ISPs Starting To Charge for 'Guaranteed' Email Delivery

Presto Vivace writes "Under the guise of fighting spam, five of the largest Internet service providers in the U.S. plan to start charging businesses for guaranteed delivery of their e-mails. In other words, with regular service we may or may not deliver your email. If you want it delivered, you will have to pay deluxe. 'According to Goodmail, seven U.S. ISPs now use CertifedEmail, accounting for 60 percent of the U.S. population. Goodmail--which takes up to 50 percent of the revenue generated by the plan--will for now approve only mail sent by companies and organizations that have been operational for a year or more. Ordinary users can still apply to be white-listed by individual ISPs, which effectively provides the same trusted status.'"

Comments

Fighting spam?

[LordHatrus]

How does it fight spam if the spammer can ask to be whitelisted, or if the spammer can pose as or actually be a business operating for more than a year? Lame.

Re:Fighting spam?

[nacturation]

How does it fight spam if the spammer can ask to be whitelisted, or if the spammer can pose as or actually be a business operating for more than a year? Lame. You combine it with other techniques, such as whitelisting only specific IP addresses and rejecting mail from those IPs if spam reports get too high. A business approaching Goodmail and saying "please whitelist these 500,000 zombie IP addresses" would be just a tad suspicious.

Re:Fighting spam?

[tacocat]

No, you are really wrong.

The point behind guaranteed delivery is that the ISP will not blacklist your domain/ip address regardless of how many spam reports they receive. This is the whole point behind goodmail.

I just spend hours in a meeting discussing this very topic. Our company was blacklisted by AOL because too many people reported our email as spam (it's all mail that they opted in for -- default is out). The result was all of AOL delivery was blacklisted. Eventually we got it fixed, but the next tier to the solution is to pay GoodMail $$ to effectively certify our domains as legitimate senders and they pay AOL a portion of their proceeds to guarantee permanent whitelist status no matter what the users do.

The only criteria that AOL has leveled against us is if someone tags our email as spam, we have to remove them from the mailing list. But I don't know if this will change or not with the introduction of GoodMail into our mail delivery system.

Re:Fighting spam?

[Ucklak]

Same boat as you my friend. We decided that AOL email addresses aren't allowed to be used in our monthly drawing for a free product(meal) so we don't accept AOL addresses on our web form.

The problem is that part of the registration sends a message to the recipient that the user has to acknowledge. That message sent to AOL addresses gets tagged as SPAM. Secondly, the newsletter we send out also gets tagged as SPAM by a good percentage of AOL users. So my opinion of this crap is to discriminate against people with goodmail services.

Re:Fighting spam?

[tacocat]

If he tags what you sent as confirmation to his request, what do you think the chances are that they will also tag your newsletter?

A lot of AOL users tag messages as SPAM when they don't want to see them anymore. It's easier than opting-out and so they abuse the process. They have no repercussions to their actions.

But a lot of users do this. I see it in my house where I run my own mail server and my own spam filter. It's a bayesian filter so you have to tell it when it was wrong. Wife won't tell it anything but she complains about the spam she's getting. Can't help her. She's being obstinant and dumb.

Re:Fighting spam?

[Not_Wiggins]

I work for a major corporation and assist with the email policy.

For AOL, they required only two things from us, and we haven't run into problems:

1) Publish an SPF record (they were pushing it big-time). I'd recommend a loose policy that states "if it doesn't pass the SPF check, make your own decision" (which is the ?all option).

2) Establish a complaint/opt-out email box and process the messages that come from AOL.

Of course, there are vultures out there looking to make a buck by selling everyone a solution that is of questionable effectiveness.

We've resisted paying the "marketing tax" and haven't seen a drop-off in deliverability.
If more businesses refuse, then this trend will die off.
I hope it goes the same way as the "linux license" that a business could purchase from the SCO; let it be known to be tantamount to extortion! ;)

Re:Fighting spam?

