Yahoo Revives Pay-Per-Email, With Charitable Twist

holy_calamity writes "Yahoo research have started a private beta of a scheme that resurrects the idea of charging people to send email to cut spam. Centmail users pay $0.01 for each message they send, with the money going to a charity of their choice. The hope is that the feel good effect of donating to charity will reduce the perceived cost of paying for mail and encourage mass adoption, making it possible for mail filters to build in recognition of Centmail stamps."

Comments

How Exactly Does This Fight Spam?

[eldavojohn]

Subtitle of CentMail:

Do Good. Fight Spam.

So it sounds like an 'opt-in' program for doing otherwise would be suicide by a mail provider. And since it's opt-in, I highly doubt the spammers will be doing the opting. So unless your penny is going to an anti-spam organization, how are you fighting Spam?

Also, I'm not too clear on how this would work. Wouldn't it require a certificate-like central authentication server? And wouldn't this increase in traffic just exacerbate the situation of too much traffic? Especially if all Spam starts to come with fake 'stamps.'

Re:How Exactly Does This Fight Spam?

[FlyingSquidStudios]

It seems to me that the only way to truly insure that the receiver gets 100% spam-free mail is to intercept and sort it before it's received with humans doing the sorting. Even the most robust spam filters get overcome fairly regularly. I know I don't want anyone reading my mail but me.

Re:How Exactly Does This Fight Spam?

[betterunixthanunix]

The idea is that a Centmail signature attached to a message would automatically reduce the message's spam likelihood; if enough people adopt Centmail, then receivers would be increasingly able to require a Centmail signature on mail, and killfile mail that lacks such a signature.

In theory, great. In practice, I predict it spiraling out of control as different parties try to "get in on the action" and see a chance to turn a profit instead of just giving the money to charity.

Re:How Exactly Does This Fight Spam?

[gurps_npc]

Yes, you do need to verify that the email company that sent you the email was in fact who they claimed to be.

The spam-fighting method is to build a sufficient number of email accounts that work that way and start black-listing every email that does NOT work that way and/or is not on your contact list. Not that hard to do.

Re:How Exactly Does This Fight Spam?

[mcgrew]

So it sounds like an 'opt-in' program for doing otherwise would be suicide by a mail provider

I read this with alarm; I have a yahoo (actuallt rocketmail) account and I use it for slashdot. If this becomes popular I can see yahoo charging for all their mail services.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

From what I understand, this is not fighting spam directly. It's to encourage the adoption of a system that eventually will allow people to fight spam effectively-- that is, if everyone's already used to paying the cent for sending an email, they won't care when every email provider adopts this model. It only costs them a few bucks, after all. However, if you're sending millions of emails...

Re:How Exactly Does This Fight Spam?

[TaggartAleslayer]

I have never understood the concept. Forget for a moment that spammers don't follow the rules, and generally work pretty hard to circumvent anti-spam measures, how are we all going to implement and maintain good measures on the receiving end?

Ohh... someone like Yahoo will do that for us. Got it. Just pay my monthly dues or licensing fees and then a low $.01 per email and it's all good. Glad this is such a humanitarian effort aimed at cleaning up our interwebs and not a huge cock-up out for profit, because then it would just be unethical...

Re:How Exactly Does This Fight Spam?

[binarylarry]

Oh right, the only foolproof way is to rely on HUMANS.

You must manage an IT dept or something, I take it?

Re:How Exactly Does This Fight Spam?

[Darkness404]

However there are -tons- of legitimate reasons to have more than one e-mail account. For example, a business might want to have one for each employee, so there is one, another would be a personal e-mail, and another one would be an "internet" e-mail for occasions where you might not want to reveal your real name (forum registration, etc). Plus there are many occasions where you forget either a username or password and when you try to register for a new account it helpfully tells you there is already an account for the e-mail address yet won't send you the username. Another reason is for convenience, I used Yahoo mail for a while but then I realized that I might as well get a Gmail account because I searched Google, had Google as my homepage and never used Yahoo except to check mail.

And also this will create problems with students/poor people who while they can afford the "stamps" might not have a credit card to buy them. And finally, this is unethical because the cost of a single message is -far- less than one cent, similar to how US carriers charge 10 cents or more per text message when it costs them nothing to send.

Re:How Exactly Does This Fight Spam?

[whisper_jeff]

If this becomes popular I can see yahoo charging for all their mail services.

Don't worry. It won't become popular.

Re:How Exactly Does This Fight Spam?

[D'Sphitz]

Let them profit if they want, it sounds like a good idea to me. If I send 10 emails a day, which is probably much more than your average computer user, that's $3.00 a month. I can handle that, but a spammer who sends millions of messages a month cannot pay $10k per million messages.

It's essentially a way to guarantee to recipients of my email that it is not spam.

Also, when customers with zombiefied computers get a six figure bill from their ISP, maybe they'll spend a few bucks to get their system cleaned up and secured, which benefits everyone.

Re:How Exactly Does This Fight Spam?

[TaggartAleslayer]

Another marked troll? Seriously. Yahoo does have mod points today...

Re:How Exactly Does This Fight Spam?

[betterunixthanunix]

Look at what happened with SSL. There are dozens of different authorities, each with different requirements, and the net result is that an SSL certificate is not the highly reliable security token that it might have been if greed had never entered the equation. This system will succumb to the same problem: everyone will want to get a piece of the action, and in the end only amateur spammers will be thwarted.

Re:How Exactly Does This Fight Spam?

[causality]

The idea is that a Centmail signature attached to a message would automatically reduce the message's spam likelihood; if enough people adopt Centmail, then receivers would be increasingly able to require a Centmail signature on mail, and killfile mail that lacks such a signature. In theory, great. In practice, I predict it spiraling out of control as different parties try to "get in on the action" and see a chance to turn a profit instead of just giving the money to charity.

Besides, this doesn't address the ultimate cause (or depending on viewpoint, the ultimate enabler) of spam. Spam exists for one reason and one reason only: someone, somewhere is willing to buy from spammers or otherwise to give them money. Any solution which doesn't address that has entirely failed to learn why Prohibition didn't stop people from drinking or why the War on Drugs hasn't made illicit substances go away. It doesn't matter how sophisticated or underhanded the spammers are, if no one gives them money anymore they WILL go out of business. This is probably a matter of education, though it's possible that credit card companies could be part of the solution since many of these transactions could not occur without their services.

Re:How Exactly Does This Fight Spam?

[Fozzyuw]

I thought a lot of spam came through zombie / infected computers. So, it's just going to be other people who pay for it anyways.

Re:How Exactly Does This Fight Spam?

[Chabil Ha']

Except that SSL was never intended as a way of establishing identity, even though it is a feature of it. Its purpose is and always has been a means of encrypting communication. As your valid reasons indicate, anyone using it to identify is absolutely peanuts.

Re:How Exactly Does This Fight Spam?

[causality]

I have never understood the concept. Forget for a moment that spammers don't follow the rules, and generally work pretty hard to circumvent anti-spam measures, how are we all going to implement and maintain good measures on the receiving end? Ohh... someone like Yahoo will do that for us. Got it. Just pay my monthly dues or licensing fees and then a low $.01 per email and it's all good. Glad this is such a humanitarian effort aimed at cleaning up our interwebs and not a huge cock-up out for profit, because then it would just be unethical...

Also, why should I have to pay a new fee of any sort merely because someone else wants to send spam? The whole problem with spam is that everyone but the spammer has to bear its costs. This only increases the costs that all the rest of us have to bear because of spam. For that reason the ethics of this solution are already questionable despite its presumably good intentions.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Email marketers will wet their pants - this is a way to bypass Yahoo's sending limits and deliver directly to inboxes.

Re:How Exactly Does This Fight Spam?

[betterunixthanunix]

Except that part of establishing secure communications is authenticating the other end, or else you are vulnerable to a man-in-the-middle attack; that is why SSL has a certificate system. If the only intention was to have a means of encrypting communication, then there would be no reason for SSL to have such a complicated protocol that includes identification and capabilities management.

Re:How Exactly Does This Fight Spam?

[causality]

Another marked troll? Seriously. Yahoo does have mod points today...

That does seem to be the most trendy form of asshattery on Slashdot lately, to just indiscriminately mod down every top-level post that you can as "Troll". There do seem to be enough of them in this discussion that it would take more than one jackass moderator to pull off.

Re:How Exactly Does This Fight Spam?

[digitig]

The spam-fighting method is to build a sufficient number of email accounts that work that way and start black-listing every email that does NOT work that way and/or is not on your contact list. Not that hard to do.

Yeah, maybe you can afford to send new customers to /dev/null, but I sure can't.

Re:How Exactly Does This Fight Spam?

[causality]

And finally, this is unethical because the cost of a single message is -far- less than one cent, similar to how US carriers charge 10 cents or more per text message when it costs them nothing to send.

That's my main problem with it. The "logic" seems to go like this: "well, we couldn't come up with a way to make spammers pay, so instead we'll try to make everyone else pay to prove they're not a spammer." I can't support that.

Re:How Exactly Does This Fight Spam?

[Garridan]

Problem is this: if you blindly trust Centmail, then it'll be worth it for spammers to pay to send email. Don't believe it? Check your physical mailbox.

Re:How Exactly Does This Fight Spam?

[nine-times]

In theory, great. In practice, I predict it spiraling out of control as different parties try to "get in on the action" and see a chance to turn a profit instead of just giving the money to charity.

Well to me, the bigger problem is that if everyone did adopt this (which is what would need to happen in order for it to really stop spam) and no one else was "in on the action", then we'd essentially have centralized control over email. Scary.

On the other hand, if anyone can get "in on the action" and use their own signature, then I'm not sure how paying for email helps. Spammers would just get their own signatures, and the system wouldn't be any better than if everyone signed their email.

I do think everyone signing their email is a pretty good idea, though. It would probably not solve the spam problem, but it might help. If SSL certs got moved into DNS (as some people are suggesting) then it should be easy to use authoritative (signed) DNS records which also provided you with a list of authorized mail servers for each domain, as well as SSL certs for those mail servers. That would at least allow you to verify that a given email originated from the mail server it claims to come from, and that the mail server is an authorized server for a given domain.

Now that doesn't give us too much, except it means it could make it much harder to spoof mail, which is what a lot of spammers are doing. Further, it means spammers would have to register domains to send spam, email from those domains would clearly come from those domains, and those domains could easily be blacklisted.

Does that work? Probably not. I'd be interested to know why not, if anyone is willing to explain.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Didn't you learn anything from Prohibition or the War on Drugs? The biggest lesson I see is that, no matter how illegal or stupid or dangerous something may be, there will always be people who do it.

Rationing away spam as "a matter of education" (implying that we could somehow educate 100% of the internet-using population) is just as foolish as arguing that spam exists solely because email is free.

Re:How Exactly Does This Fight Spam?

[Foobar of Borg]

Also, why should I have to pay a new fee of any sort merely because someone else wants to send spam? The whole problem with spam is that everyone but the spammer has to bear its costs. This only increases the costs that all the rest of us have to bear because of spam. For that reason the ethics of this solution are already questionable despite its presumably good intentions.

Well, you see, the best way to make it work is to make the "charity" a special fund. The biggest spammers are only a few hundred people at most. So, the way the fund works is that, when it accrues to the point that we can hire a hitman to take out one of the spammers, we pay out to a hitman and the spammer gets whacked. Pretty soon, the spam problem is solved.

Or, I guess alternately we could use the special fund to do something legal like bribe congressmen/MP's/dictators (depending on country needing the action) to pass the needed laws or simply have the spammers arrested and thrown in jail for life.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Well, getting coupons for local stores and restaurants is an improvement over receiving emails from Abu son of a late General in Nigeria and internet "pharmacies" trying to sell herbal vi@gr@.

Re:How Exactly Does This Fight Spam?

[Sancho]

The whole problem with spam is that everyone but the spammer has to bear its costs. This only increases the costs that all the rest of us have to bear because of spam.

The point is that once Centmail gets off of the ground, spammers will have a choice--bear the costs of sending millions of messages per day (eating into their bottom line) or accepting the rejection/increased spam classification of not having Centmail-signed messages. This means that the ultimate goal will either increase the cost to spammers, or effectively eliminate spam. Unfortunately, the short-term effects are not as useful, and you end up with people thinking that it only adds a cost to legitimate mail.

Of course, that's probably why they suggest that the money go to a charity.

Re:How Exactly Does This Fight Spam?

[NotBornYesterday]

I think this is a terrible idea, and it will never work. Law-abiding folks will be taxed a few more pennies, and lawbreakers will find a way around it. Even when it becomes an abject failure, you can bet that whoever is in charge if this will never kill their nice fat revenue stream by admitting that it is a pig.

If the average corporate worker sends 20 emails a day and copies 3 people on each, and works for a company that has 1,000 employees, that's 60,000 emails per day, or about $150k per year. That's the annual salary for a couple good jobs.

You yourself hit on an obvious spammer solution ... rather than send the emails directly, simply trojan a few thousand PCs and let someone else foot the bill. Do you think that ISPs are benevolent enough to forgive a $100k debt? I could very easily see someone dragged into court to collect on it, for no reason more than they weren't protected against the latest malware. It would be ironic if the end user in such a case had been relying on the AV/firewall that their ISP provided, like Comcast.

