Slashdot Mirror
ISPs Starting To Charge for 'Guaranteed' Email Delivery
Presto Vivace writes "Under the guise of fighting spam, five of the largest Internet service providers in the U.S. plan to start charging businesses for guaranteed delivery of their e-mails. In other words, with regular service we may or may not deliver your email. If you want it delivered, you will have to pay deluxe. 'According to Goodmail, seven U.S. ISPs now use CertifedEmail, accounting for 60 percent of the U.S. population. Goodmail--which takes up to 50 percent of the revenue generated by the plan--will for now approve only mail sent by companies and organizations that have been operational for a year or more. Ordinary users can still apply to be white-listed by individual ISPs, which effectively provides the same trusted status.'"
How does it fight spam if the spammer can ask to be whitelisted, or if the spammer can pose as or actually be a business operating for more than a year? Lame.
while charging for email would suck, i think it is one of the few ways that would actually stop spam: making it too expensive to send a lot of email.
of course, having not RTFA, i wouldn't say how well this would work for non-US countries being certified... this could turn out to be more like the current net neutrality issue (pay the isps money or your traffic/email won't go in the "good pipes"/"certified")
Well, assuming an user pays for the e-mail account, isn't this a breach of contract and false advertising? By "providing an e-mail account", it can be assumed no real mail is ever meant to be knowingly dropped.
Declaring those who haven't paid the protection racket as not "real mail" is not really something that I would envision as something which would pass a non-bribed judge.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Comcast - EVIL
Cox - not very evil yet
Time Warner - The incarnation of Evil
Verizon - Pure evil
They didn't say who the other three are, but I'll guess here
AOL - Strange evil
BellSouth - Pure Evil
Mediacom - Incompetent Evil
This is pretty freaking outrageous.
If there's any way to organize and refuse to relay mail from any of these greedy self-appointed guardians, I'd certainly be interested. Blacklisting all mail out of their domains would probably be extremely educational for them.
Good for the goose...good for the gander.
apart from the initial shock (face it, evryone wants to plug the tube that is the internet), won't this generate more unwanted e-mail traffic? think of all the people who would now send >1 copies of each of their mails just to increase the chances of delivery.
of course it's all assuming that the real intention is not 'end-of-free-emails'(which cud be quite naive)
Real smart. Fight the symptom not the problem. Spammers should have to pay for all the time they waste of every single person they send their trash to, and all the bandwidth it consumes. It blows my mind that this shit isn't considered as big of a problem as it needs to be with lawmakers.
It really was guaranteed delivery using a transactional scheme with software that supported it. This could be something actually worthwhile.
And how much will they pay me if my mail doesn't arrive?
The Internet isn't just TCP/IP. It's an agreement amongst its members to carry each other's traffic and cooperate. I guess rather than dying the net might just shrink to retain good Netizens. The world will then contain two networks: Netizens connected by the Internet and selfish bastards sort of connected by a broken network.
Honestly, I don't see what the problem is. Charging some sort of cost - whether it be responding to a whitelist request, paying in CPU cycles to complete a hash, or just flat out paying a quarter of a cent - is the only practical way to fight spam. Spamfilters always have a small false postive and false negative error rate, while charging money or a cost does not. A quarter of a cent is many times the expected monetary return on a pure spam.
Since it costs money to set up an infrastructure to accept a cost of any type (reliable servers, an organization, ect) charging actual money rather than hash cycles or CAPTCHAs makes the most sense, and is also the only practical way for a big organization to send emails to a bunch of users.
These days a lot of spam are being sent by bot-net. How does this in any way help to combat this? It does not. All it does is guarantee a revenue stream for them.
ELOI, ELOI, LAMA SABACHTHANI!?
This is easy to do. Most mail server software lets you block by domain name of the SMTP client host and/or the host part of the sender email address. If you don't have this option, but can refuse email from SMTP client hosts without valid reverse DNS, you can force the reverse DNS to be bad by adding empty zones for their domain to your DNS server that your mail server uses.
They cannot be educated. They would never notice, anyway. Their customers may notice. A few might even quit. But they (the corporate executives) won't notice.
What we do is create the "invisible alternate internet". This is the internet where all the "good stuff" is. It would be based on an alternate set of DNS root zones with distinctive new top level domains that "they" don't have access to. Eventually more and more of their customers will want access to "the other internet". But they (the evil ISPs) won't be able to provide it because those alternate DNS root zones will have the evil domain names blotted out with strange addresses like 0.6.6.6.
Oh wait, there already is an alternate internet. Sorry, I cannot disclose the location.
now we need to go OSS in diesel cars
For every mail delivered to me with a blue ribbon I will charge 0.125 cents. If the ISPs dont pay me I will not read the mails. Howz that!
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
So the spammers who use botnets will just cause the hijacked computer's owners to pay thousands in email fees?
I can imagine the new "training" course at the grade schools:
Don't download music because you'll get sued for thousands of dollars by the RIAA and then have to pay thousands of dollars because a "virus" sent out emails from your computer!
you have all the fun when you're evil
Its kind of like if the mob owned the USPS and said "You might get your mail in one piece...and you might not if you don't pay up."
So if I send (and pay for) mail to joe blow and his mail server is down- how are you going to deliver the mail to him and still call it 'guaranteed delivery'?
It was nice while it lasted.
The "problem" is that there are a ton of non-profits, news sites, news groups, blogs, lists, whatever-of-the-day sites, schools, churches, and other organizations that send out a lot of requested put-me-on-the-list email to their members.
Have a decent-sized list on which you're doing a daily run, and even at a quarter of a cent you're suddenly looking at thousands of dollars a month out of pocket.
So now all of those sites and services and lists either: A) Stop sending email and/or go out of business, or B) Start charging for the stuff you used to get for free.
Is it so hard for people to figure this stuff out? Apply a cost somewhere and--one way or another--you're going to pay it.
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
I mean, my postal mailbox is totally free of spam-like mail, because companies have to /pay/ for postal mail.
What say we band together and start a new Internet? This one is quickly becoming useless.
No sig for you!!
"For this fee, I may or may not deliver your email."
"Ok, deliver my email, and I may or may not pay your fee."
OK- so you've got the infrastructure to do pay-by-email set up. Now the end user has something like an iTunes account backed by paypal and it just sort of automagically charges your account every time you send an email, what happens when your machine is compromised by a bot-net and you're sending millions of emails for a quarter?
This is like privatized jail system in the USA. The moment it was set up, the number of people sent into jail has started to grow steadily, since there is direct financial interest to "maximize" profit on investment.
If you need to pay fee to get your email for sure, the same companies can make sure that the emails of non paying people will get lost.
E-mail is becoming increasingly difficult day by day to deliver as there are a variety of spam filtering techniques used on the recieving party. Simply setting up an SMTP server no longer cuts it, there is much that needs to be done including continous monitoring on shared SMTP servers. If there was no spam, (administratively) there would be no problem. If you are running a simple SMTP server on a cheap DSL or cable connection, chances are your reverse DNS lookup isn't going to match your intended host name. Most ISPs won't do a custom reverse DNS lookup name entry on a cheap connection.
I guarantee I'll never pay an ISP for 'Guaranteed' delivery of anything because the only thing I can guarantee they'll deliver to me is a bill.
One word: Hashcash. Basically you prove that you wasted a couple seconds worth of CPU to send your message. I believe SpamAssassin already recognizes Hashcash headers, not sure about other filters. But if you're really ready to start dropping email en masse in favor of a whitelist-style approach, this is the simple and elegant solution.
If other reasons we do lack, we swear no one will die when we attack
...how about asking for receipts of emails? That's what I do for important documents that I email out any way, just so that I know that the recipient doesn't accidentally delete it and then blame me for not sending it. It also helps confirm that I don't email something out to the wrong person without knowing about it.
Another solution would be to extensions with Thunderbird or whichever email client you use that provides a certificate and requests a confirmation upon receipt automatically. This could be protected from spam by only sending automatic receipts to addresses found in your address book.
This is probably true as stated, but almost meaningless. Each of those ISPs will be counting the number of users that have email accounts with them, and then they just added up those numbers. The problem with this is that many users have more than one email account and don't use the one provided by their ISP - a large chunk of that 60% probably uses yahoo, hotmail, or gmail. Many people will also have another account provided by their employer.
It is not particularly useful to count email accounts as a fraction of the US population.
People need to understand what these things are: SCAMS.
They don't cut down on spam, what this means is a list to bypass all spam filters.
I lost faith in any system like this a while back when Yahoo decided to have a gauranteed signature bs thing.... oh it sounds good but then you realize they whitelist any yahoo account and bypass ALL spam filters for whitelist.
Overnight the spam for my yahoo account increased by a factor of 20, and it's still like this today. Spammers realized what was going on and started to hack the yahoo mail system so their crap would be guaranteed to go through.
I think part of the problem is that spam filters are generally broken and don't work that well. Part of the problem is that no one has seriously thought about how crappy the approach is. The other part of the problem is that their is little or no personal ownership of the filtering of spam.
When the ISP/customer have no relationship on identification of what is spam the ISP has to aim really high and take the approach that anything that is obviously spam is not delivered and everything else is. The net effect is the ISP might not deliver porn spam, but they'll deliver many other things with impunity. If there was a more aggressive involvement of the customer/consumer of the email then you could better tune the filters to match each user better.