[Jay L]

Of course, Goodmail can't guarantee that the *recipient* isn't filtering. And it doesn't blacklist anyone. It's just an accreditation scheme like DKIM, but at the per-message level instead of the per-domain level. It does three things, from what I can tell:

1. At the sender side, for those senders who are paying Goodmail, it adds a token to the e-mail that recipients can verify. This part could be great, if they open up a public way to validate that token (and it's in their interest to, I think). Spam filters like SpamAssassin could then score the e-mail differently. Either Goodmail is useless, or it's useful. If it's useless, recipients can ignore the token. If it's useful, recipients can decide to apply less filtering - or they can apply all the usual filters, and just (using SpamAssassin as an example) apply a negative point or two to Goodmail so it's less likely to get filtered.

2. At the recipient side for those recipients who are Goodmail "partners", it guarantees that your mail will bypass all other filters. This part is dubious. Will they regret becoming partners? Maybe, if people start sending spam that's signed by Goodmail. Can they get out of their partnership or change the terms? Dunno. Will the market sort this out? You bet. If Goodmail partners start delivering more spam than non-partners, people will switch to the non-partners.

2. Also at the recipient side for those recipients who are Goodmail "partners", it adds a pretty blue ribbon, etc. to the "chrome" of the e-mail. Yes, the chrome is unforgeable. No, users can't tell the difference between a blue ribbon in the chrome and a blue ribbon in the body. AOL tried this years ago with "Certified E-Mail", so you could tell when a message was REALLY from AOL. Did it stop phishing? No. This part is security theater.

Nobody gets blacklisted. Right now, ALL our mail is essentially second-class mail, subject to all sorts of filters. GoodMail creates a first-class tier that potentially bypasses all that if you pay for the "postage" (which is only 1/20th of a cent for non-profits). Again, the market will sort out whether or not that postage is useful. In fact, "postage" is probably the wrong word - it's more like "notarized" e-mail.

Re:Fighting spam?

[datlas]

Actually being Goodmail requires *fewer* complaints than even regular white listing. The point of Goodmail is NOT that the ISP will not blacklist you regardless of how many complaints you get -- exactly the opposite. If you get a lot of complaints you won't even qualify for CertifiedEmail: http://www.postmaster.aol.com/whitelist/certifiede mail.html : How is eligibility determined for participation in the CertifiedEmail Program? The CertifiedEmail program is open to qualified, accredited senders with a history of good sending behavior. These senders will be further accredited to make sure the sender's programs conform to CertifiedEmail acceptable use policies. Senders accepted into the Certified Email Program will maintain status in the program by keeping complaint rates below threshold across recipient mailbox providers. Violation of complaint thresholds will result in the sender being placed on probation or excluded from the CertifiedEmail Program.

Re:Fighting spam?

[IngramJames]

AOL... I do that too

Surely you meant to type:

"Me too!"

Ahem. Thank you, thank you. The old jokes are.. well.. old.

Re:Fighting spam?

[tacocat]

I was thinking of the repercussion as something you would experience if you were using a bayesian filter.

If you tag indiscriminantly everything that you don't want delivered for any reason, they you will start getting more false positives because it's an adaptive AI process. There is a little care and feeding of the whole filtering process you have to pay attention to.

I don't believe that AOL is going to use something like this. If you tag email as spam, AOL takes it upon themselves to send you a warning email and if you don't opt them out they black list you (eventually). What would be a repercussion to the consumer is the eventual increase in false positives -- giving the consumer a repercussion to their indiscriminant feedbacks. No one is made aware that there is an effect.

And just to clarify -- I'm not talking here about the obviously unsolicited email, but the email that is solicited but no longer wanted. The consumer took a positive action to get the email and now no longer wants it. What I am definitely not talking about here is the email that you never asked for, or where opted-in by means of fine print that few can even read at light grey and 6pt font.

Re:Fighting spam?

