Slashdot Log In
MS and Sendmail work together on Spam Solution
Posted by
CmdrTaco
on Tue Feb 24, 2004 10:22 AM
from the here's-hoping dept.
from the here's-hoping dept.
fudgefactor7 writes "Powerhouse software vendor Microsoft and the venerable Sendmail, have formed an alliance to launch a sender authentication plug-in which is hoped will combat email fraud and spam. The plug-in lets organisations verify a message's source before accepting it by automatically checking to see if an email came from where it claims it did. Could this be a sign of the beginning of the end of spam?" Update: 02/26 08:01 GMT by S : Though Microsoft and Sendmail are both working on solutions, there's no official alliance in place between the companies.
This discussion has been archived.
No new comments can be posted.
MS and Sendmail work together on Spam Solution
|
Log In/Create an Account
| Top
| 471 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
|
2
(1)
|
2
Perspective.... (Score:5, Funny)
(http://prometheus.med.utah.edu/~bwjones/ | Last Journal: Wednesday November 28, @05:15PM)
Wow......this really sounds like it was written by a marketing director. A Slashdotter could have just as easily interpreted this as "The 800 lb gorilla of the software industry, Microsoft has coerced the long suffering Sendmail to provide Microsoft with a software patch that fixes security holes inherent in Microsoft products that allow for email fraud and spam to run rampant. Another side benefit is that Microsoft can exert their market dominance to further entrench the Microsoft monopoly by refusing email not conforming to Microsoft "standards".
Laugh, it's intended to be funny.
Re:Perspective.... (Score:5, Funny)
(http://goalsuccess.typepad.com/goaltips)
Re:Perspective.... (Score:4, Insightful)
Pfizer suffers from this due to a possibility of a counterfeit drug causing harm, making Pfizer a target of an inadvertant lawsuit, the cost of which being huge amounts of negative publicity. Imagine: Pfizer getting sued - big headline on front page - everybody's talking about it. The drug turning out to be counterfeit - tiny headline near back page three months later - nobody notices. The fact that it came from a spammer - doesn't even get reported.
Submitter and Editor didn't RTFA (Score:5, Informative)
(Last Journal: Sunday April 16 2006, @09:28PM)
While it's nice to see this type of work being done, the headline is misleading.
wbs.
Re:Submitter and Editor didn't RTFA (Score:5, Insightful)
(http://www.sigsegv.cx/)
Microsoft - well... dunno... hard to say anything... Some of their ietf work has been brilliant. It is the implementation (and the marketing in command of it) that has been horrible.
Sendmail - no fscking thanks. Their track record in inventing features and suddenly introducing them without at least informing the internet community at large is not anything to shout about. Basically in order to deal with the sender-address-must-resolve and the antispam parts of their rulesets you usually need 4 apirins and 200ml of vodka. That along with 24 hours of sleep gives you a chance of recovering your sanity after getting it to work after the upgrade forced by the next inevitable Sendmail Security FuBAR(TM). Note - it is a chance. Some people never recover. In other words there is a reason for the upside down bat to be the sendmail logo. That is the way a sysadmin looks like after dealing with it. No matter how much I dislike some of Exim sillies I would stick with it.
fscking moderators... (Score:5, Insightful)
(http://www.livejournal.com/~tassach/)
Face it: by any rational standard, sendmail sucks. /etc/sendmail.cf is so obfuscated that makes the Windows registry look simple by comparison. It's track record for security is as bad as anything coming out of Redmond, and has a similar track record for releasing patches which break more than they fix. Fortunately for mail administrators who aren't masochists, there is Postfix. Now if only some of the major Linux distros *cough*redhat*cough* would use postfix as their default MTA, life would be better.
The parent poster is also correct in that Microsoft has made important contributions to ITEF and other open standards boards. They do occasionally manage to do the right thing, even if it's because the engineers managed to sneak it out the back door when the marketroids weren't watching.
Re:Submitter and Editor didn't RTFA (Score:5, Informative)
(http://www.lemming.be/)
The article only states "Microsoft is one of several companies who are also working to combat spam with a "caller ID" system. Yahoo's DomainKeys is another one."
The article [sendmail.com] on the Sendmail site says "By incorporating a selection of sender authentication technologies into these applications, Sendmail aims to significantly hasten the global adoption of mainstream authentication initiatives such as DomainKeys, recently introduced by Yahoo!, as well as proposals put forward by Microsoft and others."
A Sendmail press release [sendmail.com], also released today, does mention the collaboration of Yahoo and Sendmail: "Sendmail, Inc., the global provider of electronic message management solutions and Yahoo! Inc. (Nasdaq: YHOO), a leading global Internet company, will begin testing the DomainKeys. cryptographic authentication solution in March 2004."