Spammers only make money if a company pays them to "advertise" their product. The reason our inboxes are filled with spam is because some company down the line (other than the spammers) makes money from it. I say we find a way to sue/fine the shit out of the companies who hire spammers. Make spam a toxic way to do business, and demand will dry up.

Re:How Exactly Does This Fight Spam?

[Sancho]

Once they get hit with that bill, they'll clean up their computers. Multiple positive effects here.

Re:How Exactly Does This Fight Spam?

[Culture20]

I predict it spiraling out of control as different parties try to "get in on the action" and see a chance to turn a profit instead of just giving the money to charity.

Yahoo is betting on that. The steps they'll take:

1. Charge 1 cent per email opt-in sent to charitable org
2. Pretend 1 cent isn't enough while the real reason is that other email systems don't implement similar setup and because spammers don't opt-in. Charge 2 charitable cents per email
3. Charge 3 charitable cents per email. Make the system opt-out.
4. Make the system mandatory. Reduce price to 2 charitable cents per email. The people rejoice!
5. Now that everyone's been used to paying money per email, raise price to 3 cents, but only 2 cents of the charge are donated (processing donations takes money from Yahoo).
6. ...
7. Collusion between Cell phone companies and ISPs on the price of SMS/email: 25 cents per each. US Postal Service goes postal and wants in on the deal.

Re:How Exactly Does This Fight Spam?

[calmofthestorm]

1) Encryption without identification is like locking your message in an unbreakable safe then handing the key to the first stranger you see along with the box and asking him to give it to your friend Bob.
2) SSL is full of TONS of complicated shit related to authentication but not encryption. Its purpose is both, or it is poorly designed. Perhaps both.

Re:How Exactly Does This Fight Spam?

[ashtophoenix]

But what if your centmail account gets hacked and the hacker uses it to send millions of spam messages. If you credit card is on their file you will be down a $10,000. Of course you can feel good about donating that much to charity!

Re:How Exactly Does This Fight Spam?

[drukawski]

The only way to truly insure you don't get spam is to turn your computer off. There have always been con-artists in one form or another, and as long as people are generally selfishly driven there always will be.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

You already pay for some sort of spam protection (even if indirectly through your ISP or employer). I hate to "me too", but I agree 100% with an earlier poster.
Any legitimate entity should be able afford to pay a penny per email and not even notice it. If I have to pay 3 to 5 bucks a month to cut down on spam, that's well worth it. And it would very quickly make the owner of zombies realize their computer wasn't the only mindless entity in their house - thus forcing a wide scale cleanup of not only spam - but perhaps botnets as well.
whatcouldpossiblygoRIGHT

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Not as much as you'd think. Apparently once you get up to a certain amount of Karma level you get 15 mod points at a time to play with.

Ironically enough, posting anon to prevent from undoing moderation. I'm not the troll-modder though. I swear. -dyingtolive

Re:How Exactly Does This Fight Spam?

[hairyfeet]

Not to mention they seem to be missing the BIG "ooops" in this scenario: How is most spam sent today? Botnets, from PCs that have been pwned. Imagine the stink when all those grandmas that get hit by the next worm or virus get handed a bill for $25k because they got rooted.

The simple fact is I will NOT pay for email just because Yahoo hasn't figured out a way to charge the spammers, who will just pass the bill onto the owners of the boned networks just like they do now. We already pay a high enough price with network slowdowns and bandwidth bottlenecks from asshat spammers, I will NOT pay 01c an email, charity or not, for the right to "prove" I'm not an asshole spammer. Thanks Yahoo, but no thanks.

Re:How Exactly Does This Fight Spam?

[HikingStick]

The compromised bots would not likely ever incur the "postage" charge, because they're not going to relay through the Yahoo! mail server. They are going to run on a shadow server, sending out as many messages as they can. The only way the pay-per-email message might snag spammers and bots is if this were done at the ISP level, and if it were done by monitoring the SMTP traffic flows. [I, for one, don't think that would be a good situation.]

Re:How Exactly Does This Fight Spam?

[gad_zuki!]

Theyre not going to register with centmail. Heck, theyre just running a little program that is connecting to smtp servers. That sidesteps all of this.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Indeed. Somebody needs to start a fake online pharmacy, spam the hell out of people and then mail them poison pills. A couple deaths might actually get people to stop responding to "CH33P V!4GR4" spam...

Re:How Exactly Does This Fight Spam?

[Tony Hoyle]

Just like that haiku idea that was tried a few years back, which rapidly became a near 100% reliable spam sign as it was too easy to forge.

Re:How Exactly Does This Fight Spam?

[geckipede]

The centmail scheme seems to be solely pre-pay. You buy these stamp-like certificates in five dollar bundles in advance and then use them as required. Making somebody else pay for your emails would be tricky.

Re:How Exactly Does This Fight Spam?

[Tony Hoyle]

Wanna bet?

If I was a spammer and this system was a way to get past spam filters, sure as hell I'd find every compromised box with an account on it and relay a few million messages straight through the yahoo mailserver.

Re:How Exactly Does This Fight Spam?

[justdaven]

I would guess that from a money standpoint, that Yahoo! probably gets the money and turns it over to the charity on a monthly or a quarterly (or even yearly) basis. Doing this allows them to use the money for a while, investing it and pocketing the interest.

Re:How Exactly Does This Fight Spam?

[Tony Hoyle]

Similarly, the day after this becomes widespread the linux kernel mailing list would have to declare itself bankcrupt. It wouldn't surprise me at all if that shifts a million emails a day.

Re:How Exactly Does This Fight Spam?

[Tony Hoyle]

Or the third option, they alter their botnets to sniff out centmail registered users and send the spam through that.. 80 year old grannies suddenly get hit with $100,000 email bills and lots of bad publicity ensues.

You're forgetting that most spammers do *not* send email. They have botnets for that.. and the botnets are just naive Windows users. Much as I like the concept of taxing people for not securing their computers it's not exactly fair.

Re:How Exactly Does This Fight Spam?

[prgrmr]

But how long before the spammers start forging the CentMail signature?

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

This is a valid point, however, if the cost of sending spam exceeds the return on investment, the spam will stop. The biggest trouble is that spam is 'free' to send, and thus any return is enough.

Re:How Exactly Does This Fight Spam?

[causality]

Rationing away spam as "a matter of education" (implying that we could somehow educate 100% of the internet-using population) is just as foolish as arguing that spam exists solely because email is free.

Continuing the analogy to various forms of prohibition, look at cigarette smokers. Cigarettes have remained legal yet the number of people who choose to smoke has steadily and significantly declined since the mid 20th century. Why? Because the dangers of using them have been thoroughly publicised and have become something that everyone knows. I'd like to see something like that happen to spam and the people who financially support it.

Re:How Exactly Does This Fight Spam?

[causality]

Not as much as you'd think. Apparently once you get up to a certain amount of Karma level you get 15 mod points at a time to play with. Ironically enough, posting anon to prevent from undoing moderation. I'm not the troll-modder though. I swear. -dyingtolive

My karma is "Excellent" and has been for a long time now. I've never, ever seen more than five mod points at a time. Please explain this discrepency.

Re:How Exactly Does This Fight Spam?

[Hillview]

You've never received a letter from Nigeria in your postbox? There's a shock. ;)

Re:How Exactly Does This Fight Spam?

[Kabuthunk]

And of course, it won't actually affect the spammers in the slightest. In fact, they'll be laughing their asses of at it.

Sure sending an email costs a cent. Why, I guess the spammer will have to pay for all of those emails he sends from his home comp- oh, wait... we forgot about the MILLIONS OF BOTNET COMPUTERS that send the spam, not the spammer's home computer.

So now he's not only still sending spam, but he's ruining the financial records of millions of individuals. Profit AND entertainment. Hell, this might cause more people to get INTO spamming, purely for the "fuck people up" factor.

Re:How Exactly Does This Fight Spam?

[sunderland56]

The idea is that a Centmail signature attached to a message would automatically reduce the message's spam likelihood

And so spammers will simply attach a Centmail signature to their messages. Cut-n-paste is still free.

Re:How Exactly Does This Fight Spam?

[nmb3000]

It seems to me that the only way to truly insure that the receiver gets 100% spam-free mail is to intercept and sort it before it's received with humans doing the sorting.

Which is why that's how Important People handle spam. The thing is though, that 100% spam-free email isn't really a reasonable or common goal. Businesses and administrators would be happy with just reducing the cost of fighting spam, even if the number of messages that get through the filter stays the same.

What's funny is that the solution to spam is pretty simple: Force ISPs to get their act together. Most spam messages come from hijacked residential computers. Machines on residential Internet connections shouldn't be allowed to send mail (port 25 should be blocked). If a computer on Comcast's network (for example) wants to send mail, it should be forced to go through Comcast's SMTP gateway. By doing this the ISP can easily track who is abusing the service and cut them off. Businesses that need direct access to send mail can intentionally change to a business class ISP account.

If all residential ISP customers couldn't send messages directly, spammers would have to look into other, more visible methods of sending mass quantities of mail. If nothing else, killing the mail capacity of the world's zombies and botnets would hurt spammers financially and might drive some out of the business.

Re:How Exactly Does This Fight Spam?

[DShard]

Last time I had moderator points, it was 15. But then again /. also blocks ads for me for all my dedication to there site.

Re:How Exactly Does This Fight Spam?

[Khashishi]

Parent is not a troll. What makes you think humans are any better at sorting spam than computer algorithms?

Re:How Exactly Does This Fight Spam?

[Khashishi]

Turning off your computer won't stop you from getting junk mail, or flyers stuffed on your car window, or under your door, or stapled to your tree, or junk text messages on your phone, or robocalls.

Re:How Exactly Does This Fight Spam?

[betterunixthanunix]

Cryptographic signatures are a bit harder to forge than that; that is the point.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

You don't know what you're talking about. Just look at the draft of SSL v1:

http://tools.ietf.org/html/draft-hickman-netscape-ssl-00
The SSL Protocol (April 1995) ...The SSL Protocol is designed to provide privacy between two
communicating applications (a client and a server). Second, the protocol is
designed to authenticate the server, and optionally the client. SSL requires
a reliable transport protocol (e.g. TCP) for data transmission and
reception. ...

The SSL protocol provides "channel security" which has three basic
properties:

    The channel is private. Encryption is used for all messages...

    The channel is authenticated. The server endpoint of the conversation
is always authenticated, while the client endpoint is optionally
authenticated. Asymmetric cryptography is used for authentication

    The channel is reliable....

Re:How Exactly Does This Fight Spam?

[Chabil Ha']

You don't seem to know what you're talking about, either, because as that script reads, authentication is an ancillary feature of the protocol whose main objective, (as my post indicates and non-coincidentally appears in the draft spec), is to hide what is being transmitted.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Your analysis fails. Spam is sent *because it is profitable*. Yes, people want the goods and services offered by spam emails, but if the cost to send that spam email is increased enough so that it is no longer profitable, there is no incentive to send the spam in the first place.

Quick napkin analysis: Sending emails to 5,000,000 people at 1 cent per email costs you $50,000. You'd better net 5000 customers from that 5,000,000 people at $10/pop to break even, at the very least (a 0.1% return, which is average for email.)

I doubt there will be a high adoption rate for this, no matter how noble the intentions are. Getting a bill in the mail monthly from your ISP for roughly $0.38 would be a huge waste.

Re:How Exactly Does This Fight Spam?

[drukawski]

I didn't realize the article was about adding a $.01 postage to all snail mail letters, printings, and phone calls as well... Where exactly did you see that bit?

Re:How Exactly Does This Fight Spam?

[Dan541]

It's just a quick money grab attempt by Yahoo.

Re:How Exactly Does This Fight Spam?

[Dan541]

The idea is that a Centmail signature attached to a message would automatically reduce the message's spam likelihood; if enough people adopt Centmail, then receivers would be increasingly able to require a Centmail signature on mail, and killfile mail that lacks such a signature.
 

That's a serious problem. Either pay yahoo or you can't send email, I really can't think of a quicker way to kill such a vital communications medium.

Re:How Exactly Does This Fight Spam?

[Dan541]

SSL is a flawed system that was built on pure greed.

Why should I have to pay someone just so Firefox will not chase my users away.

SSL is nothing more than extortion and it has stopped encryption from becoming standard.

Re:How Exactly Does This Fight Spam?

[Dan541]

mail come in physical form?

Re:How Exactly Does This Fight Spam?

[apoc.famine]

Spam exists for one reason and one reason only: someone, somewhere is willing to buy from spammers or otherwise to give them money.

I recently read a theory that challenged the (afaict, completely factless, unproven) idea that the advertisers make money off of spam. It's P. T. Barnum's "There's a sucker born every minute", as seen in get-rich-quick schemes, applied to spam.
 
You have two parties - advertiser, and spammer. Advertiser pays spammer $10k to send a million spams. Spammer sends those million spams. The advertiser sits around, counting his imaginary sales. But nobody shows up. A couple of days pass, he sells $1k of stuff, and is $9k in the hole due to his spamming efforts. Does he spam again? Quite possibly not.
 
But who learned from that? Only that individual advertiser. Even if each advertiser never makes money, as long as there is another sucker in line, there will be no end to spam.
 