[Jasin Natael]

I don't trust the parent and grandparents who are so righteously complaining about how customers have all "opted in" for their junk mail.

Your personal incredulity is not a rebuttal. I actually developed and run a site where each user pays us close to two thousand US dollars per year to receive our email updates, and some users on AOL still mark our messages as SPAM. About every six months or so, delivery to AOL email just gets blocked wholesale, and they aren't the friendliest people to deal with.

And we give the users many ways to opt in or out as they choose. They can even call or email customer service and we have a girl who will set up their account preferences for them -- so that each specific type of message, product category, or messages related to certain businesses, are excluded. And they still mark it as SPAM. I'm not sure if it's a penny-per-four emails problem, but it is certainly a problem.

Re:Fighting spam?

[caffeine_high]

We get this a lot, people just mark a legitimate message as spam because it is easier. This is particularly common with with aol users.

The best option I have found is to include a unique identifier in the message and setup a 'feed back loop' with aol. They send you a notification when someone marks a message from your domain as spam. We remove them from our system and then contact them to explain why their lazy actions effect other aol users. Usually they are shocked that they have been caught and vow never to do it again. They often also ask to get included in the system again.

Re:Fighting spam?

[MightyYar]

You aren't the typical AOL user... Put up a real estate related site with a sign-up form... watch the contact info fly in. I don't know what it is about that demographic, but they sign up for EVERYTHING. Of course, that doesn't stop them from using the SPAM button as "unsubscribe". I'm not going to complain, though, because you'd be nuts to click on an "unsubscribe" link for something that you don't remember signing up for.

Re:Fighting spam?

[tacocat]

Ten years ago I would agree. But now I don't.

The confirmation of an email address isn't valuable anymore. It's too easy to get real addresses en masse without anyone confirming the address. There once was a time when people would pay big money for lists of confirmed email addresses as a list for spamming. I don't know that there is much value in this anymore.

The process of sending spam is basically Fire and Forget so there's no added value to having a confirmation to the address. I have many records where people try to send email to random names or even characters on my domain and none of them could have ever been confirmed. And they keep coming. Add to that the back-scatter spam and you've no need for addresses being confirmed.

Go ahead, confirm your address. The spammers already have it and they don't really care if it's confirmed or not. They'll keep using it for months to come. And at least it gives the legitimate mailings a chance to play honest and opt you out without getting punched in the nose.

For legitimate purposes, if the sender provides and opt-out mechanism then it's the consumers responsiblity to use it and the marketers responsibility to honor it without qualification. But if you don't provide this mechanism then you should be labelled spam and prosecuted.

Re:Fighting spam?

[Sparr0]

AOL email addresses aren't allowed to be used in our monthly drawing for a free product(meal) ... the newsletter we send out also gets tagged as SPAM So you get people to sign up for a drawing, and start sending them a newsletter? Hello spam.

Breach of contract

[KiloByte]

Well, assuming an user pays for the e-mail account, isn't this a breach of contract and false advertising? By "providing an e-mail account", it can be assumed no real mail is ever meant to be knowingly dropped.

Declaring those who haven't paid the protection racket as not "real mail" is not really something that I would envision as something which would pass a non-bribed judge.

Re:Breach of contract

[bwd234]

"Well, assuming an user pays for the e-mail account, isn't this a breach of contract and false advertising? By "providing an e-mail account", it can be assumed no real mail is ever meant to be knowingly dropped.

Declaring those who haven't paid the protection racket as not "real mail" is not really something that I would envision as something which would pass a non-bribed judge."

Guess what, this is exactly how the USPS works. They are not responsible for making sure the mail is delivered unless you pay more for it, like certified mail, etc.
How do I know? I was told this in so many words when I had mail lost and complained to the Post Office about it.
It was basically, "if you want to make sure it gets there, have it insured, otherwise..."

Yeah, nice little racket the USPS has too!

Re:Breach of contract

[asamad]

Slightly different analogy, you are already paying for you packets to make it to the internet, why should you have to pay again ?