Re:Perspective.... (Score:5, Informative)
source, http://www.sendmail.com/sender_auth.shtml
-CPM
again NOT new features (Score:5, Insightful)
PS: I actually turned this on one time to get rid of spam, blocking a whole bunch of legit email in the process. Ooops. hello internet just enforce the tools that you already posses.. nuff said.
--jboss
Re:Gee this isn't biased (Score:5, Insightful)
(http://www.zenfar.com/ | Last Journal: Friday February 25 2005, @05:16PM)
Which version (Score:3, Interesting)
Re:Which version (Score:4, Funny)
(http://www.djesi.ba/~aidin | Last Journal: Friday July 23 2004, @08:30AM)
Re:Which version (Score:5, Funny)
Read the ...article? (Score:4, Funny)
What is this ...article you speak of?
I see why MS did it (Score:3, Funny)
Re:I see why MS did it (Score:5, Informative)
Apparently, 60% of the world does.
Re:I see why MS did it (Score:4, Funny)
(http://flaver.com/)
especially when fully compatible alternatives like Postfix exist and have been around for years
Re:I see why MS did it (Score:5, Informative)
For many people postfix or exim work very well, and should be used over sendmail. But in a larger environment, sendmail is the standard. Qmail, well, I've never liked it.
Re:Could this be the end of spam ? (Score:5, Insightful)
(http://slashdot.org/~gmack/journal)
It will also put an end to using a free email account to recieve spam replies.
So it's not a cure but it will make the game more expensive for the spammers.
Re:Could this be the end of spam ? (Score:5, Informative)
In fact, if you search the /. archives, you'll find a somewhat recent article.
For the average /. reader who can't be bothered to RTFA, the short of it is that works like a reverse MX record. Only hosts listed in your SPF (Sender Policy Framework) rules (published in DNS) are considered allowed senders of email from your domain. Recieving MTAs can then make an informed decision on whether to accept mail that has an envelope sender from you domain, based on whether the sending host is listed as permitted. This means that for any domain that is publishing SPF rules, spoofing the sender address while using an open relay/M$ zombie box becomes impossible, as long as the receiving MTA checks SPF.
It won't put an end to spam, but when enough domains have implemented both publishing SPF rules as well as checking them for inbound mail, it will cause severe headaches to the spammers, and cut down their arena significantly. Best of all, if there ever are any false positives that are rejected, it's due to the originating site policies, not the receiver's or middleman (as the case easily is with distributed blacklists)!
Re:Could this be the end of spam ? (Score:4, Interesting)
(Last Journal: Wednesday March 27 2002, @09:26PM)
Shoot, man! That's what SMTP Auth is for. Most of my "roaming" users use it. Those that don't, use webmail. Talk to your mail provider. They probably have a solution similar to this (it's been around for a while now).
Subject: Check this out
Response - This subject is commonly used in Virus e-mail, bounced back to me.
Now *that* is screwed up. Just like people of set up their mail servers to bounce any email containing the word "viagra", the potential for false positives is too high.
Talk about your odd couple. (Score:3, Insightful)
(Last Journal: Tuesday December 19 2006, @05:12PM)
Just my opinion.
Re:Talk about your odd couple. (Score:5, Interesting)
(http://arstechnica.com/journals/linux.ars)
I don't [cert.org] think [cert.org] they're that [cert.org] different [cert.org]. Sounds like a match made in security hell.
Soko
Re:Talk about your odd couple. (Score:5, Informative)
If the SPAM isn't lieing about where it's coming from then it's easy to block all SPAM from a web server, notify the offending servers admin if possible, get the spammers accounts revoked, etc.
I don't know, am I missing something? The problem isn't that this won't help, the hurdle is getting the modification to the protocal accepted and used widely.
Re:Talk about your odd couple. (Score:4, Interesting)
(Last Journal: Saturday June 30, @01:22AM)
I do this all the time, I send mail through whatever SMTP server for the ISP I'm currently connected to, but my email address is always the same, and the email domain is my hosting provider, which is not my ISP.
They better not fuck things up for people that don't always use their ISPs email address, or have more than one ISP.
Re:Talk about your odd couple. (Score:5, Informative)
(http://www.nodomain.org/)
Basically forging email addresses is going to have to stop, just like using open relays had to stop years ago. SMTP AUTH has been around for years & every mailserver supports it.
Re:Talk about your odd couple. (Score:4, Informative)
Not sure if the Microsoft/sendmail suggestions work the same way.
Good job Microsoft! (Score:5, Interesting)
(http://seventhcycle.net/)
I posted an idea similar to this on slashdot here [slashdot.org], which would essentially involve sendmail digitally signing messages that it sends and then having receiving mail servers verify it. I think most of the people who read the idea misinterpreted it as forcing us to get digital certs through verisign, which was NOT what I was implying.
See, now this is a much better idea than "email postage" and "computationally expensive" sending of email. This way, the accountability falls down to individual email addresses, and domains for sending UCE.
It's FAR easier to track emails and their likelyhood of sending spam than the actual messages themselves (after all, buyviagra@biggerpenis.org is most likely sending you spam).
This, combined with a spam filter could do the trick.
Congratulations Microsoft for actually partnering with somebody who matters is this whole affair. I'm hoping the other companies like Yahoo and AOL follow suit with this strategy, and a solution becomes standardized.
Re:Good job Microsoft! (Score:4, Funny)
Hey, that's *my* email address!
Re:Good job Microsoft! (Score:4, Informative)
(Last Journal: Monday August 16 2004, @09:50AM)
You didn't read the article, did you? Go RTFA
"Microsoft is one of several companies who are also working to combat spam with a "caller ID" system. Yahoo's DomainKeys is another one."
Re:Good job Microsoft! (Score:5, Informative)
(http://slashdot.org/)
Even better, such a solution is implemented at the server level, it's transparent to users, and it's backwards compatible (you could still configure your server to accept unsigned mail, or just filter it more aggressively), making gradual implementation a possibility. So there's a good chance it could catch on if major ISP's were to adopt it.
I confess to not having thought through all the details, but something along these lines is probably going to be the answer. Makes a lot more sense than any of the "pay per message" proposals, that's just Libertarians Gone Wild.
Re:Good job Microsoft! (Score:4, Insightful)
Requiring a cert to run a mail server is NOT a heavy burden,
Personally, I don't think it's even necessary. I doubt that spammers will start doing man-in-the-middle attacks or DNS manipulation (not because they're morally above it, but because of the technical expertese, legal exposure, and risk of being caught and traced). So just make up a cert and stick it in a DNS record for your domain. No PKI needed => no payment to get your cert.
Re:Good job Microsoft! (Score:4, Informative)
You are. 5% is way too high, it's more the
Re:Good job Microsoft! (Score:5, Interesting)
(after all, buyviagra@biggerpenis.org is most likely sending you spam).
That statement would have made sense in 2002 perhaps, but today a _very_ large portion of email is sent through hijacked machines.
It's just as easy for the hijacking spammer to sign the outgoing email on the hijacked machine.
Consider it similar to a telemarketer that goes from house to house to find unlocked doors. When the door is open, he goes in and makes the phone call from the phone in the residence. The caller ID is not going to identify the phone call as a telemarketer call.
In the real world this would be absurd, but unfortunately there's tons of machines out there with SMTP backdoors.
Re:Good job Microsoft! (Score:4, Interesting)
(http://www.highprogrammer.com/alan/ | Last Journal: Saturday April 29 2006, @04:33PM)
When people discover that they've been sending out Viagra spam, pissing off their friends and embarassing themselves in front of coworkers, they'll suddenly have a personal understanding on why security is so important. They will scramble to fix the problem to limit the damage to their reputation. When it is explained that they infected themselves by running that screensaver they got through email they'll not do it again. When it becomes endemic they'll start screaming at their software providers to stop shipping buggy crap and to make things secure by default. It may be a messy road, but it will eventually work out.
Re:Good job Microsoft! (Score:5, Insightful)
(Last Journal: Sunday October 03 2004, @04:03AM)
Microsoft may actually produce something that benefits the community as a whole. Seems incredible, but...wow, if we owe having a *good* email infrastructure to Microsoft, the world will be standing on its head.
Anyone have a link to a good technical description of Microsoft's proposed system?
Thanks -- my take on Caller ID (Score:4, Interesting)
(Last Journal: Sunday October 03 2004, @04:03AM)
Sigh. Trust Microsoft to release their techncial information in
The Microsoft solution is not actually very different than SPF. It aims at doing pretty much the same thing -- identifying outbound mail servers for a domain in DNS, and disallowing mail from any mail servers that are not listed in DNS. I *still* feel that this approach is a hack and is going to have undesireable long-term effects.
There are some things to be said for the Microsoft approach, though. It seems to be basically a "better SPF". They considered a number of implementation issues that I was upset over in SPF. They talk about DNS caching and security implications of DNS as a transport mechanism. They address server migration, and provide an attempt at dealing with multiple apparent identities -- one that I feel isn't really sufficient, but which Microsft, being Microsoft, might manage to pull off through control of Outlook.
