Slashdot Mirror
Distributed Spam Detection
A reader writes "There's an interesting project at SourceForge, called, "Vipul's Razor", that uses a gnutella like
system to let users exchange spam "signatures" to filter spam. I work at an ISP in Ottawa, we have been using it for last two weeks to stop bulk of spam coming to our POP3 accounts. More impressively, it hasn't tagged any valid mail as spam yet.
Here's
the scoop from its webpage:
"Vipul's Razor is a distributed, collaborative, spam detection and
filtering network. Razor establishes a distributed and constantly updating
catalogue of spam in propagation. This catalogue is used by clients to
filter out known spam. On receiving a spam, a Razor Reporting Agent (run
by an end-user or a troll box) calculates and submits a 20-character
unique identification of the spam (a SHA Digest) to its closest Razor
Catalogue Server. The Catalogue Server echos this signature to other
trusted servers after storing it in its database. Prior to manual
processing or transport-level reception, Razor Filtering Agents (end-users
and MTAs) check their incoming mail against a Catalogue Server and filter
out or deny transport in case of a signature match."" Cool idea. I'm up around 80% spam a day on my main mail account. Might be worth a try.
I'm personally using SpamBouncer, a procmail-based spam filter. Works fine for me.
This is a great use of p2p -- something that doesn't involve piracy. I wish I had heard of it before.
Are there any other innovative non-piracy p2p apps out there that we should know about?
...what stops this from being abused? Say I set up a box that automatically reports all mails on the most popular mailing lists as spam, effictively making the ISPs around the world start to filter out the mailing lists...
It's a great initiative, I really hope no troll out there takes my word on this and actually do this.
I read some of the documentation, but I can't find details on a couple of questions. Do the servers authenticate with each other? It was implied, but how deep is it? Are the SHA signatures signed to the originating server (or client/trollbox) too? I think this kind of model is great, but if you don't have some nifty authentication/accountability, it can be wide open for abuse. I'm sure anyone reading slashdot can imagine a vengeful spammer flooding the network with bogus or malicious hashes.
funny munging
The people who came up with this idea deserve to be considered heros! This is one of the coolest uses of technology I have seen. (Not to be too gushing: SPAM is a rich mans problem - I hope someone comes up with some cool technological solutions to some of humanities more basic problems.) I run a server which hosts mail for a number of domains. I haven't yet, cause I just heard of it, but this will be used! There might be some interesting extensions based on possible problems: certain kinds of spam interest certain people. Perhaps a categorization system would be useful so that spam can be filtered based on these categories (for example, some people might like receiving 100 MLM spam messages a day :-P ). Also, there is an (extremely) slim chance that a legit mail might be blocked based on match hashes. Although this is extremely unlikely, could it be fixed somehow? Finally, some spam comes with very slight differences but is essentially the same spam instance. Chain letters are in a grey area. It would be good to have some heuristic methods of filtering based on content too. I don't know the characteristics of the hashing algorthm used, but perhaps by doing three hashes: start of message, middle of message, and end of message, it may be possible to identify spam even if a small part has been change.
Anyway, just some random thoughts.
Kudos again to those who have built this!
Helping with organizational effectiveness is our job.
Nothing truly insightful here, just speculation from a convenience freak.
-
And the Angel said unto me, "These are the cries of the carrots! The cries of the carrots!"
I'll post my usual public service announcements here:
SpamCop is a great service for reporting spam; just paste the spam message into the web form, and it'll automatically figure out where the smap came from and send complaints off to the appropriate people.
The Spam Bouncer is a procmail-based personal spam screening tool. It's got some interesting features, but I haven't used it in a long while.
The way I avoid spam is to have my mail client screen out any email which contains any of these phrases:
to be removed
to be permanently removed
to get removed
to get off the list
to get off this list
to be taken off
to remove yourself
removal instructions
remove in subject line
"remove" in subject line
remove in the subject
"remove" in the subject
'remove' in the subject
S.1618
S. 1618
This list by itself catches about 80% of the spam I get.
Razor catalogs spam by hashing the entire text of the message. Later potential spam is "detected" by hashing entire texts of messages to see if the hash matches any of the existing hashes in the spam catalog.
To get around this all a spammer has to do is change/add at least one charachter to each spam. This would make all the hashes unique and no spams would be detected.
I love costing spammers real money just got to
http://goto.com
and do a search for "bulk email" each link you click will cost the scumbags that sell spam software or spamming services several dollars each
Also I love this new technology I wish all isp's would use it
and for more spam fighting ideas please check out
http://www.lenny.com/spam
http://Lenny.com
4 great justice!
As far as I can tell from a quick glance at this, it looks like the entire message body is being used to compute the signature. This isn't going to work very well -- over half of the spam I receive is "personalized", and that fraction is growing every day.
This could work very well, but we need some way of computing signatures which will be invariant across different copies of personalized spam for this to be effective.
Tarsnap: Online backups for the truly paranoid
Although, i marvel at the theory and innovative use of peer to peer technology to achieve exemplary aims. I have some concerns about the possibilities of abuse, AFAIK the submission system for spam, is not moderated in any way. In fact only the hash is sent to the server and not a copy of the spam, i am therefore concerned that the system could possibly be abused by someone submitting the hash of a legitimate mail to the system that would then result in this email from being recieved by the other hosts. This could be done to prevent the circulation of bugtaq items, my a malicous user for instance. And as everyone has different personal opinions about SPAM and what constitues it, i think a set of clear guidelines is required and when submissions are made a copy of the mail is associated with it and a human being moderates the hashes being submitted. Although i have my doubts about the system, if these were put to rest i would have no hesistation in implementing a system like this.
Rob 'robster' Bradford
Debian Planet Guy
We are the apt. You will be packaged. Resistance is futile.
It does seem like a remarkably sensible system, just getting email clients to talk to each other about the emails they get.
You can tell if the same email has been sent to hundreds of people (and if you use hashes, you can do that without revealing the email)
You can click a "this is spam" button when you read an email, and anyone who trusts you (i.e. has your public key in their "trusted filtering friends" list) can look for similar messages and filter them.
But, there do seem to be a load of problems:
- Personalised email, as someone already mentioned
- Privacy problems with letting others into the secrets of your mailbox
- If you have the original of a message, you can calculate the hash, then see who else got the message (i.e. works for personal mail as well as spam)
- Relatively easy for malicious users to wrongly label someone as a spammer
Well worth investigating, though...
One question about this system that I hope the poster (or someone else using this system) will answer: what's it like on server load? Right now, at the ISP I work at, we're using procmail to filter for spam (check the graphs here: http://selenium.dowco.com/spam/spam.html). It's a good way of doing things, but there are some shortcomings: basically, since it runs on our mailserver, I can't run all the body searches I want; in fact, we had to cut out body searches recently because the load was getting too high and/or email was taking too long to get through. There's some workarounds that I haven't got around to putting in yet (body scanning only when 3k in size, etc), but you can see my point. Anyone?
Carousel is a lie!
search google for SHA digest, read how it works the take a good look at your question
This is probably a 'fuzzy' hash function that should ignore minute variations. However, it goes without saying that if this hash-based spam filter becomes widespread, then the spammers will simply figure out how to hash-bust their way past it.
To have any hope of working over the long term, this kind of an approach must include the ability to distribute not just the hashes themselves, but the hash function as well, so that the hash function itself can be adjusted, when needed.
.derf
In the first place, it's not 20 words, it's 20 characters. In the second place, those 20 characters are simply the SHA signature of the offending message. I assume they key on some of the more constant headers and (possibly part of) the body of the text. By the very nature of digital sigs, it would be difficult (impossible?) to key on something like "any post with the word 'carroway' in it".