SpamAssassin is the worse offender. It's origination was to do static regex checks and add points for each hit. And when you were done, the points put you either IN or OUT. But in order for SA to work you have to tune the number of points added for each regex test. And this is constantly changing. But for it to work, you have to be constantly monitoring the results. No one does this on a consistent basis.
A critical drawback with their approach is the constant game of catch-up they have to play in order to get the filtering to work correctly and then someone has to run some update script to hopefully get everything working correctly. Again, this has to be done continually like the tuning or it will start to fail.
Bayesian filters offered a great alternative but they quickly turned into their own problems. SA uses Bayes, but it's not effective because of the lack of feedback from the consumer (in most cases). It's also prone to over-rides by their own auto-whitelisting. Convenient, but deadly. Where Bayes lacks goes back to the original problems of non-customized feedback and involvement. It's very inconvenient to try and set up something like bogofilter to run for every individual in a group of 1000's so the mail admin makes one file for everyone thereby generalizing the statistics and making them less effective because they have to be good enough for everyone but not so good they remove any of the really serious spam.
And yes, SA does user specific Bayes filtering. I used it for three months and it sucked. It was not a very effective spam filtering system even with user specific bayesian filtering included. It's also getting pretty darn slow. Slow enough to become a consideration.
DSpam is effective, customized, and slower than molasses in january. It will also lose email. But YMMV and I don't really care to hear about how great it is. I lost a lot of email and a lot of money as the result of it. Perhaps some day they can get their act together, but there will always be a severe performance penalty for CRM114. But Bayesian filtering can still compete with CRM statistical success with 100X performance increase.
So what do you do about spam filtering?
The technology exists to effectively and efficiently filter spam. But that's not the problem. The technology that is used today is relatively lame because there are shortcomings abound that prevent a good solution for someone really large (like an ISP).
The problem is to redefine how the consumer is going to own their own spam filtering effectiveness. No more auto-whitelist. No more auto-blacklist, No more auto-update of Bayesian tokens. All of these can be carefully manipulated to taint the statistics and allow delivery in droves. The consumer must take ownership of their mailbox in the same manner that they are expected to take ownership of their credit card information on the internet.
who is paying for this service and gets infected. Ouch, what a bill that will be, and
all guaranteed to be delivered. New bot target:Certified senders!
I wouldn't be so confident about that even... I have Brighthouse cable internet, they're supposed to send monthly bills... I never got a bill, I called them, they told me I have no pending balance and told me how to access my account online. I repeatedly asked them if everyone was ok as I wasn't getting billed, and they said yeah, I'm fine. 6 months down the line, I never receive a bill, but I log into my account and there is a just posted bill for all of the previous 6 months. I knew it would come eventually, so I paid it, and after that I'm billed monthly. Another 6 months go by, never receiving a paper bill and paying online every month, and I started getting calls from a collection agency.
:( (and they're not very reliable either, the cable goes out daily)
It took me getting my lawyer talking to them for a little while, and they eventually refunded all my payments for a year for the inconvenience and reversed the mark on my credit rating, but they are totally incompetent. Now I FINALLY get a paper bill in the mail every month after all of this. Took them long enough. I wish there was competition in the cable market, its them or nothing unfortunately
This is making a REALLY bad assumption that an ISP generated email address is used by the account holder. Problem is, once there became multiple ways to get online about 10 years ago, LOTS of people switched to web-mail for the permanence and convenience. (Hotmail, Gmail, yahoo, etc) I would guess that any major ISP has less than half of their accounts use their provided email services.
People who think they know everything really piss off those of us that actually do.
Then what value is the ISP?
This cant be legal. "here is your service. Oh, you want it to actually work, well pay up"
---- Booth was a patriot ----
I'm thinking I should bookmark this and use it as an example to anyone who claims ISPs won't attempt to charge websites for "prioritized" delivery, and degrade people who don't pay up.
In short: They already have.
Of course, I don't think net neutrality legislation will cover email -- not that I care much, I really don't send mail to many people at AOL -- but it's just a perfect example to all the Libertarian idiots out there of why we do need government intervention sometimes.
The free market will sort it out? Sure...
Don't thank God, thank a doctor!
I think if I had an email that was so important I felt I needed to pay for guaranteed delivery of it, I would just pick up the phone.
R(k)
Gmail started rejecting mail from my home system back in April. At the time the rejection was "Our system has detected an unusual amount of unsolicited mail originating from your IP address."
... our engineers work hard constantly to improve the system ... are you still having trouble?"
This turned out to be a lie, but I wasted time making very sure it wasn't true. Nor was it an inherited IP problem from DHCP because I'd had the same for months.