There's nothing I've seen that indicates the individual advertisers make good money off of spam. The spammers, sure. But they're just taking money from one sucker after another.

Re:How Exactly Does This Fight Spam?

[shutdown -p now]

If I send 10 emails a day, which is probably much more than your average computer user, that's $3.00 a month. I can handle that

You can. What about countries where earning $100 a month is considered a very good job?

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

I don't understand how this could possibly work. By definition, spammers are criminals. I would predict that only a few days would go by before they find a way to counterfeit any identifying certificates.

Re:How Exactly Does This Fight Spam?

[FlyingBishop]

But the age of spam has soured everyone against junk mailings. There are laws against unsolicited bulk email, which should easily extend to centmail. And if they are paying, it's pretty clear where the bank account is in which the government should levy the fine (which is not as clear with normal spam.)

Re:How Exactly Does This Fight Spam?

[gd2shoe]

Our ability to deal with natural language (a subset of context-sensitive grammars which are notoriously hard to program for). It's not enough that you can have an algorithm which deals with a given problem, but it must run in a reasonable number of clock cycles*. Further, spam filtering by humans could be done by at the semantic level (beyond syntax and pattern matching.) It would be outrageously hard to design a program that understood and responded to all the semantics that a human can. I'm not saying a machine could not possibly outstrip a human, but I believe it would require a major innovation in AI to make it happen.

(And for the record, having a 3rd party human read someones email is just plain wrong in all but the most limited situations.)

*(Yes, there is a corollary to this. It is unreasonable to pay people to sit and read spam all day in order to catch the few real messages in the system.)

Re:How Exactly Does This Fight Spam?

[mrbcs]

I think we're going about this wrong. When they find a spammer, they should take him to the center of a large city, the televise his beating worldwide.

Nothing has worked... we're not shooting enough spammers to scare the rest of them. The ultimate problem though is with society. How do we deal with a people so dumb as to actually believe penis enlargement pills work? We all know that if there was no profit, there would be no spam. My sig says it all.

Re:How Exactly Does This Fight Spam?

[sneader]

a spammer who sends millions of messages a month cannot pay $10k per million messages.

Sure they can. It's not like they don't have thousands of stolen credit cards handy to make the payment.

Re:How Exactly Does This Fight Spam?

[gd2shoe]

And I just ran out of mod-points.

Mod parent insightful. I'm going to remember this one.

Re:How Exactly Does This Fight Spam?

[gd2shoe]

On the plus side, It would teach a few people to keep their computers mal-ware clean. (yes, I'm kidding. Don't mod me into oblivion.)

Re:How Exactly Does This Fight Spam?

[zuperduperman]

a) have a maximum limit on number of emails you can send (budget of say, $10 / month)
b) have a slightly arduous process by which you can claim back money, after giving assurances you have cleaned up your pc, etc.

It might actually be a useful way to finally get through to people the impact of allowing their pc's to become zombified.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

The only solution to spam is white listing. The beauty of this is that white listing is already a standard feature of mail servers and clients. All someone needs to do is to develop an easy white listing request systems that can reside along side of existing infrastructure. You know something easier then phoning someone and saying please add me to your white list.

A "white list me" request system could even use the same addressing system but on a different port. The request system has to be limited to a standard non-customizable format that is verifiable.

Next week we end world hunger and talk to a boy who has a cure for cancer.
 

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

This could be solved by having a prepaid balance that you pay out of—say, charge $20 to your credit card and then pay again once you've sent 2000 messages. That way the worst that could happen (assuming your credit card info is not stored in the account) is that you lose your existing balance, which, at one cent per message, could be kept pretty small.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Who said anything about blindly trusting it? You can easily stack a spam filter on top of it if that becomes a problem. The difference with physical mail is that I can't have an automated spam filter running on that.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Bingo! As long as there are new people buying into get-rich-quick MLM marketing schemes, there will be customers to pay for SENDING spam! Even if NOBODY buys anything, ever.

A lot of spam is sent buy people hoping to "sit back and count the $$ come in" from some marketing scheme they just paid $$$ to learn about from some infomercial. They pay a "direct-email marketing company" to send the mail for them.

Re:How Exactly Does This Fight Spam?

[xtracto]

mail come in physical form?

Of course, don't you know how much does information weight?
 

Re:How Exactly Does This Fight Spam?

[IanCal]

But who learned from that? Only that individual advertiser. Even if each advertiser never makes money, as long as there is another sucker in line, there will be no end to spam.

You're assuming here that if *some* people will still send spam that the problem will be the same. Sure, some people will advertise through email. However, you're now limited to people willing to pay quite large sums for modest exposure.

I'm most concerned about people who have a legitimate reason to send out lots of emails. Anyone running a newsletter for example. You'd need a way of allowing people to send emails without it costing them.

Re:How Exactly Does This Fight Spam?

[dword]

Look at what happened with OpenID.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

I just can't behind thathttp://www.youtube.com/watch?v=KM6pYG1DQ4s.

Re:How Exactly Does This Fight Spam?

[ftobin]

The certificate system is an unfortunate aspect of SSL; ssh has enormous popularity without demanding a rigid chain-of-authority system, relying instead on cached host keys instead. It's a "good enough" solution that balances the needs and simplicity well.

Re:How Exactly Does This Fight Spam?

[furby076]

How about this...for every message over 20/day that you send you get charged. That would make it so those who send under 20 don't get charged while those who send over 20 get charged. Let it be an increasing charge. First 20 - Free 21-100 = $0.001 cents per e-mail 100+ = $0.01 cents per e-mail This would still hurt spammers who send e-mails in the tens of thousands+ range and would provide little hinderance to casual e-mailers.
Then we can make this a mandatory system. I would feel OK with this. But a flat $0.01 per e-mail? I send lots of e-mails.

Re:How Exactly Does This Fight Spam?

[HikingStick]

Even if a pay-to-email system were enacted, do you think the mail server hosts would drop their other anti-spam technologies, like those that monitor for unusual mail patterns, or those that freeze account activity if more than x messages are sent in a given 24 hour period?

Re:How Exactly Does This Fight Spam?

[lsatenstein]

Yahoo is international. I can't see how this concept fights SPAM. Unless all email in the world is "taxed". The second situation is that many of us send a lot of emails which are not spam. The daily tax amounts will add up. Thus, we need income tax slips at the end of the year to indicate charitable deductions. And residing here in Canada would mean that I would require Yahoo to prepare charitable deduction income tax slips for my province, and the provinces would have to have Yahoo register with each as an approved charitable organization. Furthermore, Yahoo's books would have to be open to government auditing too. Laah dee daaah, another idea not well thought out.

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

I don't get enough spam to make me want to pay per-email, even with Yahoo's crappy spam protection. And I've had the same address for many years.

Re:How Exactly Does This Fight Spam?

[nobaloney]

it sounds like a good idea to me

Only if you're willing to not accept email that doesn't have the stamp, and if spammers don't figure out how to forge the stamp.

Me? I'm not willing to only accet mail from someone who's bought a stamp, and I'm certainly not willing to believe spammers won't figure out how to forge the stamp.

Re:How Exactly Does This Fight Spam?

[Crazy Taco]

If I send 10 emails a day, which is probably much more than your average computer user...

Actually, I think that's way less than an average computer user. That may be average for at home personal use, but what about businesses? Do you realize how much correspondence happens via email? The costs of this would kill business (and if it comes down to centmail killing business via adoption, or business killing centmail by not adopting it, I think we ought to chip in and buy centmail's tombstone right now).

This is a really stupid idea for other reasons as well, because part of the reason IM, Email, Desktop Sharing, Videoconferencing, VoIP and other technologies have caught on is that they allow collaboration for free, as opposed to shipping things, paying for expensive phone line teleconferencing or traveling to meet with someone. If centmail were by some miracle able to catch on, five years from now someone will ask why we are paying for each message and will invent a "free" message carrying protocol. Basically they'll reinvent email and we'll be right back where we started.

And lastly, if this were adopted, all the message traffic would have to go through some central authority or clearinghouse for centmail, in order to be charged a bill and given the certificate. I don't know about you, but I'd rather not have all my email going through one group. That's a security risk if nothing else (and there are other problems).

Re:How Exactly Does This Fight Spam?

[centuren]

Also, I'm not too clear on how this would work. Wouldn't it require a certificate-like central authentication server? And wouldn't this increase in traffic just exacerbate the situation of too much traffic? Especially if all Spam starts to come with fake 'stamps.'

So why not go back to the PGP/GPG system of authenticated public keys and signed email? All the cost-per-email is doing is modifying an email so it's verified as centmail. Why not just modify it as signed, requiring a user's passphrase or similar identification? If spammers can get around that with their botnets, they can get around CentMail just fine also. Why involve money?

Re:How Exactly Does This Fight Spam?

[tomz16]

Except that part of establishing secure communications is authenticating the other end, or else you are vulnerable to a man-in-the-middle attack; that is why SSL has a certificate system. If the only intention was to have a means of encrypting communication, then there would be no reason for SSL to have such a complicated protocol that includes identification and capabilities management.

I agree with you in principle, but practically speaking this system is hobbled by the lowest common denominator. A decade+ ago, I remember having to pay many dollars, talk to a rep over the phone, fax over government issued ID's, and incorporation documents in order to get a signed SSL cert that was included in the browser root. This process took several days, and you paid for the verification step! Nowadays I just add one to my shopping cart, pay ~$5, specify any domain name I want, and hit checkout. If you want a signed SSL cert for a MITM attack of paypal.com you can go out and buy one within 5 minutes! IMHO, practically speaking, the signatures means absolutely nothing anymore!!!

Re:How Exactly Does This Fight Spam?

[Anonymous Coward]

Nope. I would assume that the accounts would have daily caps (say, 200 emails a day.) Anything above the limit (or "unusual activity") would flag and temporarily lock the account (or put it in a low frequency mode - one email every ten minutes), like what might happen if your visa card number is being used by someone else.

For people with higher volume email use, the cap could be higher.

Re:How Exactly Does This Fight Spam?

[tompaulco]

I don't see the problem here. People who spend megabucks advertising on TV or radio can never really quantify if their advertisement ever did any good either, yet they continue to buy advertising time. The only people who are really able to make money by advertising is marketing firms.

Re:How Exactly Does This Fight Spam?

[Garridan]

Not if they pay with a stolen credit card...

Re:How Exactly Does This Fight Spam?

[Garridan]

Right. Leaving you back at square one, where you need software to filter your mail. Remind me what problem this solves? Oh right, people invested in Centmail, and the investors need their moneys back now.

$10 for guaranteed delivery to 1,000 users?

[ickleberry]

Now here's something both the spammers and the ISP's will love. I presume somewhere in their long-term plan is a means of getting rid of all those pesky renegades who run their own email server and don't opt into this scam

Re:$10 for guaranteed delivery to 1,000 users?

[exhilaration]

Exactly, they're trying to charge spammers for guaranteed delivery to your inbox. I prefer the Gmail model of spam management - build some incredibly good filters and eliminate 99% of all spam.

Re:$10 for guaranteed delivery to 1,000 users?

[Darkness404]

An even scarier twist would be if legislation makes it -illegal- to discriminate against mail sent this way with a spam filter (probably thrown in with some form of net neutrality) making it a guaranteed delivery, illegal to block.

Re:$10 for guaranteed delivery to 1,000 users?

[glop]

Well, the best part for the spammers is when they don't pay the 10$ because the owners of the zombie PCs do... This objection was raised years ago already for other "payment" schemes like for instance the computation payment (you do a computation that takes a lot of CPU to sign the message. So you "paid" for your stamp).
It does not sound like a very well thought plan. Maybe the idea is that people will be more careful not to get pwned?

Re:$10 for guaranteed delivery to 1,000 users?

[Nossie]

"when they don't pay the 10$ because the owners of the zombie PCs do.."

Gives them one more to give a fuck about security does it not?

Re:$10 for guaranteed delivery to 1,000 users?

[wift]

That does not eliminate the traffic created by it.

Re:$10 for guaranteed delivery to 1,000 users?

[prograde]

From the paper, section 3.2 http://centmail.net/centmail.pdf :

A related scenario is when a user attempts to reuse a single legitimately obtained stamp to validate a single message sent to thousands of people. This is in fact considered to be acceptable behavior from the perspective of CentMail, similar to the use of blind carbon copy (bcc) for emails.

That sounds like exactly what spammers do - send the same message to thousands of people. So, really, that's $10 for delivery of 1,000 unique messages to unlimited millions of recipients. Good deal!

Re:$10 for guaranteed delivery to 1,000 users?

[FlyingBishop]

If someone is paying for the spam, then it's impossible for them to avoid anti-spam legislation. They've signed a document saying they've sent spam (or at least money has changed hands.)

This is a really good idea, because it creates potential for government oversight. The Gmail model is inherently flawed. Not only does it let spam slip through, it creates false positives. Authenticated email needs to start coming along, and this is the best way to do it. The problem with spam is that it's untraceable. If someone is paying, then you trace to the payer, and payers have incentive to stop, because we can levy hefty 5 cent per message fines on top of that if abuse is proven.

Re:$10 for guaranteed delivery to 1,000 users?

