Slashdot Mirror
Spam Slows AT&T Email
jonerik writes: "MSNBC has this article about AT&T's frustration with the increasing quantity and sophistication of spam traffic. As has been noted here already, much of it these days is originating from Asia and, according to the article, 'now represents 20 percent of all e-mail floating around the Internet.'"
Ha! Not if you post on Slashdot...
mailto:<?=implode("@", array("chris", implode(".", array("php", "net"))))?>
Most of it originates in the USA! And you don't know how annoying it is getting spam for USA paraphenalia, gas masks etc when you are not USian!
Or even better: Outlaw them, so we can shoot them.
Boy I hate those asians
OMG! AT&T want to outlaw spam! They want to take away my right to free speech! They are just as bad as Europe! OMG!
The War on Spam must be fought on several fronts, not just one. These evildoers can be defeated by striking them in American courts and fixing the open-relay problem in Asia.
The owls are not what they seem
This is a great example of the Free Market at work! Businesses want their product to be known and Asians advertise! Go Free Market, boo AT&T!
Vote Libertarian.
from the people who brought you gunpowder...
Adam
mp3s by me
I don't think this would be a problem if people weren't idiots with their email addresses. If you don't want spam, stop signing up for all the "punch the monkey" banner ads you see! I use ATTBI, and I have never received a SINGLE piece of spam with my ATTBI email account. I suspect ATTBI uses the same filtering service as Worldnet, and I'd have to say it works quite well. The spam problem maybe is due to idiot users, but it's also possible that ATT made the foolish decision to sell the customer email database to spammers and now are forced to deal with the consequences.
I have an excite email address that nicely filters out all the spam the address collects. Excite email did have some problems earlier this year (i.e. change of ownership, hardware failure, etc.) but now it seems to be working great. So maybe ATT should switch over to whatever they're doing?
The future isn't what it used to be.
Well if 20% is hurting their network, I'd say they'd better do something about improving their infrastructure.
Steps in curing email spam
1. Close all open relays. That way the route of email is from your ISP to their ISP. [well at least as far as SMTP is concerned]
2. Use a HashCash like system.
3. Actively deny connection from IPs that try to connect more than N times in L seconds.
Duh...
Someday, I'll have a real sig.
from the people who brought you nuclear weapons...
Eve
Quality merchandise.
... is a bewolf cluster of spamfilters...
Okay, so it was funnier before I typed it...
The only reason that spam is a problem is because everyone has access to email you at your email address. It's the same problem with your phone. Anyone can punch in your number from their phone and dail you directly.
Your P.O box, however, can only be given mail from the actual Post Office. (I'm making an open-relay analogy) Nobody can walk in from the street and legally place mail into your mailbox. Although using a Post Office type deliverer for mail won't filter any spam, it will keep messages that are sent from outside the "post office" deliverer.
So, we need to decide that email doesn't work for private internet messages and come up with a different tool for getting personal messages online, otherwise we will continue to get spam.
I really hate Dan Patrick.
The DMCA seems to be the swiss army knife of absolute slimeballs. I'm /still/ amazed that such a law could exists in this country. I would not be suprised if it were used in the defence of spammers. Suppoes they encrypted their return address in some simple fashion? That Dimitri guy was thrown in jail for "cracking ROT13". The fucking DMCA would allow them to sue you for trying to figure out where they came from.
from the god who brought you light. gotcha.
mp3s by me
This ongoing 'war on spam' will only really be dealt with when two things happen:
1 Sysadmins living in a 'clue fee zone' must be wised up. This means, amoung other things, more education for sysadmins, better products and documentation, better or more translations of documentation, etc. It should be easy to obtain documentation in your local language. Every HOWTO has to have an accurate, up to date translation readily available. As should documentation for proprietory products.
I don't like viruses nor encourage illegal break-and-enter of another person's computer, but a 'whitehat' virus that shuts down the relay component of an email server would be damn handy.
2 The economics of SPAM must be altered, literally turned on their head. It costs to receive bandwidth, but (generally) little, or none at all. (The obvious exception is when you have a bandwidth intensive site that requires nice fat outward pipes). It costs so little to send, just electricity, enough money for a bulk sender (off the shelf or home brewed) and a net connection. Pay the real cost of outgoing mail and watch the volume of spam decrease to an approximation of zero.
Don't know how this last one will be achieved except via a totally new version of 'the net' (or at least a new set of RFC's).
Q:I was listening to a CD in Grip and it sounded horrible! What's up? A:Perhaps you are listening to country music
One good thing to keep in mind is that the more recent default configurations of mailer packages are configured to deny relaying. So as mail servers get updated, reloaded and replaced, the problem of open relays will become much smaller. And the clueless sysadmins will have to learn more about their systems in order to turn that function back on. Hopefully they will have had a good speaking to regarding their decision by then, too.
Intelligent Life on Earth
The "Spam" that I get from MS ("Windows Update" notification) is killing me. In the past two weeks I had to "update" my W2K TWICE.
And when ever I try to update, the process would break halfway because M$'s server can't keep up with the demand.
In my view, not only has M$ taken over 95% of the desktop, they will soon take over internet traffic with their daily "update".
Karma stuck at 50? Add 2-5 inches.. err.. 2-5x Karmas Count to your pen1es.. err.. Karma all naturally and private
I've seen code to trap the spiders the spammers use and fill up their databases with crap. What I haven't seen is a honeypot designed just for spammers - a box that *looks* like an open relay, but not only doesn't forward the spam messages, it logs and possibly automagically retailiates against the originator. The anti-spam groups have had good luck attracting spam with email addresses set aside for that purpose, but we need to take it to the next level and have some anti-spam servers. Maybe just a simple bot to start listening on port 25 and responding like known weak versions of sendmail when accessed would do. Any of the mighty code ghods here at /. want to see what they can come up with?
You're just jealous 'cuz the voices talk to *me*
Spam belongs in a can!
You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
The other possibility is a net-block equivalent of ORBS. Some on the Sec-Focus Incidents list (and other fora, over the years) have bounced around the idea of blocking netoblocks who'#s POCs don't work, or who don't have or respond to mail to the RFC-mandated abuse@, security@, hostmaster@,.. standard mail accounts. I'm all in favour. Automate probes, the way ORBS did for anonymous relays. I think this would be a Good Thing. People do have a legitimate need to communicate between Asia, America and Europe: simply dropping everything from .kr is evil and wrong, IMHO.
Finally - y'all know that anonymous HTTP proxies are just as bad, if not worse, than traditional open mail relays? Just testing ;)
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
I often get email where the from domain claims to be yahoo.com, but it was sent via an as-yet un-rbl'd server. As it stands your smtp server will accept a mail from anywhere not in a block list, with no checking on whether the server sending you the mail is a legitimate server for that email's claimed from address.
:).
In the same way that RBLs are published via DNS records, it could be useful to have a scheme whereby for your email domain you can advertise (via dns) what hosts are authorised to send email for that domain.
So a mail comes in from a yahoo.com address, you do a dns lookup on the incoming connections ip address appended to validservers.yahoo.com or whatever the convention decided upon is, and the result would tell you if it's valid. You'd also need a way to check that yahoo.com is actually advertising the valid mail servers (and if it isn't, you failsafe and accept the mail).
This scheme wouldn't be compulsory, and would probably be suited mainly to free email providers, large corporates. The downside of it is that if you have a yahoo.com address, but want to run your own smtp server to deliver your mails, then you'd fall foul of such a system. I don't think that's a biggy though - if you could run your own smtp server, you'd probably not use a yahoo.com address you'd have your own domain
While I'm rambling, another system which could be done is a protocol for verifying email addresses (you could also do this via dns too, I guess, but dns is getting cluttered enough as it is). For a given email domain it has an entry (in dns) for an email address verification server. When an email comes in, you check if there's a verification server for the source domain of the email, and if so try connect to it, and then submit the email address for verification. Depending on whether it says yay or nay, you accept or reject the mail. If they're not running a verification service, you just failsafe. I know SMTP vrfy exists, but sites often turn it off, or it doesn't do anything useful as the external server is just forwarding mail, etc etc.
These systems wouldn't be so useful until they got adopted by hotmail.com, yahoo.com, eudoramail.com, aol.com etc, and I'm sure people have toyed with these ideas before and maybe there are downsides which outweight the benefits or maybe someone knows of implementations of such a thing.
wow with all the postings talking about spam these days, we should open a new forum dedicated to that..
spam.spam.spam.slashdot.and.spam.org
it's also possible that ATT made the foolish decision to sell the customer email database to spammers and now are forced to deal with the consequences.
Oh, hell yes i bet they sold the database. Fuck them, let 'em wallow in the perfect hell they constructed.
The reason for the spam is because of the prepaid internet access common in asia! You buy those prepaid cards, in malls, and you are totally anonymous if you buy in cash. As discussed here, the spam therefore come from asia, but the content of the spam is from the US.
like a good chance to GET RICH FAST
and to MAKE MONEY FROM YOUR HOME
(At least for those of you living in the US, where most of my spam originates)
When I've e-mail AT&T about people using their dial-ups to then contact open relays, the reaction of AT&T is:
Not from our network. Problem closed.
So, I have little compassion for AT&T.
I have seen this claim a few times; one anti-spam site (I can't remember which one off-hand) also claims Australia is one of the worst baddies, despite the fact that Australian ISPs are generally pretty quick to kill email accounts under AUPs.
I am curious as to where these "figures" come from, given the logistics of measuring internet traffic generally, let alone distinguishing between "legitimate" email and spam.
For the record, at least 95% of the spam I receive originates from the USofA.