To make it more fun, much confusion was caused because some of my 'rejected mail' had actually gone through.
Eventually I got a response from complaining to Gmail as a Gmail customer. There was no other way to contact them about the problem, and they still took two weeks to make a generic reply to the effect of 'thank you for calling
Hell yes I was, but what they did in the meanwhile was tweak their error response. Now the rejection was "The IP you're using to send email is not authorized to send email directly to our servers. Please use the SMTP relay at your service provider instead." Which is already what I'd ended up doing while waiting around of course.
I told them that and got another two-week later canned reply saying "Thank you for your reply. We suggest that you utilize the SMTP relay from your service provider."
It's horseshit, and just laying the foundation to charge for 'guaranteed delivery'. Our machines are supposed to be able to connect to one another. This Gmail mess was proof positive it's not about spam because there was none. It's about making money by lying that it's about spam.
There is not now and will never be such a thing as 'guaranteed email delivery'. SMTP is a collaborative, best effort thing. Read the fine RFCs.
t work.pdf).
In practice, with the myriad spam fighting methods out there, and the fact that some of the companies which pay up for the service will at some time or other have some of their systems take over by spam sending robots, there *will* be legitimate reasons to not accept (and optionally tarpit) attempts at mail delivery from hosts or networks whose owners have paid up for the 'guaranteed delivery' scheme.
This is some of the stuff I was on about in my BSDCan paper (now accessible at http://home.nuug.no/~peter/malware-talk/silent-ne
Now, of course it is legitimate to dream about a mail delivery system without SMTP's warts and wrinkles, but this is not it, and it is not going to help solve any real-world problem.
-- That grumpy BSD guy - http://bsdly.blogspot.com/
You can forget about using email for commercial purposes - a good size fraction of the anti-spam community considers any use of email for commercial purposes to be SPAM. So commercial email gets blocked. If you send an email to someone using Outlook with the word "sale" in the email address, it gets trashed. Examples like this go on and on.
If you are using email to communicate with customers, a large number of your customers aren't getting their receipts, confirmations or even their purchases. And of course the customers don't know anything about it - their ISP or email provider is dumping the email before they even see it.
Guaranteed delivery? Yeah, sure. Pay a fee so your email isn't blocked for one reason and it will still be blocked by 37 more reasons. Nobody can stop this from happening and charging for such a service is a sucker move designed to take in the ignorant. And I bet it works for at least six months before it dies.
Don't use email for anything commercial or important. It doesn't work.
I have yet to see an adequate defense proposed against the problem of multiple "certified email" vendors in the same mail stream, where one vendor has been paid and the others haven't. How does one vendor ensure that validated mail gets delivered?
This is exactly the same problem with backbone pipe vendors wanting to get paid for "premium" bit transfer.
-- Gary Goldberg KA3ZYW 301/249-6501 AIM:OgGreeb Digital Marketing Inc., Bowie, MD
Isn't it obvious this is only a ploy to a) make people think they care and b) make more money?
Nice plan.
Give me back my ports and I won't have to worry about spam or your fees.
Friends don't help friends install M$ junk.
Where can I get an up-to-date list of theese companies, so I can add their addresses to my spam filter ?
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
I want my gmail to have a new button, "opt-out." This way when I get sick of having your stupid weekly update and don't remember my password to your site I can hit opt out and gmail does the work I don't want to do.
Of course they are doing it 'Under the guise of fighting spam'. That's how you disguise reporting your information to the government. This way you can call it a surcharge instead of calling it a tax.
We must be vigilant.
It was not immediately clear what Gonzales and Mueller meant by suggesting that network data be retained. One possibility is requiring Internet providers to record the Internet addresses their customers are temporarily assigned. A more extensive mandate would require companies to keep track of e-mail messages sent, Web pages visited and perhaps even instant-messaging correspondents.
Your sig(k) has been stolen. There is a puff of smoke!
Your post advocates a
(X) technical ( ) legislative (X) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
(X) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
(X) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Damage to the public is distributed in cost to all of us, when we can't find some sucker to blame. In the case of spam, we're all going to have to pay a "get it right fee" now that spam has ruined normal email. Good work, society.
Anti-Globalism
Any laws about do-not-spam lists only apply in the country that makes the laws - so spammers will send mail from other countries. They often do that today, simply because it's harder to get a Chinese ISP to shut down spammers, and a lot harder to get Korean zombie farmers to shut them down.
It's possible to make the do-not-email lists a bit safer - instead of listing the email addresses directly, list hashes of them, which lets anybody who wants to check an individual address see if that address's hash is in the list, but doesn't let you recover the address from the list. But it's still a losing game.
[Insert the usual checklist here....]