Re:Breach of contract

[codegen]

I have not read your terms of service, but I can *almost* guarantee there
is a clause that specifies that the ISP can modify the terms at any time
by posting them on the website and that you agreed to it.

Let's rate the ISP's

[Anonymous Coward]

Comcast - EVIL
Cox - not very evil yet
Time Warner - The incarnation of Evil
Verizon - Pure evil

They didn't say who the other three are, but I'll guess here
AOL - Strange evil
BellSouth - Pure Evil
Mediacom - Incompetent Evil

Not that I like spam but....

[ralphart]

This is pretty freaking outrageous.

If there's any way to organize and refuse to relay mail from any of these greedy self-appointed guardians, I'd certainly be interested. Blacklisting all mail out of their domains would probably be extremely educational for them.

Good for the goose...good for the gander.

recipe for disaster?

[jb.cancer]

apart from the initial shock (face it, evryone wants to plug the tube that is the internet), won't this generate more unwanted e-mail traffic? think of all the people who would now send >1 copies of each of their mails just to increase the chances of delivery.

of course it's all assuming that the real intention is not 'end-of-free-emails'(which cud be quite naive)

Well

[ShooterNeo]

Honestly, I don't see what the problem is. Charging some sort of cost - whether it be responding to a whitelist request, paying in CPU cycles to complete a hash, or just flat out paying a quarter of a cent - is the only practical way to fight spam. Spamfilters always have a small false postive and false negative error rate, while charging money or a cost does not. A quarter of a cent is many times the expected monetary return on a pure spam.

Since it costs money to set up an infrastructure to accept a cost of any type (reliable servers, an organization, ect) charging actual money rather than hash cycles or CAPTCHAs makes the most sense, and is also the only practical way for a big organization to send emails to a bunch of users.

Re:Well

[tacocat]

But who do you think it going to pay that cost?

I'm on a lot of mailing lists. So 300 emails a day works out to 75 cents US. Which adds up to $273 a year that I have to pay. If you look at it from the point of view of the mailing lists, they might have 10,000 users which means every email costs them $25US. For someone like Debian this is death. For someone like Microsoft -- They'll just add $25 to their product prices.

When the F... are you going to realize that pay per use is not a means to being effective for anything. It's a means of generating money. It doesn't save you money and it doesn't get you any more freedom, happiness, or flexability

Re:finally

[abertoll]

Yes, but I'm not sure it's expensive enough at 1/4 cent. That kind of price sort of sounds like they're hoping the spammers use them so they can make a lot of money. Not that they're going to help prevent spam.

Re:finally

[mikelieman]

You're not getting junkmail in your reality-based mailbox, then?

This has NOTHING to do with stopping Spam.

This is all about generating revenue from Spam.

I want my share too.

[140Mandak262Jamuna]

For every mail delivered to me with a blue ribbon I will charge 0.125 cents. If the ISPs dont pay me I will not read the mails. Howz that!

And this will help how?

[Anonymous Coward]

So the spammers who use botnets will just cause the hijacked computer's owners to pay thousands in email fees?
I can imagine the new "training" course at the grade schools:
Don't download music because you'll get sued for thousands of dollars by the RIAA and then have to pay thousands of dollars because a "virus" sent out emails from your computer!

This is extortion

[HellYeahAutomaton]

Its kind of like if the mob owned the USPS and said "You might get your mail in one piece...and you might not if you don't pay up."

Well the PROBLEM is that...

[shmlco]

The "problem" is that there are a ton of non-profits, news sites, news groups, blogs, lists, whatever-of-the-day sites, schools, churches, and other organizations that send out a lot of requested put-me-on-the-list email to their members.

Have a decent-sized list on which you're doing a daily run, and even at a quarter of a cent you're suddenly looking at thousands of dollars a month out of pocket.

So now all of those sites and services and lists either: A) Stop sending email and/or go out of business, or B) Start charging for the stuff you used to get for free.

