Re: Email Web of Trust - Problem Statement

Your explanation seems to roughly correspond with John Levine's web 
page.  I have a few more questions.

1. Has the group considered supporting a common policy as a basis for the 
web?  Otherwise, there needs to be some language to represent a particular 
member's policy.  Member A rates mail according to criteria x, y, z while 
Member B uses v, w, x.  This seems intractable to me.  I can almost hear 
the argument that it would be too difficult to define such a common policy, 
but any entity that rates mail is implementing a policy.  There might be 
multiple webs based on distinct policies for characterizing mail.

2. Why not focus on mail operators as members of the web of trust rather 
than users since there are far fewer (millions rather than billions?) of 
operators than users, and it is the operators that can most reliably 
support such a thing.

3. How is the web of trust realized cryptographically?  Or is it?

Mark


At 01:54 PM 3/9/2004, Alan DeKok wrote:
>Mark Baugher <[email protected]> wrote:
> > > Spam is whatever a domain decides is spam.
> >
> > I could be missing something here, but "web of trust" to me means that a
> > collection of principals have decided to trust each other to some degree
> > for some specific access or authorization to some resource.  So I don't
> > understand your response.  One principal that speaks for a particular
> > domain might have its own definition, but where does the web come into 
> play?
>
>   While everyone has their own definition, they can publish *some*
>information for others to use.
>
>   e.g. "I, as example.com, believe that 90% of the mail from
>example.net is spam".
>
>   Someone else doesn't know how example.com makes that decision, and
>they don't care.  They CAN determine that if a message was handed
>from example.net, to them, through example.com, that there is a 90%
>probability it would be marked as spam.
>
>   The web comes into play when you start finding multiple paths
>between people.  Different paths have different levels of trust, and
>you can choose which path to believe.
>
> > I think I'm missing something.  Is the "web" the chain of persons
> > (relays?), specifically, or is it more general, such as a web of mail
> > operators that trust each others authorization decisions?
>
>   The web is the "set of chains of people".
>
>   I connect to N people.  Each of those people connect to M others.
>Draw the connection diagrams, and you have a web.  Walk the web from
>one person to another, and you have a chain of trust.
>
>   The walking process doesn't have to include SMTP.  That is, the
>message doesn't have to actually be delivered through the web of
>trust.  All we're interested in is a theoretical question: If it WAS
>delivered that way, how would it be treated?
>
>   Alan DeKok.