NYTimes: Tangled Up in Spam 413
ezekieldas writes "Congratulations to the SpamAssassin developers and community! There's a mention of SA in the NYTMag as "one of the best tools for network administrators..." in an extensive article entitled
Tangled Up in Spam.
The article is quite substantial and the author, James Gleick, is more technically educated than what we've come to expect from the big press. Central to the story is the complexity in dealing with spam effectively in both technical and legal terms and the confusion it brings upon the neophyte. The conclusion drawn may be oversimplified but nonetheless pragmatic: 1) forged headers should be illegal 2) a specific header entry should identify the email as unsolicited."
Kudos to SA. (Score:4, Insightful)
Re:Kudos to SA. (Score:3, Insightful)
But how do people get on the spam-lists to begin with? I mean, I have one email address for work and one private. Neither one of these gets more than one spam/month. Ever. The (obvious) reason for this is that I never use these addresses "in public" (web forms, online buying, etc.), for that I have my spam-collector, the Hotmail account, which do recieve a lot of these messages.
But then, I would guess that most people have been warned not to use their "real" mail address for the hazards I mentioned, making them as careful with their addresses as I am with mine. This would contradict my mesures beeing that effective when others still seem to get massive amounts of spam?
Am I just incredibly lucky with my two "real" email addresses?
If you took the same precautions I did, how do you think you got into the spam-generals addressbook?
Re:Kudos to SA. (Score:4, Interesting)
If you email address is simple (e.g. first initial+last name+some number) and your domain name is that of a public ISP, then there's an excellent chance that the spammers will find you regardless of whether or not you ever use the address. Email addresses at work tend to be safer because spammers usually don't bother guessing at addresses in domains with so few valid mailboxes.
Re:Kudos to SA. (Score:5, Interesting)
Re:Kudos to SA. (Score:3)
Re:Kudos to SA. (Score:5, Funny)
From that point on the crap has hitting my mailbox, about 10 per day.
I still haven't figured out how to thank him for that damn link that started it all.
Re:Kudos to SA. (Score:3, Interesting)
I am wary of these thnigs too. I have various 'levels' of e-mail addresses. The actual real pop3 address practically nobody gets, except my parents, and a few technie friends. All of these people know better than to abuse an e-mail address.
The 'next' address is what most people I know get.
The webmail addresses are what I use if I do something related to 'the unwashed masses' . Those can get filled with spam, I don't care. I only check them once every few days.
For anything that is shown publicly, I always anti-spam-armour it, and make it some sneakemail address or unique address for my domain name.
Due to this strategy, I only get 3-4 spams or so per year.
Re:Kudos to SA. (Score:3, Insightful)
Not only does your spams-per-hour count begin to rise, but you have to suffer the geek's frustration: How could you have a friend so mind-numbingly ignorant of technical manners?
Every time I set up a new email address ("Okay, this one will be spam-free. Really.") spammers find a way to get it, whatever I may do to prevent them. It only takes one leak.
Re:Kudos to SA. (Score:5, Insightful)
send link to a friend
A couple of months ago I got fed up with the ridiculous amount of spam I was getting at my primary address. I sent a note to the people I give a crap about, telling them that my primary address would henceforth be a new account I had created in my own domain.
I explicitly begged them not to give the new address to "those stupid send this cool page to a friend" sites. Set up filters in my email client to segregate the old address, and so far, so good, although my Mom gave the new address to an e-greeting card site. Fortunately, the site in question doesn't harvest addresses, and I (respectfully but frantically) pointed out to her that e-cards fall into the "stupid" category, and told her how to make up a disposable address for greeting cards, using my domain name.
Having to go to these lengths to to keep my inbox clear of spam makes me homicidal.
Re:Kudos to SA. (Score:3, Funny)
Did this for Alan Ralsky - wonder how much snail-mail spam he's received from them so far?
Re:Kudos to SA. (Score:4, Insightful)
One of the major costs of spam is that people are afraid to make their addresses available, making it much harder to contact people. I think it's sad that many geeks have become so used to spam that they think anyone who posts their e-mail address on a web page is stupid. Some geeks even go as far as to blame friends for spam they get when a friend isn't as careful with the geek's address.
Re:Kudos to SA. (Score:5, Informative)
Here are the vectors for getting on lists that I know of;
- using a valid email address in newsgroups
- using a valid email address on a web page
- using a valid email address in form properties in a web page
- using a valid email address on a mailing list or web-forum
- using a valid email address for domain registration contacts
- using a valid email address to sign a web page up for a search spider
- having an email address that can be "brute forced" (i.e. almost all of them)
- your pal puts an email address in an "e-vite" or "e-greeting"
- getting a virus that spreads via email
And above all, being naive about the workings of the Internet, when only a few weeks of ignorance will permenently get the address out there "in the wild". Just about everybody is this at one at one time or another.
Some people cannot avoid having email addresses hung out there on the Internet, so getting on the lists is more or less inevitable if you are doing business or communicating on the Internet in any meaningful way. Since I cannot ignore what comes in the boxes I run, I MUST sort through whatever arrives. That makes SPAM a big issue for me.
Your usage of your email addresses is probably typical (not on web pages and so on..) but you are probably fortunate to both be clueful about it and not dealing with your email address publicly available out of necessity.
