RE: [Asrg] Re: RMX Records

> From: "Gary Feldman" <gaf@rtr.com>

> ...
> I no longer accept "breaks existing functionality" as a
> bulletproof objection.  The stock reponse is what is the underlying
> requirement, and how can that requirement be met in the context
> of a spam-preventing email system?  If the requirement
> can be met some other way, then the objection disappears.

That is true only provided you still meet the design goals served by
the existing solutions.  "Solutions" that are too much work or don't
support easy mail among strangers are irrelevant.  Recall the
telemarketing (non-)solutions that would be perfect, if only you could
force all of your callers to jump through hoops such as DTMF passwords.

Even if you do find a solution that meets the design goals, you can't
force the market to accept your solution.  Your new solution must be
enough better to make people change.  That is a very high barrier.

> > So how will anyonymous users who want anonymity for privacy 
> > send mail in this world.
>
> Currently, anonymous means "can't find a responsible party."
> That is unacceptable.  The way to achieve anonymity, as
> already suggested, is to work with a responsible third-party
> willing to assume responsibility.

No, almost all spam already has a responsible party that could be
found if only those responsible for keeping records would meet their
existing responsibilities.  No third parties are needed or could do
anything but make things worse.  All ISPs could know their customers.
Open relays and open proxies could be closed or have good logs.  ISPs
hosting spammers could know their customers.  Telephone companies
serving spammers that advertise only their telephone numbers know
their customers, the spammers.  Essentially no spam lacks a pointer
to the responsible party.  (Yes, I know about "joe jobs" as well as
some religious, political, and "kook" spam that lacks such pointers.)

On the other hand, no third party can guarantee anyone's identity at
a price that mail senders or recipeints could afford.  Verifying that
someone is who they say they are costs a lot more than the $350 that
Verisign charges for a certificate, as demonstrated by the Microsoft
certificate they issued.

Back on the first hand, in practice the credit card numbers used to
buy ISP services are good and sufficient proofs of identity.  If they
were not, then no Internet or any credit card commerce would be
possible, because there would be too much credit card fraud.

The only reason some (but not all!) ISPs don't know their customers
and don't exact penalities from spammers sufficent to deter almost all
spam is that it's cheaper or more profitable to support the spammers.

Vernon Schryver    vjs@rhyolite.com
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg