- cypherpunks-legacy - lists.cpunks.org

Re: Hardening lists against spam attacks
by Hal Finney 17 Dec '03

17 Dec '03

From: "Mark M." <markm(a)voicenet.com> > On Tue, 31 Dec 1996, Igor Chudov @ home wrote: > > > Send a number of unique tokens to each subscriber each day. > [...] > > If tokens are used improperly (to post off-topic materials) the > > offending subscriber is denied any further tokens. > > > > The problem of this scheme is (besides its cost) that anonymous users > > will not be truly anonymous. > > I think this problem can be solved by blind signing the tokens. A user > generates a random number, multiplies it by the blinding factor, then sending > it to a token server which would append a timestamp and sign the blinded > token. All signature requests should be signed with a PGP key. The server > response would be encrypted with the user's public key. A person's PGP key > would be sent along with the subscription request and then saved by the list > software. This is an interesting idea, however it will be possible for someone with a respectable public persona to continue getting tokens indefinately for posting abusive anonymous messages. There is no way to link the anonymous tokens with the ones which were issued to good subscribers. An alternative is to give each subscriber only a small, fixed number of blinded tokens which he will use for the lifetime of his subscription to the list. When someone posts anonymously, they use up one of their tokens. Then, if the message was not abusive, a new blinded token is created, encrypted with the public key of the good-guy anonymous poster, and broadcast to subscribers. This way good anonymous posters will get to keep posting, while abusive ones will shortly run out of anonymous posting tokens. The big problem with schemes like this is the difficulty of defining "good" posts in an acceptable way. Some list members are hard-line freedom-of-speechers and don't want to see any limitations on list postings. Others would probably classify 80% of the messages on the list at times as grounds for termination of posting privileges. Everyone will have their own thresholds. There is also the administrative problem of who will judge the posts. This could take a large commitment of time. I'm sure many of us have gotten behind in our list reading from time to time and it can be intimidating to return from a trip to find hundreds of messages waiting. Imagine how it would be if you were supposed to be reading them and looking for bad messages. We might also want to consider the paradoxical possibility that if we remove the junk, the list will die! At least now we are constantly reminded that the cypherpunks list exists. Other lists like the cryptography and coderpunks can sometimes go for quite a while without any posts at all. On CP you have the sense of a dynamic community where you can hope for a response to your posts, more so than on a list which is silent for days at a time. Hal

5 4

Zippy, anonymously
by Adam Shostack 17 Dec '03

17 Dec '03

http://www.metahtml.com/apps/zippy/welcome.mhtml Let Zippy provide you with web service. Chaining through the anonymizer works, too. :) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Hardening lists against spam attacks
by Douglas Barnes 17 Dec '03

17 Dec '03

The problem with payment schemes like this is that they're hard to rationalize (as Lucky points out here). A direct mail piece (via snail mail) can easily cost the sender more than a dollar when all costs are taken into account. This does not seem to have appreciably slowed down junk mailers IRL. Spam to a large mailing list has a multiplicative effect (although it's also easier to throw out and/or ignore.) Certainly if someone had a real product, it would be worth anywhere from $1 to $25 to post an advertisement to a sizeable mailing list. On the other hand, a blanket charge would serve as a disincentive to people who make valuable contributions, unless it were a completely negligible cost, in which case the advertisers would have no problem coughing up the money. There's a serious imbalance between how annoying spam is and how much we're willing to pay to post (most of us would like to see them charged to the point where they wouldn't do it at all.) Possibly a system of charging for non-list-members? Sort of a closed list with a way for outside posters to contribute if they really wanted to? In general it seems very difficult to balance the various aspects of maintaining a lively discussion, fostering a sense of community, allowing anonymous postings, and keeping the whole thing simple enough to actually implement. The best approach I can think of for dealing with a lot of this crap is to a) ignore outright spam, b) do not feed the energy creatures (the people on the list who thrive on conflict.) and c) instead of responding to noise, contribute to signal. I've been on the verge of responding to certain posters over the last few months, and I've realized before I've hit the "send" key that I'd be giving them just what they want -- attention -- while further degrading the signal to noise ratio. At 11:47 AM 12/31/96 -0800, you wrote: >At 10:25 AM 12/31/96 -0800, Peter Hendrickson wrote: >>The easiest and fastest solution is to set up toad.com to charge a >>dollar per message. (Proceeds to be spent by John Gilmore as he >>sees fit.) >> >>We can then leverage off the existing e-cash infrastructure which >>already provides blinding software for free on all major platforms. > >I am not sure that this proposal would work. Some of the spammers on this >list are rather dedicated. They might gladly pay a dollar per message. > > > >-- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred > Make your mark in the history of mathematics. Use the spare cycles of > your PC/PPC/UNIX box to help find a new prime. > http://www.mersenne.org/prime.htm >