To eliminate the situation where one person posts a lot of "incorrect" signatures, a ranking system could be applied.
./ moderation?
The thought goes like this.
A person submits a signature of "identified" spam mail to a "supernode" for ex. and the submission gets a ranking of 1. Each additional submission (by other users) increases the score by a number.
This way, there are several classifications which could be used to filter incoming mail. For the mail providers, they could opt for only removing mail matching signatures with a very high score (thus very likely these will be actual spam) or they could filter anything reported.
The purpose of allowing the use of classifications is that it will take longer time to get higher scores, since more people have to report the specific spam mail. Some people whish to eliminate things the least bit suspected, but mileage may vary.
Do you see a resemblance with the
In a society that believes in nothing, fear becomes the only agenda ~ Bill Durodié
Injecting random hashes into the network won't result in valid emails being tagged, but can flood/DOS the catalogue machines.
It would be possible to create hashes for a number of "probable" emails, but diversity in messages is so big, the chances are quite slim to actually stop a legitimate mail.
Okay... I'll do the stupid things first, then you shy people follow.
[Zappa]
You might be thinking of brightmail. I think that's what they do (to lazy to look it up)
autopr0n is like, down and stuff.
I always figured that the major problem with a system like this was randomized messages. I figured a way around it would be try to make a 'conceptual' hash of the contents, that try to analyze the meaning of the text, not just the data.
:). But redistributing the hash function when spammers figure out the old one is an interesting idea as well. The big problem is with the more technically savvy spammers (yeh, I'm sure they're are some out there, unfortunately) who could reverse engineer the hash to figure out what makes it tick.
The big problem with that, is well, it's not easy
autopr0n is like, down and stuff.
I'm using Mailwasher it works well for me. Allows you to preview your message headers, delete,blacklist and 'bounce' anything you dont want to recieve. Works well on spam as well as email from your ex-girlfriend.
Don't Tread on Me
This wont work. All that will happen is that the spammers will just modify their spam programs to slightly modify each message they send out. This will result in each message having a COMPLETELY different SHA signature.
Cool idea but wont work. Sorry. Maybe some kind of AI algrorithm.
Official GOD FAQ.
for abusers who report bogus signatures is to count the number of times each signature is reported and only consider a report valid after the count exceeds a threshold value. Real spam mailings would be reported many times each from distinct nodes and would be easy to distinguish from bogus signatures, which wouldn't be as widely reported.
Easy, automatic testing for Perl.
Spammers -have- been doing this for a long time, appending some randomly generated crap characters to the subject line, to avoid hash-recognition.
I noticed that a lot of spam coming through my Yahoo account had been tagged with the header "X-YahooFilteredBulk". I added this to my Exim system filter and I've gone from 20+ spams a day in my inbox to 2 in a week. Thank you Yahoo!
Unfortunately, a lot anti-spam measures (including Exim 3's system filters) only take place after a message has been accepted for delivery. For me, this results in a lot of bounce messages frozen in the queue as they cannot be returned (Hotmail mailbox full, etc). I've switched on features like verifying the sender and the headers, but this doesn't catch them all, and in some cases might even stop some legitimate spam (one of my mailing lists uses incorrect syntax for the "RCPT TO:").
More effective anti-spam systems need to filter before the message has been accepted. If you wait until then, it is already too late and it is on your system. No, refusing accept delivery is much effective IMHO, and forces the MTA's further up the chain to deal with it. They shouldn't have accepted it in the first place! When you get spam, return 550 (or whatever the code is) and let the SMTP client deal with it. In an ideal world, ever provider (ISP, or free service like Yahoo) will implement stricter MTA's. If the spam rejection can be pushed far enough up the chain, life for everyone will easier.