How about $.001 to send an email, and $.001 when the receiver acks it, like deposits for those lugage carts in the airports? Spammers will stop real quick. =)
What about doing away w/ smtp relays? Why not save the bandwidth and send and email directly to the dest smtp? Then, the ops could just ipchains -j DENY them? I realize this defeats the nice "features" of redunancy and off-line/UUCP batch transfers of email, but oh-well.
If you're a public IP on the internet, you have to expect some DoS, and have to work w/ authorities/ISPs to catch and stop DoSers at the higher levels.
Maybe require PGP or GPG (3rd-party trust authority)?
The biggest trick the devil pulled was letting lawyers become politicians so they can write the laws.
--- BEGIN PARANOID RANT ---
So I guess since they know what 20% of Internet e-mail traffic is... they must be monitoring 100% of it... Hey AT&T, can you give us a pie chart that categorizes all e-mail sent throughout the Internet...? I'd like to see the data points; and even more interestingly, how you got them.
--- END PARANOID RANT ---
If ISP can't play nice, drop their address blocks. (Dropping all of China wouldn't be much loss right now.) The trick is to block all an ISPs blocks, not just the spammer's IP. Spam friendly ISPs routinely shift the IP address. When their legit customers start leaving they'll wise up.
It gives me the warms fuzzys when some spam friendly ISP posts to news.admin.net-abuse.email, and asks pretty-please to be taken of the blocklists. (Then someone points out that they got spam from them in the last couple of days, and to take a flying leap.
One line blog. I hear that they're called Twitters now.
I agree with the other posters who note that the economics of Spamming need to be reversed in order to stop it, but I think that, even before that, public opinion needs to be swayed such that it is perceived as a significant problem worth addressing all over the place, not just at one ISP or for one open relay. A lot of people have just gotten used to ignoring/deleting 5, 20, 100 spam messages per day. "It's just part of using the Internet, right?" This needs to change. When things like the AT&T congestion happen, they should be used to get the public a little more outraged.
I have to say that spam is destroying the internet. I've given up trying to complain to administrators (it takes too much of my time up) so any spam i get i just delete immediately. I have one email address (with spam filters), forward me email to another address with more spam filters before I pick up my mail. This is the state I've got to in just reading my email.
Some spam is also too hard to track down. I wish someone would come up with a system to trash mail with invalid headers (e.g. from somebody@sasd.sdada - I've had stuff like this).
Like I said, spam is destroying the internet - something needs to be done about it. It wastes the time of everyone who gets it (and even spam you can read would be good - no use if it is in an Asian language I don't understand), plus wastes bandwidth.
This is a great example of the Free Market at work!
So is the trafficking of stolen car parts. But it doesn't make it right, ethical, moral, or legal. No, spam is a great example of theft at work. The spammers are taking bandwidth and e-mail storage that they don't pay for. They are inconveniencing Internet users while costing them more money (it's Internet users everywhere that bear the cost of spam traffic, storage, filtering, and response).
This is a fantastic example of where we need more, not less, government regulation and laws. We need laws that moke people criminally and civilly liable if they send spam or pay to have others send it. We need laws that indemnify ISPs and blacklists from lawsuit for blocking spam e-mail.
If allowing some bunch of amoral assholes to interfere with the delivery of e-mail to millions of users is your idea of how the free market should work, then I cannot imagine a better argument against a free market.
Most of it does indeed originate in the US.
If you go to the person responsible that is. They're using relays over in Asia to mask themselves. There's no way most of the spam is from Asia - the spam I get is pretty well written for spam, and tends to not contain language gaffes.
I really have no pity for people outside the borders of the US who receive spam from our lowest common denominator. Secure your damned servers so the rest of us don't have to put up with Penile Implants, Free TV's, and LEGAL HIGHS!!!!. We can't do very much if you don't.
As the wired article points out, email itself is under attack here. Yesterday, I got a stupid snail mail advert from Earthlink with much the same stuff in it as I'm reading here. While promissing "raw unfiltered internet" they also claimed to be blocking more "spam"(70%) than other ISPs, AOL (40%), MSN(40%), ATT(40%). As you can see, spam is a marketing tool. Should we be supprised when compainies with the morals of M$ abuse open relays to send messages like "fck me like a slut"? Would it be supprising if a large country trying to halt communications between it's people and other countries also abused email? The abusers all have the same goal, to destroy email. The more you block, the happier they are.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
From the people who brought you gunpowder.
SPEWS, ORBS, etc are fine, but we also need some agressive law enforcement against the criminals gangs that are sending spam and the companies that are paying for the spam to be sent.
Dropping all of China wouldn't be much loss right now.
I take it you don't have family or friends over there.
Coding Blog
I'm not sure I like this idea but it isn't too bad.