1 0

Re: Hardening lists against spam attacks
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:01 PM 12/31/1996, Z.B. wrote: >On Tue, 31 Dec 1996, Dale Thorn wrote: >> ...I will *not* install and run PGP. > I agree with Dale here...requiring PGP in order to post would probably > deter low-level, idiot spammers, but it would also keep those people off > the list who, for one reason or another, don't like/want/use PGP. People who don't like using PGP, or can't use it, or won't use it, do not belong on this list. > Also, what about people who post to and read the list from someplace other > than their home computer, like school or work? I have access to this account > from my college, but I'm sure not going to leave my keys lying around > my account just so I can post to a mailing list. Easy. Keep a copy of PGP there and a copy of the list public key. It's okay to leave public keys lying around. I might add that this is not "just a mailing list." It is the Cypherpunks mailing list. It's worth a little trouble. If you don't agree, find a list which is. Peter Hendrickson ph(a)netcom.com

4 6

Anonymous Post Control
by ph＠netcom.com 17 Dec '03

17 Dec '03

It's hard to filter anonymous posters. I want to see what a few of them have to say so I can't filter on the remailers. If anonymous posters PGP sign their posts, it is still hard to filter using a lame filter software such as that which comes to Eudora. It would be nice if toad.com would verify signatures and insert a header into the messages with the PGP User Id of every poster. Then it would be very easy for many people to filter the messages using widely available off-the-shelf mail software. (I volunteer to adapt majordomo for this task if it seems like a good idea.) Peter Hendrickson ph(a)netcom.com

4 3

Re: Hardening lists against spam attacks
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 2:04 PM 12/31/1996, Douglas Barnes wrote: > The problem with payment schemes like this is that they're hard > to rationalize (as Lucky points out here). > A direct mail piece (via snail mail) can easily cost the sender > more than a dollar when all costs are taken into account. This > does not seem to have appreciably slowed down junk mailers IRL. > Spam to a large mailing list has a multiplicative effect (although > it's also easier to throw out and/or ignore.) Certainly if someone > had a real product, it would be worth anywhere from $1 to $25 to > post an advertisement to a sizeable mailing list. > On the other hand, a blanket charge would serve as a disincentive > to people who make valuable contributions, unless it were a > completely negligible cost, in which case the advertisers would > have no problem coughing up the money. There's a serious imbalance > between how annoying spam is and how much we're willing to pay > to post (most of us would like to see them charged to the point > where they wouldn't do it at all.) It won't be worthwhile for a year or two for spam artists to go to the trouble of figuring out how to do this. I'm not sure I have a good solution to this problem in the long term, however. If our custom was to send money to people who make good posts, then you could imagine the fee being quite high, say $20, since most of the money will be made back. Voila! We have a wonderful feedback system for how much contribution we have made. People who want to make sure that they are putting in at least as much as they take out can make a little rule for themselves: I won't take money out of my cypherpunks e-cash account. I will only send it to other people for their good posts. In effect, this is a fully distributed tokening system without the choke point of a single token administrator. > In general it seems very difficult to balance the various aspects > of maintaining a lively discussion, fostering a sense of community, > allowing anonymous postings, and keeping the whole thing simple > enough to actually implement. I agree that we should keep it sweet and simple. That's one nice aspect of the e-cash scheme. All the software is already out there, except (maybe) the majordomo part which I have volunteered to do. Keep in mind that if the list brings in, say, $1000/month that buys a lot of food. I have to think that this will liven up the monthly meetings and create many positive and lasting relationships. > I've been on the verge of responding to certain posters over the last > few months, and I've realized before I've hit the "send" key that > I'd be giving them just what they want -- attention -- while further > degrading the signal to noise ratio. This is exactly the sort of process which is facilitated by paying a dollar. In your case it won't make a difference, but most people will find their presence on the list becomes much more responsible when they have to put up a buck. Peter Hendrickson ph(a)netcom.com

