On Thu, 21 Jun 2001, Richard Erlacher wrote: What we really need is a law that says anyone caught spamming will be fined $10,000 per message sent. Then wait for the first sucker to get caught, make an extreme example out of the asshole, repeat a few times, and that's that. Problem solved. Sellam Ismail Vintage Computer Festival ------------------------------------------------------------------------------ International Man of Intrigue and Danger http://www.vintage.org

On Thu, 21 Jun 2001, Richard Erlacher wrote: All it takes is a handful, and the rest will get the message. These guys are selling a product, they gotta be able to be contacted somehow. The net effect is that they will be so driven underground to avoid capture that the cost of doing business, and their ability to do business, will be greatly diminished. An interesting example of spam I got today has no domain name, just an IP address (to avoid having to register). You go to their website, and there is a form for you to fill out with your name, address, etc. These fools can still be found. Just fill in the form, wait for them to contact you, pretend to be a customer, gain their trust, get an address, arrest, prosecute, fine, throw in jail, butt-rape, done. Sellam Ismail Vintage Computer Festival ------------------------------------------------------------------------------ International Man of Intrigue and Danger http://www.vintage.org

On Thu, 21 Jun 2001, Richard Erlacher wrote: [spammers] Perhaps what's needed is a giant spammer trap: organize a trade show for them: a large tent placed over over the mouth of a volcano. "Step right this way folks, lots of hot ideas for the anonymous sending of e-mail inside..." -- Copyright (C) 2001 R. D. Davis The difference between humans & other animals: All Rights Reserved an unnatural belief that we're above Nature & rdd(a)perqlogic.com 410-744-4900 her other creatures, using dogma to justify such http://www.perqlogic.com beliefs and to justify much human cruelty.

But we don't have an Internet Caller ID -- we just have a reverse DNS lookup and identd, and that last is so easy to spoof ... In fact, stockholm has a fake identd running that answers 'nobody' to every query, just as an object example, to satisfy stupid services that insist the other side be running some sort of ident. Besides, the reverse DNS lookup doesn't help much with the mega-scale spammers who operate on six billion throwaway accounts. The Amazing Mailhole, which I wrote and use here, makes people authenticate to get mail through the public E-mail address I expose, but spammers still send mail to it anyway (it's just ignored) and people usually ignore the instructions and I never see the mail until days later when I'm cleaning out the spam folder where the Mailhole has routed all the unauthenticated messages. There's no good solution for this other than legal action. After all, I want my cut of the hard disk here and CPU time and electricity and network spent handling mailing lists I didn't subscribe to and can't get off of. Surely I can sue them for that. (I'm only *half* kidding.) -- ----------------------------- personal page: http://www.armory.com/~spectre/ -- Cameron Kaiser, Point Loma Nazarene University * ckaiser(a)stockholm.ptloma.edu -- You're never too old to become younger. -- Mae West ------------------------

Actually, the core of the internet is quite under-utilized. The problem is that fighting fire with fire isn't the right approach. IF we all had, for example, authentication tokens that were cryptographically secure and were required for signing any piece of outgoing email, then this problem would disappear overnight (that is, legit email will be signed and verifiable as to the sender, and everything else would be considered spam. I consider lack of authentication as the biggest oversight in the original design of the Internet.) -Mike On Thu, 21 Jun 2001, Richard Erlacher wrote:

And how hard do you suppose it would be for someone to make it LOOK extremely like an innocent person was spamming? What allows spam to happen is that most users pay the costs of all incoming mail, and spammers pay little of the cost of sending it. Turn that around, so that the bulk of internet support costs come from charges related to bytes sent, and spam becomes MUCH less attractive. I don't see spam as a long term problem though.

