My recent newsletter on a new approach to stopping spam, in which antivirus and antispyware vendors would place an encrypted serial number on a user’s computer during the installation process and then use this number to check a sender’s antivirus and antispyware capabilities, generated some very thoughtful responses. Here’s a sampling:

* “Why make it more complex than it has to be? The ‘wire’ into the ISP is the key to the whole problem of botnets. There is a ‘hard’ link between the ISP and the end user. The ISP can FORCE the user to push all their e-mail through the ISP’s SMTP mail server. Why put more hands into the soup [with] more products, more vendors and more expense? The ISP-customer link should have a giant message counter; it [is] hard to spam a gazillion messages if the ISP was counting and had limiters in place.”

* “Your idea of tagging the outgoing e-mail might work, but as someone had pointed out, getting all the various parties to agree to this might be difficult. I’d propose that more antivirus and operating system developers use a firewall to shut off traffic on port 25 except when triggered by an application that has to be manually approved by the user (give them a list of approved e-mail apps to make it easy or have it default to the operating system’s current default e-mail app). And then only long enough to send the message. If this were integrated into the OS, even someone without antivirus or running outdated antivirus could get a popup saying something’s sending e-mail on your PC if it happened while the e-mail app wasn’t running. I’d think you would find that most people seeing an alert saying that their PC was doing something on its own it wasn’t supposed to, would at least get them to do something (especially if the alert said, ‘Buy some Antivirus software knucklehead!’”

* “The main problem I have with the strategy you spoke of is that it favors a select group of ‘accepted’ antivirus and antispam providers and would require an additional bureaucratic layer or oversight of such providers. It would then require 100% buy-in by all e-mail service providers and e-mail clients, or else the receivers of e-mail would need to put in such substantial exemptions to the system that it would be rendered futile. And, ultimately, if you are proposing a change that would require a 100% buy-in by all parties involved, a modification to every e-mail client on earth and every e-mail server on earth, then you might as well just change the geriatric SMTP standard as a whole, eliminating the need for this band-aid entirely.”