Re:Kudos to SA. (Score:3, Interesting)
If you took the same precautions I did, how do you think you got into the spam-generals addressbook?
Co-worker unknowingly installed spyware on their computer which harvested my email address out of their email software address book. Sucks.
Re:Kudos to SA. (Score:3, Insightful)
If you ever put your resume on a job-seeker board, prepare for an onslaught of spam. It's a catch-22: You want your email address to be seen by a potential employer, unfortunately the spammers can easily scrape the sites for their email addresses. These bastards are truly the lowest forms of life.
Re:Kudos to SA. (Score:5, Insightful)
I work as a freelancer. My website hosts my CV, as do several online databases, where companies go to look for people of my profession. The CV of course includes not one, but several of my email addresses, because, in the long run, this translates directly into payable work.
I write software for fun (not profit). I even do email support, so my email address is again right there in plain html, and displayed by every software archive site I've ever uploaded my stuff to.
But this is the point of having an email address in the first place, isn't it? I could be as protective of it as the parent suggests, except by doing so I would lose much more than I am losing now (in terms of time and net-related costs). But to me, it's not only a matter of give and take: I refuse, on principle, to obfuscate my email address; I refuse to give in to spammers. When people start to hide their email contact information en masse, then spammers have won and email has become usleess.
At last (Score:5, Interesting)
Re:At last (Score:5, Informative)
Can't wait for the new tricks spammers will use to disable anti-spam programs.
Wait no more. I got a spam today that purported to be an apology for how the sender got my address, something like "so sorry, but these stupid porn sites like [link] must have sent me a virus. I can't believe my kids are visiting sites like [another link] even though I never go to sites like [yet another link], blah blah blah."
I have to admire the creativity of spammers even as I wish for Bad Things to happen to them.
Re:At last (Score:4, Interesting)
Someone sent an email from us to spamcops saying we were spamming - I checked our logs and in one day one person sent us 4 unsubscribe requests - they never got another email but I wonder if it wasn't them. Anyway, we were totally shut down with no warning, two different sites (one hosted the website the other hosting the email program) yanked off the internet when spamcops complained to our ISP.
This is downright stupid. One, anonymous complaint (never did find out who did it so we couldn't very well remove them from our list!) and all our websites, over a dozen, art galleries, political sites, stores, and some 'adult dance club' sites (you do what you can to make clients now...) all went down. No warning. And no apologies from our ISP or spamcops when we pointed out they pulled our service with absolutely NO research, no attempt to contact us, no evidence whatsoever other than a sole complaint which could have been posted by anyone (um, competitors to the adult club jump to mind).
My ISP (Speakeasy) eventually got someone in touch with us who really did nothing more than empathize with how angry we were and promised to try and not do it again. That's it. There's a movement afoot to try and reign in this sort of insane overkill, one story here [website101.com] and an a nascent organization against overzealous antispammers is here [niba4u.com].
For the record, we did not have confirmation on our opt-in list so theoretically someone could have signed up another (say a priest or something) for our mailing lists. We never got more than a couple new registrations a day so there was no systematic abuse, still, we fixed this and added confirmation (using mailermailer.com, I'm very impressed with them so far) after the complaint (no need to knock us off the web to get our attention, a simple email would have done) and, as I said, we had valid contact info if they had only bothered to ask...
Anyone else been a 'victim' of crazy blacklist providers?
I've gotten rid of 90% of spam (Score:3, Funny)
Garunteed Way to Block Most Spam (Score:2, Interesting)
Re:I've gotten rid of 90% of spam (Score:2)
I think they've wised up to that - I seen versions of the scam claiming to be from "Sierra Leone" and "Cote d'Ivoire".
I'll be interested to see how the new Mozilla 1.3 mail filters work, but I don't want to try an alpha release.
Re:I've gotten rid of 90% of spam (Score:5, Funny)
>
>IMMEDIATE ATTENTION NEEDED
>HIGHLY CONFIDENTIAL
>
>FROM: GEORGE WALKER BUSH
>202.456.1414 / 202.456.1111
>FAX: 202.456.2461
>
>DEAR SIR / MADAM,
>
>I AM GEORGE WALKER BUSH, SON OF THE FORMER PRESIDENT OF THE UNITED STATES
>OF
>AMERICA GEORGE HERBERT WALKER BUSH, AND CURRENTLY SERVING AS PRESIDENT OF
>THE UNITED STATES OF AMERICA. THIS LETTER MIGHT SURPRISE YOU BECAUSE WE
>HAVE NOT MET NEITHER IN PERSON NOR BY CORRESPONDENCE. I CAME TO KNOW OF YOU
>IN MY SEARCH FOR A RELIABLE AND REPUTABLE PERSON TO HANDLE A VERY
>CONFIDENTIAL BUSINESS TRANSACTION, WHICH INVOLVES THE TRANSFER OF A HUGE
>SUM
>OF MONEY TO AN ACCOUNT REQUIRING MAXIMUM CONFIDENCE.
