Re: spam

On woensdag, mei 28, 2003, at 02:36 Europe/Amsterdam, J. Noel Chiappa 
wrote:
> Anyway, this whole discussion is moot.
I couldn't agree more. The bottom line is that most people simply don't 
want to receive spam, often to the degree that they are willing to pay 
extra to get rid of it.
> I'm sure there is rough consensus in the IETF that getting rid of spam 
> is a good idea. (Maybe a question worthy of a plenary hum to confirm 
> this.)
> The only question left is if there are any *technical* components to 
> doing so
> (which would be the IETF's preserve), and, if so, what they are.
It surprises me that so many people are so eager to declare defeat 
before even trying the protocol route. (With current protocols defeat 
is pretty much inevitable.) If we adopt such an attitude in other areas 
as well, we would all refuse to have locks on our doors because they 
don't stop all burglars, and refuse to call the police when someone is 
assaulted on the street because the perpetrator may have a diplomatic 
passport.
The problem with spam isn't that legitimate business are legitimately 
advertising legitimate services. (Although even in those cases I never 
gave them my email address so even this type of spam isn't completely 
above board.) For that, filtering or unsubscribing should keep the 
problem within reasonable bounds. Without forgery it isn't all that 
simple to bypass filters and legitimate businesses lose more than they 
gain from trying to do so.
The problem is that we are subjected to all kinds of filth and scams, 
and the SMTP protocol is severely abused in the process in order to 
avoid filtering. And this is only going to get worse over time, as 
people get more adept at avoiding spam. Spammers then simply have to 
send out more messages and address even more perverse "demand" to make 
money. Going after them in the real world won't work for the same 
reason that the war against drugs doesn't work: limiting supply only 
increases profit for the remaining suppliers so it's more attractive 
than ever to enter the game. So if we can't get spam under control 
(which isn't the same as eliminating it) by doing something about 
supply or demand, we have to do it in the middle by giving users the 
means to blacklist spammers or whitelist legitimate correspondents and 
make it sufficiently hard to fake an identity to get around this.
I don't think moving to some kind of SMTPng is quite as impossible as 
people seem to think. Receiving wouldn't be a problem anyway because 
the new service would simply fall back to SMTP when delivering 
messages. Most service providers would be thrilled to switch to a near 
spam-free email service given the opportunity, so email between service 
providers wouldn't be the problem. Email between customers and their 
service providers wouldn't be a problem either: here regular SMTP can 
be used together with existing authentication mechanisms. So that 
leaves people running their own mail server: either they have to 
upgrade, or subscibe to an upgraded email service.
About the "charging for email" thing: this doesn't have to be actual 
money. Doing it with some kind of cryptographic token that is passed 
from sender to recipient should work just as well in making sure people 
can't send many orders of magnitude more email than they receive, and 
this wouldn't have many of the adverse effects of using money for this.
Mabye a BOF would be in order in Vienna?