Based on monitoring the discussion for the past 18 hours or so, I
think I see some trends, but maybe I'm on drugs.
I think people are willing to have a solution which creates work for
legitimate bulk emailers (e.g. authentication, custom software...).
They do not want a solution that interferes with the current
peer-to-peer benefits of email. They do not find it practicable to
have a solution which requires major infrastructure, MTA or MUA
changes. Any solution must support a phased-in process.
Those constraints lead me in the following direction. I'm not 100%
comfortable with it, because I haven't had time to think through all
the ramifications, but I'll throw it out.
1. You need to be able to identify whether email is bulk or not.
This enables you to separate peer-to-peer from spam and bulkmail.
2. You need to place a requirement on bulk mailers that their email
be authenticated. That authentication carries with it certain
technical requirements (e.g. possibly confirmed-opt-in or other
restrictions). Those are contractual specifications set forth by the
certificate authority.
If you can examine an email message and reliably determine those two
things, then you can reliably distinguish spam from regular email.
Issues.
Q. What prevents abuse by certified bulk mailers?
A. The legal system. The U.S. courts have already agreed that
spamming violates ISP AUPs, and that there is an assumption of
knowledge on the part of the spammer (i.e. they don't have to have
read the AUP--they should know that spamming is not allowed).
Additional laws would probably, especially wrt collecting damages
(currently spam suits almost certainly cost more than they recover).
But these laws can focus on contractual and trespassing issues, not
technical issues. The key is that we have locked down the identity
of the abusers, and by giving them an identity, have imposed certain
legal constraints on their behavior.
Q. Can we reliably detect bulk mail using a distributed system?
A. People on this list claim so. The main issue is whether they will
remain effective as new countermeasures are introduced. I also worry
about abuse of the system via deliberate attempts to discredit
companies and/or people. Somewhere.com is on way more blacklists
than I care to think about. All from joe-jobs back in the
mid-nineties. Everyone adds people to blacklists. Nobody removes
them.
Q. What authentication?
A. My personal preference would be a cryptographic key verified via a
DNS lookup against the the domain in the From line (yes, the one the
user sees). I think that domain-based authentication has a number of
advantages. There's already an infrastructure for selling
domain-based certificates. It avoids the need to have certificates
on a per-user basis. It puts the onus of keeping track of user
behavior on the company owning the domain. It allows the signing to
take place in the MTA instead of the MUA. A number of these features
aid in the migration of the solution down to general users in
addition to just bulk mailers. Over time this means requiring less
and less reliance on the need to identify messages as being bulk.
So? Tear it apart, but in three parts. Are the initial requirements
accurate? Does the proposed solution theoretically address the
issues (i.e. assuming the technologies behave as described)? Does it
practically address the issues?
--
Kee Hinckley
http://www.puremessaging.com/ Junk-Free Email Filtering
http://commons.somewhere.com/buzz/ Writings on Technology and Society
I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg