Re: Email Web of Trust - Problem Statement

Jeff Silverman wrote:
> [snip]
>     Actually, I have what might be a better definition of SPAM.  SPAM is 
> any message with a successful response rate less than a certain 
> percentage rate, say 1% or 0.1%, unless the message was explicitly 
> agreed to by an opt-in mechanism.  One of the reasons why I like this 
> definition is because it forces the SPAMmer to receive messages.

I think the opt-in exception is problematic unless people start using 
digital signatures of the recipient to prove opt-in. On the other hand, we 
could redefine successful response rate in different ways.
Regardless, this is a useful way to think of spam, and definitely warrants 
further study. I wonder where this should idea be forwarded to?

>     You and I are human beings (or else you are a very, very good 
> implementation of the Turing test!) and whenever I send you an E-mail 
> message, you always send one back to me.  That's common courtesy, and 
> you are polite.  It is also a 100% response rate. But even if you 
> skipped a message or two or three, that would reduce the response rate 
> to 25%.  By way of contrast, nobody responds to SPAMmers, they have a 
> response rate of less than .1%.  E-mail is so cheap, they can continue 
> in business at that low rate.

This becomes a little bit problematic for mailing lists. However, it's not 
unreasonable to ask mailing lists to identify themselves some other way. A 
cryptographically secure List-Signature: header would be nice. A simple 
implementation would require a header that contained a monotonically 
increasing nonce value, incremented for each message the list distributes, 
and its signature with the list's or the list server's private key. I'll 
bring that idea up elsewhere.

>     The problem with my better definition of SPAM is that I don't know 
> how to measure it without trusting the SPAMmer, and that seems 
> impossible unless there is a trust third party.  I think we're in 
> agreement that trusted third parties are undesirable solutions, yes?

AFAICT, there would indeed have to be a trusted third party, but it 
certainly would not have to be the spammer. And there are steps that could 
be taken to minimize the trust placed in this third party. Most of the 
privacy issue can be eliminated by submitting something like the hash of the 
References header on every outgoing message, along with a hash of the 
sender's unique identifier. This is difficult, but not impossible, and I'm 
sure some more knowledgable mind can find a good solution.

>     Unfortunately, my comment isn't helpful other than to help describe 
> the problem.  Sorry.

Au contraire, this is quite helpful. Your suggested definition of spam (not 
capitalized, SPAM is a Hormel trademark) is a major contribution to the 
discourse, and deserves further attention.

Philip Miller