5 ms·

What would it take to rescue email? What would need to happen to make it less annoying for you?

by beders 4y ago

tjpnz 4y ago
I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.
- geoduck14 4y ago
  Ok. So. I'm not going to say that is a bad idea, but I will share a story. I used to work for a company that was the USPS's #1 or #2 customer (depending on the year). We spent a TON of money on spam. The biggest cost was the stamp. If people have to start paying for emails- it will eliminate a lot of the spam -but it won't eliminate all of the spam- and companies like the one I used to work for will start to shine.
  - JCharante 4y ago
    What if you are able to set your own fee, so before sending mail you lookup the difficulty level for the receiver. People can just keep raising the dificulty until they stop seeing spam.
  - yreg 4y ago
    People who deliver spam to my physical mail box IRL spend money on it and manage to fill it no problem. However, if they also had to pay me I would mind the spam a lot less.
- paddez 4y ago
  This was the concept behind HashCash, the concept behind BitCoin/Cryptocurrencies in general. The idea being that each email would do a non-trivial amount of work, such compute a valid hash - encode it in the message header. This message header can be checked quickly on receivers side, but takes time for the sender. This makes sending a large amount of email quickly infeasible without a significant amount of compute power. https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash
toast0 4y ago
Ban Microsoft and Google from email to start (they both control an awful lot of email but actively undermine its usefulness). Death penalty for spammers (maybe three strikes, or 300% of revenue from spam + audit costs if you want to be really nice). Corporal punishment for inappropriate reply-all. Refuse HTML email. Maybe some sort of nice and easy to use mailing list setups, so I can invite you to my family / friend / crazy internet people list, and I'll send a mail every once in a while and you can read about what's going on with your family / friends / crazy internet people in a nice text optimized way. I'd also love someone to make server side filters that operate on read email or email left in inbox for 30 days. I want my mail to sit in a big mixed pile of garbage when it's newish, but after a while, settle into a decent taxonomy.
dane-pgp 4y ago
Big email providers need to set a flag day after which they will drop all email from domains that don't have DKIM+SPF. Their servers also have to support TLS for sending and receiving mail. That's the easy half. Next, we need a stronger system of domain reputation. For this, we grandfather in all existing domain names, but any newly registered domains need to put up a bond for good behaviour. If one of the big email providers detects high levels of spam from the domain, they can slash the bond, but after a few years of good behaviour the bond is returned. Of course this gives a lot of unelected power to the big providers, but guess what, they already have that power, except they're using it for making their moat bigger, not for actually solving the problem. If this bond system used a public ledger, then smaller competitors would be able to see the reputation decisions that these big providers made, and crypto-currency would also be suitably international for a global system like email.
- wakeupcall 4y ago
  This is fully misguided. Did you ever maintain a mail server and/or check your spam? SPAM is for the vast majority SPF/DKIM/whatever compliant (in fact, my regular email has less DKIM signatures). The joke was always that SPAM was passing all these checks _earlier_ than real email systems. Why? SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. Add a new check? Well, sorry to break it to you, your spam is going to have it too. In fact, on the systems I manage, 70%+ of all spam is coming from gmail itself. People conflate SPF/DKIM/DMARC with spam checking.. they're not systems to prevent spam. They're intended to prevent forgery. Realistically, to protect from the dumbest forms of forgery (which is what spam initially was leveraging on), SPF is really all you need. If a spam email can leave a system configured with SPF, in practice it's already a problem with the organization that let that message out. No system is going to help you with such a problem, and so they're equally useless as spam filters.
  - Avamander 4y ago
    > This is fully misguided. It is not. There's still a significant amount of spam that doesn't have SPF, there's a lot of forgery and it's easier to filter if everyone used the holy trinity. > SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. That's what you see on and from gmail, but it's not the majority of spam.
dwallin 4y ago
Honestly I think email needs to be rethought from the ground up, just a whole new protocol with a killer app to get it going. Some of the most salient uses/qualities of email: - Asynchronous communication - Decentralized / Federated - Identity Issues: - Spam - Lack of room for the format to expand - Identification verification is hard My ideal replacement for email would look something like a decentralized/federated identity protocol with default whitelist for contact upon which you build out data formats for sharing. One key spam reduction technique in a federated system is to realize that most legitimate interactions are with people and services you are already in contact with so it’s better to make initial connections harder to improve the quality of daily use. Another tool that works decently in a decentralized system is introductions/vouching. Eg. you can ask mutual contacts to connect you or at larger scale you can entrust third party services to “vouch” for a user, similar to how certs work. If a vouching service does a poor job of vetting who it lets through than users will stop trusting it.
- Avamander 4y ago
  > Honestly I think email needs to be rethought from the ground up, just a whole new protocol with a killer app to get it going. That's why it hasn't and won't happen any time soon. > My ideal replacement for email would look something like a decentralized/federated identity protocol with default whitelist for contact upon which you build out data formats for sharing. Nobody stops you from implementing sender whitelists with email. > Another tool that works decently in a decentralized system is introductions/vouching. This idea boils down to PKI but that's far from perfect due to humans, not tech. We could already absolutely significantly increase mail trustworthiness if we'd use S/MIME en-masse. If postmasters aren't improving mail integrity, end-users could. A few EU countries have deployed certificates to people, but it hasn't reached critical mass to act as an indicator yet.
justsomehnguy 4y ago
Banning everyone who has a different RCPT TO: and To: would be enough.
- Avamander 4y ago
  This is intentionally allowed and very frequent. It's not a thing anyone could realistically change. However, one Microsoft's patent expires, we could enforce "SPFv3" on both.
  - justsomehnguy 4y ago
    I don't see where different RCPT/To should matter. Mailing list expansion happens on the mail server, not in the client.

