[tlug] Eliminating spam using email with an economic model

["Stephen J. Turnbull" <stephen@example.com>]

Shannon Jacobs \(6881\) writes:

[Re: the "average spammer"]

 > No, there are only a few big fish at the top of the pyramid, though
 > they do generate the lion's share of the spam.

Different "average".  Who cares how many individual spammers are out
there?  The question that matters to me is not "what is the average of
those who send spam?" but "what is sent by the spammer who sends the
average spam?"  IOW, the median spammer ... who by your statement is
one of the big fish.

 > I'd say that almost none of them can be anywhere close to 'decent
 > money'.

As Godwin points out, most likely the ones who are making a decent
amount of money are outright frauds.  Not that I'd call that "decent
money." ;-)

[Re: NEMS]

 > Well, there a number of ways to ways to define spam-free email
 > systems. I actually favor a pre-paid postage system that would
 > basically be an electronic equivalent of snail mail.

This doesn't stop direct snail mail, though.  I do not *ever* want
Republican National Committee propaganda in my mailbox, not even if
they pay me $200 to accept it (I'd feel obliged to read it in that
case).  So I'll still need a spam filter.

 > However any email system that associates *ANY* real cost with
 > sending email has already destroyed the spammers' divide-by-zero
 > economic model.

That's not at all clear.  Remember, the typical spam these days seems
to be coming from a pwnzd machine, whose owner will pay (if he's
participating in NEMS).

So what is very possible is that you'll get two systems: NEMS for
people who care as much as you do, and SMTP for people who can't or
won't invest in securing their machines.  Or more likely, you'll get
one NEMS, run by a large trustworthy company, say NEC or Hitachi or
the privatized post office which will have a *very* strong incentive
to lobby for "Clipper"-like mechanisms to secure insecure OSes.  No,
no, no, thank you!

What is clear, however, is that you've destroyed the economics of
legitimate mailing lists like TLUG, which will have to go through
unprotected SMTP.

Besides, we already have several systems that associate real cost to
sending email: hashcash and challenge-response, to mention two.
Hashcash has the problem that it requires changing the software on
both ends.  However, I find it hard to believe that actually paying a
royalty to send to someone is going to be preferred to challenge-
response except in seriously time-critical applications.  But
challenge-response is widely detested, especially by mailing list
admins.

 > In actuality, if you allow for reciprocal accounting, very little
 > real money needs to change hands, though I think it's important to
 > keep relatively little economic slack in the system.

The problem you're going to run into is that it's all too easy to
leave a loophole that allows theft or denial of service, or of funds
(how about a provider setting up honeypot accounts to attract postage,
while just throwing away all mail to them?), unless you reduce it to
"I have his business card with his public key and he has mine, so we
can exchange mail."  But if you're going to do that, why not just do
that?

 > However, once you have any real economic model in place, then you
 > can go to town with it. How about auctions for your email access? 
 > My idea here was that your email service provider (ESP) would act
 > as an intermediary to hold and hide your personal information.

What do you think the recent hooraw at AOL about StrongMail (or
whatever it was called) was all about?

 > For example, I'd be willing to look at 15 minutes of email
 > advertising each day when I'm seriously in the market for something
 > like a new computer or a new apartment, and it would be very much
 > in the interest of certain companies to pay for that access at
 > those times.

Have you looked at the data returned from Google or Amazon searches
lately?

I don't want advertising in my mailbox *at all*; no unsolicited bulk
mail at all.  I think that web-based pull systems like Google and
Amazon rock, here.  I don't think your push model will have enough
customers to pay for itself.

I could be wrong; for example, you could use it like an alarm
clock---the push model ensures that you'll see it in your mailbox.
But you have to sign up and maintain your preferences; I think that
most people would prefer to simply pull the advertising rather than be
annoyed by push advertising and have to take specific effort to switch
it on and off.

Regards,
Steve