Some ISPs block outgoing port 25 connections so that a spammer operating on their system will be unable to send outgoing mail except through their mail server. It seems to work OK. I haven't seen a lot of spam originating from Netzero which by its design should be a spammer haven.
If you do need to send email, from, say, your work account, your work should either set up a vpn or a relay on a high numbered port (not an open relay either).
Coding Blog
...and I still don't see why it won't work. Have something that'll keep my machine occupied say, five seconds per mail, which could possibly be fifty for the slowest ones out there, but hardly a crisis for a mail to someone you've never sent mail to before. However a spammer is usually sending multi-recipient messages, and in massive amounts. Thousands times a couple of seconds at full load = high electricity bill, machine costs (need a fast machine, not a P75 spitting out mails) and much slower.
Also, include the following: Address verification *after* factoring. So people scanning will have to factor on every attempt (and people who made a typo will also factor once for no result, but they do it once, not a hundred times).
Naturally, you should be able to add a group of trusted addresses and domains that don't need to do this. Also, mailing-lists and similar should have the possibility to request this. This would not be a regular mail and so can't contain spam. It'll only contain the who and what, no body. "subscribe@somewhere.com requests authorization to send you 'Somewhere.com newsletter'". If authorization is granted, your server would get back to the originating server and tell it's ok. This would be the normal opt-in message you recieve today, only now put into a system.
As the factoring should occur upon delivery of the mail, it'd have to reside serverside, so I guess there would be some privacy issues about the server knowing who you trust, but I don't see that as a big problem.
Techincally, it shouldn't be any problem:
Server: 2x pseudoprime generation, multiply, send.
Client: Factoring algorithm, return.
Server: Verify through division or comparison with original.
The problem? As long as spammers can just fall back to the old protocol, it doesn't improve anything. But if it starts somewhere, others might catch on, and in the end people might just fish out non-spam messages out of their conventional mails, encouraging them too to use the new system, and in the end just block conventional email altogether. It's a long term solution, but the end result is a lot more promising than most other suggestions I hear.
Kjella
Live today, because you never know what tomorrow brings
you can do this already. Do an RDNS lookup on the IP of the server and reject it if the domain in the 'from' doesn't match.
Fsck the millennium, we want it now.
Millennium Crisis Line: 0890 900 2000 [calls cost 50p/min]
I am very careful with email addresses - though obviously not careful enough :-) ;-) }
This week I recieved my first ever unsolicited email from my own country - a real world business {thats choiceco@aol.com , choicewatford@aol.com and info@choiceofficefurniture.com for any spambots reading!! Fight fire with fire
As far as the spam from US people using open relays in asia, sure shut them out/down - unfortunately the spammers wont give up quite as easily as that, i'm sure they will find some other way to send their crap.
no sig.
Do you seriously think that spam is coming from ancient linux distributions?
No way... It's come from brand new machines with dual processors and half a gig of ram that are ready to process a LOT of email.
These people aren't being exploited with open relays... Some are but most aren't. They're being paid to place open relays out there.
What do they care, American businesses want to pay them to spam Americans. Many of them don't even like Americans anyway.
Asian ISPs don't care or we would have heard from them by now.
Blacklisting Asia is not such a bad idea. The biggest problem with blacklisting asia is all the people that won't unblacklist them if they get their problem fixed.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Kornet.net (the biggest offender)
abuse@kornet.net, ip@ns.kornet.net, ip@ns.kornet21.net, domain@NS.KORNET.NET, donghk@soback.kornet.net, ever@kt.co.kr, jeonnam3@soback.kornet.net, jeon@kornet.net, jeonbuk3@kornet.net, koreatelecom@KORNET.NET, gfd5246@soback.kornet.net, gspark@kornet.net, help@KORNET.NET, helpdesk@KORNET.NET, haewha1@soback.kornet.net, heyeunmi@kornet.net, kmhno1@soback.kornet.net, hopewon3@soback.kornet.net, kgromc@soback.kornet21.net, kmhno1@soback.kornet.net, legal@KORNET.NET, network@kornet.net, packet@soback.kornet.net, postmaster@kornet.net, postmaster@soback.kornet.net, postmaster@ns.kornet.net, postmaster@soback.kornet.net, pusanpub@soback.kornet.net, root@soback.kornet.net, root@kt.co.kr, service@kornet.net, support@kornet.net, system@kornet.net, yjjeon61@kornet.net, abuse@ns.kornet21.net, domain@ns.kornet21.net, network@ns.kornet21.net, postmaster@ns.kornet21.net, resume@kornet.net, root@ns.kornet21.net, service@ns.kornet21.net, support@ns.kornet21.net, system@ns.kornet21.net, wong@kornet.net, abuse@ASADAL.NET, postmaster@ASADAL.NET,