>
>I AM WRITING YOU IN ABSOLUTE CONFIDENCE PRIMARILY TO SEEK YOUR ASSISTANCE
>IN
>ACQUIRING OIL FUNDS THAT ARE PRESENTLY TRAPPED IN THE REPUBLIC OF IRAQ. MY
>PARTNERS AND I SOLICIT YOUR ASSISTANCE IN COMPLETING A TRANSACTION BEGUN BY
>MY FATHER, WHO HAS LONG BEEN ACTIVELY ENGAGED IN THE EXTRACTION OF
>PETROLEUM
>IN THE UNITED STATES OF AMERICA, AND BRAVELY SERVED HIS COUNTRY AS DIRECTOR
>OF THE UNITED STATES CENTRAL INTELLIGENCE AGENCY (CIA).
>
>IN THE DECADE OF THE NINETEEN-EIGHTIES, MY FATHER, THEN VICE-PRESIDENT OF
>THE UNITED STATES OF AMERICA, SOUGHT TO WORK WITH THE GOOD OFFICES OF THE
>RESIDENT OF THE REPUBLIC OF IRAQ TO REGAIN LOST OIL REVENUE SOURCES IN THE
>NEIGHBORING ISLAMIC REPUBLIC OF IRAN. THIS UNSUCCESSFUL VENTURE WAS SOON
>FOLLOWED BY A FALLING-OUT WITH HIS IRAQI PARTNER, WHO SOUGHT TO ACQUIRE
>ADDITIONAL OIL REVENUE SOURCES IN THE NEIGHBORING EMIRATE OF KUWAIT, A
>WHOLLY-OWNED U.S.-BRITISH SUBSIDIARY.
>
>MY FATHER RE-SECURED THE PETROLEUM ASSETS OF KUWAIT IN 1991 AT A COST OF
>SIXTY-ONE BILLION U.S. DOLLARS ($61,000,000,000). OUT OF THAT COST,
>THIRTY-SIX BILLION DOLLARS ($36,000,000,000) WERE SUPPLIED BY HIS PARTNERS
>IN THE KINGDOM OF SAUDI ARABIA AND OTHER PERSIAN GULF MONARCHIES, AND
>SIXTEEN BILLION DOLLARS ($16,000,000,000) BY GERMAN AND JAPANESE PARTNERS.
>BUT MY FATHER'S FORMER IRAQI BUSINESS PARTNER REMAINED IN CONTROL OF THE
>REPUBLIC OF IRAQ AND ITS PETROLEUM
>RESERVES.
>
>MY FAMILY IS CALLING FOR YOUR URGENT ASSISTANCE IN FUNDING THE REMOVAL OF
>THE PRESIDENT OF THE REPUBLIC OF IRAQ AND ACQUIRING THE PETROLEUM ASSETS OF
>HIS COUNTRY, AS COMPENSATION FOR THE COSTS OF REMOVING HIM FROM POWER.
>UNFORTUNATELY, OUR PARTNERS FROM 1991 ARE NOT WILLING TO SHOULDER THE
>BURDEN
>OF THIS NEW VENTURE, WHICH IN ITS UPCOMING PHASE MAY COST THE SUM OF 100
>BILLION TO 200 BILLION DOLLARS ($100,000,000,000 - $200,000,000,000), BOTH
>IN THE INITIAL ACQUISITION AND IN LONG-TERM MANAGEMENT.
>
>WITHOUT THE FUNDS FROM OUR 1991 PARTNERS, WE WOULD NOT BE ABLE TO ACQUIRE
>THE OIL REVENUE TRAPPED WITHIN IRAQ. THAT IS WHY MY FAMILY AND OUR
>COLLEAGUES ARE URGENTLY SEEKING YOUR GRACIOUS ASSISTANCE. OUR
>DISTINGUISHED
>COLLEAGUES IN THIS BUSINESS TRANSACTION INCLUDE THE SITTING VICE-PRESIDENT
>OF THE UNITED STATES OF AMERICA, RICHARD CHENEY, WHO IS AN ORIGINAL PARTNER
>IN THE IRAQ VENTURE AND FORMER HEAD OF THE HALLIBURTON OIL COMPANY, AND
>CONDOLEEZA RICE, WHOSE PROFESSIONAL DEDICATION TO THE VENTURE WAS
>DEMONSTRATED IN THE NAMING OF A CHEVRON OIL TANKER AFTER HER.
>
>I WOULD BESEECH YOU TO TRANSFER A SUM EQUALING TEN TO TWENTY-FIVE PERCENT
>(10-25 %) OF YOUR YEARLY INCOME TO OUR ACCOUNT TO AID IN THIS IMPORTANT
>VENTURE. THE INTERNAL REVENUE SERVICE OF THE UNITED STATES OF AMERICA WILL
>FUNCTION AS OUR TRUSTED INTERMEDIARY. I PROPOSE THAT YOU MAKE THIS
>TRANSFER
>BEFORE THE FIFTEENTH (15TH) OF THE MONTH OF APRIL.
>
>I KNOW THAT A TRANSACTION OF THIS MAGNITUDE WOULD MAKE ANYONE APPREHENSIVE
>AND WORRIED. BUT I AM ASSURING YOU THAT ALL WILL BE WELL AT THE END OF THE
>DAY. A BOLD STEP TAKEN SHALL NOT BE REGRETTED, I ASSURE YOU. PLEASE DO BE
>INFORMED THAT THIS BUSINESS TRANSACTION IS 100% LEGAL. IF YOU DO NOT WISH
>TO CO-OPERATE IN THIS TRANSACTION, PLEASE CONTACT OUR INTERMEDIARY
>REPRESENTATIVES TO FURTHER DISCUSS THE MATTER.