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I've always thought the best way to eliminate spam is by default charge a fee for each email, say a penny each. You could whitelist your friends and mailing lists to exempt them, and any time a company wants to advertise to you, you make a little money, even if you choose not to read it. Its P2P e-postage.
AOL's in a touchy position - they really do receive infinite quantities of spam, and it's hard to tell some kinds of spam from legitimate mail without having humans read it, and it's hard to tell legitimate senders asking to be reinstated from spammers asking to be reinstated, and the financial incentives for allowing good email aren't very high so they can't afford to put lots of humans into the loop. But their reputation is such that lots of mail senders are simply not willing to deal with them.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
It's an old canard against Goodmail to claim it's an anti-spam system and then comdemn it as an ineffective solution. It's not supposed to be an anti-spam system. It's a system for legitimate senders to avoid false positives.
It's not just a matter of ponying up the money to them. You have to demonstrate that you are a legitimate business and a legitimate e-mail source, and not a significant source of complaints by users.
Interesting read, thanks for the link. They do make a pretty convincing case that proof-of-work isn't enough to outweigh the biggest botnets. I wouldn't go so far as to say "You just can't make it expensive enough for it to deter spammers", though, because clearly it's going to be a deterrant for any spammer without a sufficiently powerful botnet (e.g., just spamming through a relay) or for someone operating on a very limited time-frame. It just can't meet the goals outlined in the paper.
A small additional consideration is that zombies will be somewhat easier to detect if spammers are constantly maxing the CPU to calculate POWs. Small because of course that will go largely unnoticed, as the zombie in question didn't have enough attention paid to it to keep it secure in the first place.
If other reasons we do lack, we swear no one will die when we attack
Some or most of those ISPs do also offer POP/IMAP mail services, so the user has a chance to do filtering, but that's not most of the users, and just guaranteeing that the ISP *won't* junk the message may be valuable enough for some senders to pay for Goodmail.
Some of the commercial email senders will probably be spammers, especially if you read their AUP carefully and notice that it doesn't require confirmed opt-in, but at least the economics of a quarter cent per message make it likely that there won't be a *lot* of spammers using the service - only the ones who are doing a good job of targeting customers\\\\\suckers for high-value services.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Read up on the early history of Radio. It used to be free to broadcast. Now it's really expensive. Soon the only web pages and mailing activities will be those that are sanctioned by the key masters.
No, it's cheap to radio broadcast, Pirate radio stations do it all the tyme. There's even pirate radio on the internet. What's espensive is getting a license to broadcast. And that's just how the mass media wants it. Clear Channel doesn't want more competition, it wants less.
Should there be a Law?
Honestly, I don't see what the problem is. Charging some sort of cost - whether it be responding to a whitelist request, paying in CPU cycles to complete a hash, or just flat out paying a quarter of a cent - is the only practical way to fight spam. Spamfilters always have a small false postive and false negative error rate, while charging money or a cost does not. A quarter of a cent is many times the expected monetary return on a pure spam.
The problem is is I already pay for my email and I don't want to pay twice. I wouldn't want to pay extra either if I ran either a business or a nonprofit.
Since it costs money to set up an infrastructure to accept a cost of any type (reliable servers, an organization, ect) charging actual money rather than hash cycles or CAPTCHAs makes the most sense, and is also the only practical way for a big organization to send emails to a bunch of users.
Yea, right, everyone's born with a silver or gold spoon in their mouth. NOT!!! The cost of the infrastructure, as well as profits, are made by providing net access to begin with. If providers can't make a profit then maybe they need to get out of the business.
FalconShould there be a Law?
When I first read about this earlier in the week, my first thought was "isn't this just a signed message?" It sure sounded like it -- it shows up in your inbox with a little blue ribbon next to it, and so forth. So why pay some company a per-message fee for this? Just get an honest-to-God email signing certificate, that's signed by trusted authorities (that is, has a chain of trust that goes back to what's included in your browser / email client), and then sign all your email? Then people can easily tune their inbound SPAM filters to give a lower score to properly signed messages.
And this would have the side effect of finally getting signed/encrypted mail to the masses, at least on a low-level. Why the hell I can't just get myself a certificate and have my bank email me my statements, encrypted, automatically is beyond me. I really hate having to remember to go out to everyone's site once a month to download PDFs.
Just a thought...
There isn't a central authority controlling email - but they've got the ISPs that are over 50% of the US mailbox market. (Microsoft MSN isn't one of them, though
Joe-jobs, Forgery, Worms and Zombies, etc. - The press releases don't say *how* they handle their certification other than to mention cryptography. But their board of technical advisors is interesting - Marty Hellmann, Avi Rubin, Dave Crocker - so there's a good chance they've done it right. Cryptography does take a fair amount of horsepower, but it's scalable dumb horsepower, and if they've done things well they can avoid having to verify the crypto on most forged messages. If they've designed things well, it's not incompatible with open-source tools, but they're writing Press Releases, not technical documentation, so it's hard to tell.