Itnsoft.com (the #1 spamvertised Korean domain)
abuse@itnsoft.com, help@itnsoft.com, ip@ns.kornet.net, hostmaster@nic.or.kr, marom@itnsoft.com, postmaster@itnsoft.com, root@itnsoft.com, eglee@yesnic.com, info@yesnic.com, hostmaster@yesnic.com, postmaster@yesnic.com, eglee@whois.co.kr, postmaster@whois.co.kr, whois@whois.co.kr, brkim@INWANG.NOWCOM.CO.KR, domain@NOWNURI.NET, busisik@nownuri.net, kbr@nownuri.net, memory@nownuri.net, abuse@nownuri.net, postmaster@nownuri.net,
DreamX.net (Korean porn spam, mostly)
abuse@dreamx.net, abuse@cjdream.net, abuse@todream.net, admin@dreamx.net, admin@cjdream.net, administration@dreamx.net, administration@cjdream.net, billing@DREAMX.NET, billing@cjdream.net, brkim@cjdream.com, dns@dreamx.net, dns@cjdream.net, dnsadmin@dreamx.net, dnsadmin@cjdream.net, domain@DREAMX.NET, domain@todream.net, domains@DREAMX.NET, domain@todream.net, feedback@DREAMX.NET, feedback@cjdream.net, help@DREAMX.NET, help@cjdream.net, helpdesk@DREAMX.NET, helpdesk@cjdream.net, hostmaster@dreamx.net, hostmaster@cjdream.net, inhanna@cjdream.net, info@dreamx.net, info@cjdream.net, jyan@dreamx.net, jyan@cjdream.net, ley319@dreamx.net, loveabuse@dreamx.net, loveabuse@cjdream.net, mail@dreamx.net, mail@cjdream.net, mgr@cjdream.com, news@dreamx.net, news@cjdream.net, newsabuse@dreamx.net, newsabuse@cjdream.net, postmaster@dreamx.net, postmaster@todream.net, raven3@dreamx.net, raven3@empal.com, root@dreamx.net, root@cjdream.net, soip@cjdream.com, sales@dreamx.net, sales@cjdream.net, sbkim091@dreamx.net, sbkim091@cjdream.net, service@DREAMX.NET, service@cjdream.net, solhan@cjdream.net, spam@DREAMX.NET, spam@cjdream.net, support@cjdream.net, support@dreamx.net, sysop@DREAMX.NET, sysop@cjdream.net, sysop@todream.net, tech@dreamx.net, tech@cjdream.net, technical@dreamx.net, technical@cjdream.net, technicalsupport@dreamx.net, technicalsupport@cjdream.net, system@cjdream.net, system@dreamx.net, sysop@todream.net, ykshin@cjdream.net, ykshin@dreamx.net, eglee@yesnic.com, info@yesnic.com, hostmaster@yesnic.com, eglee@whois.co.kr, brkim@INWANG.NOWCOM.CO.KR, domain@NOWNURI.NET, kbr@nownuri.net, memory@nownuri.net, busisik@nownuri.net, abuse@nownuri.net, postmaster@nownuri.net, inhanna@sysone.co.kr,
Thrunet.com
abuse@thrunet.com, abuse@korea.com, admin@thrunet.com, admin@korea.com, administration@thrunet.com, dns@thrunet.com, dns@korea.com, dnsadmin@thrunet.com, domain@thrunet.com, feedback@thrunet.com, feedback@korea.com, help@thrunet.com, helpdesk@thrunet.com, hostmaster@thrunet.com, mail@thrunet.com, mail@korea.com, news@thrunet.com, news@korea.com, newsabuse@thrunet.com, postmaster@thrunet.com, postmaster@korea.com, root@thrunet.com, service@thrunet.com, support@thrunet.com, sysop@thrunet.com, tech@thrunet.com, tech@korea.com, technical@thrunet.com, technical@korea.com, technicalsupport@thrunet.com, youngkim@thrunet.com, youngkim@korea.com, hostmaster@nic.or.kr,
hananet.net
abuse@hananet.net, bluelinux@hananet.net, domain@hananet.net, domains@hananet.net, feedback@hananet.net, help@hananet.net, helpdesk@hananet.net, info@hananet.net, hostmaster@hananet.net, lee@hananet.net, linux@hananet.net, news@hananet.net, postmaster@hananet.net, root@hananet.net, service@hananet.net, spam@hananet.net, support@hananet.net, system@hananet.net, sysop@hananet.net, tech@hananet.net, technical@hananet.net, webmaster@hananet.net, WooJooLee@hananet.net, WJLee@hananet.net, ysjeon7@hananet.net, bspark@kci.co.kr, bluelinux@YAHOO.CO.KR, abuse@YAHOO.CO.KR, postmaster@YAHOO.CO.KR,
KIDC.NET
abuse@KIDC.NET, billing@KIDC.NET, dnsadm@KIDC.NET, domain@KIDC.NET, guard@kidc.net, helpdesk@KIDC.NET, hostmaster@KIDC.NET, hostmast@KIDC.NET, hjryu@kidc.net, ishan96@kidc.net, postmaster@KIDC.NET, root@KIDC.NET, security@kidc.net, support@KIDC.NET, abuse@BORA.NET, anti1473@bora.net, b4012391@users.bora.net, badmail@bora.net, billing@BORA.NET, dnsadm@BORA.NET, domain@BORA.NET, help@BORA.NET, ipadm@bora.net, ipadm@nic.bora.net, hostmast@BORA.NET, lyt082@bora.net, news@BORA.NET, postmaster@BORA.NET, root@BORA.NET, security@BORA.NET, sysop@BORA.NET, ysjeon7@bora.net, sexxkorea@hanmail.net, abuse@hanmail.net, postmaster@hanmail.net, hostmaster@hanmail.net, abuse@chollian.net, muscle73@chollian.net, zcedomain@chollian.net, znotice5@chollian.net, abuse@kr.iasiaworks.com, postmaster@kr.iasiaworks.com, webmaster@kr.iasiaworks.com, 1004@domain1004.com, I@i1004.com,
Lawrence Person (lawrencepersonh@gmailh.com (remove all "h"s to mail)
http://www.lawrenceperson.com/
Maybe this is a good thing. First, it provides a graphic rebuttal to the people who say "Why worry about spam, just hit the Delete key and it's not a problem anymore.". A slowdown like this is a big problem, and hitting the Delete key won't solve it because the servers are still bogged down delivering it so you can delete it.