>
>I PRAY THAT YOU UNDERSTAND OUR PLIGHT. MY FAMILY AND OUR COLLEAGUES WILL
>BE
>FOREVER GRATEFUL. PLEASE REPLY IN STRICT CONFIDENCE TO THE CONTACT NUMBERS
>BELOW.
>
>SINCERELY WITH WARM REGARDS,
>
>GEORGE WALKER BUSH
NO NO NO (Score:2, Interesting)
Re:NO NO NO (Score:2)
There is an excuse (Score:2)
Id love to see the types that do fall for spam, but they must be out there.. somewhere..
Re:NO NO NO (Score:2, Interesting)
On the other hand, I doubt that any of this is enforcable in any event.
Re:NO NO NO - for a different reason (Score:5, Insightful)
Don't we ever learn from the past? We've all seen the unintended consequences of poorly-crafted legislation (e.g. DMCA), so why run to the shelter of more restrictions which, in the end, will only cause us more problems? Like the criminals trying to scam your mom with the Nigerian-hold-my-money-for-a-day scam are going to suddenly begin obeying the law... yeah, right. Which begs another question: what law, in what jurisdiction? Even if the US were to pass this law and ruthlessly enforce it (domestically), all scammers would simple flood us from offshore servers.
The solution is not legislation, it is the creative use of technology. Build software that "learns" what is spam and what isn't, then evolves to keep up with the changing tactics of the spammers. Something like PopFile [sourceforge.net]
Re:NO NO NO (Score:3, Insightful)
However, a method to force identification of BULK email (more than, say, 100 similar messages) might have fewer undesirable side-effects.
SpamAssasin in large corporate use? (Score:3, Interesting)
Re:SpamAssasin in large corporate use? (Score:4, Interesting)
Personally, I'd like to see more companies using SpamAssassin just to prove that it can stack up against other products, because I think it can work well if it's configured properly and you use spamd. I use it on my mail server at home and at last check it catches 98.2% of all spam message sent to my machine, and I haven't had any false positives since I set up my whitelists.
Re:SpamAssasin in large corporate use? (Score:3, Interesting)
Reasons for not using SpamAssassin are the CPU and bandwidth costs. Refusing e-mail from known spam sources is cheaper and (more importantly) does not give away information about which addresses are valid.
After checking the source IP address against lists such as Wirehub [wirehub.nl], Osirusoft [osirusoft.com] (despite its name not only a list of open relays) and/or some other lists, almost no spam will be accepted.
IP space is finite and, even better, allocated in ranges. Continued spam from (or spamvertizing a website on) an IP address is a very good indicator for more spam from the IP range.
Re:SpamAssasin in large corporate use? (Score:3, Interesting)
We run an Exchange server. I didn't go with the free version, because we don't have the skill set to maintain it at our company. I have some Linux experience, but after 3 days of trying to get it to work I finally had to give up.
I installed Deersoft's SpamAssassin on my Exchange server. Kind of expensive (about $5000) and right now Deersoft customers are left hanging due to Network Associates purchase of Deersoft. NAI pulled the Deersoft version and are releasing it in Q2 2003.
Illegal? (Score:5, Interesting)
Why does everyone in the USA assume that everyone else in the world will somehow obey US law when it is made "illegal"?
Re:Illegal? (Score:5, Insightful)
Because the vast majority of spam is sent by Americans, advertising products sold by other Americans and hoping to sell them to still more Americans. The fact that the spam is sent via open relays in Korea or bulletproof accounts in China, and received in Europe or Australia, is neither here nor there. Ralsky, for instance, lives in America, regardless of where the spam is routed; indeed, _his_ location is very well known nowadays ;-)
Re:Illegal? (Score:3, Funny)
Because the vast majority of spam is sent by Americans, advertising products sold by other Americans and hoping to sell them to still more Americans.
Actually, I'm an American and at least one third of the spam I get is sent from Korea, advertising in Korean, presumably for Korean products. This spam is completely unreadable by me (I have friends who can read Chinese and Japanese, but none who read Korean).
I don't see Korea caring what laws the US passes regarding forged headers. Might help with the rest of my spam tho.
Re:Illegal? (Score:3, Interesting)
First of all, it's a start. If the USA adopts this law, it may well be that many other nations follow suit, making life harder for spammers.
Second, it will help against spam originating from the USA. That guy Ralsky seems to be responsible for a sizable portion of all Internet spam. He is based in the USA, and taking orders from sites and companies in the USA. Even if his actual spam originates from an ISP in China, you'd still be able to take him to court for this.
Re:Illegal? (Score:4, Interesting)
Stop the flow of money from US residents, and you will be effectively making everyone in the world obey US law, with respect to spamming within and into the USA.
Re:Illegal? (Score:3, Interesting)
Playing devil's advocate here, you still have to prove they sent the spam out, which would be that system's Achilles heel. Else what would stop people from hiring an offshore spammer to send out fake spam from a competitor?
Re:Illegal? (Score:2, Interesting)
Um, that wasn't a troll. It's a valid point. If sending spam becomes illegal in the U.S., big fucking deal. Plenty of spammers are not in this country, and those that are will move offshore (c.f. KaZaA). Good luck prosecuting a bunch of spammers in some pacific island country...
Re:Illegal? (Score:2)
It's about enforcement, and yes US law is enforceable, especially with the many countries that have or want beneficial relationships with the U.S.
Sure, lots of people will break the law, but without we wouldn't even have grounds to act against them.
Talking of spam... (Score:2, Funny)
* ZERO * (Score:2)
Granted there is always the risk that they could be hacked, as their main page was some time agi, but what's life without risk?
Re:Talking of spam... (Score:2, Interesting)
MIT's Post Servers... (Score:5, Interesting)
Re:MIT's Post Servers... (Score:2)
The largest scored spam I've gotten is somewhere around 32
Re:MIT's Post Servers... (Score:3, Funny)
Re:MIT's Post Servers... (Score:5, Informative)
Some more clarification:
-it's not on a scale of 10 - the SA score can go as high as necessary. I got 27 the other day. Your threshold will be configurable (sometime next week) to "high" (3.0), "normal" (7.5), or "low" (12.0), or a custom number. You'll also have custom whitelists and blacklists.
What was the e-mail? (Score:3, Funny)
"Hello, I am a Nigerian prince who is selling XXX-brand diet pills that also have the side effect of enlarging your penis. Also if you forward this email to five other people and tell them to each send you a dollar you can make money fast."
*ducks*
Always with the legislation... (Score:5, Interesting)
Re:Always with the legislation... (Score:5, Interesting)
Consider the following. We all access the internet from a fixed and typicaly small number of physical and virtual locations. Were we to map the internet as a whole, starting from any given location the map would look like an expanding cone.
In short, almost all of the traffic from a given point flows through a very small number of servers and routers at some point close to the source.
Since spam messages are sent by the millions and it is fairly easy to determine what messages are likely to BE spam why not set up a filtering system on the routers that determines the rough content of a message based on both its Spam Precentage and the number of identical messages sent.
I.E. If the router sees 500,000 messages of nearly identical content with a 89% spam rating it blocks all of them. If it sees 44 messages with a 23% spam content it lets them through.
Thoughts anyone? I'm sure this idea has gaping flaws in it... what would have to be chnaged for it to work? What are the critical flaws? Is this a viable model or am I missing something major?
Bad idea (Score:4, Interesting)
There are also philosophical problems with such a scheme which others can explain...
Re:Always with the legislation... (Score:3, Informative)
I'm less psyched about filtering at the router (mail server). Two words: arms race.
Having each mail server filter on content along the chain would work in the short run, as soon as it became too effective, the spamers would think of ways to eeek by the ratio. Lower the ratio, so would the spammers till you end up filtering out mail that is legitimate.
(That, and I'd hate to have to spec a system that would do that filtering without adding substantial delays!)
Beyond adding a cone of paths like you first described, and figuring out other technical ways to deal with this, I see a couple things that will probably be required in the future;
(Ob comment: Yes this is a big deal, involves pain, is likely not backward compatable, and should be thought out very carefully.)
Re:Always with the legislation... (Score:3, Informative)
Actually, it wouldn't due to the multihomed nature of most networks.
Since spam messages are sent by the millions and it is fairly easy to determine what messages are likely to BE spam why not set up a filtering system on the routers that determines the rough content of a message based on both its Spam Precentage and the number of identical messages sent.
I.E. If the router sees 500,000 messages of nearly identical content with a 89% spam rating it blocks all of them. If it sees 44 messages with a 23% spam content it lets them through.
First, routers are meant to do one thing, route traffic. They do not have the memory or CPU power to do much more than that.
Second, "identical" and "near-identical" messages are very different things. It is fairly cheap (processor/memory wise) to determine if two messages are identical. It is quite another task to determine if they are nearly identical.
Third, there are many instances where identical or nearly identical messages sent out in bulk are not spam. Mailing lists like bugtraq or linux-kernel have very large subscriber lists, but are are not spam. If the head of IBM sends a message to all his employees, it is not spam. If my car insurance company sends out a bunch of messages warning people once a month that their policy will expire if payment isn't received, it is most definitely, not spam.
Re: (Score:3, Interesting)
Me ditto (Score:2)
Seems to me that the problem could be self correcting if there were no forged headers. If spam could always be traced back to its originator, or to a bad relay who accepted forged headers, then only 1% of the recipients would have to reply to flood the miscreant's mailbox.
So why is it not possible to prevent forged headers? Why can't SMTP relays reject mail whose most recent Received-From: header does not match the the sender? As long as you can trace these backwards, at some point you will hit a forged header or the originator. If the header is forged, that means the the next relay did not verify headers, and is a worthy target of complaints about spam, as good as the originator, in fact.
If only 10% of SMTP relays and ISPs enforce this, that would seem to me enough to flood spammers with complaints.
Why would this not work? Worst I can see is it would take a few months to become widespread enough to have an effect, and early adopters would have a slight processing overhead increase, due to having to check for forged Received-From: headers.
Re:Always with the legislation... (Score:5, Insightful)
No, it is not. It is a social and economic problem.
That's why you can't come up with a technical solution, because it isn't a technical problem.
Making it impossible to forge headers is not going to solve any of the problems above. It will only make it easier to report spam to ISPs, but it will not pressure them more to whack the spammers.