[thetoadwarrior]

And you probably never will unless you charge people for mass mailing and all botnets. If they at least stop it showing up in my inbox I'll be happy.

Re:$10 for guaranteed delivery to 1,000 users?

[icebraining]

But greatly reduces the likelihood the spam will reach the potential "costumer" and therefore it's profits, making "spamming" a less attractive business.

Re:$10 for guaranteed delivery to 1,000 users?

[Anonymous Coward]

"when they don't pay the 10$ because the owners of the zombie PCs do.."

Gives them one more to give a fuck about security does it not?

No, it gives them more reason to call their ISP and scream about it until they credit the charges back.

Re:$10 for guaranteed delivery to 1,000 users?

[Tehrasha]

AND the spammer can deduct charitable contributions on his taxes at the end of the year....

Re:$10 for guaranteed delivery to 1,000 users?

[SBrach]

So? I never get spam in my G-mail inbox. Google and ISPs, I'm sure, are dealing with tons of spam traffic but I am not. If ISPs want to pay a fee to some central authority to stop spam traffic on their networks that's fine. But remind me again why I should have to pay when I use the services of a company that is clever enough to offer me free* e-mail and still turn a profit. How exactly would I benefit? Last time i checked ISPs were screwing me over left and right. *free-as-in-cost and free-as-in-spam-free

Re:$10 for guaranteed delivery to 1,000 users?

[Sancho]

I bet that a pretty big chunk of those filters relies on people pressing the "report spam" button. It'd be really nice if Google would offer a spam-checking service so that non-Gmail users could check messages against Google's spam corpus.

Re:$10 for guaranteed delivery to 1,000 users?

[Nossie]

And the problem with that? maybe ISPs will actually start giving a damn when it comes down to spam.

Re:$10 for guaranteed delivery to 1,000 users?

[NotBornYesterday]

I'm worried about the chilling effect of email being tied to commerce. Internet commerce requires that your identity be tied to the transaction, whether it is to the ISP who provides your email account, PayPal for your ebay goodies (or supporting Slashdot), CC transactions on Amazon, etc. They know who you are. Now, in an instance where you need privacy, or better yet, actual anonymity, you are screwed because you can't use email to blow the whistle on an employer who acts unethically, violates OSHA regs, etc. And I wouldn't be surprised if the government likes the ability to track a specific email back to a specific person.

I don't mean to come off like a tin-foil hatter, and could probably write a more coherent rant if I had more time. There is no good that can come from this. Ever.

Re:$10 for guaranteed delivery to 1,000 users?

[Tony Hoyle]

Wow. So what this does is *encourage* spam, but yahoo get a cut of the profits.

Re:$10 for guaranteed delivery to 1,000 users?

[scrib]

How do you guarantee delivery? I, for one, could set up a simple filter to block ALL CentMail messages because no one I want to hear from would pay money to send me email...

Re:$10 for guaranteed delivery to 1,000 users?

[chromatic]

Your logic only works if you assume spammers care if the messages they send on behalf of other people reach potential customers. I don't assume that.

Re:$10 for guaranteed delivery to 1,000 users?

[martin-boundary]

That's silly. ISPs are practically the only ones who give a damn about spam. Users tend to expect their ISPs or webmail providers to take care of spam for them. Spam is mainly an ISP (maybe local admin) problem, and always was.

Re:$10 for guaranteed delivery to 1,000 users?

[selven]

Your argument is "evil is good because it encourages people to protect themselves from other evil". We see many incarnations of this fallacy even here on Slashdot - "Go Conficker! Finally people will start downloading updates!" "419 scammers are good, it helps weed out those idiots that trust people on the internet"

The fallacy is that protecting yourself has a cost - the cost of time and bandwidth to install updates, the cost to the security community to make the updates, the opportunity cost of lost business deals, the time spent authenticating people to make sure they are who they say there are, etc. If there was less evil, there would be less need to pay any of these costs, and society as a whole would run more efficiently.

Re:$10 for guaranteed delivery to 1,000 users?

[Anonymous Coward]

Did you read the line below the one that you cited?

"Recipients are informed, however,
of the number of times a message has been verified,
alerting them to down-weight the value of a donation
appropriately."

that pretty much settles it.

Re:$10 for guaranteed delivery to 1,000 users?

[Anonymous Coward]

How are They going to know unless they log into each and every SMTP server on the Net looking for signs of spam filtering software. Moreover, how will They be able to recognize it - people still think that Nethack is a k-r4d 0-day h4x0r tool.

Oh, and let's not forget client-side spam filtering built into all sane e-mail clients nowadays.

Re:$10 for guaranteed delivery to 1,000 users?

[GigsVT]

Making a direct connection on port 25 is a presumption of guilt these days anyway.

Re:$10 for guaranteed delivery to 1,000 users?

[GigsVT]

You should assume it. If the people actually making and selling penis pills no longer get as high a return, they will stop hiring spammers.

While spamming is artificially cheap due to externalities, it's not free. There's always opportunity costs. At some point it will indeed become not worth doing for the majority of spammers.

Re:$10 for guaranteed delivery to 1,000 users?

[GigsVT]

Of course ISPs give a damn about spam, it's a profitable business selling high bandwidth links to known spammers for many times the market rate.

ISPs allow spam to exist because it makes them money.

Re:$10 for guaranteed delivery to 1,000 users?

[Nossie]

no... it proves that computers are not for everyone (as much as Microsoft would like you to believe otherwise) and the blame gets given to those that dont pay attention and not to internet users as a whole.

If I was an ISP, I'd cut customers off for sending spam zombied or otherwise just as quick as for piracy. And Why do they not? no financial incentive, lets give them one.

Re:$10 for guaranteed delivery to 1,000 users?

[Nossie]

"If there was less evil, "

And you call my argument fallacious?

Less evil, there is no such thing as evil... just people with different contradicting perspectives.

Re:$10 for guaranteed delivery to 1,000 users?

[chromatic]

What makes you think spammers care about repeat business?

Re:$10 for guaranteed delivery to 1,000 users?

[GigsVT]

A steady stream of new suckers to inject money into such an idea will be pretty hard to come by if word gets around that spam doesn't make much money anymore.

what about pwned accounts?

[Khashishi]

How will this discourage spam if the spammers are just using pwned accounts?

Re:what about pwned accounts?

[Anonymous Coward]

If you got a bill in the mail for $50 for emails you didn't send, you might figure out why and get it fixed.

Tax Deduction?

[Ambiguous Coward]

This will surely make for some highly-entertaining tax return forms in the near future.

Re:Tax Deduction?

[Barny]

Dear gods, could you imagine a "legitimate" spamming company trying to write it all off as tax deductible losses? :)

Gosh.

[fuzzyfuzzyfungus]

I'm glad that goodwill and fuzzy feelings are able to cut transaction costs; because they'll be the real killer at $0.01 a pop.

I assume, because of this problem, that they'll either be billing you when your tab reaches some worthwhile value, and trusting you in the meantime, or forcing you to buy in large blocks ahead of time(which would be super annoying, goodwill or no).

How stupid....

[Darkness404]

Honestly, this is one of the stupidest things I have heard of. For one, if this is adopted it will lead to discrimination of services (as in, you are using Gmail and not our ISP's pay-mail, so your message automatically gets flagged). For another, I've found that Gmail and other webmail services are pretty good of not giving false positives, in the few years I've been using Gmail, I've gotten 3 spam messages total, none of which was a false positive and no spam e-mails in my inbox. But honestly, this is simply charging for what should be a free service to help solve a problem that doesn't exist if you use Gmail (can't say for any other mail provider because Gmail has been so good I really haven't used any other mail provider).

Re:How stupid....

[TaggartAleslayer]

This marked as trolling? Yahoo must have mod points today. O.o

Re:How stupid....

[Anonymous Coward]

Gmail has been so good

Gmail's spamfilter is good, but their "labelling/conversation" format is horrible.

Re:How stupid....

[macraig]

Someone probably misapplied the Troll mod for "Shill". The guy sounded a bit like a shill for GMail, don't you think? Either that or a genuine noob: "...Gmail has been so good I really haven't used any other mail provider". Jeez, he's NEVER used ANY ISP e-mail account? I find that rather hard to swallow, unless he's really fresh off the boat. So yeah, if I were modding his post I'd be inclined to mod it something other than favorably myself. He's just not that believable.

Re:How stupid....

[Stupendoussteve]

Gmail's spamfilter is good, but their "labelling/conversation" format is horrible.

It also makes using it via IMAP incredibly complicated.

Re:How stupid....

[TaggartAleslayer]

I could see that... but I use Gmail as well and share many of his sentiments.

Though, that being said, I have received more spam of late. Either spammers are getting better, or I really have won the Nigerian lottery.

Re:How stupid....

[thetoadwarrior]

To be fair out of all my ISP and freebie email accounts Gmail has been by far the best. I'm positive I could count all the spam I've received on my fingers with no legit email showing up in my spam folder.

Re:How stupid....

[macraig]

I've used GMail since its inception. To this day I still despise its MANDATORY antispam system, which continues to vex me with false positives that I'm hard-pressed to find in the deluge of actual spam in the Spam "folder".

This is compounded by the well-known bug in GMail that causes the system to ignore periods in addresses when it is delivering mail... in other words, any mail addressed to blahblahblah@gmail.com winds up being delivered to blah.blah.blah@gmail.com instead (perhaps only if there's no actual unique blahblahblah account). Because of that bug, I get MORE THAN TWICE the amount of spam that I "should" be receiving, because GMail is delivering mail to my Inbox that wasn't actually addressed to me!

GMail is great, but it also sucks, and sucks hard, at EFFECTIVE spam control. I can do much better with PopFile and localized filtering, but GMail won't even let me do it since their filtering can't be bypassed or disabled (you can't "opt out").

That's precisely why I found the original comments not credible. He was either clueless or disingenuous.

Re:How stupid....

[hairyfeet]

Well I can say that as someone who has 3 Yahoo Mail accounts (and is still worried that MSFT might buy them and turn Yahoo mail into MSFT Yahoo 2.0 webmail live optimized for Vista) I can say I get a whole 1 email a week or two that is spam. There haven't been any false positives, everything just works.

So why is Yahoo pulling this stupidity? Are they making some side cash in "administration fees"? Is this a new way to make them more attractive to MSFT, who IIRC championed that "pay per email" scheme awhile back? Because this just seems to me like a way to make sure spam gets to your inbox by buying a stamp. Not the brightest idea to come out with when you are stuck at #2, with MSFT throwing money at Bing and Google ahead of you in every way.

And OT, but if anyone at MSFT with any power is reading this? Please just stop with the "Bing Web Live 2.0 optimized for Windows Vista" crap. You suck at the web, accept it and move on. Go back to making business desktops, you were good at that. BTW Win7 is NOT a business desktop. It is a bling bling Apple nightmare. Put a Win2K GUI on Winserver 2K8 and you have an awesome business desktop. Why do you think there are so many tutorials on how to turn 2k3 and 2k8 into desktops? Because you are ignoring you core markets trying to be Apple. But you're not Apple, and Steve Ballmer does not look good in mock turtlenecks. So go back to making solid, easy to manage with GPO business OSes. You'll be happier, we'll be happier, the whole world will be a better place.

Re:How stupid....

[TaggartAleslayer]

I always considered the period addresses as a perk. When I sign up for a newsletter, I can do my.name@gmail.com and filter on it. I also like the ability to add + comments to your address such as myname+newslettersignup@gmail.com.

Both make it extremely easy for me to filter out spam immediately.

I've never really experienced a false positive problem, though I suppose I should check more often just in case.

Re:How stupid....

[Darkness404]

Eh, I'm young, and didn't get broadband till about 2003 and used gmail since its inception. I did "use" Yahoo mail, but didn't really do anything on it. So yes, I really have only actually used Gmail.

Re:How stupid....

[cephah]

Or he has all his other email addresses forward to his gmail account. It's what I do - that way I don't get bothered by the false positives that e.g. my university account delivers, gmail does it for me.

Re:How stupid....

[macraig]

Nope, that wasn't the case, since he's confirmed otherwise (and replied before you did).

Yahoo is at least polite enough, if POP3 delivery is used, to allow bypassing their spam system and delivery of ALL mail, so that a local filtering system can be used if so desired. GMail is utterly authoritarian about it, and doesn't allow anyone to opt out for any reason. If you try to use a local Bayesian filtering system with a GMail account, your corpus will be skewed by GMail's forced filtering and you'll never achieve the 99.9+% accuracy that you might otherwise.

Re:How stupid....

[fatalwall]

who needs to buy a stamp when they can just hyjack user accounts who use the feature and get it for free!

why use my stamps when yours work just as well and are free

Re:How stupid....

[Zelucifer]

Here's my perspective:

I've been using Gmail since a month after it came out. I've been receiving, roughly, 100 emails a day, every day, since it came out. I have 3000 emails in my spam "folder", currently. In the past ~5 years, I've had 2 false positives come to my attention.

Its possible that I've missed a few, but even if I missed twice as many as I found, its a low enough error rate where I'm content.

I've been using it for school and personal, with Very limited work emails getting sent to that address, you may be getting a much higher concentration of work related email, somehow causing a higher number of false positives.

Re:How stupid....