Having read the SPF proposal and the Microsoft proposal, I do think that the Microsoft work is a lot more mature and builds on SPF, and is a better overall solution.
If one of the two must be implemented in the short term, I would prefer Microsoft's work.
I still think that Microsoft's Caller ID is still vulnerable to a number of SPF holes (such as throwaway domains). I am more than a little irritated, since Microsoft is really the only single player capable of promoting a PKI scheme (given that they control a major mail server and the major mail client). Furthermore, migrating to a PKI-based system would provide reasons to upgrade to new versions of Microsoft software -- pushing PKI makes excellent business sense for Microsoft. My guess is that Microsoft needed a solution *now*, given that they were facing SPF deployment, and wanted to fix some of SPF's problems rather than gambling on a full retrofit of the email system.
Submitter didnt RTFA (Score:5, Informative)
MS is a footnote. Aside from headline, the article mentions nothing about an 'alliance' or even Sendmail and MS working together.
Re:Submitter didnt RTFA (Score:4, Informative)
The sky is falling (Score:5, Funny)
(Last Journal: Wednesday August 27 2003, @02:48PM)
Re:The sky is falling (Score:5, Informative)
(http://www.haeleth.net/)
Even if you don't count the French Revolution, doesn't the Norman Conquest count? French invade Britain, French win, Britain ruled by Frenchmen for several hundred years. I'm pretty sure William of Normandy was French, and I'm pretty sure the Americans didn't intervene in that one.
Re:The sky is falling (Score:4, Interesting)
(http://slashdot.org/)
The Normans were regarded even in their day as Vikings with a veneer of French civilization. They were regarded as the equivalent of 17th and 18th Century Russians, who, due to their rather unsanitary personal habits, were regarded by courts in Europe to be "baptized bears".
So, in the final wash, it was Yet Another Viking Invasion Of England, albeit this one more successful than the others because the family stuck around for a while (until Richard III, in fact).
qmail (Score:3, Interesting)
(http://millahtime.blogspot.com/ | Last Journal: Friday July 15 2005, @01:00PM)
Re:qmail (Score:4, Informative)
See also.. (Score:5, Informative)
Why Sendmail ,why? (Score:5, Funny)
(Last Journal: Monday February 27 2006, @09:54PM)
Not going to fix it (Score:5, Insightful)
A crap load of junk mail comes from insecure personal computers that were hijacked. If these computers send their junk mail, and this system tracks them, it will send the "A-OK" because the mail came from where it said it did.
This will help, no doubt. But fix the problem? No.
Re:Not going to fix it (Score:5, Informative)
Re:Not going to fix it (Score:5, Informative)
And there's your problem... (Score:5, Insightful)
(http://www.openwin.org/mike)
And therein lies the problem. No vendor, no matter how well placed, should just run off and try to implement a solution. Why? Because odds are good it will not take off. Everyone involved needs to agree on a solution THEN implement it.
A Phased approach (Score:5, Informative)
(http://jm-smith.com/)
As with any change to infrastructure, the conversion is likely best done in a phased approach.
Step 1: Impliment authentication, but don't block messages from unauthenticated servers.
Step 2: Adjust existing SPAM filters to weigh mail from unauthenticated servers as having x % (where x is initially some relatively low number) greater liklihood of being SPAM than messages from authenticated servers.
Step 3: Increase x gradually over time. At the end of some period (say, one year), x appraoches 90%, effectively blocking most mail not on whitelists from unauthenticated servers. Leave x at this high value for some time (say another year)
Step 4: stop accepting mail from anauthenticated servers completely.
End of SPAM? Probably not (as SPAM mailers can authenticate themselves, and Microsoft WORMS and Viruses can hijack legitimate mail servers which authenticate themselves and send SPAM anyway) but it is a start.
End of what? (Score:5, Funny)
(http://www.orlandi.com/)
Dunno... but it could be the beginning of the end of sendmail. Not that it would be a bad thing...
There's much better [postfix.org] software [spamassassin.org] out there.
Re:End of what? (Score:5, Insightful)
And, as far as postfix being better than sendmail...sendmail has a bad rap because it has been around the longest...
Yes, some older versions of sendmail had security problems. Yes, sendmail has some feature bloat...
But, sendmail is the MTA of choice for UNIX distributions...sendmail is probably one of the most configurable of all MTAs (that also makes it one of the most difficult to configure)...mainly because of its past, sendmail is good in a different way than MTAs like postfix...
Eh? (Score:5, Funny)
(http://www.realistic-dragon.co.uk/)
Sounds more like the end of the world than the end of spam to me!
this is low, even by /. standards (Score:5, Insightful)
(Last Journal: Wednesday October 16 2002, @11:21PM)
It tells of Sendmail launching a plugin for sendmail, and then :
"Microsoft is one of several companies who are also working to combat spam with a "caller ID" system."
Does anyone RTFA anymore? Am I alone in this? Is god really a abnormally large crustacean living on the moons of Jupiter?
Appropriate question.. (Score:5, Insightful)
(http://ck-gunslinger.deviantart.com/ | Last Journal: Thursday July 08 2004, @01:17PM)
I wonder how this works... (Score:4, Funny)
The era of spam is over! (Score:5, Insightful)
Yes, just like computers have made the era of office paper end (I enjoy my paperless office, do you?), and how Bill Clinton in 1995 ended the era of big government.
Sooo.... (Score:4, Interesting)
Just imagine... (Score:3, Funny)
(http://homepage.urbanet.ch/aborel)
Sendmail AND MS? (Score:4, Funny)
until you plug it in..
(Flamebait to induce conversation.. calm down)
Hi, I'm Bill Gates (Score:4, Funny)
A better article (Score:5, Insightful)
back in the day (Score:5, Interesting)
(http://www.angrypeoplerule.com/)
Spammers used to buy a T1's worth of phone lines and then dial in to several different ISP's all at once and use THEIR mail server to send spam. With the advent of easily hacked broadband connections, this isn't required anymore. I can see it popping back up pretty quickly. While the idea is OK, spammers are adaptable. The ONLY way to make spammers stop, is to make them feel pain and this solution doesn't provide nearly enough pain.
For instance, I ws joe jobbed, I recieved about 2300 bounced messages advertising various web sites. For every bounced message I forwarded a 900k graphic that said "Do not use my return address in your spam campaign, it is illegal". Since I recieved another bounced spam before I had finished responding to these kind people, I decided perhaps another avenue of communication was approriate. I posted an order on each of the three websites I found advertised 2300 times (PERL w/LWP). Since I was unable to get a response via e-mail, I figured that I would get a response via an order form. I posted 2300 times(one for each boucne) with my contact information and a request to not use my e-mail in the shipping information box.
What happened?
1. one of the mail servers stopped responding all together. It didn't come back up for more than a week (qmail queue default lifetime anyone?)
2. During the post to these web sites (ALL on hacked machines running open proxy servers) the web site went down and stopped responding. I guess the concurrency of 2300 was a bad idea.
It appears that my e-mail address is no longer being used, although their websites finally recovered about 8 hours later. These web sites no longer accept orders from my IP address. No imagine if only 1/2 the people that recieved a spam did what I did? Think of the number of bogus orders that have to be sorted to simply get to a legitimate one? Think of the amount of traffic going INTO comcast and RR to these hacked machines (waving flag over here, over here LOOK LOOK security@rr.com!). Of course this would take time, and we alreayd have precious little of this. If enough people took the time, we would also have precious little spam. The cost would be too high.
AngryPeopleRule
similar solution already available (Score:5, Informative)
(http://www.only4christ.de/)
sendmail fun (Score:5, Funny)
HReceived: $?sfrom $s $.$?_($?s$|from $.$_)
HDate:@@_$_$?sfrom^*$%#%!*(()^&^&*#$##
$%@$#%&&_%#__&^#$%_#$%%___*(__Y_JY_*_*(_#$%#_
#@$@@#sonofa@#$%@@#@#$#
I know it just looks like line noise but this is a working config!
Re:sendmail fun (Score:4, Funny)
This will fail because (Score:5, Funny)
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
(x) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
(x) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Article doesn't say they're working on same thing (Score:5, Interesting)
(http://www.alvestrand.no/harald/ | Last Journal: Sunday September 09 2001, @04:21AM)
A lot of other people are pushing a solution called SPF, which involves putting text "code snippets" into the DNS telling you how to check the MAIL FROM: envelope return address.
This topic will be discussed at the IETF next week in Seoul, Korea. Hot topic!
Some more info here.... (Score:4, Informative)
(http://mail.communigate.com/~ab)
DoS attack anyone? (Score:5, Insightful)
(Last Journal: Friday October 18 2002, @11:25AM)
Doesn't this just sound like a great way to create a DoS style attack?
I: Flood many servers with email supposedly from server X
II: All servers attempt to contact server X
III: Server X crashes/is overwhelmed with requests, stops responding
IV: Some of the orginal servers might get hung trying to clear email from Server X, now no longer responding...
I admit that IV seems avoidable, but I-III don't seem like a big strech based off of prior MS security exploits...