Is it so hard for people to figure this stuff out? Apply a cost somewhere and--one way or another--you're going to pay it.

Yeah, that works

[scribblej]

I mean, my postal mailbox is totally free of spam-like mail, because companies have to /pay/ for postal mail.

Re:Yeah, that works

[maxume]

I get 3 or 4 mailers a week(probably partly because I live on a rather underpopulated route) and at least 3 or 4 spams an hour(that are almost universally filtered). I wouldn't care if I got 3 or 4 spams a week, filtering or no.

Re:Yeah, that works

[Duhavid]

Sarcasmville.

Infrastructure problem

[Loconut1389]

OK- so you've got the infrastructure to do pay-by-email set up. Now the end user has something like an iTunes account backed by paypal and it just sort of automagically charges your account every time you send an email, what happens when your machine is compromised by a bot-net and you're sending millions of emails for a quarter?

Re:Infrastructure problem

[guruevi]

That's a good thing, then the TCO of Windows would be even higher! Also, all dumb users on the Internet would be bankrupted and not able to afford a fast internet line, more bandwidth for us, less crap on the web.

Re:finally

[tacocat]

Give this man a cigar.

Not only will it generate revenue for delivering spam, but it will also mean the end of non-cost based mail delivery. Think mailing lists and personal domain servers.

Scam

[Anonymous Coward]

This is like privatized jail system in the USA. The moment it was set up, the number of people sent into jail has started to grow steadily, since there is direct financial interest to "maximize" profit on investment.

If you need to pay fee to get your email for sure, the same companies can make sure that the emails of non paying people will get lost.

Whitelisting is a solved problem: Hashcash

[loqi]

One word: Hashcash. Basically you prove that you wasted a couple seconds worth of CPU to send your message. I believe SpamAssassin already recognizes Hashcash headers, not sure about other filters. But if you're really ready to start dropping email en masse in favor of a whitelist-style approach, this is the simple and elegant solution.

Dubious statistic

[asuffield]

According to Goodmail, seven U.S. ISPs now use CertifedEmail, accounting for 60 percent of the U.S. population.

This is probably true as stated, but almost meaningless. Each of those ISPs will be counting the number of users that have email accounts with them, and then they just added up those numbers. The problem with this is that many users have more than one email account and don't use the one provided by their ISP - a large chunk of that 60% probably uses yahoo, hotmail, or gmail. Many people will also have another account provided by their employer.

It is not particularly useful to count email accounts as a fraction of the US population.

Re:I'm not surprised

[Just some bastard]

If you are running a simple SMTP server on a cheap DSL or cable connection, chances are your reverse DNS lookup isn't going to match your intended host name.

If you're running an MTA on a cheap connection you need to use your ISP's smarthost, mail that appears to come from dynamic addresses is increasingly rejected due to zombies.

Matching forward & reverse DNS (and sometimes helo) is an additional requirement for delivery to certain servers.

Spam Filters are Broken

[tacocat]

I think part of the problem is that spam filters are generally broken and don't work that well. Part of the problem is that no one has seriously thought about how crappy the approach is. The other part of the problem is that their is little or no personal ownership of the filtering of spam.

When the ISP/customer have no relationship on identification of what is spam the ISP has to aim really high and take the approach that anything that is obviously spam is not delivered and everything else is. The net effect is the ISP might not deliver porn spam, but they'll deliver many other things with impunity. If there was a more aggressive involvement of the customer/consumer of the email then you could better tune the filters to match each user better.

SpamAssassin is the worse offender. It's origination was to do static regex checks and add points for each hit. And when you were done, the points put you either IN or OUT. But in order for SA to work you have to tune the number of points added for each regex test. And this is constantly changing. But for it to work, you have to be constantly monitoring the results. No one does this on a consistent basis.