[macraig]

I receive no work related mail at all at my GMail address, and I've received many orders of magnitude more than just two false positives in the last five years. Perhaps you're the exception, and not me.

Re:How stupid....

[Tsujiku]

That's not a bug, it's a feature (for real). To their system, blah.blah@gmail.com is the same account as blahblah@gmail.com, and it was designed that way intentionally.

Re:How stupid....

[macraig]

If it walks like a bug and bites like a bug, then it IS a bug. Feature, my ass. There's no benefit to be had from it. For spammers it amounts to an exploit, a way to deliver twice as much spam to some people.

Re:How stupid....

[Anonymous Coward]

A) You can create a filter to bypass gmail's spam controls entirely if you'd rather use your own

B) the "ignoring dots" is a feature, not a problem.. And gmail does not allow accounts to be created that would cause a conflict. john.smith and johnsmith cannot both exist.

Re:How stupid....

[Anonymous Coward]

All Gmail address disregard the periods entirely. b.l.a.h@gmail.com is identical to bl.ah@gmail.com and blah@gmail.com.

If you own bla.h@gmail.com, none of the address above exist, I guarantee you.

Re:How stupid....

[macraig]

No, a filter CANNOT be created to bypass the spam system. I know the theory, but it doesn't work.

Re:How stupid....

[macraig]

And exactly how does this "feature" help me avoid the spam being sent to ALL of the above addresses that winds up in MY inbox... because of this "feature"?

Re:How stupid....

[macraig]

Not one but two colluding assholes sneaked into this discussion five days after the fact, and marked THIS - the above legitimate question - as Flamebait. I should have a reciprocal means to mod the anonymous modders down as Troll. Why don't I?

Ad hominem modding, where the mod is directed at the person rather than the actual comment, should itself be strongly modded down.

Good idea. Who pays the bill?

[tp_xyzzy]

Once this service is up and running, they'll get a botnet which will take over people's machine and start sending spam. If it manages to send 10000000 emails from your machine, who pays the bill?

Re:Good idea. Who pays the bill?

[DeHackEd]

From my interpretation, you buy stamps first and send mail later. This isn't a case of botnets racking up bills, this is a case of credit card fraud fueling spam.

Oh well

[JohnHegarty]

Your post advocates a

( ) technical ( ) legislative ( ) market-based ( ) vigilante (x) charitable

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
(x) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
(x) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
(x) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( X ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(x) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Oh well

[Shakrai]

Well I knew that was only a matter of time. Anybody know the actual origin of the template above? Always wondered about that.....

Re:Oh well

[Jurily]

Summary for the tl;dr crowd: x xx x xx xx x xx x x x x xxx

Re:Oh well

[bcmm]

I don't know, but I wish it were more widely known. That way, people designing hairbrained schemes for ending spam could read it first and save their time.

Re:Oh well

[dreeves]

We did try to address these common objections. See Section 3.2 of the paper: http://centmail.net/centmail.pdf

Re:Oh well

[CannonballHead]

The closest I can find to an "original" is this one, which is linked to a lot.

Re:Oh well

[Anonymous Coward]

It was spammed to Usenet.

Re:Oh well

[SlashDev]

1) Will not work? I don't think you, me or anyone else have a say in this, if they decide to implement it, it will work. People need email, they will spend a penny on each; I know I would. Unless you're using your Yahoo email for business, at that point, you have other things to worry about besides costs, the average persons, sends 10 emails per day. 2) You obviously don't work at an ISP to really understand blacklists, spam and what effect they have on your ISP's ability to send email to other ISPs.

Re:Oh well

[Tubal-Cain]

Missed a few:
(x) Many email users cannot afford to lose business or alienate potential employers.
(x) Joe jobs and/or identity theft.
(x) Countermeasures must work if phased in gradually.
(x) Feel-good measures do nothing to solve the problem.

Re:Oh well

[ricotest]

You offer three points in rebuttal:

1) An increase in use of Centmail points could be flagged as suspicious

...after the fact? Or will you have an automated system that prevents the mails from being sent if they seem suspicious? Otherwise a spammer can simply do a hit and run and exhaust the user's account. Regardless of that, spammers are more likely to control a very large amount of zombie Windows boxes, sending out a small number of e-mails on each machine.

2) If a user gets hacked, he just ends up donating more money to charity

Which is wonderful and all, but doesn't really solve the problem.

3) Hackers are more likely to be interested in other aspects of the user's computer

Spammers have demonstrably took over swathes of Windows machines exclusively to send out spam. Even if they didn't, centmail offers the chance to send a mail that is practically verified as genuine, which is very rare, and worth hacking a computer for.

Re:Oh well

[kitserve]

I don't get why people object to this template so much. I'd much rather read through it and get a quick overview of why people think a proposed anti-spam system wouldn't work, rather than sift through hundreds of posts, most of which are all saying the same thing...

Re:Oh well

[MillionthMonkey]

I initially wrote and posted it here in 2003. Note the lack of a bitchslap against challenge-response schemes that hadn't yet become popular:

( ) Spammers pass all your Turing Tests

or something like that.

Re:Oh well

[gd2shoe]

1) Will not work? I don't think you, me or anyone else have a say in this, if they decide to implement it, it will work. People need email, they will spend a penny on each; I know I would. Unless you're using your Yahoo email for business, at that point, you have other things to worry about besides costs, the average persons, sends 10 emails per day. 2) You obviously don't work at an ISP to really understand blacklists, spam and what effect they have on your ISP's ability to send email to other ISPs.

1) Will not work. I don't think you or I have a say in this, if they decide to implement it, it will not work. People need email, they will not spend a penny on each; I know I wouldn't. If you're using your Yahoo email for personal use, at that point, you have other things to worry about besides a bill from Yahoo. The average persons, sends 10 emails per day, but some send considerably more. 2) You obviously don't work at an ISP to really understand how to use SPF to control spam and form correct English sentences. (sorry about that last one, but you were asking for it.)

Cost TOO MUCH!

[Sepiraph]

$0.01 / email is WAY too much, even with spam filter on. A price range of $0.01 / 100 emails is more realistic and cost friendly.

Re:Cost TOO MUCH!

[ctaylor]

I'd rather it was $1 per email. That might cut down on all those forwarded chain emails my relatives keep sending me.

Re:Cost TOO MUCH!

[Anonymous Coward]

I'd rather it was $1 per email. That might cut down on all those forwarded chain emails my relatives keep sending me.

Ah yes, the "bless you and send this blessing to 10 others or some horrible bad luck will befall you" emails. And the senders don't quite comprehend why the email isn't Christian.

Re:Cost TOO MUCH!

[betterunixthanunix]

In all honesty, I would rather keep email the way it is. This "stamp" based approach will not work; either nobody will adopt it, or it will become popular and a bunch of other stamping businesses will crop up looking to make some money. I would rather just continue with my current spam filters, which kill 95% of the spam that hits my machine -- the other 5% does not amount to anything terrible.

Re:Cost TOO MUCH!

[YouWantFriesWithThat]

exactly. the people who do what you do will continue to do that, with incremental improvements in filtering technology and software that they run on their box(es). and the people who do what i do will continue to do nothing at all. relying on someone else to do the filtering and access it from whatever device, where ever i am and not manage the box(es) ourselves. and out of these two groups very few will ever buy a one cent stamp for an email.

Re:Cost TOO MUCH!

[Anonymous Coward]

Did you not even bother to RTFS? "Centmail users pay $0.01 for each message they send..."

Re:Cost TOO MUCH!

[sincewhen]

I agree with you that the cure could be worse than the disease. But the problem we are likely to face is that there will be continued ongoing efforts to increase that 5%, so a continued ongoing effort will be required to improve filters.
And in the meanwhile, the net is flodded with spam which is never delivered, but impacts us all with the costs for bandwidth and storage which it uses.

Re:Cost TOO MUCH!

[Degrees]

I would prefer to switch to something that costs spammers money to send. My job is email administrator, and it is a rare day that my system gets less than 1/2 million spam connections. That is six connections per second, sustained, over every 24 hour period. We've had days where it was two million spams per day.

So it may not look like a big problem to you - but that is because people like me spend time and money to minimize the effects of the problem for you.

I'd rather spend the money on something useful.

Fundamentally, the reason the spammer makes money is that the fool that advertises with him/her pays $500, and the spammer pays pennies for electricity and bandwidth for the job. As long as it is lucrative, spammers will exist.

So I like the idea of moving to a for-pay email system. I prefer the bonded sender idea, but that hasn't taken off.

I don't think this system will take off either. I don't see an advantage to configuring my mail servers to accept the Centmail stuff automatically. Bonded Sender, I would reconfigure for. But this looks to be an invitation for junk mail from well heeled advertisers.

The real problem I see...

[TaggartAleslayer]

If widely adopted, there is built in inflation and no incentive to keep costs low. We assume that spam is uneconomical at $.01 per email. If that is proven false and the threshhold is actually even slightly higher, does that mean we all pay more to send approved email? If you refuse to pay, is your corporate email likely to be marked spam?

With this scheme, all we do is put ourselves in a direct cost offset race with unscrupulous organizations, pitting our own "safe email" assurances against those already proven willing to go to unethical and illegal lengths to profit from the very people paying for the "safe email" certificate in the first place...

Am I missing something, or does the entire system just seem destined to leapfrog in price and crumble down in a pathetic heap? Then again, it's really not about the spam, it's about profiting from one of the last free forms of communication.

Re:The real problem I see...

[Hungus]

I personally think the best way to implement this is to not allow the mail in if the sender has not already paid. PLus it should be 1c per recipient not 1c per email. SPammers make money because the over head is effectively nil and so any profit is substantial compared to the cost. Ars Technica claims 12% of people have at some time wanted to buy somethings from a spammer, but I cannot find out what % of spam actually generates a sale. Lets pretend that the rate of actual spam pieces to orders generated is 1%, though I suspect it is much lower. If it is $1 then the system will fail because the profit margin for bulk mailing spam is still large. However if it is .1% then we are talking about $10 in "advertising" (read spam) per sale and that is far less profitable. Plus it potentially could eliminate botnets with regards to spam.

Forged headers?

[chickenarise]

I was just wondering if you forged your From: to someone who uses this would they be charged for it, or is that technically not a problem? Other than that, I agree with previous posters' worries about pwned accounts getting griefed and racking up a substantial bill.

Re:Forged headers?

[betterunixthanunix]

I think you would have to be authorized to Centmail's SMTP servers. Pwned accounts are not such an issue either, if you buy blocks of 500 "stamps" ahead of time and are not automatically billed for it; spammers would only get a small number of stolen stamps at a time, and that would at least slow them down.

The real issue is that it will not remain charitable for long. If it becomes popular, rival for-profit services will start cropping up, and we will wind up with a situation similar to SSL, where there are dozens of different authorities competing with each other, some with different levels of trustworthiness, some charging different amounts, etc.

Re:Forged headers?

[maxume]

Only if it is implemented extremely poorly, which is unlikely. For instance, Domainkeys/DKIM has not been defeated yet (that I have noticed, anyway):

http://www.dkim.org/

(DKIM is a scheme for message signing, if a message contains an organization's signature, it is quite likely that the organization did handle the message)

Cynical? Me?

[TDyl]

So when will Microhoo start upping the charges for Redmond to take their pound of flesh?

Call Me Crazy, But I Would Participate

[Slashdot Parent]

If I could use any email client, I would participate in this.

I mean, why not? I give money to charity anyway. What difference does it make to me if I go through "Centmail" or any other intermediary, as long as "Centmail" doesn't charge a fee?

Pay per mail?

[Robert Goatse]

Meh, the day Yahoo! charges for an e-mail is the day I switch e-mail providers. It's not like they are the only free e-mail provider out there, gnome sayin'?

Re:I tried this with linux

[Vovk]

depends on your distro and what you need drivers for. your most common stuff can probably be added as a kernel module, or is available from your distro's package manager (if you are brand new to linux and your distro DOESN'T have a package manager, then switch distros. Seriously, they are good for beginners and experts alike)

around we go

[mugnyte]

  Either the authentication traffic kills us, or the spammers clone any sort of component embedded in email to lend credibility. If you can fake an email as spam, you can fake a stamp.

  If Centmail stamps are auto-verified, then either an API must authenticate the key and authorize the action - which is a lot of traffic - at a single server/authority, or we disperse it. With dispersal, possibly for abuse goes up, and then we have new keys arriving which means more traffic. We of course can't use keys per mail, but perhaps per-sender. This is still a huge number of keys to be managed.

  Filters work as a form of decentralized authentication, where the proper "key" is passing the filter, which is slowly morphing from user feedback. This seems to me to degrade over time, as the filters cannot change quick enough, still weighing-in prior exclusions while accepting new ones. There's a fair amount of noise to ignore while people mark email they don't like as SPAM and similarities are extracted.

  Blacklists and Whitelists are just filters with a central authority, but open to more abuse and too coarse-grained to remove much, as spammers hop or spoof origins quickly.

  Overall, I don't feel like bolt-on public systems can categorize the messages other than how we're doing it today. If we had a re-do on email, it might involve some encryption for senders, certificate stamps, and a trust level of pathways and a distributed authorization system with feedback to violators. But we're a long ways off from that.

This has all been discussed for years.