Solve the problem at the SOURCE (Score:5, Insightful)
I'm thinking not...
How about making all spam a crime and holding the companies who finance it liable. Then giving consumers the power to sue for damages.
I'm not an ISP, under CAN-SPAM I can't do ANYTHING about the over NINETY THOUSAND spam messages sent to my server per month.
Needless to say, my poor little PII-400 linux box gags and chokes during spuratic 'floods' of spam through each day.
I must say, though, any efforts to thwart spam are good in my opinion. However, the problem will _never_ be solved until the companies PAYING for spam are held financially and/or criminally liable for their actions.
After all, if you PAY someone to commit murder for you -- does that make you any less guilty?
No.
MS + Sendmail = The Spam Problem (Score:5, Interesting)
At an old job as a firewall engineer, I had to tell the Exchange Admin for a major medical insurance provider HOW to set up our AV server as their relay. I found it on Google faster than she could fumble through her documentation. At another site, I had to battle an NT/Exchange admin who, after moving the Exchange server to an internal network, wondered why he no longer could receive mail.
MS and Sendmail owe everyone on the Internet countless hours of lost time due to idiotic softawre config problems, its about time that they came up with a solution.
Article not very informative. (Score:5, Interesting)
SPF is basicly a reverse DNS lookup on SMTP servers if I understand it correctly. Basicly under the plan to send mail you have to have a registered SMTP server in DNS so that your mail can be traced back to the sending SMTP server. No SPF records then your mail is most likely spam and can be discarded at the client or even at the POP server. Heck I suppose even SMTP servers could refuse to forward such mail. Will not eliminate all spam but it would halt the span-in-can email virus like SoBig that makes every Winblows box into instant spam machine. It would also stop spoofed email that causes so much headache.
Very needed plan IMHO.
Can I still use my own mailserver...? (Score:5, Insightful)
(http://sekai-isshuu.blogspot.com/ | Last Journal: Monday August 14 2006, @09:26AM)
If so, this will bother me to no end. I currently have two main email addresses, one using Cluemail [cluemail.com] and one using MyRealBox [myrealbox.com]. I check both of these addresses using IMAP with MacOS X's Mail.app. However, since MyRealBox is an experimental server and is not always up and since the free accounts on ClueMail don't have SMPT access, I am using my own machine running QMail to send my emails. Obviously my IP and whatever domain gets assigned to it from So-Net (yay Fiber Optic connection to the apartment!!) do NOT match either of my mail addresses.
So, will something like this spam solution break my set-up?
Disclaimer: I am somewhat clueless about all of this. I only know enough to have been able to set my machine up securely so it is not nor can/will not be a source of spam. So, I appreciate any information. Cheers. :)
The way to get rid of a lot of spam... (Score:3, Interesting)
A large portion of the spam I receive doesn't have my address in the To: field. Why doesn't mailer software look for this kind of mail? Am I missing something?
Sending from home? http://slashdot.org/users.pl (Score:5, Interesting)
(Last Journal: Friday December 01 2006, @10:51AM)
Re:Sending from home? http://slashdot.org/users.pl (Score:5, Insightful)
(http://linuxhomepage.com/)
The issue you face is one of "identity distinction". By being on Comcast Cable, you appear to be one of the unwashed masses. Whether your system is secure or not isn't known, and isn't practical to find out (trying to actually crack your machine to see if one can get in, to refuse mail if the crack succeeds, has certain legal risks).
You can distinguish yourself by making your email address known and others can whitelist it. Of course that's only good up to the point that spammers start to joe-job you using that address (which may not be for quite a while). Another way (which won't work with Comcast because they are so clueless, but could work with some other ISPs) is to get static IP and arrange for reverse DNS to identify your domain name. Some (I do, for example) block Comcast based on the domain name (easier to manage than a bunch of IP address ranges), which means if your IP didn't have comcast.net on it, it might get through. And if you do have a static IP, you could just ask for that one to be whitelisted.
There are also message content ways to distinguish yourself, such as cryptographically signing your message. But the problem here is that mail servers have to accept all mail first to see that signature. That breaks the ability to refuse during the SMTP RCPT command; refusing at the DATA command not only means wasting the bandwidth always on every message, but also the inability to let users separately whitelist, or means sending bounces to unverified addresses (bad). If they would redesign SMTP to provide the crypto signature during the SMTP session, that would help a lot.
Probably the best solution is to subscribe to a mail submission service (e.g. someone who has a colocated mail server and takes your mail only via authenticated SMTP or MSA). Then the fact that you're on Comcast is hidden deeper in messy RFC headers.