That's absolutely correct! It's tough finding a solution that works at all, and finding one that works correctly will be VERY difficult. Ultimately, the only fair way to bill for internet use, above and beyond the basics of providing the connection, will be on the basis of bandwidth used. SPAM ultimately will have to be traceable because nobody will want to pay for unsolicited mail. SPAM is a nuissance, but it's not any worse than the 450KB cutesey greeting card that grandma sends to all her grandchildren, and the cute or funny cartoon that gets sent to everybody in your address book because you think it's so funny. I frequently exhort my friends/relatives not to do that sort of thing because of the bandwidth cost. SPAMmers got smart early on in the "internet revolution" in that they knew that it would ultimately come down to a cost per bit. They use email because their local server doesn't have to send an individual mail to each addressee. The router to which it is sent by his local host does that, and, in fact, it's possible to have a router downstream of that one do the dirty work. They know that it will eventually come down to the cost per bit, so they set things up to have someone else pay that cost. That's what I view as wrong. WE are the ones who pay for SPAM, and WE are not the ones who want it that way. Perhaps rewriting the email protocols can fix that, but the place it has to be worked out is in the IP/ICMP pair, among others, and in the TCP/UDP pair. Tracking the actual bandwidth used by a SPAMmed message probably will involve tunnelling protocols, which are normally avoided in order to preserve the layered architecture. My own experience with SPAM has shown me that even the application layer doesn't generally become aware of the actual source of the mass-mailing. Nevertheless, the challenge is to find that source and pass the cost back to him. It's not a priority today, because we're not charged by the bit. People are charged for bandwidth usage in some countries, however, so it's just a matter of time. Dick ----- Original Message ----- From: "John Foust" <jfoust(a)threedee.com> To: <classiccmp(a)classiccmp.org> Sent: Friday, June 22, 2001 7:29 AM Subject: Re: Wave of the Future (Spam)

Point taken, but most folks here in the U.S. either have unlimited accounts (typically costing $12-$20 monthly, and the extra bandwidth is transparent to them. Here in the U.S. is where the battle will be fought, though, and it's here, where complacency reigns, that the SPAMmers have the best chance of getting by, since everybody worries about what's easy, and almost nobody cares about what's right. Dick ----- Original Message ----- From: "Iggy Drougge" &lt;optimus(a)canit.se&gt; To: "Richard Erlacher" &lt;classiccmp(a)classiccmp.org&gt; Sent: Saturday, June 23, 2001 12:14 AM Subject: Re: Wave of the Future (Spam) <snip>

It seems to me that it is unwise to ignore what the largest single society associated with the problem under scrutiny does, and why they do it, or at leasty why they may do it. Paying for hookup time is a sad reality, the result of which is that each bit of email is paid for twice. It's my understanding that hookup time is what's metered in Germany, though I don't know what unit is metered in Sweden. I can assure you, if the folks who send you junk email from outside your country had to pay as the ones sending you the junk snail-mail do. If folks who detest nuissance mail as I do, all united their energies and talents, it's likely someone, somewhere, would come up with the right combination of ideas to make it possible to charge every bit of bandwidth back to the individual SPAMmer who sent it, irrespective of where the multiple destinations were applied, at a rate proportional to the $20 per month I mentioned before for the 168-hour week, which is approximately 1.0901E-9 cents per bit, there'd be no more SPAM from outside your own regional economy at all. I think the traffic sent about via SMTP and received via POP, or whatever other protocols can be used for moving email around, should be paid for by the sender. more comments below ... Dick ----- Original Message ----- From: "Iggy Drougge" &lt;optimus(a)canit.se&gt; To: "Richard Erlacher" &lt;classiccmp(a)classiccmp.org&gt; Sent: Sunday, June 24, 2001 12:00 AM Subject: Re: Wave of the Future (Spam) <snip> I find the foreign-character-set-stuff even more annoying than the stuff I can read. I do, however, read the junk snail-mail, for the very reason you spelled out, namely that there might be a good by on chicken or fresh produce in the ad's. That's not as likely in an ad I receive in Cyrillic alphabet. I certainly wish they worked here in the U.S. Even a "no solicitors" sign on the door won't stop the door-to-door sales people. My connection purportedly runs at 512Kbps ... I don't even then like the delays associated with those unsolicited pictorial advertisments. I don't send 'em either, and, I suspect, if I had to pay for the bits I send as mail, I'd probably snip a lot more out of my replies than I presently do.

I do a lot of posting, usenet etc. and I always use my real name and my email ID is my real name, and I never do anything to hide my email address. Maybe 10% of my email is unwanted junk, split about half and half between spam and web site junk where I failed to say no after visiting. Spam is so far from my problem list it isn't even funny. My sincere guess is that the solution to spam will be more of a PITA than spam.

On Fri, 22 Jun 2001, Mike Ford wrote: Perhaps the reason you have so little spam is because your friend left you off of his target list. I think that that was literally what Sellam had in mind for spammers.