Subject: RE: namedroppers, continued

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Fri, 6 Dec 2002 16:48:46 -0600

[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
  and therefore delete posts by non-subscribers.  if you wish to regularly
  post from an address that is not subscribed to this mailing list, send a
  message to <listname>[email-masked] and ask to have the alternate
  address added to the list of addresses from which submissions are
  automatically accepted. ]

> Too bad nobody has ever thought of it 
> before; we  could really use the outcome 
> of that research
while researchers has not thought about global
PKI, their are research which focus on spam 
elimination.

this is the work all about (yesterday's seminar in a MIT group)

" If I don't know you, and you want your e-mail to appear in my
  inbox, then you must attach to your message an easily verified
 "proof of computational effort", just for me and just for this
 message.

If the proof of effort requires, say, 10 seconds to compute, then the
economics of sending spam are radically altered, as a single machine
can send only 8,000 messages per day.

The recent proliferation of spam has lead to a renewed interest in
these ideas.  This  work is about both the choice of
functions that can be used to yield easily verifiable proofs of
computational effort, and architectures for implementing the proof of
effort approach.  Filtering and/or forcing senders to pay in other
currencies, such as human attention and money, will be covered as time
permits"

for more details http://research.microsoft.com/research/sv/PennyBlack

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Dean Anderson <[email-masked]>
Date: Sat, 7 Dec 2002 12:18:27 -0500 (EST)

This seems clever, however, it will also take significant computational
effort to verify the computational effort was actually done. Even if a
class of functions are found that are "easier" to verify than to compute,
they will no doubt still take up a significant fraction of time.

Also, all outgoing messages would need this computation, since a
mailserver does not know who it has sent mail to in the past, and whether
they are still in receipt of the verification.  So then you would only be
able to send 8000 messages a day, too.

Clearly, that doesn't scale very well.

It seems unlikely that this would change the percentage of spam, since it
would merely reduce the total amount of mail sent.

I haven't observed a recent proliferation of spam, however. Spam seems to
be level.

		--Dean

---

From: Ketil Froyn <[email-masked]>
Date: Sun, 8 Dec 2002 18:13:43 +0100 (CET)

> can send only 8,000 messages per day.

Wouldn't something like this cause problems for (large/free) email
providers?  They would probably need a lot of extra hardware to do all
this computation. And until something like this is included in the
standard, the receiver must accept mail from senders that don't implement
this yet.

I personally like the idea behind qconfirm (http://smarden.org/qconfirm/)
and TMDA (http://tmda.net/). If I receive an email that I do not recognize
or otherwise find to be authentic, a mail is sent back to the sender,
requesting that they send a verification mail to a unique secret address.
When a mail is received at this secret address, the original mail is
delivered to me, and the secret address is removed. For a spammer, it is
too expensive to receive and reply to all these mails.

Ketil

---

From: Lloyd Wood <[email-masked]>
Date: Sun, 8 Dec 2002 22:29:36 +0000 (GMT)

On Fri, 6 Dec 2002, Ayyasamy, Senthilkumar  (UMKC-Student) wrote:

> If the proof of effort requires, say, 10 seconds to compute, then
> the economics of sending spam are radically altered, as a single
> machine can send only 8,000 messages per day.

tracking moore's law could be a problem.

> these ideas.  This work is about both the choice of functions that
> can be used to yield easily verifiable proofs of computational
> effort, and architectures for implementing the proof of effort
> approach.  Filtering and/or forcing senders to pay in other
> currencies, such as human attention and money, will be covered as
> time permits"

"Sender pays" is good. The penny black stamp effectively introduced a
flat-rate tax on sending letters, rather than a variable-rate tax on
receiving them, effectively turning mail into a common good available
to all society.

The government also undercut private messaging operators and
effectively put them out of business, but could use money earned
towards other services for society (having simplified and saved on its
operational costs along the way).

So, computing as a social good - you want to send an email to someone
you're unknown to, you've got to provide proof that you're
participating in SETI@home, searching for big primes, in a distributed
crypto challenge, working on processing public GIS information,
autocomparing versions of typed ascii out-of-copyright texts (or raw
CD rips?) for accuracy, processing gene data or archived NASA tapes or
otherwise doing good things -- guess this would make each computing
charity (give us your spare cycles) the ticket server or PKI manager,
although you might want to try distributing that too.

> for more details
> http://research.microsoft.com/research/sv/PennyBlack

I don't see any discussion there of the computation as a social good,
or computational functions as utility functions. Microsoft, eh?

http://www.glassinesurfer.com/f/gsrowlandhill.shtml
-- and here's the obligatory mention of Jeremy Bentham.

L.

<http://www.ee.surrey.ac.uk/Personal/L.Wood/><[email-masked]>

---

From: Dean Anderson <[email-masked]>
Date: Sun, 8 Dec 2002 19:34:10 -0500 (EST)

> receiving them, effectively turning mail into a common good available

You assume this really means "the spammer pays" [more]. But that isn't the
case.  This is based on the myth that somehow the receiver pays the entire
cost of a spam message. This isn't true, and never was true. The sender is
already paying, whether they are spammer or mailing list operator, or
regular end user.  The fact is that email is so cheap that it costs almost
nothing per message to send and receive.  It gets cheaper every day, as
disks and bandwidth get cheaper and cheaper. The receiver doesn't pay any
more than the sender pays. Real commercial spam happens because the cost
of sending spam is less than the cost of sending letters or postcards.

If you artificially made email expensive, it would be expensive for list
operators and regular people as well. You mentioned a rate of one cent per
message.  That would not be enough to deter spam. A rate of ten cents per
message would still be cheaper than postal mail, and so spammers would
still exist.  Much non-commmercial spam is sent by KLEZ or Nimda viruses.
This sort of abuse would not be affected whatsoever.  Note that KLEZ
infections are already illegal.

Think how much it would cost to send out namedroppers, (and the entire
bulk of IETF standards related email) if each message to each recipient
cost, say $0.10.  Or even one cent per message per recipient.  This
proposal would essentially wipe out many if not most mailing list
operators, and most ISPs.

I made a proposal back in 1997 that would not eliminate spam, but would
keep it out of your mailbox. My proposal was rejected because radicals
demanded a complete ban on spam. In 1998, there was an opportunity to get
anti-spam legislation passed.  Unreasonable anti-spam radicals passed up
that opportunity when they insisted on unrealistic demands, and
exaggerated and factually wrong assertions about the cost of spam.  They
assumed they could "shout down" any opposition, as they shouted down more
reasonable proposals.  They were understandably and easily crushed by the
Direct Marketing Association (DMA).  You can still see my proposal at
http://www.av8.com/H.4581/better.html This proposal would have been
difficult for the DMA to challenge since they already accept these
restrictions on postal mail.  You have the radical anti-spam leadership to
thank for your spam, and the fact that you don't have a universal opt-out
list.

The anti-spam effort was for all practical purposes completely crushed
when Exactis successfully sued MAPS and demonstrated that blacklists are
subject to the Sherman Anti Trust Act and that blacklists weren't
protected by the First Amendment.  I told Vixie this would happen in 1997.
He assured me that anti-spammers could win by technical means. If it
wasn't clear that he was wrong in 1997, (and it seemed pretty obvious even
then), it is now painfully obvious that Vixie and the rest were very
wrong.

It is really time for new, reasonable, anti-spam leadership, not artifical
changes to the cost of email, or schemes to try to make sending mail more
expensive for the senders, and certainly not gyrations in the sending of
namedroppers.

Thanks to the ineptitude, lack of foresight, irrationality, and general
unreasonableness of the anti-spam leadership, spam is here to stay. It is
just a matter of degrees of how bad it will be.  I note there is some
legislation before the house and senate (HR 1017) on spam control, that
reportedly isn't opposed by the DMA. However, these only control
fraudulent spam.  HR 1017 proposes extensions of 18 USC 1030, which makes
it a fraudulent spam a crime, but the FBI probably won't bring charges for
small violations. There is no provision for a civil action.

Another bill (S.630) would require each spammer to maintain an opt-out
list.  You would have to contact each spammer, and have your email address
added to their list, one by one. There would be thousands of spammers to
contact.

Note that my proposal would had a single opt-out list (the Post Office
already maintains such a list for postal junk mail), and my proposal
probably could have been passed into law in 1998.

		--Dean

---

From: "Bill Cunningham" <[email-masked]>
Date: Sun, 8 Dec 2002 20:09:24 -0500

---- Original Message -----
From: "Lloyd Wood" <[email-masked]>
To: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Cc: "Fred Baker" <[email-masked]>; "Hallam-Baker, Phillip"
<[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>
Sent: Sunday, December 08, 2002 5:29 PM
Subject: RE: namedroppers, continued

> receiving them, effectively turning mail into a common good available

Lloyd, in the US we pay .37 to mail a first-class letter. I don't know how
many pence you pay in the UK but we still have "spam" bulk rate unwanted
solicitations. Forcing the sender to pay doesn't solve a spam problem. I
don't see how in could. It would force everyone to have to pay a price.