My Karma for their Karma (Score:5, Interesting)
I know I'm blowing my karma points on this one, but I believe it's justified and realistic.
No business partnership or alliance of any signficance has existed with Microsoft that resulted in a mutually beneficial conclusion. To put it another way, it's like trying to make a deal with the devil.
I don't expect that sendmail will be summarily destroyed as such. But I ernestly and honestly believe that the final outcome of this venture will only result in Micorosoft obtaining an absolute choke hold on email.
To expect anything less is niave and ignorant. There is no past performance which disputes this claim. Even considering legal judgements, Microsoft will not hesitate to make "all your email belong to us".
I apologize if I come off sounding like one of the slashdot anto-microsoft zealots, or some conspiracy theorist. But think it through.
Microsoft develops a means by which all email must be reverse authenticated as to the sender. Believe me, they will patent it and everything that looks like it before the night is over. This sounds great, but then all they do is just modify the email servers to require that this proprietary reverse authentication take place or you can't send any email.
The fact that they are working with sendmail, the company and not the OS project, allows them to license this technology to a Unix platform. This allows them a foothold onto the majority of email servers, which are Unix based, and to establish the means by which they have complete ownership of all email transactions. And it will be a matter of time before sendmail.com has to turn over their assets to pay the licensing fees, but then maybe Microsoft doesn't want them able to pay the fees.
Yeah, Spam sucks. But get a clue! Spam filters account for 99+% of all the spam out there. I would rather have my 1 spam a week out of 600 then to have Microsoft telling me I have to pay royalties to send email. There is nothing cool or encouraging about this.
And the real problem here isn't the spam, or the cost of sending spam, they haven't done anything to reduce either one of these. The problem is the adolescent pimple-butts who really think that herbal viagra will give them a 36" schlong that lasts all month long. Do you really want that? It's hard to pee standing on your head!
wont stop spam (Score:4, Interesting)
(http://www.gyrate.org/)
Re:wont stop spam (Score:4, Interesting)
(http://hircus.wordpress.com/ | Last Journal: Monday October 30 2006, @09:12AM)
It would be much easier to accurately blacklist [netsonic.fi] them, really. Currently some poor people get erroneously blacklisted by mail admins because spammers spoof their e-mail addresses.
Ironically for Yahoo's involvement in blocking spam, I was recently forced to switch my mailing list subscriptions from my Yahoo account because Yahoo's servers are considered insecure and some mail servers tag Yahoo mails as possible spams...
no solutions I can see (Score:3, Interesting)
(Last Journal: Friday November 10 2006, @10:38PM)
When you can register domains in bulk for $5, perhaps less, and can host the DNS for free or just a few dollars a year, how exactly is any DNS based verification system going to operate to limit spam? Al the spammers have to do is fudge up the zone file so that any verification system will succeede because the spamming server is "legit". The server may very well be anonyous or hacked or have 20 IP addresses.
I still say the single best solution to spam is for ISPs to start a policy of disposable email addresses. This is a relatively simple matter to impliment with Sendmail and a few CGI scripts, or even via email messages.
An end user is given lets say 8 email addresses. These addresses are never to be given out to anyone for email purposes, they are simply for sorting incoming mail among several family/household members.
Each account can have up to 50 aliases at any time. Aliases are created on the fly by the end user, and can be set to expire at some future date, or be removed manually.
When you go to sign up for a discussion forum you create an alias for just that forum, ex: gjslashdot@ispdomain.com. If you start getting spam on that address, you can simply delete it and create another one, there's no attachment to the address outside that forum.
I've been using this system myself for about a year and have gone from 500+ spams a month to 3-5 a month. Again... as soon as I get spam at an address, I delete it and create a new one if necessary.
What's causing the spam problem is human ignorance. Layering technological complexity on top of the existing system will not eliminate the underlying ignorance. My solution does that.
As far as corporations go.... get your email addresses off of your business cards, and stop using employee names as the basis for email addresses. If someone has access to an email client, they probably have access to a web client. Out-side emailers should use a web form to send email to employees unless there is an existing relationship.
Once there is a relationship, siret email can be used.
Email addresses on business cards... business cards handed out like candy on haloween... no wonder you get inundated with spam.
Big 3 Spam Solutions (Score:5, Informative)
(http://slashdot.org/ | Last Journal: Friday December 23 2005, @04:30AM)
(1) Caller ID is Microsoft's big proposal. Domain owners put XML in the TXT records in their domain. Receiving email systems can determine if a message is valid only after seeing all of the headers.
