Re: [Asrg] Economic model is borken. (sic.) Let's fix it

At 11:28 AM -0500 3/8/03, Eric S. Johansson wrote:
> 1) the incentive is to make sure their messages delivered.  In the 
> physical world, if I call them up on the telephone and order a 
> catalog, they have an incentive to add postage to make sure I get 
> but I asked for otherwise they risk me taking my business elsewhere. 
> so, why should not be the same electronically.
That incentive does not exist until a significant percentage of 
systems block non-stamped email.  Until then the only person 
suffering is the one who installed a non-stamp-blocking system, not 
the vendor.
> 2) increasingly, antispam filters are taking out legitimate 
> communications from businesses.  The use of a stamp would allow them 
> to bypass the filters without requiring the recipient to do anything 
> special (i.e. white list, filter exception).
This logic works better.  But of course any standard authorization 
mechanism can provide this benefit, not just stamps.
> > 2. If they do automatically add a stamp, what keeps me from abusing 
> > that fact by continuously generating non-paying transactions which 
> > require responses?
> this is a serious risk factor before near full adoption.  In a 
> nutshell, the business would need to be careful about how many 
> messages it was prodded into generating for a given address.  There 
> would need to be some logic put into the robot to say "hey!  I have 
> received over X messages in the past Y hours from this user.  Time 
> to get a human".
I can register a new domain for $10.  I can receive all email sent to 
that domain, and create a new one every day.  Now if you aren't going 
to give me a cut of the stamp price, then maybe I don't have a big 
incentive.  But if you are then you have a fraud problem.
> I accepted this is a weak spot but I believe it can be solved. 
> Using techniques such as address probes (i.e. does this domain/user 
> exist) and rate analysis (normal vs. abnormal levels of traffic) can 
> help minimize the impact.
Yow.  That's a pretty heavy bit of infrastructure for doing nothing 
but set up a mailing list.
Something to remember when thinking about fraud, spam, and attacks on 
the internet--especially when comparing to that in real life.  There 
are lots of things that people would never do in real life that they 
will do online.  Furthermore, do to the point to point nature of the 
internet, every single lowlife in the world has a direct connection 
to you.  So, multiple decreased inhibitions by increased access and 
you've got to be a lot more careful.
The other thing that really concerns me about spam fighting is the 
cost of unintended consequences.  Stamps are one type of solution 
that is very prone to this, as are many of the legal solutions people 
have proposed.
These solutions don't try to stop spam.  They try and set rules for 
spamming.  "You may spam if you pay postage."  "You may spam if you 
provide an unsubscribe address."  These solutions legitimize spam. 
They open up the door for lawsuits against ISPs who block email that 
meets the rules.  They send a message to every company in the world 
that it's okay to send email to people who didn't give consent, so 
long as they follow the rules.  A postage-paid system that doesn't 
put a company like ZDNet out of business (what, a million messages a 
day or something like that?) is *not* going to be a barrier to entry 
for most companies.  Instead of having a thousand or so spammers 
running around hitting you every day, you're going to have tens of 
thousands of companies sending you email every month saying, "If you 
don't want to be on this list, please follow these arcane unsubscribe 
directions."  This will *not* be an improvement.
--
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg