ietf
[Top] [All Lists]

Re: Proposal to define a simple architecture to differentiate legitimate bulk email from Spam (UBE)

2003-09-06 19:29:03
Thanks for the feedback and giving me a chance to clarify some issues.

This is broken in two distinct ways:

Disagree.  Read on.


1) I as a mail user now have to go check 150 POP servers several times a day
for all the various lists I'm on - many of the lists are low-volume, but I'd 
have
to go CHECK every day just in case something DID get posted.


If it became an RFC or internet standard, and it became widely adopted, then it 
is reasonable to assume that email clients would add features to handle this.  
It is quite a low bandwidth operation (probably less than 1K bytes) to poll a 
POP server for email.  I assume it would become popular because as shown with 
further logic in my responses below, the idea provides strong benefits to all 
(except spammers).

However, there is one key technological hurdle I did miss in my haste, there 
would need to be some mechanism so that the same user doesn't keep downloading 
the same messages over and over again.  This would either require a special 
modification to the POP server and require each user to login with a unique 
user name. Or better, users' email clients can be made smarter because there is 
a UIDL command in both POP3 and IMAP4.  This unique identifier can be used by 
the email client to only download messages which are new to that user.  One 
would assume that POP servers could also remove messages older than say 1 month 
or so (configurable by the administrator).

And as a side benefit, there would be no way for someone to subscribe me to a 
list without my permission, as can be done by sniffing an authentication email 
for Majordomo.  And no way for someone to subscribe me to a list that has no 
public instructions for subscribing or unsubscribing (i.e. spam in guise of 
business email).


In the case of a public distribution (e.g. most direct email and mailing
lists), a POP3 (and IMAP) account of user "anonymous" with password "none"
would suffice.  In the case of private dissemination (private mailing 
lists), a
POP3 (and IMAP) server with individual accounts could be provided.

Nope.  even for a public list you get to keep a separate POP3 account for each
subscriber - if one person has checked for postings yesterday, but another 
hasn't
since last Tuesday, you can't feed the right list to each person.


False.  You are correct that I missed this issue in my initial post.  However, 
it need be only one POP account (one storage of emails) with flags for each 
user.  In other words, the storage requirement need no increase drastically 
with number of subscribed users.  The flags can either be stored at the POP 
server and then give each user a unique login id, or more realistically just 
let email clients manage their own flags using UIDL.



2) I as the administrator of a site that hosts 6,000 mailing lists just got the
additional aggrivation of providing POP3 service for 700,000 e-mail addresses
(yes, we've got that many).  This includes "My password doesn't work" support
and things like that.  Gee thanks.


No only 6000 POP accounts.  See above how email clients can handle the 
detection of new messages using UIDL.  And you only need one anonymous login 
and no password (just configure the POP server to accept any login and 
password).

Now instead of sending 700,000 emails for each email sent to all your 6000 of 
you lists, you only send 6000 emails or less.  Now instead of managing bounces, 
keeping your IP off of blacklists, hassling with subscribing and unsubscribing 
the users, then all you have to do is publish the domain names of your 6,000 
POP servers on a web page.  The flow of noise is probably greatly reduced.


Have you actually *TRIED* to use more than 100 POP accounts under any current
mail software?

I will respond with similarly rhetorical question.  Did you try to use Netscape 
2 on most current web pages?  Why make any application RFC if there can be no 
progress in applications?


1. Any bulk email is then spam (receiver has not opted in) and can be dealt
with by ISPs, Hosts, legislators, judiciaries, and anti-spam software.

So I drop a note to 50 friends inviting them to a barbecue, and I end up in 
the slammer.


50, even 5000, is not statistically bulk on internet scale.  Is it not possible 
(or likely) to write laws without exclusions?  Do you think Hosts, ISPs, and 
anti-spam software would not account for this statistical phenomenon?


2. Receivers now have uniform control over opt-in/opt-out policy without a 
global authority

This actually means "We've pushed the headache to the recipients".


How so?  In my mind, I find it to be no more of a headache than subscribing and 
unsubscribing to a mailing list.  And certainly a lot less of a headache than 
trying to opt-out of a list that won't let you opt-out.

I think recipients already have a big headache, it is called "spam".  And it is 
getting worse.  It is predicted that very soon 90% of all email sent will be 
spam.  When that happens, the internet email system will start to fail as a 
viable communication medium.  Then your 6000 mailing lists won't work any more 
any way.


3. Legitimate bulk senders can be insured that they or their email won't be
misclassified as spam

So.. you ready to have every single eBay or Amazon customer check their POP 
account
there every day just in case there's important mail for them?


Is it any different than checking their existing POP account(s) and reviewing 
InBox each day??

And as an advantage, they can (if they want) with a more finely grain comb 
choose which email to check and when.


So let's see.. Currently, if your bank sells your e-mail address to another 
company,
you get spammed.  So instead, you'll have it so that you check your bank's POP
server in case there's important mail about your mortgage.  Seems like the 
obvious
scheme is for the bank to charge the other company to put stuff in your POP 
mailbox.

So you still get spammed...


No.  Because you can chose to not check it and/or you at least know who is 
spamming you and can hold them responsible directly.  Thus your bank would stop 
doing it, because they make $ by not losing your business.


It's ironic that you're proposing this on a push-based mailing list provided by
an organization that is probably not in a position to provide POP accounts for
the 30,000 or so recipients of the the list.


No.  As I said above, they would only need to provide one POP account for this 
mailing list.


Baby with the bathwater, Shelby... Baby with the bathwater.


No baby, bathwater only.  Check the logic above.  Just the facts, Valdis...Just 
the facts.