BTW, according to Philip Hazel (a message I recieved to a question I posed on the Exim mailing list), Exim 4 will offer much more functionality along these lines, including the invocation of C funtions after the DATA phase of the SMTP input. I guess this would be the spot to plug in Vipul's Razor, although I don't know what kind performance hit that would lead to. Mr. Hazel also pointed out that some stupid clients are in contravention of the RFC and will continue to try and delivery a message if they recieved 5xx after the DATA phase... oh well: they'll be using my bandwidth but they won't be putting any crap on my server.
What stops the spammer from including a unique identifier in each e-mail (such as a count variable), changing the SHA for each e-mail that goes out?
Just a thought...
http://kered.org
I wonder if Hotmail is using the same kind of logic. I mean, they allow the user to label which emails the user sees as spam. Then they can set somekind of threshold based on how many labels a signature has received.
When the threshold is crossed, then the signature will be categorized as spam to all other users.
It will work beautifully considering how many users they have.
And what good will that be? Are you planning some vigilante action?
I found a clever way to defeat most spam on the webpage of an avid cyclist; unfortunately I can't remember his name or enough information about him to run a Google search and give this method proper attribution. But here goes anyway:
The key to this method is to realize that most spam has a spoofed "To" address -- RARELY is it addressed directly to you. If you dig in the message headers, you'll usually found it was mailed (or CC'd) to a whole bunch of people at once, for obvious reasons. So you set up your mail filters thusly:
First, set up a filter allowing any "legal" mailing lists you're on to go to your Inbox.
Next, a filter to allow any mail sent directly to you (i.e. you@domain.com is in the To or CC lines) to go to your Inbox.
Finally, a filter that deletes everything else.
You'd be amazed how effective this is. Since setting this up, I only get maybe one spam message past this system every three or four months.
Mind you, I also have my email come in via Bigfoot, which has a pretty good spam filter itself. But this has nonetheless proven quite effective.
>> This wont work. All that will happen is that the spammers will just modify their spam programs to slightly modify each message they send out.
It will however require them to send each specific message separately rather than sending large cc's or using some sort of relay. That alone is a big step since right now most spammers can get away with sending a single email message and relying on an open relay to retransmit to a larger group.
Furthermore I have doubts that for the time being this project will concern spammers. Infact I am pretty sure spammers are not really interested in wasting their own time trying to spam people who consider spam a violation. It is more convenient to ignore those people (which is why they don't bother to check if you want spam or not before they send it to you).
DLG
To a degree, this can work. If the signatue was of the text itself. If it was based on long sentences being present within a mail, plus the origin of the mail (based on the connecting IP), this might have a chance.
Think of it, spammers would have to start hitting multiple mail servers which creates a lot of over head and is just silly, to get around this. That and spammers would have to use very very generic text to get by it. Like "Act now. We sell. Porn!. Natalie Portman!" vs "Come see our barely of age teens do really bad stuff."
-
ping -f 255.255.255.255 # if only
This seems like it would be a great method for virus detection on a non-Windows machine. For those of you who run *nix mail servers which eventually filters down to Windows clients, having a mail tagged as viral would be nice to have it be immediately denied at the server. So I'm assuming all it would take is a smart admin to tag the email as spam, and then it will propagate around to the other servers (less than 1k would transfer!).
Let me make an ammendment, a common IP, not necessarily the IP of origin. Someone could be behind NAT :) But then again, the software to figure out the common IP shouldn't be hard...
-
ping -f 255.255.255.255 # if only
It will however require them to send each specific message separately rather than sending large cc's or using some sort of relay. That alone is a big step since right now most spammers can get away with sending a single email message and relying on an open relay to retransmit to a larger group
:(
Most spam I get has my real name somewhere in the body of the message, so it doesn't seem like a problem for spammers
I spent the last few days hacking together a bulk mailer in perl. I did so with a lot of sensitivity and a bit of trepidation and a lot of social engineering to my employer who wanted to put together a way to send invitations to a party via email, rather than the very expensive snail mail method that we had been using.
