Hacker News Reader

Comment by cm2187 | Hacker News Reader

The problem is not so much the attitude of the big guys. It is that smtp is fundamentally broken. we need a better mail protocol that ensures: 1. Traffic always encrypted and content always signed 2. Guarantee that the sender is who it claims he is 3. Decorrelating the email from the domain, a lot of users are prisoners of their current provider just because the address they gave everyone ends with the provider's domain name, very much like it is very hard to switch bank accounts 4. Ability to provide disposable adresses which can be deleted when spammed

3 and 4 would require a sort of token system

View on HN

> It is that smtp is fundamentally broken.

Because the SMTP cabal is fanatically opposed to changing it.

The response I had 15 years ago was "It takes 10 years to deploy any serious changes to a protocol".

Uh... so? Does that mean we shouldn't do it?

Apparently, yes. 15 years later, there have been no substantive changes to SMTP.

Repeat after me, SMTP is perfect. It's perfect! Well, there are a few known issues. But it's deployed! It's too hard to change. You're trying to change it? You're a terrible person who doesn't understand SMTP.

I got that for 5 years before giving up and going to more productive lines of work.

Changing SMTP would create a lot of interoperability problems. I agree with this. This is why I concluded that we need a new protocol that solves the problem of SMTP. If it's good it will take over SMTP's market share. That's the way to go. It's like IMAP taking over market share of POP, ...

It's been some years now that I'm thinking on this messaging and spamming problem. It is not a protocol or technical issue. The problem is the abuse of the communication system by spammer.

The worst is that people have to hide their contact address or use semi private messaging systems. This is totally contradictory to the evolution of the communication systems. We have smartphones and can't reliably send a message to any body in the world ? Internet is lacking a solution for that.

> Decorrelating the email from the domain, a lot of users are prisoners of their current provider just because the address they gave everyone ends with the provider's domain name, very much like it is very hard to switch bank accounts

This one seems completely uninteresting in a world in which $15/year can get you your own domain name, complete with reliable email servers, IMAP, and as many email aliases as you like at that domain. Given that, why create an entire infrastructure to "decouple" email addresses from domains?

Each individual using a GUID as domain name and another GUID as username for each correspondant is probably the solution. I am not suggesting it will require some fundamental changes. But the one thing that would never work is having to ask users to mess with MX entries themselves. So it take some infrastructure change somehow.

That being said my suggestion doesn't work from a privacy point of view as the domain GUID would become a tatoo and it wouldn't take long for directories mapping GUID to real identities to appear.

Anyone can sign up with a provider and become "prisoner" but not everyone knows how to get out of it. How can you even compare the complexity of someone signing up for Internet service and getting foobar@att.net for free, and then later having to somehow figure out to pay $15 to set up another domain with E-mail to replace it?

That's $15 a year that some people can't, won't or haven't paid before. If someone decides later on that they wish to do so, they have to set up forwarding and try and convince contacts to use the new e-mail address instead.

Maybe something like this?

https://github.com/ssbc https://github.com/ssbc/secure-scuttlebutt https://github.com/ssbc/scuttlebot

Or djb's IM2000 (later fleshed out by JdeBP): http://homepage.ntlworld.com/jonathan.deboynepollard/Proposa...

That might have since fallen out of favor, I'm unsure.

I wrote about the further balkanization of SMTP-based Internet electronic mail, lamented by the headline article here, some ten years ago in http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/sm... .

I am surprised and encouraged to see IM2000 mentioned in this discussion.

As to whether such ideas have fallen out of favour, I offer this observation:

You are using a pull-style electronic communications system right now. Your WWW browser is the originator and receipient UA, and Hacker News is the message store. A copy of a message is only made and sent across the network when you request it with your User Agent. A lot of Internet-mediated communications are not SMTP-based any more. The shift to pull-style systems has, in some ways, actually already happened.

As such, many of the things that people ask about IM2000 are questions that they can answer from their own direct experiences, with a little reflection. How do you deal with senders who alter their messages? Well: how do you the receipient deal with the fact that right here and now I can hit an edit button and modify this comment after people have pulled it for reading it, with no edit history and nothing but the honour system for dealing with letting people know? The fleshing out of IM2000 set out the idea of downloading to folders in the recipient MUA the messages that one wanted to take off the senders' mail stores, by the way.

I agree and disagree. SMTP is bad, but it isn't the primary problem. The problem is social conditioning.

Since the 19th century, postal services have been monopolized by government institutions with a fee levied for storage, processing and transportation costs.

Physical mail delivery in bulk is costly, which makes it more profitable to send directly rather than en-masse.

But SMTP requires no fee. Originally, your ISP would provide you with e-mail in exchange for the fee you paid for your connection. Since the advent of "free" email services, people got used to not paying for mail anymore.

With electronic mail, it's cheap and easy to send in large quantities. Before we never needed to verify who was sending us mail, but now it's the only way we can filter out the noise.

To make electronic mail better we have to make it more expensive. Requiring a payment to send mail would reduce the cost-effectiveness of spam, and I would argue it would make the systems more verifiable. You could even preserve anonymity by having anonymous mail services, as long as you paid to send those mails, say with bitcoin.

Want to run your own mail server? Fine, but relaying will cost you. FedEx doesn't deliver mail from the USPS for free, and so relays shouldn't be expected to pass on mail without transportation costs.

"3 and 4 would require a sort of token system"

Not to get all handwavey, but I think this is why some people are super excited about bitcoin becoming 'part of the internet'. There are definitely some areas where we need a concept of identity & trust, and bitcoin seems like one of the first truly distributed ways of doing it.

The thing is while the Internet is all excited about bitcoin, everyone else has (kind of) stopped using e-mail for communication. It's all phone based now. E-mail is just for the things that doesn't have an app. And maybe resetting your password. Unfortunately, the "geek" age is out in favor of the startup age.

That may be the case for personal communications (well, not me, I am old school) but I don't think it the case at all for professional communications.

True, although now shared with cloud tools, at least intra-company. In some markets, like China, they use messaging for business. It's better in some ways e.g. you get a response faster.

I doubt it. No-one wants to pay to send an email. Even if they did, it'd involve waiting 10+ minutes for a payment to go through and limit the global email rate to a maximum of 5 messages per second. Bitcoin is not a good fit.

Not to pay per email, but to pay per email address. If you aren't a spammer, how many email addresses do you need? I don't think asking for a registration fee akin to a domain name is unreasonable.

You know, I've been wondering about this. I wrote about an email token system here [0], let me know what you think.

[0] https://roj.is/blog/a-different-approach-to-online-account-m...

We had a better system back in the day: X.400.

Howso?

The X protocols have typically struck me as grossly overdesigned and complicated.

More overcomplicated than the complex system of headers and whitelists trying to bolt some basic security and authenticity features onto SMTP?

The latter didn't win because it was "better" just because it was easier to implement. Like a car with no brakes or seatbelts.

Why the X protocols didn’t win is up for debate, but a good reason why they shouldn’t win, ever, is that, aside from being complicated and over-engineered, they are incredibly centralized in their design.

NB: that doesn't answer my question at all. I didn't ask what the deficiencies of X protocol alternatives were. But for the specific advantages of X.400 and related standards.

Reply on news.ycombinator.com