A critical drawback with their approach is the constant game of catch-up they have to play in order to get the filtering to work correctly and then someone has to run some update script to hopefully get everything working correctly. Again, this has to be done continually like the tuning or it will start to fail.

Bayesian filters offered a great alternative but they quickly turned into their own problems. SA uses Bayes, but it's not effective because of the lack of feedback from the consumer (in most cases). It's also prone to over-rides by their own auto-whitelisting. Convenient, but deadly. Where Bayes lacks goes back to the original problems of non-customized feedback and involvement. It's very inconvenient to try and set up something like bogofilter to run for every individual in a group of 1000's so the mail admin makes one file for everyone thereby generalizing the statistics and making them less effective because they have to be good enough for everyone but not so good they remove any of the really serious spam.

And yes, SA does user specific Bayes filtering. I used it for three months and it sucked. It was not a very effective spam filtering system even with user specific bayesian filtering included. It's also getting pretty darn slow. Slow enough to become a consideration.

DSpam is effective, customized, and slower than molasses in january. It will also lose email. But YMMV and I don't really care to hear about how great it is. I lost a lot of email and a lot of money as the result of it. Perhaps some day they can get their act together, but there will always be a severe performance penalty for CRM114. But Bayesian filtering can still compete with CRM statistical success with 100X performance increase.

So what do you do about spam filtering?

The technology exists to effectively and efficiently filter spam. But that's not the problem. The technology that is used today is relatively lame because there are shortcomings abound that prevent a good solution for someone really large (like an ISP).

The problem is to redefine how the consumer is going to own their own spam filtering effectiveness. No more auto-whitelist. No more auto-blacklist, No more auto-update of Bayesian tokens. All of these can be carefully manipulated to taint the statistics and allow delivery in droves. The consumer must take ownership of their mailbox in the same manner that they are expected to take ownership of their credit card information on the internet.

Pity the fool

[stabiesoft]

who is paying for this service and gets infected. Ouch, what a bill that will be, and
all guaranteed to be delivered. New bot target:Certified senders!

a bad figure if I've ever heard one

[briancnorton]

accounting for 60 percent of the U.S. population

This is making a REALLY bad assumption that an ISP generated email address is used by the account holder. Problem is, once there became multiple ways to get online about 10 years ago, LOTS of people switched to web-mail for the permanence and convenience. (Hotmail, Gmail, yahoo, etc) I would guess that any major ISP has less than half of their accounts use their provided email services.

No gurantee of service?

[nurb432]

Then what value is the ISP?

This cant be legal. "here is your service. Oh, you want it to actually work, well pay up"

Net Neutrality

[SanityInAnarchy]

I'm thinking I should bookmark this and use it as an example to anyone who claims ISPs won't attempt to charge websites for "prioritized" delivery, and degrade people who don't pay up.

In short: They already have.

Of course, I don't think net neutrality legislation will cover email -- not that I care much, I really don't send mail to many people at AOL -- but it's just a perfect example to all the Libertarian idiots out there of why we do need government intervention sometimes.

The free market will sort it out? Sure...

Google already does this

[Anonymous Coward]

Gmail started rejecting mail from my home system back in April. At the time the rejection was "Our system has detected an unusual amount of unsolicited mail originating from your IP address."

This turned out to be a lie, but I wasted time making very sure it wasn't true. Nor was it an inherited IP problem from DHCP because I'd had the same for months.

To make it more fun, much confusion was caused because some of my 'rejected mail' had actually gone through.

Eventually I got a response from complaining to Gmail as a Gmail customer. There was no other way to contact them about the problem, and they still took two weeks to make a generic reply to the effect of 'thank you for calling ... our engineers work hard constantly to improve the system ... are you still having trouble?"

Hell yes I was, but what they did in the meanwhile was tweak their error response. Now the rejection was "The IP you're using to send email is not authorized to send email directly to our servers. Please use the SMTP relay at your service provider instead." Which is already what I'd ended up doing while waiting around of course.