Second, if the majors like AT&T start getting affected like this, maybe they'll start taking it seriously as a "this is going to cost us customers" problem. The spamhauses have hidden behing the fact that it doesn't cost their providers much to keep them around and they do pay their bills. If this kind of realization sinks in, the majors may start looking for the ultimate source of the spam (not just the relay they used, but the person/company actually responsible for the spam) and punting them from their networks completely to avoid ticking off the other major players. If I call UUnet and complain about a paying customer they're not likely to listen. If AT&T calls UUnet, they've a slightly bigger club to wave.
I got spam from the DNC. They use Cheetahmail.
Now, I'm a registered Libertarian, and have never given the DNC my email, or any indication that I want to hear from them...
Go figure.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
See? this is where I think the Gov. is failing. We got something that we all commonly HATE: SPAM.
:).
We have a common target on which we'd love to see some LEGISTLATION against it, for once.
And what is the Gov. doing? Passing laws left and right to protect big corporation, to reduce your rights as consumers, to be a complete pain in the ass and give themselves the right to sue the planet, but what is being done for the VOTERS, the USERS, the people paying the tax dollars?
Well this is one case of an EASY win of public opinion, heck, they could even pass a few bad things without people noticing it because we'd be so impressed that our elected people actually did something for the PEOPLE.
Ok this sounds like I am frustrated against the system but you get the idea... of course a global spam law and action will be taken one day... when all the big corporations will be really pissed. Or major ISP be fed up paying bandwidth for SPAM, Look now AT&T is starting the run, shouldn't take long now before we get something out of this.
I think blocking ASIA would be a good thing, a pain in the start, obviously, but for a good cause, when they'll see they can't conduct buisness properly, they'll move and close those open relays and hey, screw human rights on spammer, you can KILL the biggest of them and I don't see anyone here who'll be really upset, for once
Spam is doing 20% of the global traffic, the numbers are about right with what I see in my mailbox, as for my hotmail mailbox though, it's more like 95%.
--- Metamoderating abusive downgraders since my 300th post.
IMHO, the only real way to stop spam is when all ISPs worldwide adopt a policy that 1) validates a credit card when someone signs up, and 2) charges that credit card a fee if the user spams. Sure, this will mean that no one will be able to get Internet access in less than 24 hours, but so what?
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
Hi!
This would be a problem for notebook users. If you're running a POP3 server in a corporate environment, one of the problems you have to contend with is traveling users (sales people, etc.) who want access to mail, and want to be able to send mail at the same time. One solution (for Windows NT users) is to implement the SMTP server that's built into NT. Have the road warrior send from his local SMTP server, but retrieve his mail from the corporate POP3 server.
One could, I suppose, simply add all those road-warrior notebooks to the list of authorized MTAs. But in a large-ish corporation it might be a record-keeping nightmare.
Okay... now that business interests are being demonstrably damaged (affected) maybe something can and will be done!!
Proof of damages clearly removes the age-old argument "just delete it! don't be such a whiner!"
The "Asian" spam people are concerned with doesn't always precisely "originate" from asia in the truest sense, however, it does come from mail relays being prone to being open.
On today's roads, a driver's license is required in most countries and certainly in the U.S. The purpose is at least partially to demonstrate proof that they have met minimum required skills and knowledge to operate a vehicle lawfully and safely. I hate to say "Hey, we need even MORE legislation" because I generally stand for smaller government. However, I believe that since the IIS flaws which still exist today (along with unpatched and currently still infected operating Windows boxes) combined with other people running servers with open relays among many other problems, I'm beginning to think that having an operator's license (not unlike a radio operator's license) should be required for internet usage.
