Re: Email web of trust - summary?

"Peter J. Holzer" <[email protected]> wrote:
> 1) There needs to be some concept of identity and a means for
>    establishing it. An identity could be an IP address, a domain name,
>    an email address, a PGP key. (with various levels of usefulness and
>    confidence)

  Identity is at least a domain name, validated somehow.

> 2) Scaling issues: The number of identities is huge. There are millions
>    of domain names and mail relays and vastly more email addresses.
> 
>    A web of trust is likely to be a scale-free graph, though.

  This sounds familiar...

>    (Incidentally, research on diseases suggests that diseases can be
>    fought most efficiently by vaccinating the hubs, which may also be
>    useful in fighting spam)

  Which, I recall, was a comment in one of my posts a few days ago.

>    Search results can also often be cached.

  Once cached, they can be validated trivially when the cache expires.

  e.g. "get updated record for path A-B-C-D" means you have the path,
and don't have to re-create it.  You've just got to validate it.  So
anyone who creates/maintains the path can synthesize the responses
validating a path.

> 3) Privacy issues:
>    Could be ameliorated by using domain names instead of email
>    addresses.

  There are 10^3 more email addresses than domain names.  Let's solve
one problem at a time.

> 4) How can the web of trust be secured from spammers?

  You don't.  You just mark them untrustworthy.

>    There will be rogue members of the network, and computers will be
>    hijacked. So spammers will get into the web of trust.

  Exactly.  We WANT them in the web of trust.  If they're outside of
the web of trust, we can't control them.


>    There will be rogue members of the network, and computers will be
>    hijacked. So spammers will get into the web of trust.

  Trust is gained by establishing a record of behaviour over time.

> 5) What is trust?
> 
>     It is not a binary value, but a continuum.
>     It is also not a scalar, but a vector.

  Agreed.

>     Trust changes over time. A newly created identity isn't trusted by
>     anybody and can gain trust over time. It can also lose trust if it
>     behaves in an unacceptable manner. The history of trust may be
>     relevant.

  A new domain can be quickly trusted if it's created by someone you
already trust.

  e.g. example.com registers example.net.  There should be little
trust difference between the two, if example.com publishes a 100%
trust in example.net.

  Alan DeKok.