This was emailed to our real customers - our 'A list'. These are the people who get invited to these parties each time - people who come and enjoy the food and drinks, no strings attached.
But, yet, technically, it *is* bulk email and this first time, unsolicited. A very large percentage of the people responded enthusiasticly that they want to remain on the list for this, but a few (8 out of 3500) asked to be removed from the list. One guy seemed annoyed and I typed him a personal apology. (In fact, I doubt that this guy read the email before sending off his remove request.)
What if that guy had submitted the email as spam to this system?
In that case, the rest would miss out on coming to a good party.
I hate spam as much as anyone on slashdot. I was asked to set up a bulk email and found that it could be done in a way that was not offensive in this case. Had it conflicted with my conscience, I would have refused.
Maybe the system needs some sort of moderation as a filter, too. At least that would allow valid bulk email to survive one trigger-happy end-user.
Ok, go ahead and tell me that I'm wrong in this...
Cheers,
Jim in Tokyo
-- My Weblog.
Well at least it *WILL* filter some of the bad content while leaving the good one clean, right now I receive 20 mails a day of spam in my hotmail inbox and the hotmail filter killed *VALID* messages! they keep junk for 2 weeks, I found that out 3 months later because my girlfriend posts would never reach me for the last few days.. and she's far from being a spammer.
:) ).
There's not perfect solution for spam (aside from killing every single individuals that dare spamming people, which unfortunately is still illegal
Legislation is too busy removing our civil rights right now than to make our lives better (as they should do). So right now, I'd say, ANY technology helping us to reduce spam should be welcomed and helped in a productive way instead of bashing on it without even giving it a try. It's an open project and it means that if you can contribute in a POSITIVE way, you should. Else, people, please don't discourage programmers working on something that could eventually come out as being a very good solution.
--- Metamoderating abusive downgraders since my 300th post.
I'll never get another "funny email" from my Mom again!
Many such tricks can be defeated by only hashing words that appear in some standard dictionary and discarding all else, such that
gets reduced to LIVE NAKED DRESSED GIRLS before hashing. Even then, the smart thing to do is not to block matching mail but to blackhole the sources of matching mail, preferably permanently. Humanity's more basic problems are the inability to cope with the concept of a world without scarcity. Would that technology fix that instead of providing the powerful with more ways to create unnatural scarcity.-jhp
/. -- the Free Republic of technology.
By filtering out mails that contain the phrase "this is not spam"
I've finally had it: until slashdot gets article moderation, I am not coming back.
Tom Geller
For the many /.ers who:
a. Use Outlook secretly
b. Receive loads of foreign spam
c. Don't know any foreign languages
d. Don't have any foreign friends
e. Don't have any friends
This Outlook rule is for you!
Apply this rule after the message arrives
with
Ô or ¾ or Ç or or É or ½ or Í or ò or Ë or ® or Ä or ã or Ï or Ö or Ô in the subject or body
delete it
and stop processing more rules.
This blocks 99% of foreign spam. Sue Mosher wrote about other effective methods for killing spam in Outlook. Finally, before you reply saying "You dummy, that filter works in any client!" -- You're right.
I receive about 40 spam messages in my mail account each day and I run my own mail server (qmail). Someone told me about a very basic spam stopping method. Just remove the mail-account for a couple of weeks and then reconnect it again, you should less or no spam after that period.
I receive too much real messages in order to try this out and I think most spammers won't bother to actuall remove an email address from their database if it doesn't exist. But has someone else tried this with any luck?
This p2p spam sounds really nice and I'm going to give it a try asap. I already "lost" an other mail-account in the flood of spam I got on it, so now it forwards all messages to msnbill@microsoft.com (microsoft domain billing address).
everytime spam gets mentioned on slashdot, someone says this, and everytime i respond with the work i've been doing-
pattern matching spam
uses word counts and phrase counts from known spam and known good mail to match against incoming mail. requires a certain amount of known spam/not spam, but otherwise it has a good rate of matching spam/not spam and doesn't require the incoming mail to at all known beforehand.