Not only could this better raise awareness of security, but also netiquette and some basic technical understanding about the net and how things operate.
So, to just run a "client" computer, no license or something very minimal should be required. To run a personal or private server (email, web, ftp, whatever...small or limited use) something of a "Class C" license should be required. ISPs and hosting companies should require a professional license and such.
I don't propose that these cost any money or require any given renewal concerns. Costs should be extremely minimal to the point that it doesn't matter and only serves to fund the project. I just think that while we can't have "joe user" installing a Windows Server or some default *NIX to utilize the internet should be held accountable for his lack of knowledge, skills or ability as it DOES affect the rest of us in some way or another. Negligence in other areas of life are punishable offenses.
As things stand now, the internet is treated as a concern that is separate from daily life, however, I hold that for some, the internet is as essential to public access as our roads are! I don't think this notion is far fetched and I don't think it will "shut out" too many people.
In addition to that, suspending a license could be a more appropriate punishment for certain hacking activities as opposed to life in prison and never again accessing a computer device.
Anyway... I'm sure this idea in its basic form has a great deal of merit and will serve the public good. The devil is in the details and we should be very careful with its implementation. (example: licensing/certifying Operating Systems as 'internet safe' and such might be an issue of great concern and commercial interest.)
http://razor.sourceforge.net/
Deleted
The cause of the mail slowdown has been discussed in the worldnet.* internal groups.
fencepost
just a little off
I was just thinking the other night how ironic it would be if the DMA's mail servers were using ORBZ/ORDB or were an RBL subscriber. I think I might take the time to bounce something off of an known open relay and see if the DMA kicks it back.
Heh - most amusing (and of course unlikely) would be a court order forcing the DMA to disable any and all spam interception on their systems. Let them reap what they have sown.
One could, I suppose, simply add all those road-warrior notebooks to the list of authorized MTAs. But in a large-ish corporation it might be a record-keeping nightmare.
Just use authentication for them. Surely, it wouldn't be any harder than keeping user accounts on the intranet servers up to date. It could even use the same authentication database.
I hate spam with a passion, and go to great lengths to keep from even seeing it in my In Box.
I still keep an AOL account, and it was YEARS ago when it hit the point where it became more convenient to block all mail and have to add someone's address to my whitelist before they could send me anything, than to delete all the spam that hit that account without the whitelist.
I do much the same thing with my regular e-mail client. The last rule enacted on messages that aren't filtered out by the rules before it, basically puts everything into Deleted Mail, and it gets trashed automatically after 3 days. I peek in there once per day and almost never have to adjust any rules because non-spam accidentally was marked as spam.
~Philly
Got hit with this a couple days ago. Hmm, Why am I (postmaster) getting 400 bounce messages from one of our webservers? (we are an isp).
Starting digging through the logs and find an autotmated tool is using an old version of formmail that one of our users had installed. Seems like a spider found that is was a formmail cgi and tested it and found it to be vulnerable. so It sent e-mail to an aol box. 4 hours later what appears to be a Windoze program using the Microsoft URL Control is Sending tons of messages through this formmail cgi. By passing any rules we have setup in the mail server to dynamic blackholing of people that send too many messages or messages with too many invalid to's in the header, cause it came from a trusted host.
Besides that fact that I was pissed, I was intrigued. That was pretty slick, once you start closing down one way for them to spam they keep coming up with more.
On a side note we have found that if you simply strictly follow the RFC's you cut back a lot of mail you accept, and also Doing a reverse dns lookup, just to make sure their ip resolves to something helps a lot. By turing on Reverse Dns lookups and not accepting mail from ip's that don't resolve. We drop about 68K messages a day.
To E-mail me, replace the first period in my domain with an @
The article notes that AT&T uses Brightmail spam filtering, and the Brightmail systems were overwhelmed by the quantity of spam mail. I've had a similar experience.
I have a Verizon DSL account and they recently added Brightmail spam filtering. All spam that Brightmail detects goes into a special "folder" - inaccessible to POP3 clients but available via their webmail interface. Nice feature, eh? You would think so. But:
The spam builds up in this folder until it grows larger than your 6MB email quota, at which time all mail to your account is returned to sender with a "server quota exceeded" error. You, as the user, never get notified. You simply stop receiving email. For those of us who never use the web mail interface, it is a confusing and frustrating problem.
My spam folder fills up once every 2-3 days, requring me to access the webmail interface and clean it out. And no, there is no way to turn this feature off. Thank god for cron jobs and wget, or I'd be forever tied to my computer... I have a cron job that hits the web site, logs in and deletes the mail for me every evening.