2 1

Re: Hardening lists against spam attacks
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 2:32 PM 12/31/1996, Timothy C. May wrote: >At 1:04 PM -0800 12/31/96, Peter Hendrickson wrote: >>At 11:47 AM 12/31/1996, Lucky Green wrote: >>>At 10:25 AM 12/31/96 -0800, Peter Hendrickson wrote: >>>> The easiest and fastest solution is to set up toad.com to charge a >>>> dollar per message. (Proceeds to be spent by John Gilmore as he >>>> sees fit.) >>>> We can then leverage off the existing e-cash infrastructure which >>>> already provides blinding software for free on all major platforms. >>> I am not sure that this proposal would work. Some of the spammers on this >>> list are rather dedicated. They might gladly pay a dollar per message. >> Let's try it and see how it goes. If it doesn't work, we can try >> a more complicated scheme. (I volunteer to modify Majordomo to >> make this happen. We could have this feature in the near future.) > "Let's try it and see how it goes" is often a dangerous step. It could kill > the list as we know it; exactly what fraction of current subscribers do you > think will arrange for digital cash accounts, will arrange their mailing > software to use this, will bother with PGP, etc.? It's not always bad to take a few chances. I've noticed that there is a lot of negativity in the cypherpunks scene. (I am not without sin in this department. ;-) It would be more exciting to try out a few ideas. I would much rather be trying lots of things and throwing out the bad ones. This should lead to better technology. This not only benefits the cypherpunks list, it benefits everybody using the Net, which is (I think) one of our goals. It short circuits poorly intentioned authoritarian schemes to dictate what may or may not be sent to a mailing list. (For example, people often propose to make spam illegal. Most readers of this list will recognize the camel's nose.) > Now maybe this is a Good Thing, to drive out the slackers and those without > good tools integrating PGP into their mailers, etc., but maybe it is not a > Good Thing. It could be a mistake, but I think the only way we will find out is to try it. Unlike the interesting token scheme, this is easy to deploy and it doesn't provide an insurmountable barrier to dissent. You can still put up a dollar to say "This is a drag! Let's get rid of it!" But if your token gets pulled by an abusive token administrator, it's harder to get the word out. (Not impossible, though.) Keep in mind that the worst case is that people will have to ask their e-cash endowed friends for a few ASCII tokens to prepend to their posts to the list. That is not very tough to arrange. >> I have seen a lot of complaints about "too much noise". That is >> not a problem. The problem is too little signal. I can extract >> the signal - unless it isn't there. > My sentiments exactly. But I fail to see how collecting a dollar per post, > or whatever the fee is ultimately set at, increases the number of good > posts (not the percentage, the S/N, the _number_, which is what we both > agree is the important thing). > Explanation? One thing it does for sure is to eliminate attacks where somebody sends thousands of messages to toad.com and overloads its capacity to forward them. It also means that bigger faster hardware can be purchased if the load gets too high, or to compensate somebody to wrangle majordomo. I suspect it will also promote high quality posting. Certainly, "me too" posts and "unsubscrive" posts will be greatly attenuated. And, people who post reams of drivel and invective can only do so at the expense of financing the monthly cypherpunks food bash. This doesn't mean they will stop, but it does mean that we can chown down on hundreds of pounds of guacamole at their expense. As for other people, I think if it isn't worth a dollar to you to post a message, it probably isn't worth it for the rest of us to read it. Without any real evidence, my feeling is that if somebody has to pay a dollar to post a message, they will give it more thought and write it more carefully. This is sort of like expecting children to use proper grammar, forms, and excellent handwriting in preparing a report. The result is that greater care and thought is devoted to the ideas in the report itself. I don't believe that people making valuable contributions have any trouble at all coughing up a dollar to do so. Very few people post more than 10 messages a month. $10/month isn't much of a burden. If this does turn out to be a problem, when readers see a post they like they should send the person a buck to encourage more good work. This is a very effective way of saying "I really enjoyed what you had to say." And, nothing stops frequent posters from asking for money on the list to continue their fine work. In a sense, this is a fully abstracted version of the token scheme. Peter Hendrickson ph(a)netcom.com

3 2

Who is the first new web page of 1997?!
by factnet＠rmii.com 17 Dec '03

17 Dec '03

Announcing the healthy birth of a bouncing new web page on January 1, 1997 at 12:00 a.m.: FACTNet International Digest, a non-profit Internet digest, news service, library, dialogue center, and archive dedicated to the promotion and defense of global free thought, free speech, and privacy rights. Please come visit and help spin the guest counter at: ********************************** ** http://www.factnet.org ** ********************************** If you would like to subscribe to our free FACTNews newsletter and you cannot access the web, or your browser does not support forms, send e-mail to: facnet(a)rmii.com With a subject line that reads: subscribe-FACTNews =========================================== Happy New Year from the FACTNet staff!

1 0

Bulk Mailing Software
by Jorge Hernandez 17 Dec '03

17 Dec '03

Mailloop is bulk mailing software that will revolutionize how people advertise on the internet. See what all the fuss is about: http://www.mailloop.com

2 1

test
by Success＠midlex.com 17 Dec '03

17 Dec '03

All Aboard!! The CD EXPRESS!! One time $50 US purchase Can earn you $500 a day !! World Wide Opportunity! - CD's/CD Rom network - Everyone Loves music - Never have to Purchase another CD - Explosive New Home-Based Business - Debt Free Company The Excitement Has Begun !! Position Yourself NOW! Call: Bill Marple (9am-9pm EST US) Phone: 704-846-8299 Reference Number: INTERNET

1 0