I told them that and got another two-week later canned reply saying "Thank you for your reply. We suggest that you utilize the SMTP relay from your service provider."

It's horseshit, and just laying the foundation to charge for 'guaranteed delivery'. Our machines are supposed to be able to connect to one another. This Gmail mess was proof positive it's not about spam because there was none. It's about making money by lying that it's about spam.

Re:Google already does this

[Just some bastard]

Our machines are supposed to be able to connect to one another.

An unfortunate side effect of zombies is that mail obviously sent using dynamic addresses is rejected. It's wrong to blame receivers for their policies, the blame lies with botnet operators and users who fail to take adequate security precautions. Neither can you expect receivers to whitelist dynamic addresses, the solutions are:

1. Relay through your providers smarthost
2. Get a static IP
3. Get a VPS and relay through that

It sucks much less than expecting receivers to accept spam.

Competing Vendors.

[OgGreeb]

I have yet to see an adequate defense proposed against the problem of multiple "certified email" vendors in the same mail stream, where one vendor has been paid and the others haven't. How does one vendor ensure that validated mail gets delivered?

This is exactly the same problem with backbone pipe vendors wanting to get paid for "premium" bit transfer.

Re:Competing Vendors.

[OgGreeb]

That's great, for the recipient ISP. But if you host a legitimate mailing list, and 10% of your destination addresses are to AOL which accepts Goodmail, and 15% are to Hotmail, which requires MicrosoftHappy, and 12% go to GMail, which requires ReallyGoogle, and there are another 15 vendors represented amongst the 30% of smaller ISPs, then how much will it cost to get messages through again?

And what kind of mail transfer infrastructure will be needed to handle all the certification and payments?

Now I understand why the block port 25.

[twitter]

Nice plan.

1. Keep users helpless.
2. Provide "service" for helpless user
3. Profit.

Give me back my ports and I won't have to worry about spam or your fees.

Spam Filter

[Joebert]

Where can I get an up-to-date list of theese companies, so I can add their addresses to my spam filter ?

Feedback Form

[SeaFox]

Your post advocates a

(X) technical ( ) legislative (X) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
(X) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
(X) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:pay me to spam me

[tomstdenis]

A penny per email isn't economical. And I already pay to send emails. It's called my ISP fees. The ISP provides IP [including TCP and UDP] service which means they have to deliver my packets to the best of their ability.

Some sort of "pay us [more] or we may drop your packets" is a protection racket of sorts. Remember that an email is no more than a TCP stream of SMTP commands.

Tom

radio

[falconwolf]

Read up on the early history of Radio. It used to be free to broadcast. Now it's really expensive. Soon the only web pages and mailing activities will be those that are sanctioned by the key masters.

No, it's cheap to radio broadcast, Pirate radio stations do it all the tyme. There's even pirate radio on the internet. What's espensive is getting a license to broadcast. And that's just how the mass media wants it. Clear Channel doesn't want more competition, it wants less.

You're checking the wrong boxes

[billstewart]

Yes, it's market-based. That does mean that most spammers won't be willing to pay for it. But some legitimate email senders (and a smaller number of well-targeted spammers) will find it worthwhile to pay to get mail through big ISP blacklists - anybody who's running a legitimate mailing-list service or doing things like product registration spends a lot of time bitching about AOL.

There isn't a central authority controlling email - but they've got the ISPs that are over 50% of the US mailbox market. (Microsoft MSN isn't one of them, though :-) And these countermeasures _do_ work if phased in gradually; otherwise they wouldn't be able to make a profit (not that we know yet if they'll make a profit or if they'll die out in a year.) It doesn't require cooperation from everybody at once - they've got enough mailbox ISPs signed up that it's at least potentially worthwhile for an email sender to pay them for the service. And they're not trying to solve the *whole* spammer problem - they're trying to get some non-spammers to pay them for delivering non-spam, which is a difficult but much simpler problem. It's not a "find the spammer to make him pay" system - it's a "pay up front to claim you're not a spammer" system.