Re:around we go

[Eivind]

Actually you can't. Not if the stamp is a digital signature of the message. checking signatures for validity is somewhat heavy work for mailservers though, but cpu isn't getting any more expensive, so I guess that could work.

Re:around we go

[mugnyte]

  I agree. One can find ways to alter messages for the same key, but thats a heavyweight cpu attack.

  So, the rest of it still stands. If someday "certified" email gets an easier path into an inbox, jump on that pipe via:

1 - Pay, build or steal a verification authority.
2 - Pump out 1000's of email under false senders (from same server), signed adequately.
3 - Auto-approve all remote calls to authenticate such msgs from forwarding servers.

After a certain number, go back to 1. Build a library of servers, harvesting from
new techniques while old ones are blacklisted.

The above strategy already exists; the servers are just botnet zombies.

Okay, I'll play this game.

[Ollabelle]

I'll set myself up as a charity, and have the system pull money out of my account, and put into the my other - er, the charity's - account. Now all my spam is blessed.

Re:Okay, I'll play this game.

[Voyager529]

Are you a Nigerian Prince?

Re:Okay, I'll play this game.

[Anonymous Coward]

No, he's the lawyer for your rich (and previously unkown) family member's estate trying to help you get your rightful inheritance.

Re:Okay, I'll play this game.

[Anonymous Coward]

Actually, this is the first legitimate objection to this idea I have seen.
I like the "penny per" idea, but what's to stop a spammer from making themselves their own charity?

Re:Okay, I'll play this game.

[Anonymous Coward]

To be a not for profit all you have to do is- not make a profit.

Set up your charity, then distribute the penny back to the sender as an act of goodwill. You've given away all of your donations, you've not made a profit.

I'd love to be the IRS tax auditor on this one:

IRS: "so you received 10,000,000 donations this year?"
CHARITY: "yes, but they were only for a penny each"
IRS: "Where did you keep these funds?"
CHARITY: "We didn't. We gave every penny away, to about 5,000,000 people. We have receipts, you can look through them all."
IRS: *palm to forehead*

Re:Okay, I'll play this game.

[gd2shoe]

Oh, that's cute. Spam telling you to switch your donations to their charity (protecting baby seals and feeding children in Somalia). Sounds like a money machine to me.

Re:Okay, I'll play this game.

[gd2shoe]

Cute, but wouldn't work.

Any unclaimed amounts would be confiscated as unclaimed property. The "owners" would then need to try to claim it from the government. (yes, they really do this.) As this would be a net income, they would love you. (not sure if it's the IRS or the State, but someone would pocket it for you.)

I've heard this scheme before.

[Ustice]

So, if we all decide to boycot a particular gas company for a month, the price of gas will go down! BRILLIANT! Oi. Why would people pay for something that they use for free. If Yahoo is worried about spam protection, then they should just use Google's spam filter, like they use MS's search engine. Problem solved.

Re:I've heard this scheme before.

[gd2shoe]

I find it telling that Yahoo doesn't implement SPF... For someone soooo concerned about spam, they can't even do the DNS half?

time to delivery not longer that important

[mugnyte]

    Email is already used to deliver messages that have lower immediacy expectations than IM or Cellular. Authentication may slow down delivery even further, but this usage pattern is putting email behind-the-times on the technology ladder.

    Right now it's still good for mixed-media and longer messages, but mostly its a holdover from an earlier era. Eventually, users will simply a document and then share it with a target audience, not actually clone content to inboxes.

    I don't mind the death of email. "Offline" reading is redundant given content capture techniques, and the messages are vastly wasteful in their design (copied threads).

Re:time to delivery not longer that important

[BMonger]

That sounds eerily like Google Wave... :)

Re:time to delivery not longer that important

[gad_zuki!]

>I don't mind the death of email.

The business world would. Maybe in your little social circle of IM and twitter addicts you can do without email, but not in the real world where money exchanges hands. Guess which world hires all the email admins?

Re:time to delivery not longer that important

[gd2shoe]

As BMonger pointed out before you, mugnyte is probably referring to Google Wave. (which is a suitable stand-in replacement for email at a bare minimum, a great boon to business if Google plays their cards right; basically, it's email on steroids.)

In reality...

[operagost]

If this system were to go in place, Yahoo would be vilified and the program would be closed within weeks. Then a few months later, it would be resurrected as a new tax by the US government in a "cap and spam" bill.

Re:In reality...

[Tony Hoyle]

I'd like to see the US Government try to tax me.. they can swivel for it.

Re:In reality...

[gd2shoe]

If this were to go in place, Yahoo would flail about madly, and everyone else would ignore them. Suddenly, nobody would be able to send email to Yahoo users. Yahoo users would complain at being charged, and leave in droves. I can't imagine anybody stupid enough (in the business sense) to do something like this. I can only assume that Yahoo has no intention to do this, and have something to gain through the publicity.

In other news...

[LordDragoon]

Spammer/Hacker has already written program to spoof centmail stamps.

Please forward this

[xgr3gx]

This message is to raise money for a litte girl with cancer.
Every time someone forwards this email it's tracked, and AOL, Microsoft, Yahoo, and Disney will donate $0.01.
The more people you forward to, the more money we can raise! So please...look into your heart and just take a few seconds to forward this message to everyone in your address book.
If you choose to be a meany, and not forward this email, you will die in 5 years, and so will everyone in your family.

Re:Please forward this

[need4mospd]

Unfortunately, I just signed up for a new Centmail account today and sending this to everyone in my spam...eh...I mean....eh...."address" book would cost me over $15k.

However, I do have approximately $10 million in an offshore account I need to get to your country, and if you could just add a quick note to the bottom of that email I'd appreciate it.

Re:Please forward this

[gmulert]

If you choose to be a meany, and not forward this email, you will die in 5 years, and so will everyone in your family.

What luck! I was just diagnosed with terminal cancer, and my doctor said I had 3 months to live! Does the FDA know about this new treatment?

FTFY

[KingPin27]

I've installed a keylogger onto your computer to capture your login credentials for the Yahoo Centmail site -- I have now solicited over half of Nigeria and most of Scotland for monies on behalf of your cousins uncles nephews best friends room mate from college who is lying sick in a hospital bed in Sweden and needs a foreign bank account to deposit large amounts of monies into before he passes away

Signed -- Centmail Approved Message

Something's missing

[Chelloveck]

Wow, that's really amazing. Neither the article nor the actual CentMail website has a single shred of technical information on how this will actually be implemented. I'm sure it has something to do with the evil bit.

Does Yahoo declare itself guilty for SPAM?

[VincenzoRomano]

That schema would work only if Yahoo could be accounted for the most part of the SPAM.
And if Yahoo is not guilty for all the SPAM, then that move would work only if all free email services would follow.
And then you would need to force all ISPs to block TCP port 25.
And only then, maybe, you would be starting limiting the amount of spam!

Re:(almost) spam-free

[TaoPhoenix]

Nah. There are several strategies unused. I'd like to start by not getting any foreign email. (I did accept some French spam on humor's sake, but any other language, forget it.)

Spellcheck. 80% of spam has beautifully awful spelling.

In an unrelated story....

[Kaptain Kruton]

Centmail users pay $0.01 for each message they send...

In an unrelated story, the number of Gmail users has recently sky-rocketed.

Whoops! time to ditch my yahoo account!

[WillAffleckUW]

Seriously, I hate spam too, but no way jose!

I knew MSFT would manage to infect Yahoo with their plutocrat ideas ...

nt

[shentino]

I'll have my email fees donated to BigSpamCompany, my employer.

Nice in theory but this is too easy to get around.

Check the box for The Human Fund

[Anonymous Coward]

The only charity with zero administrative load!

ok

[fulldecent]

you pay one cent for the privilege of Y! adding a their cryptographic signature to your message. filters everywhere learn that the aforementioned mail is less likely to be spam.

sounds like a worthy experiment to me.

Finally

[hesaigo999ca]

After all this time of me saying this from previous posts, I always said that pay per email no matter how small the cost, would atleast
let most people know their infected machines are spewing out mail...and that enabling SMTP by default is not a good thing.
So for those not able to understand what this means, it means look forward to your ISP sending you a bill next time you have a virus and are too cheap to take care of the problem.

You spend on the emails or on the maintenance of your machine...and 5million emails per month
that .01 cent each is still a sh*t load of money...hopefully the ISP companies will figure out early on that this should fall under the category of extra bandwidth and have a maximum per month you can charge no matter what happens
(my cap is 30$ a month unlimited ).

Re:(almost) spam-free

[box4831]

Spellcheck. 80% of spam has beautifully awful spelling.

Which leaves about 95% of legitimate email with beautifully awful spelling

Doesn't stop clever malware

[Anonymous Coward]

On a more basic note, what's to stop new malware from installing itself into a user's computer and sending emails on behalf of users with their accounts - on someone else's credit card?

My favorite charity

[infinite undo]

I want societal expectations and systems to support the following.

I'll be glad to read a message from a stranger for a price. After my escrow agent informs me my message reading fee has been placed in escrow, I'll gladly look at the message. If I don't like the message, I'll cash your check. No problem! If I like the message, depending on how much I like it, I'll leave the money in escrow or refund it; and if I reply, I may send you an unguessable email address for future free correspondence.

Friends and relatives would have each have an unguessable email addresses for me (and presumably each other).

This would enable folks without a personal assistant to be reachable yet not open themselves up to the spamming scum of the earth.

This would be useful for social networking sites that focus on professional relationships, like LinkedIn.

It's essential that the terms be set by the recipient.

Instead of a charity...

[Hungus]

Instead of sending the 1c to a charity, why not send it to the receiver? I receive some x number of mail's per day and send y , but the number is small and the x-y is even smaller. However for the spammer x is probably similar, where y is 8+ orders of magnitude higher resulting in a financial disincentive to spam. Commercial email is incentivized to reduce its mailing lists and target more accurately, yet is not significantly punished for its high output to input ratio.

Re:Instead of a charity...

[jnnnnn]

send it to the receiver

So all the bots just start sending mail to their herders?

On the other hand, this could actually be a good thing - getting (immediately) financially punished for being infected with a virus might make normal users more concerned about security.

Re:Instead of a charity...

[Hungus]

Why do you think the network would allow transmission without the funds already being there? If you were botted, you would only be able to send however many messages you had previously paid for. Lets say a home user sends lot more email that he receives, to the tune of 100 per day (grandpa was quite amorous in his youth and he likes to send out emails to all his grandkids 4X a day, but none of them ever reply to the old letch) So he sets up an account that is good for 3000 emails which is a grand 30 dollars. If he were botted that 30 dollars would disappear overnight and he couldn't send any ore till he filled back up his account or received more emails. I think he might spot something strange going on when he was notified he couldn't send constant updates to his g-kids anymore.

Bulk mailers who have 1 million people on their list? 10 grand per send. Thats a lot of cash, but if you have 1m customers you need to reach it is by far the cheapest way to do it. RSS can take the place of many updates that companies send and will only reach active subscribers.

Re:Instead of a charity...

[Anonymous Coward]

1. Buy cheap domain name and hosting
2. Set up a catch-all email address
3. Sign up for spam with mail00000@cheapdomain through to mail99999@cheapdomain
4. Profit!

Re:I tried this with linux

[MyLongNickName]

YHBT

Hasn't anyone here seen Superman III?!

[Carbaholic]

yahoo will just use a clever computer program to skim all the fractions of cents off the top of every transaction.

The devil is in the details

[ByzantineAlex]

The idea sounds very good... in theory. I would like to understand in more detail how this payment method will work. First, people should pay that fee in their local currency, whatever that might be. Euro, USD, CAN $, Yen, Swiss FR, etc, will not work - most people in this world don't have easy access to them. Also, the charities in question should either be local (so that they are appealing to people in, say, Mongolia, or New Zeeland, etc), either truly worldwide (Unicef). The second problem - how will the internet users pay in Surinam, for example ? Should they go to the bank, exchange their local money in some convertible currency, and then deposit that in some kind of micro-payments account ? What will happen to internet cafés all over the world (in some countries they are still the only way to have access to the net)? In case of a payment conflict, who will arbitrate ? Of course, it cannot work in any other way than pre-pay (otherwise you can install a virus on someone's computer and let that person fight the charges). So then what happens when you need to send an important email in the middle of the night and you have no money left in your account ? Remember that many people do not have a credit card to load their account with ! Will all the ISPs in this world agree to police their subscribers and provide accounting tools and supervision for ? I have many, many questions. I'd like to see this implemented, but...

Re:(almost) spam-free

[Impy the Impiuos Imp]

My own corporate email server could cut 95% of my spam by just checking if arriving mail "from me" was actually sent out by it only moments before.

I don't like this.

[Hillview]

$5.00 is a *very* cheap advertising investment to hit 500 potential customers. This won't keep spammers away, not by a long shot.

Re:I tried this with linux

[Dishevel]

I can't believe you fell for this.

alternative idea

[Anonymous Coward]

I say you have to give the receipiant a penny. I'd gladly get spammed then.

Remember Bonded Spammer?

