Ray points to a law case in America where spam blockers knocked out an important notification. This caused the lawyer to miss the court date, and expose the case to sanctions - which would have involved dismissal of the case. My own spam blockers quietly ate the single ticketing notification from an airline recently. Luckily we had a few weeks in which to sort out the mess. If it had been a few days, I would have been grounded!
This may mark an apogee for email. We all recall those stories about how email was used to achieve some wonderful purpose: re-unite families, serve summons, deliver real signed documents and so forth. Happy days when our net continued to change our world for better.
Now we'll hear the monster stories of the email that got ate by the spam blockers. Every one of us will have to go through that gut-dropping feeling of experiencing the missed opportunity, the missed deadline, the missed meeting, the lost job. We will learn that email is no longer reliable enough to be the mainstay of communication.
From a protocol engineering point of view, email is still reliable. But from a (total) systems point of view, there are now often several spam blockers competing to see which can do the most damage to the onslaught of enemy spam. We are now happy to break the reliability built into email if we can reduce our spam load. In statistics terms, we are happy to accept a few false negatives; My own thunderbird is zotting about 70% of spam, and for the price of cleaning out the rest, I can read the maybe 10 emails collected overnight.
How we respond in the total systems sense is two-fold: firstly, we go back to the old method of layering a reliable protocol over email. That means, when the important email is sent, it is followed by a phone call. "Did you get the email?" won't sound so stupid anymore. Secondly, we go back to the old technique of using multiple means of communication. Strength in diversity, and well equiped netizens now run several different instant messaging clients concurrently.
As I've written elsewhere, email's achilles heel is its ubiquity and standardisation. We are entering a phase of the Internet where both lose their appeal, and again, the human enters the loop as the ultimate layer of reliability.
Posted by iang at February 25, 2005 08:36 AM | TrackBackIf I had the time I'd start something I'd call the "signed mail initiative" -- participants send only PGP signed mail, and prefer (in mail filters etc.) to receive signed mail. They'd use a standard sig line letting people know this policy, and directing them to information on how to "join" the initiative, guidelines for corporate and ISP participation, etc.
Regardless of whether the signatures are in the strong set, are trusted, or even known, this will help to both detect and reduce SPAM: the act of signing is itself compute-intensive enough to act as a small postage charge; each unique message will have to be signed; SPAMers will want to send fewer unique messages; this will help collaborative filters detect SPAM again; eventually any unsigned mail will become suspect in the first place.
As both participants and SPAMmers become more sophisticated, participants and their MUAs can prefer longer key-lengths, better signature chains, etc. This promises a wonderful arms-race of hardware and crypto escalations, but at least that will be better than the indefensible position which mail users are in right now.
Posted by: Steve Traugott at February 25, 2005 05:34 PMThat *might* work .. but you might be surprised at the results - spammers are intelligent and they can do things like harness 1000's of stolen machines for creating signed messages.
If you were to do that, I'd suggest you pick an algorithm that was very easy to check, as you will want your filter to dispose of falsely signed emails. One way to do this is to simply put a work factor in your email sig; something like "I want signed mail where the first 8 bits of the hash are 0" ...
Posted by: Iang at February 25, 2005 06:18 PM