Joe-jobs, Forgery, Worms and Zombies, etc. - The press releases don't say *how* they handle their certification other than to mention cryptography. But their board of technical advisors is interesting - Marty Hellmann, Avi Rubin, Dave Crocker - so there's a good chance they've done it right. Cryptography does take a fair amount of horsepower, but it's scalable dumb horsepower, and if they've done things well they can avoid having to verify the crypto on most forged messages. If they've designed things well, it's not incompatible with open-source tools, but they're writing Press Releases, not technical documentation, so it's hard to tell.

Asshats, and trusting Goodmail's servers - yes, that's still a problem. Their terms of service are appallingly weak - they'll accept unconfirmed opt-ins, and their "interpret complaint as unsubscribe" is inadequate, so dishonest spammers can still pay to get service delivered for a while, until they get enough complaints. But at least the quarter-cent per message means that only well-targeted spammers will be willing to pay for it, so it won't be really high volumes of spam. If there's much of that going on, then email users won't stand for it, and they'll bitch at their ISPs (though that's more effective with AOL who charges money than with Yahoo who's giving you that email account for free anyway...)

And yes, email should be free, and whitelists suck, but blacklists also suck and some email senders may be willing to pay to deal with whitelists that suck instead of getting stuck on blacklists that suck.

protection racket much?

[c6gunner]

"Nice e-mail account you've got here. Be a shame if something were to happen to it...."

Thats a nice email

[Mantrid42]

That sure is a nice email you've got there. It'd be a shame if anything happened to it, eh?

That model is available - feel free to use it :-)

[billstewart]

A lot of the discussion about market-economics solutions to spam proposed models like that. [insert standard checklist here :-)] Some of them get it wrong and have arbitrary prices for delivery that get paid to the wrong people, so they're not likely to work economically, while others of them realize that the real cost of spam isn't the bandwidth, CPU, or storage costs, it's the recipient's attention wasted reading the junk, so they propose ways to let the sender pay the recipient for reading the mail. Some of them use artificial payments like hashcash (where the sender has to burn CPU time, and therefore can't send spam very fast), while others use real cash, typically with some kind of stamps paid for with Paypal.

In one sense, that's absolutely the right model for reducing spam - you don't care how much spam there is in the world, you just care how much of it gets into your inbox, and if some Nigerian princess is willing to pay your price for consulting service for reading your mail, your mailbox has negotiated an appropriate price with her and waited for the Paypal to clear so you really don't mind spending two seconds of attention span to junk her message.

In reality, enough of the email that most people receive is something that they do want and therefore whitelist or perhaps even pay for, so you can't enforce this mechanism on all your email, so the spammer arms race would focus on how to impersonate email sources you *did* want to hear from, and you'd use crypto to keep them out, and the financial or technical transaction costs would be annoying enough that there would be useful email that you're not going to receive because the senders didn't want to bother haggling with your robosecretary about it.

So it's not implemented very often, and it may be hard to find off-the-shelf implementations, but if you're a corporate executive, you can always hire a secretary who will not only get rid of the junk, but prioritize the non-junk mail for you.

And of course, while this sort of thing is annoying enough that most people won't bother sending you mail if you're using it, if spam becomes sufficiently annoying that many people do adopt it anyway, you'll start seeing lots of advertisements for mail systems that pay you to read email! Right there at home on your couch! ...5 PROFIT!!

Something smells here...

[BrokenHalo]

It doesn't really matter if someone filters mail into a spam bucket. The mail has been successfully delivered. The point is that all mail should actually be delivered to the addressee by default, not at the whim of an ISP making assumptions about whether the sender is friend or foe.

We're going about fighting spam the wrong way. We should just execute spammers (and maybe those who employ them) in the most painful, messy way that can be devised. Or maybe burn "THOU SHALT NOT SPAM" into their hides with a blow-torch. ;-)