Asshats, and trusting Goodmail's servers - yes, that's still a problem. Their terms of service are appallingly weak - they'll accept unconfirmed opt-ins, and their "interpret complaint as unsubscribe" is inadequate, so dishonest spammers can still pay to get service delivered for a while, until they get enough complaints. But at least the quarter-cent per message means that only well-targeted spammers will be willing to pay for it, so it won't be really high volumes of spam. If there's much of that going on, then email users won't stand for it, and they'll bitch at their ISPs (though that's more effective with AOL who charges money than with Yahoo who's giving you that email account for free anyway...)
And yes, email should be free, and whitelists suck, but blacklists also suck and some email senders may be willing to pay to deal with whitelists that suck instead of getting stuck on blacklists that suck.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
This isn't saying that everybody should have to pay money to send email - it's saying that there are people who are willing to pay money to get email delivered to recipients who've asked to receive that mail, and that Goodmail is willing to make a sufficiently credible case to the big ISPs that they're only going to send mail to people who've asked to receive it, and the per-message fee is partly to make money and partly to discourage dishonest senders by making it unprofitable to get Goodmail stamps for their spam.
There is a downside - if you make some categories of email privileged, then ISPs are more likely to tighten their filters on the non-paid email and incorrectly reject more of it. On the other hand, that's already happening to some extent - if you read some of the spam and operations mailing lists, you'll hear lots of people bitching about how AOL incorrectly blacklisted them and how difficult and slow it is to get things corrected, and there are lots of companies and sites that simply don't accept AOL addresses for mailing list subscriptions or especially for transactional emails.
Goodmail's tried to add some balance to the community complaints about this kind of service by charging a much lower price to non-profits that want to certify their mail - I'm not thrilled with that approach, but there are enough non-profits out there that use snail mail for their newsletters or fundraising begging, and
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
"Nice e-mail account you've got here. Be a shame if something were to happen to it...."
So blacklisting the ISPs doesn't make sense here - Goodmail isn't claiming that Comcast is certifying that mail from ExampleUser@Comcast.com or InfectedZombie@Comcast.com isn't spam. (That'd be nice, but it ain't happening any time soon.) They're claiming that if you have a Comcast/Yahoo/AOL/etc. mailbox, and a message shows up in it with a Goodmail certificate on it, then it's from a well-behaved non-spammer who paid to deliver it, and that if you want to do transactional mail with somebody like your bank, then your Goodmail-accepting ISP won't junk the message so it's ok to give your bank that email address if they pay for Goodmail.
If you don't like the Goodmail system, the answer isn't to blackmail Goodmail senders at your ISP - it's to boycott ISPs who accept Goodmail (or at least, not use them for your important email, though you might still use their free for your ExampleISPgroups email), plus send complaints to blackhole\\\\\\\marketing@ExampleISP.net. Blacklisting people who pay for Goodmail stamps doesn't really make sense either - senders aren't going to pay for stamps that don't go to the ISPs that accept them. You could unsubscribe from any email lists sent by senders using Goodmail stamps, if that's what you want to do, and that might be more visible; Goodmail tracks that kind of thing and requires senders to respond to the unsubscribes.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
They're also selling to companies that already pay a lot for email admin time keeping their mail with the big ISPs working and tracking mail delivery. If making sure AOL doesn't blacklist you is critical, and you're a medium-large volume mail sender, then it's already costing you a lot of work to keep everything working, and Goodmail not only promises that your mail won't get junked, but that they'll give you a delivery receipt for each message. So it might cost you less to pay Goodmail to do that rather than do it yourself.
If you're not doing kinds of business that are going to get more revenue or reduce costs by using Goodmail, then you're not the kind of person they're trying to sell to, so it's not worth their time to grab money from you. But if you _are_, then yes, it's a blatant money grab but might be worthwhile for you as well as them. Spam's a big enough problem that there are lots of opportunities to grab money while making life easier for the people you grab it from.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
They're not certifying countries, they're certifying senders of mail, and they're not certifying senders who aren't based in the US or Canada. There is a bit of neutrality risk here - if enough senders are willing to pay for certification, then ISPs may be more likely to junk non-certified email. On the other hand, if the ISPs do too much of that, their email users can switch to other ISPs, which is especially a risk for the free-mailbox providers like Yahoo, so they've got some incentive not to do it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Bravo. Unbelievable.
I saved a dated copy of this, because it's the answer to some 1000 SlashDot discussions.
