Re: Email Web of Trust - Problem Statement

Mark Baugher <[email protected]> wrote:
> > Spam is whatever a domain decides is spam.
> 
> I could be missing something here, but "web of trust" to me means that a 
> collection of principals have decided to trust each other to some degree 
> for some specific access or authorization to some resource.  So I don't 
> understand your response.  One principal that speaks for a particular 
> domain might have its own definition, but where does the web come into play?

  While everyone has their own definition, they can publish *some*
information for others to use.

  e.g. "I, as example.com, believe that 90% of the mail from
example.net is spam".

  Someone else doesn't know how example.com makes that decision, and
they don't care.  They CAN determine that if a message was handed
from example.net, to them, through example.com, that there is a 90%
probability it would be marked as spam.

  The web comes into play when you start finding multiple paths
between people.  Different paths have different levels of trust, and
you can choose which path to believe.

> I think I'm missing something.  Is the "web" the chain of persons 
> (relays?), specifically, or is it more general, such as a web of mail 
> operators that trust each others authorization decisions?

  The web is the "set of chains of people".

  I connect to N people.  Each of those people connect to M others.
Draw the connection diagrams, and you have a web.  Walk the web from
one person to another, and you have a chain of trust.

  The walking process doesn't have to include SMTP.  That is, the
message doesn't have to actually be delivered through the web of
trust.  All we're interested in is a theoretical question: If it WAS
delivered that way, how would it be treated?

  Alan DeKok.