Slashdot Mirror
Instant Messaging Standards that Avoid SPAM?
nazgul@somewhere.com asks: "There are a number of proposed instant messaging standards under development, but I haven't seen any articles discussing how these standards plan to avoid spam. AOL's IM protocol actually has what I consider to be a pretty useful feature. You can 'warn' anybody who sends you a message, once per message they send you. The more warnings they get, the slower their messages get sent, until they can't send anything at all. What are the new IM proposals planning to do about SPAM? Because if we switch to a standard that doesn't have builtin SPAM protection, that standard will be useless." What kinds of privacy features do you think should be built into chatting protocols and programs of tomorrow? What chatting services and programs suffer from a lack of protection from Messaging SPAM?
"On AIM, everyone can see somebody's warning level, and warnings gradually wear off. Of course the warning mechanism depends on several assumptions.
- There are no rogue message servers.
- Creating an account requires a valid mail address.
The latter could be fairly easily defeated by building a large enough cache of accounts, and then rotating through them, but it would be difficult. The former can be defeated if we move to a multi-server instant messaging network."
Most chat services have built in protections for annoying users. Chat programs also may have some way of dropping traffic from unwanted users. For example, most IRC clients can use the /IGNORE command to drop what traffic they don't want from specific users. I'm sure that such functionality will be built into future chatting systems.
Problem is though, the warn is global so your messages become slower to *everyone* that you message.. Often times people will abuse the warnings (jokingly or otherwise) and you wind up having to wait a minute or more between messages.. a real pain. Also, the current AIM doesn't support offline messages, ugh.
Ignore doesn't do me any good at all when I'm never going to receive a message from them anyways.
I can't block all messages from people not on my list because that keeps me from hearing from friends.
How about letting me do something complex, such as:
If a user not on my list sends me a URL message, do not show me the URL message until they send me another message.
That simple rule would block every piece of spam I have received in the past 12 months on ICQ. All of them have been URLs.
Of course, once this is implemented, they'll start using normal messages. Okay.
If a user not on my list sends me a message containing a URL, do not show me the message until they send me another message.
To work around that, spammers would have to stop putting "http://" into their messages, which removes the clickable link that makes them so effective - "Click here!" - "Goto URL!". This would cripple the effectiveness of the spam, as many users who would click to view spam won't write down a URL and retype it into their browser.
Someday, perhaps. Sounds like a good feature to be implemented in some free ICQ clone, though.
I've got one word for you: Jabber.
-----
First of all, AOL's AIM has the BEST protection. You can deny messages from absolutely ANYONE who is not on your "allow" list or your Buddy list. This is an iron clad defense against spam in an IM system.
ICQ also has a similar defense system: under the ignore tab in its Security & Privacy submenu, you can deny any and all messages from anyone not on your contact list. You can also go to SMS Messages (this submenu is a peer submenu to Security & Privacy) and opt to automatically decline any SMS requests from users not on your contact list. Woohoo! Game over, spammers.
As for email validation - LOL!!! Listen, guys. Email validation is useless if you are an experienced user. Why? Simple. Suppose my IP address 1.2.3.4 translates to dsl-1.2.3.4.verizon.sucks.net. Doesn't matter what your IP/alias is, as long as it's dynamic, but I'll use this one for symbolic meaning. The thing is, you can:
1) download and set up a mail server on your Linux box;
2) tell the instant message server that your email address is user@dsl-1.2.3.4.verizon.sucks.net;
3) receive your confirmation email from the IM server;
4) respond to the email;
5) SHUT DOWN YOUR MAIL SERVER.
Badda bing, badda boom, you have your IM account and password and no valid email.
The defense against this is, again, the draconian allow/deny system used by AOL/ICQ.
========================
63,000 bugs in the code, 63,000 bugs,
ya get 1 whacked with a service pack,
--- Grow a pair, liberals... stop letting the Republicans bully you!
Also, try and make sure you are marked as invisible on IRC (/mode (yournick) +i) and you won't be able to be seen by spammers unless they join your channel explicitly.
Most e-mail clients or add-ons (procmail for Linux) feature the capability to filter based on different options. Outlook has a built-in spam protector, which works -really- good and it can detect Adult and advertising spam. They hid it under the Organize->Junk Email option.
You can then create a rule to move all your Junk Email to a certain folder. The accuracy is quite good and if something slips through you can tag it as spam and it will learn to detect its spam pattern.
Hope it helps! -Pat
AIM warnings are usless and encourge negative behavior. They are an agressive action and they encourage an agressive response from who ever was warned. Blocking someone is the ultimate f-you. It implies that ther other person isn't even worth your time or enegy.
I run a fairly popular chatterbot and the warning system used to drive me crasy until I wrote code to adapt to the aim rate limiting system and now it works like a charm. Anyway, I just wanted to say that warnings are a flawed idea that people who don't understand the full picture are easily convinced that they are good idea.
Leknor
Most IM systems under development could be extended to avoid spam without too much trouble. The problem is that these systems all use a centralised server/service, making your communication reliant on a single service, organisation, addressing system, whatever.
We have a perfectly valid architecture for messaging ... its called e-mail. Why aren't we extending e-mail servers to handle instant messaging (IAMOF SMTP already has IM capabilities of sorts in the SOML and SAML commands).
Its about time people thought of integration and simplification, rather than running off and writing newer and more complex protocols to force yet another icon/program onto my already cluttered desktop.
i-name =twylite [http://public.xdi.org/=twylite], see idcommons.net
...it's what I do for ICQ, and works pretty much perfectly. If people need to reach you and they're not on your list, e-mail and phone calls and fax (all of which provide enough spam to last a lifetime) will do...
--
Convictions are more dangerous enemies of truth than lies.
Convictions are more dangerous enemies of truth than lies.
- Nietzsche
One system proposed to avoid spam on e-mail should work pretty efficiently in IM systems too: Hash Cash. The senders computer is asked to solve a simple problem. This is no issue unless you send very very many messages.
I think IM standards are a Good Thing. We can't just mess with existing standards, with e-mail for instance there are too many different standards already. No, new chat programs come and die at a fast pace. Let's put HC into it and see if it lasts a little longer.
(not that that alone would help)
xkcd is not in the sudoers file. This incident will be reported.
__________________________
Happy Feces Boy
__________________________
Happy Feces Boy
__________________________
Happy Feces Boy
__________________________
Happy Feces Boy