Re: Proposal to define a simple architecture to differentiate legitimate bulk email from Spam (UBE)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Thanks for the feedback and giving me a chance to clarify some issues.

>This is broken in two distinct ways:

Disagree.  Read on.


>1) I as a mail user now have to go check 150 POP servers several times a day
>for all the various lists I'm on - many of the lists are low-volume, but I'd 
>have
>to go CHECK every day just in case something DID get posted.


If it became an RFC or internet standard, and it became widely adopted, then it is reasonable to assume that email clients would add features to handle this.  It is quite a low bandwidth operation (probably less than 1K bytes) to poll a POP server for email.  I assume it would become popular because as shown with further logic in my responses below, the idea provides strong benefits to all (except spammers).

However, there is one key technological hurdle I did miss in my haste, there would need to be some mechanism so that the same user doesn't keep downloading the same messages over and over again.  This would either require a special modification to the POP server and require each user to login with a unique user name. Or better, users' email clients can be made smarter because there is a UIDL command in both POP3 and IMAP4.  This unique identifier can be used by the email client to only download messages which are new to that user.  One would assume that POP servers could also remove messages older than say 1 month or so (configurable by the administrator).

And as a side benefit, there would be no way for someone to subscribe me to a list without my permission, as can be done by sniffing an authentication email for Majordomo.  And no way for someone to subscribe me to a list that has no public instructions for subscribing or unsubscribing (i.e. spam in guise of business email).


>> In the case of a public distribution (e.g. most direct email and mailing
>> lists), a POP3 (and IMAP) account of user "anonymous" with password "none"
>> would suffice.  In the case of private dissemination (private mailing 
>lists), a
>> POP3 (and IMAP) server with individual accounts could be provided.
>
>Nope.  even for a public list you get to keep a separate POP3 account for each
>subscriber - if one person has checked for postings yesterday, but another 
>hasn't
>since last Tuesday, you can't feed the right list to each person.


False.  You are correct that I missed this issue in my initial post.  However, it need be only one POP account (one storage of emails) with flags for each user.  In other words, the storage requirement need no increase drastically with number of subscribed users.  The flags can either be stored at the POP server and then give each user a unique login id, or more realistically just let email clients manage their own flags using UIDL.



>2) I as the administrator of a site that hosts 6,000 mailing lists just got the
>additional aggrivation of providing POP3 service for 700,000 e-mail addresses
>(yes, we've got that many).  This includes "My password doesn't work" support
>and things like that.  Gee thanks.


No only 6000 POP accounts.  See above how email clients can handle the detection of new messages using UIDL.  And you only need one anonymous login and no password (just configure the POP server to accept any login and password).

Now instead of sending 700,000 emails for each email sent to all your 6000 of you lists, you only send 6000 emails or less.  Now instead of managing bounces, keeping your IP off of blacklists, hassling with subscribing and unsubscribing the users, then all you have to do is publish the domain names of your 6,000 POP servers on a web page.  The flow of noise is probably greatly reduced.


>Have you actually *TRIED* to use more than 100 POP accounts under any current
>mail software?

I will respond with similarly rhetorical question.  Did you try to use Netscape 2 on most current web pages?  Why make any application RFC if there can be no progress in applications?


>> 1. Any bulk email is then spam (receiver has not opted in) and can be dealt
>> with by ISPs, Hosts, legislators, judiciaries, and anti-spam software.
>
>So I drop a note to 50 friends inviting them to a barbecue, and I end up in 
>the slammer.


50, even 5000, is not statistically bulk on internet scale.  Is it not possible (or likely) to write laws without exclusions?  Do you think Hosts, ISPs, and anti-spam software would not account for this statistical phenomenon?


>> 2. Receivers now have uniform control over opt-in/opt-out policy without a 
>global authority
>
>This actually means "We've pushed the headache to the recipients".


How so?  In my mind, I find it to be no more of a headache than subscribing and unsubscribing to a mailing list.  And certainly a lot less of a headache than trying to opt-out of a list that won't let you opt-out.

I think recipients already have a big headache, it is called "spam".  And it is getting worse.  It is predicted that very soon 90% of all email sent will be spam.  When that happens, the internet email system will start to fail as a viable communication medium.  Then your 6000 mailing lists won't work any more any way.


>> 3. Legitimate bulk senders can be insured that they or their email won't be
>> misclassified as spam
>
>So.. you ready to have every single eBay or Amazon customer check their POP 
>account
>there every day just in case there's important mail for them?


Is it any different than checking their existing POP account(s) and reviewing InBox each day??

And as an advantage, they can (if they want) with a more finely grain comb choose which email to check and when.


>So let's see.. Currently, if your bank sells your e-mail address to another 
>company,
>you get spammed.  So instead, you'll have it so that you check your bank's POP
>server in case there's important mail about your mortgage.  Seems like the 
>obvious
>scheme is for the bank to charge the other company to put stuff in your POP 
>mailbox.
>
>So you still get spammed...


No.  Because you can chose to not check it and/or you at least know who is spamming you and can hold them responsible directly.  Thus your bank would stop doing it, because they make $ by not losing your business.


>It's ironic that you're proposing this on a push-based mailing list provided by
>an organization that is probably not in a position to provide POP accounts for
>the 30,000 or so recipients of the the list.


No.  As I said above, they would only need to provide one POP account for this mailing list.


>Baby with the bathwater, Shelby... Baby with the bathwater.


No baby, bathwater only.  Check the logic above.  Just the facts, Valdis...Just the facts.



[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]