You can take technical measures to shift the cost onto the spammer, but if you do that, you must consider the side-effects.
Frankly, I think laws are the solution. But given clueless legislators, we have to write the law.
Spammage (Score:2, Funny)
Where does it come from, Uncle Sam?
"Monty Python, don't you know,
When the madness was in full flow"
But what when the accursed stuff
Leads one to declare, "I've had enough!"?
"My son, spam's easy to fail,
When you stop using hotmail!"
-Mark
Interesting free speech point (Score:5, Interesting)
Looks like we have the supremes on our side; if we could just congress to issue some letters of marque and reprisal on the spamhausen, we'd be getting somewhere...
Techical Solutions Are Required (Score:5, Interesting)
I think that breaking that economic model -- ending the reciever-pays system for email -- is the only way to fix spam. If you had to pay some amount of money -- event 1 cent -- for each message that is delivered, spam would stop being economical. And that's the only thing that's going to make it stop.
-Esme
Re:Techical Solutions Are Required (Score:3, Insightful)
Re:Techical Solutions Are Required (Score:2)
I don't think ISPs need to charge their users per email. Since most users receive more email than they send anyway, they would generate a net income for the ISPs. They could set a quota -- even a fairly high one like 100 emails per day -- that users get included with their access.
That said, if you don't want to pay to talk to yourself, you might try a different system like a PDA or something web-based. Just because it inconveniences you, doesn't mean it wouldn't be worth it -- after all, I don't know anyone who uses email who isn't inconvenienced by spam. So even if 10% of people were inconvenienced by the new system, it would still be a drastic improvement.
-Esme
Need MSSMTP (Score:3, Insightful)
I should be able to ask Hotmail (or whoever) "I have message #xyz from your domain. Does it originate from a user in good standing?" If the ISP gets too many queries for an individual account, it will stop vouching for it.
Likewise, you need a database of "ISP's in good standing". I.e., who is known to play by the rules with MSSMTP?
Verification would serious server resources, but better that than spam.
-mse
Who steals my .sig, steals trash.
Re:Need MSSMTP (Score:2)
A new SMTP (I have a hard time equating "MS" with "More Secure", for some reason...) that had a mechanism to verify the sender's status would be good. In fact, it would be pretty much required to implement a pay-to-send system, because the SMTP would need to get the authorization to debit whatever account was going to pay for the message. The list of people who had valid accounts would defacto be the same as your "ISPs in good standing".
But I think adding the monetary element is crucial, because of the economics. In a trust system, I suspect there would be constant attacks of people hijacking trusted mail servers and using them to spam. It would, after all, still be profitable. There would also probably be people who had built up a level of trust who would then blow it all on one big spamfest. These would be corrected eventually, but the number of ISPs around the world is pretty large, so I suspect there would still be a lot of spam leaking throught the cracks.
-Esme
Re:Techical Solutions Are Required (Score:4, Interesting)
The real way to get rid of spam (Score:3, Interesting)
Sure all these programs help, but think about what creates spam in the first place.
There are clearly people out there willing to buy the things offered in spam. Obviously not that many, but enough to make a profit. I think that there should be more of an effort to target these people and tell them not to buy stuff from spam!
There is only so much a program can do to stop spam. As we've seen numerous programs have been made, Spam Assasin being one of the best (I use it), but the spam just keeps coming
Until there is no incentive to send spam in the first place people will do it despite any laws against it.
evolution users (Score:5, Informative)
Careful what you outlaw (Score:3, Insightful)
Broadcast, not unsolicited (Score:3, Insightful)
I don't know what is meant by unsolicited -- and I doubt that there are good definitions that are practical. Nor do I want any single e-mail ever to be treated as spam because some unsophisticate forgot to (or didn't have the software) to make the e-mail unsolicited.
I *DO* want the anti-spam laws to have teeth and very few exceptions -- for that, the criteria for spam should be sufficient to permit adequate filtering (to be useful), not be content-based (to be constitutional), and should be relatively objective (to be practically enforeceable).
Thus, in lieu of forcing headers to identify whether an e-mail is solicited, i would punish falsely identifying an e-mail as non-broadcast. That is to say, an e-mail is not broadcast if it was sent to, say, fewer than 200 different addresses that had not specifically opted-in by affirmative request to receive it.*
Then, we simply get most e-mails clients to flag routine e-mails as non-broadcast, and you have a decent result.
*the only tricks here are (1) subtle and non-substantive changes in each e-mail making them different and (2) sending e-mails on behalf of many different sources (from 1000's of different e-mail accounts). The solutions can be readily addressed by (1) referring to the e-mail and "substantially similar" e-mails (the copyright standard); and (2) referring to e-mails sent by or on behalf of a particular individual. Thus, the person commissioning the spam is always liable for the crime -- regardless how many different persons send the spam on her behalf.
esp SA 2.5 (Score:2, Informative)
that is the version with the Bayes fully in it and it is head and shoulders above the previous versions IMO
Legislate?? (Score:5, Insightful)
Is it just me, or is the internet community at large thinking about controlling SPAM from the wrong angle? If we're thinking about legislation as a means of curtailing wanton abuse of our mail systems, why don't we just push to force the system to be explicitly Opt-In rather than allowing your personal details to be passed around to all and sundry under the assumption that you implicitly asked for it just because you ticked a box that said 'please send me "stuff" from our affiliates' 5 years or so ago.