[Animats]

This has been tried. Remember Bonded Spammer? That was a flop. Then they were sold, reduced their standards (senders no longer have to post a bond) and are now called ReturnPath.. For $82,500/year you can send 100 million spams. They pay off ISPs to whitelist their senders. There's a way to query DNS to determine if an address is a "Bonded Spammer". It's an indication that the message should be sent to the "bulk" folder.

Nobody uses this much any more. The last Bonded Spammer e-mail I received was in 2007.

Clearly yahoo doesn't understand the problem

[vanyel]

Any system like that will fail not because it costs money, but because it's too hard to implement globally. And, as someone else pointed out, spammers *can* afford to pay for it. But ease of use is the biggest hurdle --- otherwise everyone would be digitally signing and encrypting their mail.

This is a great idea.

[bennomatic]

I think this is a great idea, although I would modify the process as follows:

• Charge a smaller amount (i.e. $0.001) but do it on a per-recipient basis, rather than a per-email basis.
• Have 80% fund go to the charity.
• Have 20% go as a CentMail credit to CentMail-using recipients of the email, so that for each 5 stamped emails you receive, you can send one out for free.
• For any recipients who are not on CentMail compliant services, the final 20% goes directly to the charity.

I proposed something like this years ago as a method of resolving the SPAM problem, and while there are many naysayers and as many real technical and political challenges to the process, the only way to ensure that nobody sends out spamvertisements to millions of recipients is to raise the cost of emailing from nothing to something. Even if it's a tiny fraction of a penny, the ROI drops significantly and spammers move on to greener pastures.

No, I don't pay to send, you pay me to receive

[stonewolf]

Seriously, I have a new plan to can spam. If you want me to see your email, you send me $0.01 cents along with the email. If you don't pay your email winds up in the great bit bucket in the sky.

We can set up a settlement system to keep track of how much we each owe versus how much we are owed. Most of us will wind up making a few cents per week from the emails from our banks and the few spammers that are willing to pay. A few of us (like one of my friends) who forwards everything to everybody will wind up paying a few cents, or even a few dollars, per month for the privilege of sending email. The charge is small enough that real businesses, those that spam my snail mail, will happily pay it. But, your average Nigerian prince with erectile dysfunction will not.

Hey we could even make it a bidding system. Let me set a price for accepting your email. If I want your email I set the price to $0. If I hate you I'll set the price much higher. Your email software would fetch the acceptance price and decide if I am worth sending a message to.

Stonewolf

Re:No, I don't pay to send, you pay me to receive

[Khashishi]

That idea is not new, but it seems impractical. It would require a large-scale, secure system of micropayments. Corporations would have no incentive to implement it.

Re:No, I don't pay to send, you pay me to receive

[stonewolf]

Not being new doesn't surprise me. I'd be surprised if it were new.

The incentive to implement it is the same as the incentive to implement the pay-to-send system. Some company somewhere gets to store the cents until they get paid out or canceled out of the system. That could be a whole lot of cents and the interest on the pot of cents they hold should be enough to make it interesting.

BTW, both system require a micropayment infrastructure. We'll eventually have such a system, but we do not have it now.

Another serious problem with either suggestion is that 0.01 USD is a lot of money to much of the population of the world. Any charge would lock millions of people out of email usage.

My real favorite solution to mass spam is to hunt down the spammers and either hang, draw and quarter them or burn them at the stake. The resulting videos would be posted on YouTube.

Stonewolf

Assure vs Insure vs Ensure...

[Anonymous Coward]

As an insurance agent, I assure you (I promise you) that there is no way in hell we would insure you (provide indemnification coverage against a specified loss) against getting spam. The only way to ensure (make sure) you don't get spam is to turn your computer off.

If your dictionary tells you that "assure", "ensure" and "insure" are synonymous and, moreover, interchangeable, please send it directly to the nearest paper recycling mill and buy yourself a set that doesn't retard your language skills.
Cue the "languages evolve" crowd. Languages may evolve, but evolution through ignorance and stupidity is hardly evolution at all; the words exist with their entirely different meanings for a reason: to convey an idea to another party. If that idea ends up being open to interpretation due to the use of ambiguous words, odds are you have failed to convey your idea entirely.

Re:Assure vs Insure vs Ensure...

[drukawski]

1.) I used parent's language to better convey my idea to parent because it occurred to me that simply launching into a dissertation of proper grammar and spelling rather than arguing the merits of his, or her, post might make me appear pretentious and kind of an asshole. If you found ambiguity in my post, might I suggest you read the thread in it's entirety before commenting on something you had a hard time understanding?

2.) On a more personal note I would like to suggest you reexamine your personal feelings about linguistic evolution. Should you still feel the same, please feel free to simply write in Latin from now on... though I suppose Egyptian, Sumerian, or Cuneiform would also probably be acceptable alternatives.

Re:Assure vs Insure vs Ensure...

[Anonymous Coward]

The only way to ensure (make sure) you don't get spam is to turn your computer off.

Really, my inbox still collects spam

Re:Assure vs Insure vs Ensure...

[Anonymous Coward]

Are your toes really that long that you would not only find my post an ad hominem attack, but that you felt sufficiently targeted to honor me with your reply?

To clear this up - my post was a post in general to -all- who would mix up "insure" and "ensure". I thought that by adding "assure" - which is not present in your post, nor the original poster's post - that would have been clear. Had Slashdot made it possible to reply to you both at the same time, I assure you that I would have done so.

But I do delight in your reply, so I will certainly address your points..

1.1) As should be clear from my post, I did not have a hard time understanding your post simply because I knew what you had intended to write. That does not mean that diluting the exact nature of your ideas by using words that are similar-but-different is acceptable as long as you believe the intended audience knows what you meant; what you believe, and what reality is, are often two different things.

1.2) There was no particularly good reason to use the original poster's slip-up. Simply changing the word to "ensure" without "launching into a dissertation on proper grammar and spelling [...]" - after all, why would you? - would certainly not have made the original poster think that you are pretentious or kind of an asshole, while at the same time you would not have perpetuated their mistake.

2) The difference between evolution from those languages - though Egyptian as a spoken word is very much alive, you were referring to the written word which is another matter entirely; note that the three words of the subject are different in both spoken and written form - to more modern languages and any supposed 'evolution' of the English language by suggesting that e.g. "assure", "insure" and "ensure", or "then" and "than", or "imminent" and "eminent" and many more are interchangeable simply because those who haven't sufficiently learned the difference believe there -is- no difference, is that the former have evolved to better convey specific ideas, while the latter makes it more difficult to convey those specific ideas due to the ambiguity arising from choosing the incorrect word(s).

But then.. I'm only an insurance agent, not an English scholar. If I were, I probably would not have written the run-on sentence above.

Re:Assure vs Insure vs Ensure...

[Anonymous Coward]

well, perhaps you should tell your inbox to find a different hobby?

Re:Assure vs Insure vs Ensure...

[drukawski]

I was debating delving into a multi-point counter argument picking apart your grammatical fanaticism; however, I suspect that would only "delight" you further.
Yet one point stands above all else; for all intents and purposes neither you nor I know where the parent hails from. Whose to say where he/she lives there aren't different grammar rules than what you personally have determined in your head to be the be-all and end-all of grammar? Surely you aren't suggesting that the poster, I, or anyone else for that matter, engaged in a conversation, should always and forever use grammar that you personally like just in case you were to stumble across the conversation without regard towards the grammar that may be "correct" in our respective locals?

Your feelings of entitlement towards reading everything in a way thats most comfortable for you are unjustified and to be honest, excessive. Now, I'm sure theres a word for that; something that means "making unjustified or excessive claims or expressing an exaggerated worth or importance." Oh wait, here it is: pretentious

Re:Assure vs Insure vs Ensure...

[RockDoctor]

Languages may evolve, but evolution through ignorance and stupidity is hardly evolution at all; the words exist with their entirely different meanings for a reason: to convey an idea to another party. If that idea ends up being open to interpretation due to the use of ambiguous words, odds are you have failed to convey your idea entirely.

Are you some sort of anti-homophone pervert?

Re:Assure vs Insure vs Ensure...

[Anonymous Coward]

You are right, it would delight me - I would especially have looked forward to reading your rebuttal to my explanation that simply changing it to the correct word in your reply would have been fine. But alas, I suppose I shall never find out.

You are also correct in stating that neither of us know what grammatical rules the original poster may adhere to. I daresay the onus would lay with you on providing evidence that there is a locale in the world where the commonly accepted (just to make it easier on you, I'm not suggesting the official) grammatical rules state that it is acceptable, when trying to convey a specific idea, to use words with completely different meanings related to the idea you're trying to convey.

In other words, I challenge you to substantiate your seemingly feeble claim* that I am only defending -my- personal views on grammar, and not official -and- accepted grammatical rules for the English language in any nation - be it as a first, second, or alternative language.
( * I'd love to be proven wrong and shown evidence of your point, as that would mean I'd have to review and refine these writings. )

However, I'm not too sure word substitution using words with completely different meanings is a part or a language's grammar at all. Grammar tends to refer to how words make up sentences, paragraphs, and so forth; a fair example being word order (subject-verb-object and all that jazz).

So, you may call me ( which is ad hominem - congratulations: you're arguing with an AC :) ) pretentious and honestly feel like I'm trying to bend everybody to my personal will; but all I ever wanted to make clear is that 1. people should not mix-up "assure", "insure" and "ensure" as they have completely different meanings and 2. (in my reply to your reply) that correcting a mistake is not a pretentious thing to do and should not make you feel like you might be labeled such.. much less "an asshole".

If you are suggesting that I feel that people should try to stick to a language's words' meanings, and its grammar, then you would be absolutely right. An evolving language serves to make conveying ideas more clear.. be that by introducing distinction, or by removing distinction where it is not required. Removing the distinction between "assure", "insure" and "ensure", however, leads to ambiguities, many of which can not easily be resolved by context without further explanation; at which point it would have been more efficient to use the correct word to begin with. I believe any student of languages - including their native language from when they were but a little child taught in elementary school - is taught these basic principles. Not sticking to them - regardless of any language evolution processes - is, I'm guessing you would agree, counterproductive.

But if you feel otherwise: cycle a house's parachute you went, fly I.

Re:I tried this with linux

[Vovk]

Have I? Well damn >:)

Hey, this works...

[roc97007]

So, spammer creates or acquires charity. They can actually be doing charitable things, for appearance sake, but their prime reason for existence is to launder money for the spammer.

Spammer opts into centmail, choosing their own charity, and continues to blast out spam, bypassing the centmail-enabled spam filters.

Profit!

So, you're charging postage?

[Anonymous Coward]

Isn't the point of using email that it's fast and DOESN'T require postage?

Standard Form Response

[Otto]

your post advocates a

(X) technical ( ) legislative (X) market-based ( ) vigilante

approach to fighting spam. your idea will not work. here is why it won't work. (one or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) spammers can easily use it to harvest email addresses
( ) mailing lists and other legitimate email uses would be affected
(X) no one will be able to find the guy or collect the money
(X) it is defenseless against brute force attacks
(X) it will stop spam for two weeks and then we'll be stuck with it
(X) users of email will not put up with it
( ) microsoft will not put up with it
( ) the police will not put up with it
( ) requires too much cooperation from spammers
( ) requires immediate total cooperation from everybody at once
(X) many email users cannot afford to lose business or alienate potential employers
( ) spammers don't care about invalid addresses in their lists
( ) anyone could anonymously destroy anyone else's career or business

specifically, your plan fails to account for

( ) laws expressly prohibiting it
(X) lack of centrally controlling authority for email
( ) open relays in foreign countries
( ) ease of searching tiny alphanumeric address space of all email addresses
(X) asshats
( ) jurisdictional problems
(X) unpopularity of weird new taxes
( ) public reluctance to accept weird new forms of money
( ) huge existing software investment in smtp
( ) susceptibility of protocols other than smtp to attack
( ) willingness of users to install os patches received by email
( ) armies of worm riddled broadband-connected windows boxes
( ) eternal arms race involved in all filtering approaches
(X) extreme profitability of spam
(X) joe jobs and/or identity theft
( ) technically illiterate politicians
( ) extreme stupidity on the part of people who do business with spammers
(X) dishonesty on the part of spammers themselves
( ) bandwidth costs that are unaffected by client filtering
( ) outlook

and the following philosophical objections may also apply:

(X) ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) any scheme based on opt-out is unacceptable
( ) smtp headers should not be the subject of legislation
(X) blacklists suck
(X) whitelists suck
( ) we should be able to talk about viagra without being censored
( ) countermeasures should not involve wire fraud or credit card fraud
( ) countermeasures should not involve sabotage of public networks
( ) countermeasures must work if phased in gradually
(X) sending email should be free
(X) why should we have to trust you and your servers?
( ) incompatiblity with open source or open source licenses
(X) feel-good measures do nothing to solve the problem
( ) temporary/one-time email addresses are cumbersome
( ) i don't want the government reading my email
(X) killing them that way is not slow and painful enough

furthermore, this is what i think about you:

(X) sorry dude, but i don't think it would work.
(X) this is a stupid idea, and you're a stupid person for suggesting it.
( ) nice try, assh0le! i'm going to find out where you live and burn your house down!

Re:Standard Form Response

[geekoid]

"(X) ideas similar to yours are easy to come up with, yet none have ever been shown practical"
I alwys disl;iked that one. If fall unser then "Someone would have done it by now" logical fallacy.