-f
www.blackant.net
Wow - you're taking that to the extreme. Do you shut out people who approach you in a room to talk to you because you didn't give them permission first? Pretty much the same concept.
If I email my bills to clients, but they didn't request them first, does that mean it's 'spam' and they don't have to pay it?
This company had legitimate relationships with current customers. If you can't email a current customer with information about something about your current relationship, then there's something seriously wrong with that definition of 'spam'.
Hmmm... I guess I'm not allowed to send anyone ANY email ever unless the intended recipient requested it first. If the 'real world' operated like some people want email to operate, the world would be a mighty dull place...
creation science book
I personally have never seen a single spam that has my real name. If I sign up on some website for something then certainly I can't be really suprised if folks from that website opt me in. Giving them my email and name and such is an invititation to recieving email unless they specifically state they will not send anything.
Much of the spam I do recieve is of the type where they are sending mail to all the DLG's out there for instance.
Also much of the spam I get comes through the email addresses that are on webpages... I infact will recieve the same spam several times a day. The only thing that might change is the subject name. (I have never understood why someone thinks that sending me 20 of the same exact advertisement overnight is wise..)
In any case, I don't know if this process will reduce all spam for all people, but considering that even with blackholes I still get a sizeable amount of spam, anything is worth trying...
DLG
This ad is produced and sent out by: AdAd Systems, NY, NY 1 1 2 2 2. To be r e m o v e d from our mailing list please email us at
harold02@musiclover.com.au with r e m o v e in the subject.
Note the spacing with the word "remove". I wonder if these guys read your post.
-- http://frobnosticate.com
I called him, and he was saying that it was un-American to stop spam. In my case, he He got the email address from a the prairielaw.com website, but it was too expensive for him to pay for advertising.
Maybe you'd like to discuss it with him.
Locators, Inc
888-595-9131 Toll Free
Fight Spammers!
I've been working on a similar project but using additional factors that help identify spam such as violations of the mail RFC's, and other header indicators, in addition to NLP. I have a prototype that I'm using to score all of my inbox e-mail and am using that to tune the weight factors and add in new factors as I encounter them. It would be interesting to combine your approach with mine I think, since I hadn't thought of analyzing trigrams.
Anyway, if you are interested send me an e-mail and I'll give you my current perl code.
LibBT: BitTorrent for C - small - fast - clean (Now Versio
I get a lot of email for Ass Hole, Fuck You, Die Spammer, and other such people I've never heard of.
An Education is the Font of All Liberty
See also DCC, the distributed checksum clearinghouse. It uses a fuzzy hash so that bulk emails with minor differences are caught. I think the details differ a lot but the idea is more or less the same.
Recently, though, SpamCop switched to a heuristic spam-filter, which is quite leaky. Not only does spam get through, messages from well-known viruses come through. It stops maybe half the spam now.
So SpamCop is now no more effective than typical procmail filters. So there's no point in paying for SpamCop service any more.
Anyone know of a good challenge/response alternative to SpamCop?
you can find some scripts here
http://www.lenny.com/spam
http://Lenny.com
4 great justice!
Some of you point out that Razor's use of SHA-1 signatures can be defeated by introducing randomness in the message. This is true; SHA-1 will eventually be phased out and replaced by a fuzzy hashing mechanism like nilsimsa in future. [http://lexx.shinn.net/cmeclax/nilsimsa.html] [http://www.geocrawler.com/archives/3/2539/2001/7/ 0/6173567/]
The protocol is structured to aid change of
hashing algorithms seamlessly, without breaking
the existing system.
Regarding the possibility of poisoning the database, we are working on a reputation system
that will assign credit to honest reporters.
Once we have a critical mass of users, it would
be hard for dishonest reporters to even join
the reporting network, much less be able to
mount a DOS attack.