"Your X May Vary"
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Of course, lots of commercial email sending systems do this kind of thing, including legitimate ones and spammers. A lot of the email I get at work from technology vendors has graphics and subscribe/unsubscribe URLs that come from email handling companies rather than the vendor themselves. (From a personal and technical standpoint, I think this is really tacky - it takes very little work to have URLs from http:mail-response-handler.examplevendor.com/stuf
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I only chose "Nice try, asshole..." instead of "Sorry dude..." because the approach is little more than extortion of companies.
That sure is a nice email you've got there. It'd be a shame if anything happened to it, eh?
In one sense, that's absolutely the right model for reducing spam - you don't care how much spam there is in the world, you just care how much of it gets into your inbox, and if some Nigerian princess is willing to pay your price for consulting service for reading your mail, your mailbox has negotiated an appropriate price with her and waited for the Paypal to clear so you really don't mind spending two seconds of attention span to junk her message.
In reality, enough of the email that most people receive is something that they do want and therefore whitelist or perhaps even pay for, so you can't enforce this mechanism on all your email, so the spammer arms race would focus on how to impersonate email sources you *did* want to hear from, and you'd use crypto to keep them out, and the financial or technical transaction costs would be annoying enough that there would be useful email that you're not going to receive because the senders didn't want to bother haggling with your robosecretary about it.
So it's not implemented very often, and it may be hard to find off-the-shelf implementations, but if you're a corporate executive, you can always hire a secretary who will not only get rid of the junk, but prioritize the non-junk mail for you.
And of course, while this sort of thing is annoying enough that most people won't bother sending you mail if you're using it, if spam becomes sufficiently annoying that many people do adopt it anyway, you'll start seeing lots of advertisements for mail systems that pay you to read email! Right there at home on your couch!
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Every so often I send emails to people in various countries and the response I get from my provider Comcast is nonsense like this:
550 Permfail destination not valid within DNS
Of course resending works because the comcast system has too aggressive a DNS T/O policy and don't know the difference between a temporary and permanent error class. Its unfortunate that many have reported the same problem over and over again and yet they continue to ignore their customers. Its even more unfortunate that I'm not surprised.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Seems a simple enough solution... have the ISPs that don't participate charge those that do to have messages originating from their systems delivered, or converesly, if Verizon doesn't pay google, then google won't accept SMTP from Verizon (well, maybe not at that scale, but it would be nice to see).
"Whoever would overthrow the liberty of a nation must begin by subduing the freeness of speech."--Benjamin Franklin
Pymilter doesn't need user training. It uses mail to honeypot addresses to train for spam: create an address and put it on your website where spammers can see it, but use all email to that address (or addresses) to train the filter as spam. Then, add all addresses a user sends to and add it to a whitelist. If incoming whitelisted mail can be authenticated via SPF or DKIM, use it to train the filter as ham. I also have a blacklist. All mail from blacklisted domains is used to train the filter as spam. Emails are auto-blacklisted if they cannot be authenticated via SPF or CBV (call back validate to check that DSNs can be sent to alleged sender).
The only thing the user has to do is check the quarantine via a webapp if they think a message might be missing. False positives are extremely rare. An enhancement would be to accept feedback when offered. But the honeypot and blacklisting already provide a huge source of confirmed spam for training. It is harder to get confirmed ham for training. (Messages released from quarantine are of course confirmed ham.)
and when a user clicks the "opt-out" button/link... it opts them IN to how many other lists? it's easier to ignore the emails (which often results in them ending) or tag them as spam.
We went through this before, with Bonded Spammer, which wanted spam filters to let their stuff through. I dump Bonded Spammer email into a separate folder, and it's almost all spam. It looks like we'll have to set our filters to recognize this new stuff, and dump it into the "bulk" folder. So how do you check for these new guys?
It doesn't really matter if someone filters mail into a spam bucket. The mail has been successfully delivered. The point is that all mail should actually be delivered to the addressee by default, not at the whim of an ISP making assumptions about whether the sender is friend or foe.
;-)
We're going about fighting spam the wrong way. We should just execute spammers (and maybe those who employ them) in the most painful, messy way that can be devised. Or maybe burn "THOU SHALT NOT SPAM" into their hides with a blow-torch.
Who needs ISPs anyway? :)
Seriously, I'll better pay for a domain name and have my own mail server that I can guarantee it delivers my mail. Or give up email, or live with may/may not paradigm. But paying for email is so 90s.