---

From: Lloyd Wood <[email-masked]>
Date: Mon, 9 Dec 2002 03:14:43 +0000 (GMT)

On Sun, 8 Dec 2002, Dean Anderson wrote:

> You assume this really means "the spammer pays" [more].

that quote is excerpted out of context.

> But that isn't the case.  This is based on the myth that somehow the
> receiver pays the entire cost of a spam message. This isn't true,
> and never was true.

It's true. It's an attention economy, where the recipients' lives and
time are finite. But placing a value on time is tricky.

> The sender is already paying, whether they are spammer or mailing
> list operator, or regular end user.  The fact is that email is so
> cheap that it costs almost nothing per message to send and receive.
> It gets cheaper every day, as disks and bandwidth get cheaper and
> cheaper. The receiver doesn't pay any more than the sender pays.

only if a purely fiscal definition is taken.

> Real commercial spam happens because the cost of sending spam is
> less than the cost of sending letters or postcards.

this is very true. It's also true for physical commercial bulk mail,
which gets special rates compared to individual letters or postcards.

Bill Cunningham adds:

$ Lloyd, in the US we pay .37 to mail a first-class letter. I don't
$ know how many pence you pay in the UK but we still have "spam" bulk
$ rate unwanted solicitations.

...that are paid for at commercial bulk rates vastly cheaper than the
individual rate, which encourages them. That's what you get for
running the postal service as a commercial business rather than as a
emphasising the social good aspects.

$ Forcing the sender to pay doesn't solve a spam problem.  I don't see
$ how in could. It would force everyone to have to pay a price.

if everyone pays the same price, then those sending the most are most
penalised. flat-rate.

> If you artificially made email expensive, it would be expensive for
> list operators and regular people as well. You mentioned a rate of
> one cent per message.

I did not mention such a rate; you've taken the Penny Black
one-penny-over-150-years-ago and run with it. Perhaps you would care
to actually read my entire message, and tailor your canned rant to it?

The act of subscribing to a list indicates that you know the list, and
you're less likely to reject mail from people you don't know that
comes or also comes via the list, since you're interested in reading
that list -- unless the list is a simple exploder with no filtering
mechanisms itself, in which case, subscribers pester each other
(rather than the list) for computational proofs until the list
implements spam filtering.

L.

> That would not be enough to deter spam. A rate of ten cents per

---

From: Lloyd Wood <[email-masked]>
Date: Mon, 9 Dec 2002 03:14:43 +0000 (GMT)

Bill Cunningham adds:

L.

---

From: Dean Anderson <[email-masked]>
Date: Sat, 14 Dec 2002 14:05:12 -0500 (EST)

> that quote is excerpted out of context.

I don't think its out of context. You assume your scheme will only
increase the costs for the spammer, and make it less economical to spam.
This is a false assumption on your part. Your scheme increases the cost
for everyone, and indeed it increases the cost for legitimate email more
than it increases the cost of spamming. In other words, it makes it
_even_more_economical_ to spam.

This is the kind of "shoot your self in the foot" thing as when Sanford
Wallace and Cyberpromo lost his T1, and spammers turned to dialup. The
dialups cost less than T1's, and so it was even cheaper to spam, and
harder to find out who was behind it.  The anti-spammers made it cheaper
to spam, and harder to determine who the spammers really were. At least
CyberPromo could be identified, sued, made to obey the law and court
orders.

> time are finite. But placing a value on time is tricky.

This argument was raised (and rejected) in the 1970's with regard to junk
postal mail.

> only if a purely fiscal definition is taken.

That is the only definition you can take, absent additional legislation.

> if everyone pays the same price, then those sending the most are most

Uhh, not exactly. They pay more in total, but it doesn't matter as long as
the advertising costs are low enough that they are still selling products
at a profit.

> to actually read my entire message, and tailor your canned rant to it?

I read your whole message, and I read it again just now.  Perhaps I wasn't
clear:  Your assertion about the benefits of flat rate vs variable rate
are irrelevant. Whatever the value (flat rate or variable rate), if its
less than the bulk postal rate, plus the cost of printing, stuffing, etc,
it will still be more economical to send spam than to use bulk postal
mail.

And, as above, it is dubious there is a variable rate involved in spam.
However, even if there was a variable rate, it wouldn't make any
difference.

> implements spam filtering.

The computational proofs cost you more than they cost the spammer.  And in
the end, the spammer can do them, and it won't make any difference so long
as the cost is still low enough to be economical.

		--Dean