From: "Andriy G. Tereshchenko"
<spf-discuss(_at_)spam(_dot_)24(_dot_)odessa(_dot_)ua>
Can you give us an estimate on maintenance costs for reputation service to
prove that fee is reasonable?
As I see it - there is no monetary cost in the reputation system. Anyone
can be a peer once they have proved their reliability. It's an expanding
mesh of peers, and someone has to start it, then they will agree for
selected others to be peers, and they will do the same, etc, etc. No single
peer has control because the reputation is agreed between many, and users
can query those peers they find most suited to their own philosophy.
I suspect there is some conspiracy behind SPF/Sender-ID.
I think you mean there are still issues to be addressed, and I would agree.
Bear in mind that spf is only one of many tools in the anti-spam campaign.
I'm not sure what you're getting at in some of you references, but
Current sender ID system support:
a) Big bulk mailers companies
This system keeps their monopoly because this will hard for new company to
enter email market
A reputation system will deal with them and new companies that want to do
this will get their own reputation based on behaviour. This one's not
really a spf issue.
b) Free web-based email providers
Users will be forced to use web-interface to send emails or providers
SMTP.
In both ways they will be forced to see ads or advertisement signature
will be added.
If it's a free web-based mail service that's not unreasonable - someone has
to pay for their CPU and bandwidth.
c) Reputation service owners.
This will looks like a robbery - "Pay us, or your mail will not be
delivered".
Once your rating will decrease you will be proposed to pay a bribe to
revert it back to 100%
Wrong entirely. The reputation service is not _owned_ by anyone, it's open
source, you put it on your server and use the service. You can even become
one of the peers maybe :-)
d) Big ISPs.
SPF records change latency can result in ISP lock-in.
Also if you will be unlucky one person who use "sometimes SPAM" ISP - you
will be forced to migrate to another ISP or close your
business.
As well this will increase in demand for static non-masqueraded IP
addresses for all users sending emails - additional costs for
almost no value.
This on might be an issue - depending on how the ISP behaves. Choose a good
ISP and you won't have a problem. ;-)
e) USA and English speaking parts of world.
How do you expect to assign reputation for legit emails from China ?
For example email from mother living in China to his son-student currently
using AOL US ?
Will you block all emails just like current DNSBL lists does : "China does
not seem to care about spam. Blocked" ?
The reputation system takes this into account and the recipient can check
the reputation of mama in China, and accept the e-mails to her son on
aol/usa as they wish. This also depends on the big ISP's joining up.
But I do not see users in this list. I've been reminded several times here
"SPF is not about spam".
Users? We are all users - I'm typing this mail to be sent from my domain to
the list and the spf record is there for the recipient to look at if they
want. And spf is not *about* spam - but one of it's main uses will be to
allow recipients to identify dodgy e-mails that are pretending to come from
somewhere they didn't.
So why do you expect users will support this conspiracy?
Good grief, Andriy - I thought I was the paranoid one here :-)
It's a pleasure to see people who are _not_ USA or UK based taking part in
this discussion. I'm based in Spain and have e-mail contacts on a regular
basis with Roumania, Hungary, HongKong, NewZealand, Brazil, Mexico, etc,
etc. and my best friends wife is from the Ukraine and e-mails her family all
the time from her home in Budapest via a server in UK. There is a tendency
for folks to think that the law in USA/UK is all-powerful. They just need
to get out more :-)
Slainte,
JohnP.
johnp(_at_)idimo(_dot_)com
ICQ 313355492