Some of these issues have been discussed on the
razor-users mailing list. The list archives
are located at
[http://www.geocrawler.com/archives/3/2539/2001/]
best,
vipul.
The comment made in the submission states that Razor is gnutella-like. That is BS too; if anything, it's Napster-like. Razor is a centralized, collaborative filtering system. One could argue that Razor's master servers are distributed and that the entire system is therefore not fully centralized, but this will change shortly to a master/slave model, which will allow the introduction of a reputation management system.
Keep your eyes peeled.
--jordan
------
If you have O2002, you can do something similar by whitelisting. "Whitelisting is the opposite of blacklisting. Whereas the latter bans messages from certain senders, whitelisting accepts mail from specific senders."
"The new feature is an additional Rules Wizard condition: "sender is in Address Book," where you choose the address book--I've chosen my Contacts folder. For a message from a sender found in my Contacts folder, the rule applies a "known sender" category and stops processing the message. The "stop processing" action ensures that the message stays in my Inbox. Another rule at the bottom of the list moves everything that previous rules didn't handle into my Junk Mail folder for later review."
How do you do this with PINE/procmail? I'd like to stop using Outlook.
I don't know how an ISP would accomplish this, but when a user sets it up, it's easy: filter your mailing lists first.
THEN filter the remaining mail.
The remaining mail SHOULD NOT contain any mailing lists, or other generic mail, just personal stuff.
Wait-- here's how an ISP sets it up: don't delete the suspected spam, just add a header. The user's client can filter it, hopefully after it handles mailing-list mail.
firstly, I would have emailed you cuz I didnt want to discuss this on /. but since I dont troll I can sacrifice some karma :)
:)
anyway, I guess the biggest gap in our opinions is over good spam. UCE from respectable, reputable people to me is a good thing. They are the companies I send my money to.
If someone on the bugtraq list came up with a commercial app that he wanted people on the list to beta test for him I would consider doing it. If he later offered it to subscribers (as before, via the list) at a substantially deep discount I wouldnt mind that either.
My two examples up there are figurative, as opposed to the literal ones I gave you the first time.
Victoria's Secret sends catalogs to my g/f, Thinkgeek sends me pamphlets and Cisco sends product announcements and specs. I like em all. I hold them in the same regard. Spam can be good...but not often
Opting-out is not a valid mechanism, because as you know many spammers use opt-out responses as a way to maintain their lists of valid email addresses.
You are correct, but my point is that for those of us who dont rely on spamming as our sole source of income, it's done responsibly. IOW there isnt a volture waiting for all those opt out emails to come in so he can sell them at a higher premium. I like to think that for most private corps that do these things (like mine), opt out means opt out.
from the original post that got us both going...
This was emailed to our real customers - our 'A list'. These are the people who get invited to these parties each time - people who come and enjoy the food and drinks, no strings attached.
BOSTON SUCKS!
They aren't trying to answer the question "should this particular piece of e-mail be considered spam," but rather "is this particular piece of mail identical (to within some factor) to one that some human considers spam." So they don't need to train anything, they just store the hash-signatures of the spam that is currently making the rounds.
Even if someone mistakenly identifies a piece of mail as spam, it won't hurt anything; the odds are very low that it will ever match another piece of mail in the entire history of the cosmos.
-- MarkusQ
Yes! In fact, why not have many fuzzy hash functions floating around at once? That way, their task would be to come up with something that yielded a different hash against all of the hash functions at once, a much harder problem. If some spammer figures out a way to do it, an anti-spammer can devise a function (looking at lots of copies of the spam, which shouldn't be hard to come by) that would catch it, and now that trick won't work any more.
Distributing the functions with the hash (with a few safe guards, e.g. re: the halting problem) would make this darned near imposible to beat.
-- MarkusQ
Think of it like dumpster diving -- sometimes you
discover good stuff in there.:
Seriously, the trick is making legit mail easier to find.