So, you buy a server, you invest time and/or money to install your mail server. you pay for an internet connection and/or bandwidth usage, you pay for the space your server takes up and the power your server consumes. Then someone knocks on the door and tells you hello mister, from this day on you pay me $x for every mail that leaves your server. Hope the gods would forgive me 'cause I'd certainly smash a chair or two on the guy's head.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
I take the risk to be modded down but:
I really believe that one should make the difference between recreational e-mail and corporate and official/corporate e-mail. For the first kind, we do not need anything and e-mail needs to remain free. For the second, this is another story and corporate e-mail should be a charged service
In my view, each country should mandate and certify at least three or four companies like goodmail and international agreement would establish peering relationships between those certifiers
- companies and administration should only accept incoming certified e-mail except of course on support@mycompany.com or sales@mycompany.com. They could even receive a fraction of the money involved.
- by law any non certified e-mail should not have any legal or binding value.
- certifier should take technical measure to enfore sender identity and retain e-mail record (only the sender, receipient and subject trace) available by both sender and recipient for two years.
- certified mail should be encrypted and signed and it would be up to the certifiyer to provide signing keys for free in exchange for the charges collected.
- all ISP should propose at least 5 certified e-mail / month on their accounts bundled in the ADSL fee. Above, subscriber should be charged.
- web mail provider could provide such certified e-mail but would eventually pay the certifier.
- per mail price should be kept very low (a couple of cents)
- no single account or IP should be allowed to send more that 100000 / month
Ok, you do not like it? But its a real way to make spammer actually pay for the bandwith that they are wasting (reminder, more than 50% of e-mail)
You will not able to use your corporate e-mail to send silly jokes to your buddies outside the company? Use gmail instead.
You won't be able to send more that 5 certified e-mail a month to corporate addresses from your personal e-mail ? How many e-mail are you actually sending to corporation from your private e-mail ?
Does that include hop tracking and filter insurance?
i will not use this system. its token will be looked for by my linux e-mail program and used to blacklist all mailers to me that use it. i have no interest in commercials in my e-mail, so anyone using these 'tokens' will be automatically assumed to be spammers. The danger is the next step, and that is the potential involvment of commercial closed source systems like micro$$ to force users of, say, IE8 or whatever to download and view each and every 'tokenized' e-mail from whatever source for so many seconds before being allowed to open any of their real mail. Imagine being forced to click through ten thousand or more junk viagra peddlers who paid 'postage' letter by letter. Imagine being forced to use 'windows' in order to use an e-mail program at all?
The answer is simple. Users should start charging their ISP's a "SPAM DISPOSAL FEE". Say $1.00 per instance. And then while they're at it, a $100 per instance "putting up with your bullshit rules and regulations and outrageously stupid fees" fee....
And then maybe user's should band together and charge providers a "PREMIUM USER ACCESS RATE" for permitting blocks of users to connect to and move traffic across their networks. So they want to charge users for premium access?? It can work both ways-- no users, no revenue.
And the users don't have to be out either-- just start building free, community wifi points and connecting the wifi points together. It would be a struggle at first, assuredly, however, we've all been here before-- rememeber the beginning? When it was really difficult and challenging to get the bits through? We had to deal with stupid phone company policies and bureaucratic red-tape and we did it then, we can do it again-- the Internet CAN be free if we want it to be. Free in the sense of speech AND beer.
All those phone companies and cables companies are hoping we CANNOT get together and speak as one voice. However, I believe in the collective power of the Internet. It isn't easy, but its happened before-- and if enough people get together on an issue, our collective voice would be like a laser-beam that could vaporize damn near any opposition whether commercial or political.
When enough people want it-- the world bends to the will of the masses. That is the lesson from history that's been taught over and over. The trick is getting the masses to stop being selfish long enough to notice.
Really it is. It's a one to one technology, mailing lists are a kludge which have been grafted on top. Things which are currently sent via mailing list to groups of people (and this applies in the corporate world too) should really use a one to many technology, historically that would be usenet, though today I think we're talking RSS feed.
So frankly if you are abusing email by sending them out to hundreds or thousands of people when you could be using RSS, or even your own Usenet server then I really don't have much sympathy when they mark your emails as spam and cut you off from customers.
Deleted
AOL used to be listed at RFC-ignorant, for perfectly valid reasons, but I guess they must have bullied the owners of that site into submission. They are still not doing real Internet email (i.e. RFC-compliant SMTP) and they have no intention of ever doing so, by their own admission. The ultimate arrogance is AOL's insistence (touched on in the grandparent post) that other spam generators (yes AOL still generates huge amounts of spam, though they are slowly getting that problem under control) must maintain valid postmaster boxes.
Hopefully DKIM will eventually solve all this for us. Don't hold your breath, though.
It seems to me that the ISPs have forgotten who their customers are. Asking people who pay at least $20 a month for internet access (and associated email accounts) to accept unblockable emails into their inbox is a lot like asking moviegoers to drop $9 on a ticket, and then having them sit through 15-20 minutes of advertisements before the movie starts. ... oh, wait.