What would it take to rescue email? What would need to happen to make it less annoying for you?

by beders 4y ago

What would it take to rescue email? What would need to happen to make it less annoying for you?

I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.

geoduck14 4y ago
Ok. So. I'm not going to say that is a bad idea, but I will share a story. I used to work for a company that was the USPS's #1 or #2 customer (depending on the year). We spent a TON of money on spam. The biggest cost was the stamp. If people have to start paying for emails- it will eliminate a lot of the spam -but it won't eliminate all of the spam- and companies like the one I used to work for will start to shine.
- JCharante 4y ago
  What if you are able to set your own fee, so before sending mail you lookup the difficulty level for the receiver. People can just keep raising the dificulty until they stop seeing spam.
- yreg 4y ago
  People who deliver spam to my physical mail box IRL spend money on it and manage to fill it no problem. However, if they also had to pay me I would mind the spam a lot less.
paddez 4y ago
This was the concept behind HashCash, the concept behind BitCoin/Cryptocurrencies in general. The idea being that each email would do a non-trivial amount of work, such compute a valid hash - encode it in the message header. This message header can be checked quickly on receivers side, but takes time for the sender. This makes sending a large amount of email quickly infeasible without a significant amount of compute power. https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash

toast0 4y ago

Ban Microsoft and Google from email to start (they both control an awful lot of email but actively undermine its usefulness). Death penalty for spammers (maybe three strikes, or 300% of revenue from spam + audit costs if you want to be really nice). Corporal punishment for inappropriate reply-all. Refuse HTML email. Maybe some sort of nice and easy to use mailing list setups, so I can invite you to my family / friend / crazy internet people list, and I'll send a mail every once in a while and you can read about what's going on with your family / friends / crazy internet people in a nice text optimized way. I'd also love someone to make server side filters that operate on read email or email left in inbox for 30 days. I want my mail to sit in a big mixed pile of garbage when it's newish, but after a while, settle into a decent taxonomy.

dane-pgp 4y ago

Big email providers need to set a flag day after which they will drop all email from domains that don't have DKIM+SPF. Their servers also have to support TLS for sending and receiving mail. That's the easy half. Next, we need a stronger system of domain reputation. For this, we grandfather in all existing domain names, but any newly registered domains need to put up a bond for good behaviour. If one of the big email providers detects high levels of spam from the domain, they can slash the bond, but after a few years of good behaviour the bond is returned. Of course this gives a lot of unelected power to the big providers, but guess what, they already have that power, except they're using it for making their moat bigger, not for actually solving the problem. If this bond system used a public ledger, then smaller competitors would be able to see the reputation decisions that these big providers made, and crypto-currency would also be suitably international for a global system like email.

wakeupcall 4y ago
This is fully misguided. Did you ever maintain a mail server and/or check your spam? SPAM is for the vast majority SPF/DKIM/whatever compliant (in fact, my regular email has less DKIM signatures). The joke was always that SPAM was passing all these checks _earlier_ than real email systems. Why? SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. Add a new check? Well, sorry to break it to you, your spam is going to have it too. In fact, on the systems I manage, 70%+ of all spam is coming from gmail itself. People conflate SPF/DKIM/DMARC with spam checking.. they're not systems to prevent spam. They're intended to prevent forgery. Realistically, to protect from the dumbest forms of forgery (which is what spam initially was leveraging on), SPF is really all you need. If a spam email can leave a system configured with SPF, in practice it's already a problem with the organization that let that message out. No system is going to help you with such a problem, and so they're equally useless as spam filters.
- Avamander 4y ago
  > This is fully misguided. It is not. There's still a significant amount of spam that doesn't have SPF, there's a lot of forgery and it's easier to filter if everyone used the holy trinity. > SPAM is mostly sent through illegitimately acquired accounts on big-brand servers now. That's what you see on and from gmail, but it's not the majority of spam.

dwallin 4y ago

Honestly I think email needs to be rethought from the ground up, just a whole new protocol with a killer app to get it going. Some of the most salient uses/qualities of email: - Asynchronous communication - Decentralized / Federated - Identity Issues: - Spam - Lack of room for the format to expand - Identification verification is hard My ideal replacement for email would look something like a decentralized/federated identity protocol with default whitelist for contact upon which you build out data formats for sharing. One key spam reduction technique in a federated system is to realize that most legitimate interactions are with people and services you are already in contact with so it’s better to make initial connections harder to improve the quality of daily use. Another tool that works decently in a decentralized system is introductions/vouching. Eg. you can ask mutual contacts to connect you or at larger scale you can entrust third party services to “vouch” for a user, similar to how certs work. If a vouching service does a poor job of vetting who it lets through than users will stop trusting it.

Avamander 4y ago
> Honestly I think email needs to be rethought from the ground up, just a whole new protocol with a killer app to get it going. That's why it hasn't and won't happen any time soon. > My ideal replacement for email would look something like a decentralized/federated identity protocol with default whitelist for contact upon which you build out data formats for sharing. Nobody stops you from implementing sender whitelists with email. > Another tool that works decently in a decentralized system is introductions/vouching. This idea boils down to PKI but that's far from perfect due to humans, not tech. We could already absolutely significantly increase mail trustworthiness if we'd use S/MIME en-masse. If postmasters aren't improving mail integrity, end-users could. A few EU countries have deployed certificates to people, but it hasn't reached critical mass to act as an indicator yet.

justsomehnguy 4y ago

Banning everyone who has a different RCPT TO: and To: would be enough.

Avamander 4y ago
This is intentionally allowed and very frequent. It's not a thing anyone could realistically change. However, one Microsoft's patent expires, we could enforce "SPFv3" on both.
- justsomehnguy 4y ago
  I don't see where different RCPT/To should matter. Mailing list expansion happens on the mail server, not in the client.