(2) SPF (http://spf.pobox.com/) is already implemented and is already blocking joe-jobs and phishing schemes. It relies only on the envelope FROM and the owners of the domain publishing a short TXT record. Currently, aol.com and many more domains (around 6,000?) publish SPF records. Implementations for filtering based on SPF exist in perl, python, C, and for Exim, postfix, qmail and sendmail.
There is a small problem in forwarding email properly, but that is being resolved with SRS (same website).
(3) DomainKeys (Yahoo!'s solution) is still being researched and is looking more and more like S/MIME or PGP but for an entire domain. The domain owners would publish the public key via DNS (probably a TXT record as well) and receving mail servers can verify that the message is indeed from said domain. There are some severe limitations: If someone gets your domain private key, you are screwed. It's also subject to a replay attack. The attacker would send a valid email to themselves through a server using domain keys, and then replay that message to the rest of the internet.
Both SPF and Caller ID can't work around DNS poisoning or IP spoofing. But they both limit the number of machines that are allowed to send email for a domain.
It is important that if you own a domain, that you publish SPF records - even if it is only "v=spf1 !all" or "I don't send any email for this domain". SPF, if it is going to be adopted, is going to be adopted at an exponential rate.
Caller ID is mostly Microsoft's response to the rapid success of SPF. They want to own the solution to spam, and they want to take credit for cleaning up your email box, even though their idea is really other people's ideas + XML. The protocol is heavy, burdensome, and subject to the whims of the XML interpreters out there right now. Plus, it is a huge proposal that is detailed and complicated, ripe for incompatibilities that could force users of Sendmail, Exim, Postfix, or Qmail to "upgrade" to Exchange.
Not a panacea (Score:3, Informative)
The one big problem neither system solves is spam from sources that are not forged, and actually have a valid return address. Nigerian spam gets through in either case, because an actual human is there. And sites that have a response-bot get through my challenge system (for the moment). These are the extreme rarity, of course, but if everyone used such a system then the spammers would just start using real verifiable return addresses all the time. It's easy to generate a new domain name every day (some already do) and get new IP blocks on a regular basis, so there's no easy way to automatically block email.
Even worse, spammers could still send out the email using zombies while putting valid return addresses in the spam so that it can be verified. They only need to hack their sendmail plugin to auto-verify any email with their return address on it and they can still use zombies all they like to send spam.
I think it's safe to say, as long as there's email, there will be spam.
more corporate control of internet (Score:3, Insightful)
Our LUG recently had a disucssion on x.509 certs and how it could be used to verify a mail server. If a mail server starts to send spam, the cert is revoked and can no longer send mail. This is more drastic, and leads to the same corporate control however.
Beginning of the End of EMAIL (Score:4, Insightful)
(http://slashdot.org/ | Last Journal: Monday January 31 2005, @05:48PM)
Certainly not. I do however predict it will be the beginning of the end of email. This is a perfect way to segment the email systems from one another; those that utilize this plugin and those that are discriminated against for not using this plugin. I for one will not use something that isn't a damned standard. You don't have to be an evil genius to recognize the evils of introducing non-standard requirements into such a critical system. It's just plain nuts.
minor correction (Score:3, Funny)
Powerhouse software vendor Microsoft and the venerable Sendmail, have formed an alliance
You misspelled vulnerable... HTH, HANDReally? You mean port 113? (Score:4, Funny)
Nah, this is an elaboration of the same thing but on the email port instead.
Slap a few new buzzwords on it as it goes through the door, of course... PKI! WMD! Cryptographic keys! 40% more trunk room! Compassionately Conservative (Less liberal than the leading brand)! Microsoft Windows Compatible!
Now it's sure to sell. Won't stink up the room as bad as old dead identd I hope.
so wil the fate of sendmail be that of.. (Score:4, Funny)
(Last Journal: Saturday October 07 2006, @07:46PM)
Usually when MS forms an alliance with someone for any reason they want to put them out of business somehow, but not sure if that would happen in this case. Isn't sendmail GPL or BSD licensed?
The question is (Score:3, Insightful)
So long as it allows for open relays (Score:3, Informative)
(Last Journal: Monday March 08 2004, @12:15AM)
MSFT Spam Protocol explained... (Score:5, Funny)
(http://www.assailant.org/ | Last Journal: Tuesday April 29 2003, @11:25AM)
The weakest link in the chain (Score:3, Interesting)
(http://bmiller.morpheus.net/)
Clippy Sez... (Score:3, Funny)
(Last Journal: Friday October 18 2002, @09:49AM)
1. define('confTRY_NULL_MX_LIST',true)
2. define('UUCP_MAILER_MAX','2000000')
3. define('confAUTH_MECHANISMS', 'EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')
4. FEATURE(`relay_based_on_MX')
5.