 
volume of illegal or abusive mail to a trickle. In the email world we 
would likely use very different mechanisms to require some per-message 
effort by senders or to make senders more accountable. No doubt any such 
mechanisms would be subvertable but again, the lesson is that if it 
requires EFFORT to subvert the mechanism, then it does reduce the 
magnitude of the problem and that in itself may be sufficient to "solve" 
the problem.

--Michael Dillon

---

From: David Morris <[email-masked]>
Date: Wed, 6 Dec 2006 10:45:21 -0800 (PST)

> I agree that this demonstrates that the 'charge per email' schemes that

It doesn't demonstrate any such thing. The physical junk mail I receive is
much more targeted to my family than spam is. I wouldn't bother with spam
filtering if I only got 5-10 junk emails per day. At 350-450 spams per
day, I can't afford not to wory about filters.

In addition to postage, physical mail has significant production costs.
Some junk mail probably costs more than $1 per mail piece. Big incentive
to send it carefully. There is a very low production cost for spam, even
the legitimate retailers who send well designed electronic spam only have
design costs and no significant per piece cost.

It is pure naviety to assert that increasing the cost of sending spam will
not reduce the amount sent. The operative word is REDUCE. Also note that
my choice of words was 'cost'. There are many ways to associate cost with
sending spam.

It isn't a trivial technical problem to revise the electronic message
infrastructure to arrange for payment of postage but to assert that it
can't be done or wouldn't be deployed flys in the face of the relatively
short time frame for adoption of the WWW or IM.

Do you truly believe that if a reliable alternative to the current email
infrastructure were available, which could operate in parallel with the
current infrastructure in which you got minimal unsolicited email, it
wouldn't be quickly adopted by major players?

Dave Morris

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 6 Dec 2006 14:32:24 -0500

On Wed, 6 Dec 2006 10:45:21 -0800 (PST)
David Morris <[email-masked]> wrote:

> can't be done or wouldn't be deployed flys in the face of the
> relatively short time frame for adoption of the WWW or IM.
> 
The problem, of course, is that the spammers would steal email postage
the same way they steal cycles and bandwidth.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: David Morris <[email-masked]>
Date: Wed, 6 Dec 2006 11:43:10 -0800 (PST)

Sure, but that then becomes an actual crime in most juristictions.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 6 Dec 2006 14:52:22 -0500

On Wed, 6 Dec 2006 11:43:10 -0800 (PST)

> Sure, but that then becomes an actual crime in most juristictions.

Given that most spam is fraudulent anyway, and is sent using stolen
resources, it's already two different crimes.  That doesn't seem to
have stopped it....

From today's NY Times, on the recent spam explosion:

	But as a result of the Can-Spam Act, which forced domestic
	e-mail marketers to either give up the practice or risk jail,
	most active spammers now operate beyond the reach of American
	law enforcement.

Beware unintended consequences...  (The full article is at
http://www.nytimes.com/2006/12/06/technology/06spam.html?pagewanted=2&ref=technology )

---

From: John Levine <[email-masked]>
Date: 6 Dec 2006 20:48:55 -0000

>short time frame for adoption of the WWW or IM.

If I had a tenth of a cent for every time someone assumed the
existence of a global low-cost highly reliable micropayment clearing
system, it wouldn't matter, because there is no such a system and
never will be, so I couldn't collect it anyway.

The problems that make e-postage impossible are entirely unlike the
ones that might have faced WWW and IM.  It's basically a banking
problem, not a software or networking problem.  I wrote a white paper
a couple of years ago that laid out the situation, which only needs
some minor updates to make the numbers even less favorable than they
were then.  Visit http://www.taugh.com, where it's white paper #1 near
the bottom of the page.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

---

From: Peter Sherbin <[email-masked]>
Date: Wed, 6 Dec 2006 18:42:00 -0800 (PST)

> I agree that this demonstrates that the 'charge per email' schemes that people

Some users seem always find a way to do harm with innocent things (a sort of a
normal distribution, I guess). In the case of postal mail at least the post office
has collected money. By the same token for a provider any paid e-mail including spam
is a source of revenue.

> And there is in point of fact an entire police force tracking down scam artists

____________________________________________________________________________________
Want to start your own business?
Learn how on Yahoo! Small Business.
http://smallbusiness.yahoo.com/r-index

---

From: Peter Sherbin <[email-masked]>
Date: Wed, 6 Dec 2006 19:13:50 -0800 (PST)

Just recently NA providers have introduced an encrypted mail. It requires a PC
client to encrypt the message. User retrieving the message does not need a client
but requires a password. It cost about 100 a year per account. The product is in its
early stage but some verticals show interest. It is interesting to see its impact on
e-mail. E.g. user controls her sender/recipient list and filters out all others.   

> wouldn't be quickly adopted by major players?

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

---

From: Dave Crocker <[email-masked]>
Date: Mon, 11 Dec 2006 08:33:26 -0800

> short time frame for adoption of the WWW or IM.
adoption

I suspect you already know this, given your language, above, but its possible to 
confuse a distinction yo imply:

There is a fundamental difference between adopting a new service, versus 
revising an existing one.  WWW and IM were new.  No concern over protecting the 
installed base.

It is one of the reasons that successful revision efforts which take a shorter 
time attempt to do so in a way that emulates adopting a new one.

MIME is a particularly successful version of that.  No changes to the 
infrastructure.  Didn't break recipient software that didn't support it.  And 
delivered a message that was still moderately readable for the non-supporting 
recipient.  (Oh, and the recipient could incorporate MIME, later, and be able to 
enjoy its features.)

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net