Personally, I'm sick of receiving these messages about enlarging my manly bits or being told that I had been chosen specially to participate in a "can't lose" investment scam. Sure they sometimes give you an opt-out link, but I'd rather choose what advertising crap to be bombarded with. I'd certainly prefer to know who was receiving my personal information, and what they are likely to advertise, so that I can avoid wasting hours out of my day cleaning up after these lazy cowards who aren't willing to contact me in such a way so that I can communicate personally with them and tell them what ASSHOLES they really are
No hope (Score:4, Interesting)
I just wish that I would not get emails in the same day to enlarge my breast and penis. It is just too sad and stupid.
SpamAssassin works so well (Score:2)
Chaos Theory anyone? (Score:4, Informative)
The uneducated guy that send this story in, need to know that was instrumental in taking Chaos theory from an obscure science in Santa Fe into something that almost every scientific discipline benefits from. Incl CS. . [around.com]
Also, Genius: The Life ... of Richard Feynman (Score:3, Interesting)
Check out where Gleick quotes Feynman on the inherent risk of Shuttle flights [around.com]. Prescient, that Feynman.
Another cool anti-spam tool (Score:5, Interesting)
I've been using Cloudmark's SpamNet [cloudmark.com] for the past few months and it's been working quite well.
The smart thing that SpamNet does, is that it relies on its users to determine if something is spam or not. If some email lands in your inbox and a few hundred SpamNet members have proclaimed it spam, it most likely is, and it gets immediatly filtered out. This has the net effect of a few user's needing to filter out a few message ocassionally, while the vast majority of messages are filtered out for all users. Although SpamAssassin seems quite good, it's still based upon filtering rules and spammers are constantly tweaking their emails to try to get around them. Since people are still better at determining what's spam and what's not, I find that its accuracy is generally better.
SpamNet isn't perfect though, as far as I know, it only works with Outlook on Windows and doesn't have a Unix, Linux or Mac version. It also sometimes filters out valid bulk mailings, but overall, I would definitely recommend it.
Go with POPFile. (Score:5, Informative)
Outlaw "forged" headers? (Score:3, Interesting)
The only headers that should be preserved are perhaps the Received: lines which show that route that the message has taken. Still, I can think of a legitimate reason to muck with these - if a company network has a sufficiently complicated internal structure, these headers might reveal some information that they don't want widely available.
but on the same page... (Score:2, Informative)
Go figure.
spam (Score:2)
what is unsolicited? (Score:2)
I can see some problems with this. If I send a message to my mother out of the blue is that unsolicited?
I haven't read the article (I don't like the NYT and avoid it when I can) but I'm sure the idea is that this applies to commercial email, but that's a dangerous distinction to make if you ask me.
I rarely ever get spam. (Score:5, Interesting)
1. Spend 10 bucks, buy a domain name (eg xyz.com).
2. Set up a few email aliases to point to your real email. eg:
joe@xyz.com ---> you@hotmail.com
temp123@xyz.com ---> you@hotmail.com
spam123@xyz.com ---> you@hotmail.com 3. Never give out 'joe@xyz.com' to anyone except friends/family.
4. Use the other emails for signing up for things on the web or in usenet.
5. When you get your first spam addressed to 'temporary21@xyz.com', delete the email address (no more spam from that source!).
I find this method works extremely well. By using aliases in this way you effectively hide your real mailbox. Even if your hotmail account starts receiving spam you can just get a new one and point your aliases at it. Also, if you change ISP you don't need to change your email address.
If you use it to forward to a hotmail account it might be better if the hotmail account name isn't a dictionary word or name (ie. use a random string for an account name that the 'bots won't guess.
You're screwed if your 'trusted' address gets out there but if you're careful you'll at least get much more use out of it before needing to kill it.
Re:I rarely ever get spam. (Score:4, Interesting)
Internet mail architecture sucks (Score:3, Interesting)
the Author's version of the article (Score:4, Informative)
A new breed of email is on the horizon (Score:5, Interesting)
With Bind 9, we finally have a decent, working implementation of DNSSEC. This will allow for a new breed of secure, verified websites and email, and (Finally!) makes a RBL actually mean something.
How's that you ask?
Well, one of the biggest problems with SPAM is the forged header, open relay issue. It's a complicated issue, and one that doesn't have an obvious, "in your face" kind of answer.
DNS is designed to tell you where to go, and SSL/Certs make sure that you got there. Why aren't they joined together? The fact that you are the DNS server for a domain makes it clear and obvious that you are an authoritative designator for where you are supposed to go - why have this wholy separate and dis-jointed SSL/Cert that can't even be made to work [slashdot.org] consistently?
If an ISP can issue DNS-SEC certs with impunity, we might actually see a reason to have encrypted and ISP certified email.
And suddenly, the ISP is back in charge again, able to validate every email going out as coming from one of it's customers. Revoke the cert and their email becomes unreadable.
Now, we have an email system with a powerful mechanism built in that is:
1) Standards compliant
2) Easy to implement
3) Clearly laid out
4) Cheap
5) secure
6) private - using the ISP's cert to identify yourself doesn't mean that the ISP can read your email! (like they can now - the command is "mail -u _username_")
What's not to argue with? The issue of locking down an open relay becomes a non-issue - an ISP could simply identify an "s-mail" server (secure mail) that will only relay for those holding a valid cert at that ISP.