So in addition to the whitelist, you need more filters:
- Filter mail sent from [family addresses] to family folder
- Filter mail sent from [friend addresses] to friends
- Filter mail sent from [*@work.com] to work
- Filter mail with subj [ebay] to ebay
- Filter mail with [foreign strings] to junk AND color it Gray
- Filter mail with [spam criteria] to junk AND color it Gray
- Anything else goes to junk for review
Key rules are #5 and 6, which color spam appropriately.Now it's easier to review your junk folder, because real mail is most likely colored Black.
Add one more rule, to be checked after you send a _reply_ to a legit msg:
I had a thought about this a little while ago. What if you only accepted mail from people that included their PGP fingerprint, and then only the particular people that you want to accept mail from?
This turns your mailbox into a Opt-In situation. I realize that this would be hard to do, and that you would have to swap fingerprints off-line, but wouldn't you have to do that anyway? This would also require mail clients to allow you to set up a new X-Header (most will, won't they?) like PGP-Fingerprint or something.
It certainly would keep unwanted mail out of your mailbox. And if you decided that you didn't want any more mail from a particular person, just remove their fingerprint. This also gets around the problem of someone sending email from different addresses. I personally have 4 or 5 different email addresses that I use for various purposes.
KangarooBox - We make IT simple!
Here's why you don't care about being able to intellegently identify spam:
1. I get a fair amount of real mail from friends of the form "check this out: http://x.y.z/"... I also get a LOT of spam that looks exactly the same.
2. You can catch spam the moment it comes out, by having honeypot-like mailboxes which are for no users at all, but you submit thier addresses to various places spammers look for such addresses.
Given these two, spam filters that don't look at real spam constantly are just hobbling themselves. Perhaps you intelligent filter should start off by running razor-check, and then thinking real hard if Razor says it's not spam...?
So when I get spammed by some idiot advertising http://www.hot-spammer-teens.com, I can submit that URL, and (assuming enough people submit the same URL from unique IP addresses) others running the same system will get a popup message when they go to http://www.hot-spammer-teens.com, and they can vote their dislike of spam by putting their creditcard away and trying to find another pornsite.
This could also work for email addresses maybe, when the spammer is trying to get people to send creditcard numbers for some MAKEMONEYFAST! scheme.
This would have the advantage that you can also use it for spam that gets sent over ICQ too (which is where most of my spam comes from these days).
Zilch
No offense, hear me out a bit:
you could just as well have said this: "We wanted to send party invitations, so we hacked into each of our customers' servers and put a message on their home page.
No, actually, you're wrong. If you go to a restaurant and leave your business card, you are pretty much authorizing the restaurant to use the information to contact you. That's how business has been conducted for quite a long time. You have a reasonable expectation that the restaurant will not abuse your trust and in that regard, I don't think we have at all. As I said, all but a very few people welcomed these invitations. My company is quite well known for throwing a hell of a party.
Yet with this software, one person can have the ability to block a group announcement that is welcomed by 99 percent of the people.
Ever click a ThinkGeek banner on Slashdot? What if one reader had the ability to block the ads for everyone? I'd miss them, even though they are technically the same as most any other banner ad and in some people's minds, evil. ThinkGeek seems to be a clueful company that knows its audience and in that is a welcome addition to the community. The also pay the money that keeps the servers running.
Ever get a catalog in the mail that you actually thought was worthwhile? What if one person could decide that it was junkmail and should be blocked for everybody? That there was no way for you to 'opt-in', because there was no way for you to hear about it in the first place.
What I'm saying is that one guy who may not even recall opting in can block a perfectly valid email announcement. In that way, the system does have a flaw.
What if I was on the CERT advisory email list and decided to say that their latest announcement was spam? From my understanding of the system in question, I would have that ability.
I would love for there to be a good system for controlling the junk email that I get, but I don't think that this is there yet.
Cheers,
Jim
-- My Weblog.