If everyone uses centmail

[PleaseFearMe]

It would work if only centmail users can email centmail users. That would isolate a huge bunch of people though, so that would not work. But if it was government sponsored... Everyone has their one individual email address that they are linked directly to. That could work.

Great way to bankrupt innocent people

[junglebeast]

Spammers send email by taking control of innocent victim's email accounts and using them to launch spam. I should know, my email has been hijacked (hotmail)...but there's nothing I can do about it. I can't imagine if they tried charging ME for spam email sent from my account because they allowed someone to hack into my account.

Re:(almost) spam-free

[Alinabi]

That might work for you, but many people receive legit emails in more than one language.

Stupid way how to make someone other rich

[Anonymous Coward]

This is the most stupid idea that I heard today

Not much of a road block

[agendi]

Won't that just mean that the cost of buying a spam campaign increase by $0.01 a message? The only way to stop spammer is to stop businesses paying them for it. There is of course the problem of spamming viruses.. this approach might make people more dilligent about keeping patched though?

If you think this will work

[geekoid]

then you don't understand email or spam.

Great way to bankrupt victims?

[MartinSchou]

Imagine for a moment that this becomes a regular part of your ISP charges. You pay 1 cent per email you sent last month. Might seem reasonable.

Then one day your computer is hit by some kind of malware (virus, trojan, worm, whatever) and starts sending one spam email per second, fully authenticated and with a centmail stamp on it.

It does this on the first day of the fiscal month. 1 mail per second isn't all that much extra traffic, so you probably won't notice. Computer on 4 hours a day, every day, you end up sending 432,000 emails costing $4,320.

Now imagine it hits a company instead. Small office, 10 computer. Now we're talking 8 hours a day x 10 computers, totalling $86,400.

Yeah - I can't wait.

Re:(almost) spam-free

[gd2shoe]

It's a little tricky to see what you're getting at, but I think you want SPF.(more)

An SPF record is a DNS record that is roughly opposite to an MX record. MX says were to send mail for a domain; SPF says where mail is allowed to come from for a domain.

Great!

[ignavus]

Now we will not only get a whole lot of spam, but the spammers can feel virtuous because they are donating so much money to charity.

And the charities will all be hiring black hats to try and pwn as many machines as possible: you will just keep getting these mysterious bills each month for huge donations to charity.

SPF. Learn it. Live it.

[gd2shoe]

No, no, no, no, no... No.

The proper solution is not for ISPs to block access between their clients and their client's mail servers. If I want to send a message from my computer at home through my companies mail server, I should be able to. If I don't want my ISP reading my email, I should be allowed to use ESMTP with auth and TLS. Your solution ignores this. It also complicates laptop setups something fierce. You're solving the problem in the wrong place by giving too much responsibility and authority to the wrong people.

The problem(1) is that SMTP is used as both a sending and a relaying protocol. There is no easy way to distinguish between an outbound SMTP connection being used to connect to a legitimate relay (work server) and as a spambot (forged headers).

The problem(2) is that SMTP servers blindly assume the sending address is legitimate. Thus, forging someones email address is easy. This is true even if the originating IP address reverse resolves to imgoingtospamyou.com or adsl-nn.nn.nn.nn.dsl.somewhere01.pacbell.net. This is what's broken, not what ISPs allow through their network.

The proper solution is for the receiving SMTP server to determine if the sender is allowed to send mail for that domain. This was not a consideration of the original email paradigm, but it is now. Sender Policy Framework If you're receiving spam from botnets, then your mail provider needs to tighten up their default SPF settings. (They may need someone to demand that they implement SPF.)

I know that SPF must be implemented everywhere for it to be fully effective, but good default policies will still block a vast majority of address spam.

The mind boggles...

[rnturn]

Does Yahoo even understand where spam comes from? To whoever at Yahoo thought this joke up: It isn't coming from people sending email to random email addresses. It comes from peoples' PCs that have been ...

Oh I give up. Now I think I know why Microsoft wanted to buy Yahoo. MS wanted their super smart anti-spam team.

SPF is available right now.

[gd2shoe]

It would be easier to use SPF. Man, I'm sounding like a broken record today.

SPF is a DNS counterpart to the MX record. MX says where you can send a message destined for a given domain; SPF specifies what servers are allowed to relay messages for a given domain. It addresses most (but not all) of the problems that TLS records would. The main difference would be what point-of-failures could be used to circumvent them (ca, dns, ip routing, etc), and what other things DNSSEC would be useful for.

Note that SPF is designed to work if the sender and receiver both use it. That being said, the receiver can still use reasonable defaults and block a majority of forged spam.

Don't touch my port 25

[gd2shoe]

Sigh. I've already said this once today. ISP blocking port 25 is bad, not good.

Re:Don't touch my port 25

[VincenzoRomano]

ISP blocking whatever is bad.
ISP throttling whatever is bad.
ISB doing anything but providing IP access is bad.

Re:Don't touch my port 25

[gd2shoe]

Here, here! (one caveat, if (and only if) the ISP is at maximum capacity, I don't mind selective throttling. It still means they need more equipment/bandwidth though...)

Re:Don't touch my port 25

[VincenzoRomano]

Maximum capacity?
Who will know?
Who will check?
Free (as in freedom, not beer) Internet for all!

Re:(almost) spam-free

[RockDoctor]

I'd like to start by not getting any foreign email.

& # 1058;& # 1077; & # 1088;& # 1072;& # 1073;& # 1086;& # 1090;& # 1077;& # 1090; & # 1086;& # 1076;& # 1080;& # 1085; & # 1091;& # 1079;& # 1080;& # 1082;? (thank you, SlashCode's inability to handle most characters) Only one? and you only work in that one language. How quaint. It must be nice being able to ignore the other 60%-plus of the world and your potential trade.

Re:(almost) spam-free

[Kalriath]

Won't work. An email server can't check SPF records for email from its own domain, since it also receives client connections, and therefore it'd need every single client PC to be in the SPF record.

What you could do is have a frontend SMTP server and a backend one which clients connect to, and configure the backend server to reject email from its own domain if it comes from the frontend server.

Re:(almost) spam-free

[Nathrael]

Yet so far, I've only received spam in English. Sure, spam from different languages exists, but it's rare and negligible for now.

I still think that the best way to ensure that you're not getting spammed is by just being careful about your e-mail address. Don't sign up for every idiotic web page, avoid posting your e-mail on the large social networking sites (forums tend to be OK), etc. That, combined with a good spam-filter (GoogleMail's filter is fine enough), gives me the "pleasure" of reading spam about 2 or 3 times a year and that's all.

Re:(almost) spam-free

[YttriumOxide]

Yet so far, I've only received spam in English. Sure, spam from different languages exists, but it's rare and negligible for now.

That depends on your email address as far as I can see... in my Google Mail spam folder, I pretty much only see English. In my work spam folder (".eu" domain) I get French, German and English. In one of my other private accounts (".nl" domain) I get English, Dutch and German. The amount of spam in German seems to be on the rise in all three though.

Fraud is still fraud

[sjwest]

A bit like dkim then (but that's free).

Does anybody use Yahoo anymore ? I suppose some people do but we have problems with groups at yahoo and there mailing lists with our 'users' / accounts that have never existed regularly hit our postfix servers.

If they implement this at yahoo I hope those people who pay to send email to our ever expanding new members of staff sue the life out of Yahoo for fraud.

how about

[Anonymous Coward]

How about you take the .01 per email or what ever amount, if it looks like they are not spamming or any thing like that at the end of the month you give the money back. If the money is just to keep people honest about what they are doing, then getting the money back after it is proven that they are.

Anything but money

[wye43]

Don't ask for money. Ask for an arm, a leg, but not money.
People will rather watch hours of advertising and spend hours managing insane amounts of spam instead of paying a cent.

Never underestimate the power of shortsightedness in most people. After all, most people still prefer the "free"(read: ad-supported) television. Yea, I'm right and most people are wrong, go on, mod me down :P

I shall now predict the future

[Kashgarinn]

Centmail will fail because ultimately email will fail.

In the future, emails won't be around. Instead there will be the Wave.

http://wave.google.com/

Ride the Wave. Ride it hard.

K.

How about a system for deleting spammer accounts?

[bemymonkey]

Why has no system for identifying and deleting spammer freemail accounts been devised yet? Wouldn't it be relatively simple to query, say, Google's anti-spam filters and delete every account that's sent more than a certain amount of spam?

Sure, it would require the freemail providers to work together, so it's unlikely to happen - but wouldn't it theoretically be possible?

Comment removed

[account_deleted]

Comment removed based on user account deletion

This is not an anti-spammer technique

[Xzael]

If all email providers charged for email, spammers will hack accounts to sends spam or they will use stolen credit card numbers to create fake accounts. Hell, they could probably even set up a charity for themselves under this specific case and have all the money go right back to them. But since they will most likely always be free-to-use email providers, spammers will just always use those, making the pay-per-email ones just money grabs for the think-in-the-box'ers. I'm not really convinced that 100% of the money will go directly to charity anyways.

Re:(almost) spam-free

[xouumalperxe]

Yet so far, I've only received spam in English.

Which leads us to the money question: how do you tell gloriously misspelt English apart from some other language, then?

ESMTP with auth and TLS

[gd2shoe]

If your SMTP server accepts email from client machines without requiring authentication, then you're doing it wrong. (by today's standards - it used to be acceptable.)

Email properly encrypted and authenticated should bypass SPF for exactly the reason you've pointed out. Any unauthenticated email for your own domain should be checked against SPF in case you have (or later setup) multiple relays. (I realize email will not necessarily have end-to-end encryption, but it is vital for the hop that includes a password.)

How will this succeed where micro-payments failed?

[Anonymous Coward]

I want to throw into the discussion that micro-payment systems have been advocated for a decade and with great implementations and great arguments for their use, all systems I know of failed in the end.

This seems to be the same idea with the same caveats about transactions decisions etc. How can it succeed?

Re:SPF. Learn it. Live it.

[nmb3000]

If I want to send a message from my computer at home through my companies mail server, I should be able to.

I figured somebody would say this, but the thing is that if you want to contact an external SMTP server it is pretty straightforward. You can either use the alternate SMTP port (587) with SSL/TLS or you can use a VPN. You could also just contact your ISP and ask for the restriction to be lifted for your account.

95% of home users don't need access to port 25. The 5% that do can either use an alternate method to access it or get their ISP to open it for them. I agree it isn't the most ideal solution, but the preferred methods (such as SPF) have two big issues: They just aren't in widespread use enough, and way too many mail servers are poorly configured which would lead to dropped mail.

What would be better is ISPs throttling the number of SMTP connections their clients make. Say anything over 300/day and they're blocked for 24 hours. Downside is that's probably asking too much from many smaller ISPs. Big ones (Comcast, Qwest, etc) should be able to do it easy.

Re:SPF. Learn it. Live it.

[gd2shoe]

... the thing is that if you want to contact an external SMTP server it is pretty straightforward. You can either use the alternate SMTP port (587) with SSL/TLS...

If your work provides it (they should, many don't).

...or you can use a VPN.

And how is that a "straightforward" part of an email deployment? Unless VPN is really needed for other work functions, it should be avoided. It's overkill.

You could also just contact your ISP and ask for the restriction to be lifted for your account.

It took me about 4 tries before my ISP listened to me. Each time they told me it would be fixed, but it wasn't. People shouldn't have to go through that for something so fundamental to Internet service.

95% of home users don't need access to port 25.

Agreed, due to gmail, yahoo mail, etc. I don't think it's relevant, but I see why you do.

I agree it isn't the most ideal solution, but the preferred methods (such as SPF) have two big issues: They just aren't in widespread use enough,...

True, which is why I bring it up. I hoped to introduce the idea to someone who in turn might cause it to be implemented somewhere. I'm spreading the word.

I maintain that it can be very effective with reasonable and very loose default settings. (not entirely effective -- that would require universal participation; certainly worth using, though.)

...and way too many mail servers are poorly configured which would lead to dropped mail.

In what way? Can you give me a brief use case detailing SPF gone wrong? Any case where the sender causes problems by not supporting SPF? Any case causing email to actually be lost?

What would be better is ISPs throttling the number of SMTP connections their clients make. Say anything over 300/day and they're blocked for 24 hours.

Assuming this doesn't apply to business lines, there are still many small businesses that are using "residential" connections. This would solve the problems for 4.9% of the remaining 5% perhaps. It would leave the rest in a bit of a pickle.

The problem is the way email is handled. It was designed without good security practices, and now the industry is struggling to very, very slowly fix the problem. I don't want my ISP to feel like it's their job to monitor my connection. I want raw bandwidth from them, nothing more.

I prefer the philosophy: fix the problem, not the symptom.

Downside is that's probably asking too much from many smaller ISPs. Big ones (Comcast, Qwest, etc) should be able to do it easy.

also:

... or get their ISP to open it for them.

Maintaining complex port filtering is probably asking too much from many smaller ISPs.

Money is not the only solution

[jcvau]

A more simple approach would be to put a delay around each mail sent by a non-athenticated agent. For most people sending a couple of mails at a time, a 1 sec delay would not change their experience. For spammers trying to send hundred thousands... it would take too long. Easy, cheap and simple.