Roaming wouldn't be an issue, nor would open relays or forged headers.
A brave new world? Yep. One I'd like to live in? Yep. One that's coming? We can only hope...
Where spam really comes from (Score:3, Interesting)
But most importantly of all, we cannot forget that American consumers are responsible for spam. That's right, spam is OUR fault. It is our fault because no matter how many messages are filtered, and no matter how many websites are closed for spam complaints (or get DDoS'd by rampaging slashdotters), they still make money. They make money because of that infinitesimally small group of consumers who buy stuff from spammers. That small percent is what makes it all worth it to them.
The day that spammers' profit margins drop to nil because consumers refuse to buy from spammers is the day that spam vanishes from our inboxes forever. No laws, no filters, no problems.
Unfortunately, as P.T. Barnum would put it, "There's a sucker born every minute..."
Technically educated? He founded Pipeline (Score:4, Informative)
Maybe because after many years as a reporter, he founded Pipeline, one of the first big ISPs.
I agree with #1 but not #2 (Score:3, Insightful)
I think it would be great if you could actually prosecute someone for forging headers. Unfortunately you don't know who that person is, now do you?
But how would you ever determine is something is unsolicited? After all, there are a lot of registration websites that have a tendency to quietly flag you as willing to accept spam from them. If I missed it, does that still make it UCE? If it does, how do I now remove myself from all the lists that I am now on...
Spam has a solution and it doesn't have to be so drastic as to put in this kind of legislation or use whitelist only maling lists. We just haven't figured it out yet.
Spam is not about content, it's about behaviour (Score:3, Interesting)
Spam is not about content. Not everyone even agrees what constitutes spam when they are evaluating it based on content, so how can a program or a recipient community do this? What makes mail spam is stuff like sending it unsolicited and in bulk. It won't matter what the content is.
I have signed up with some companies for announcements about their products. While that company may not be spamming, their content could have a lot of the same wording as another company selling similar products, but is sending it to harvested addresses. The latter is spam, but the former is not. How do you tell based on the content?
Tools that evaluate a message based on content are probably going to classify both messages the same way. If they are both classified as spam, then one of them will be "collateral damage". If they are both not classified as spam, then the other will be "leaky pinky". So I still prefer to block spam on the basis of the behaviour of the sender.
You don't have to. (Score:2, Offtopic)
javascript:letters="abcdefghijklmnopqrstuvwxyz"
There shouldn't be any spaces in there, so cut them out if slashdot inserts them. When you get to the NYTimes "you must register" page, click the bookmarklet. It's not the most beautiful solution, but it does the job.
Re:You don't have to. (Score:2, Insightful)
But this Slashdot, where information wants to be free unless it's your own.
Re:You don't have to. (Score:2)
Comment removed (Score:5, Informative)
Comment removed (Score:4, Insightful)
Re:SpamAssassin is not a solution (Score:2)
You mean like this one? [spamassassin.org]
Re:I get four a week. (Score:2, Insightful)
Re:I get four a week. (Score:2)
Ah I did wonder, I was having reall problems with the Boss at the end...
Re:I get four a week. (Score:4, Informative)
I run my own mail server. I have Postfix configured to forward username-@the.server to username@the.server by default. So, for example, I registered with amazon username-amazon, and it gets to me. If this email is ever put on a list, I'll complain to amazon, and then create a
Re:I get four a week. (Score:3, Informative)
example.com is an official internet blackhole, sanctioned by RFC. It is what everyone is supposed to use in books, demonstrations, etc, similar to 555-XXXX phone numbers on TV.
Re:Who gets this job? FTC, states, citizens (Score:3, Informative)
Enforcement is currently a state problem, for the dozen or so states that have antispam laws. Even if they can establish jurisdiction, they have to locate the offender. An asst. attorney general I chatted with in Washington state described an almost comic crusade to get ONE spammer who set up under a different corporate name every week. They used three private investigators to track him (successfully), suggesting to me their investigatory resources were limited. Anyway, they couldn't afford to do this with everyone, and this one example was located in-state!
I was surprised the author didn't really talk about state laws at all. They're kind of the laboratories for the eventual federal effort, and state law/enforcement will be complementary.
Once there is a law on the books the "cyber" aspect of it is only as issue for tracking. Postal mail and telephone calls have "no physical boundaries," too, and actually it is the crossing of state lines taht is an obvious source of federal jurisdiction. The rest is standard law enforcement. The FTC, which the author briefly visited, was busy enough with outright fraud, where it already has jurisdiction, just as it does over fraudulent TV ads and newspaper ads and product labeling and so on. I can say that I've seen some very good work by the FTC, even leading to jail terms for the guys who just won't give up. (The jail term I saw was for criminal contempt of court.)
I think they're going to need to provide a private enforcement action, as with the fax law. The gov't resources would still be needed to track down and prosecute the really tough ones, such as the WA case I described. We already have some relevant experience from the anti-junk fax law.
Recognizing spam -- good Q. I don't have any trouble recognizing 99% of it. For teh false positives, it should be possibly to allow the merchant to provide evidence of opt-in, and if enough complaints are tallied there would be further action.