I've written to the Office of the President at Verizon to tell them what a stupid feature this is. Either allow us to turn off Brightmail filtering, or don't count the spam mail against our quota. One month later, no response at all from Verizion.
Using DNS To Authenticate Domain SMTP Servers would Definately make spamers lives more difficult. To make it even more Effective the DNS Governing Body would also have to be on board to prevent spammers from obtaining thier own Domain Name so they can pass the requirements of DNS Authenticated SMTP Servers.
Do an RDNS lookup on the IP of the server and reject it if the domain in the 'from' doesn't match.
Which, of course, drops some valid mail, like mine, which has a from: okstate.edu and IP of x8b....dhcp.okstate.edu.
The downside of it is that if you have a yahoo.com address, but want to run your own smtp server to deliver your mails, then you'd fall foul of such a system. I don't think that's a biggy though - if you could run your own smtp server, you'd probably not use a yahoo.com address you'd have your own domain :).
Actually, this is a pretty big downside for many users. Every once in a while, someone proposes a similar scheme that makes it hard or impossible to "forge" From addresses. This is not exactly that, but it's close enough. The problem is that this is a perfectly legitimate and necessary use of email, and is, in fact, discussed in RFC 822.
The basic problem is that many of us wear quite a few different hats, each of which has one or more email addresses. Suppose I want to send an email using my personal address while I'm at work, or my work address while I'm at home. Suppose I need to reply to some email sent to an official address using that official address as the header From, and that I also want bounces to go to that address so that others at that address can see if my reply was not sufficient (requiring a change in the envelope From). Maybe I do run my own smtp server and domain, but I want to use my spam-trapping yahoo address to reply to yahoo mail (for privacy reasons), and I want to use mutt instead of some stupid web interface. Maybe I'm a sysadmin who wants to set up a number of forwarding addresses (perhaps official addresses for some project on some domain). Now my one-way service has to be a two-way service; instead of just editing the aliases file, I have to set up an account for each of the people who needs to send mail. These are just some of the things that I happen to do on a daily basis and that adoption of your system might make impossible or more of a pain.
Sure, a lot of times this can be solved by some sort of remote access or SMTP auth, but it would certainly be less convenient (especially because some sites are difficult to access remotely). The bigger problems are social: many of the users I know who do these sorts of things aren't the most technically-savvy; many domains are unlikely to introduce the features necessary for full remote access (so then it becomes less of an inconvenience and more of a loss of service).
The good thing about your proposal is that it's opt-in for the sender's domain (whereas most others are opt-in for the recipient's domain), and it therefore gives a domain more control over its email addresses (as opposed to less with other schemes). It allows example.com to say "we want mail from addresses in our domain sent out via only our servers." Presently, anti-relaying provisions in servers make it possible to say "we want only mail from addresses in our domain sent out via our servers." This just completes things.
I guess it depends on your perspective. As a sysadmin, I'd be happy to have the power to turn this on for my domain (though I probably wouldn't, and other domains might not use it -- look at how terrible people are with MX records). As a user, I'd be unhappy if one of my sysadmins turned it on, but happy if some of the domains spammers use and I don't use turned it on. I guess it might be sort of a "not in my backyard" issue, which might limit its adoption. Another problem might be sysadmins that block domains which don't have these records, thus taking the power away from the sender's domain again.
While I'm rambling
While I'm ramblingly replying:
When an email comes in, you check if there's a verification server for the source domain of the email, and if so try connect to it, and then submit the email address for verification. [...] I know SMTP vrfy exists, but sites often turn it off
They turn it off because it can be abused by spammers looking for valid addresses or is in some other way a privacy concern. What you propose is functionally equivalent to VRFY (except that it can run on a different server), so I doubt it would be turned on either. However, it might not be a bad thing for servers to *try* to VRFY an address, and only block if VRFY returns "no such user" (not "permission denied"). If a separate protocol and server is desirable, there is always good old finger (though it's maybe a little too free-form), but VRFY makes more sense, as the primary mail servers should know to whom they can deliver mail.
Just use authentication for them. Surely, it wouldn't be any harder than keeping user accounts on the intranet servers up to date. It could even use the same authentication database.
What accounts? What authentication database? Presently, the existence of a mailing address does not imply the existence of a user account. Consider forwarding-only addresses. Should all the volunteers behind bugs@opensourceproject.example.org require accounts? Maybe the sysadmin is a volunteer, too.
What about those of us who use webmail addresses as spam traps? Now we have to use crappy web interfaces to send (or those webmail companies have to set up SMTP AUTH, with which they very well may not want to bother).
...and so on, and so on...
Quote:
"According to Brightmail spokesperson Francois Lavaste, an unidentified Internet marketer overwhelmed Brightmail's filtering system with messages, slowing down all e-mail delivery."
Why not name and shame them?
If they used their own servers then you know who they are, and if they didnt (although the sheer volume means it is very unlikely they could have used an open-relay unnoticed) then trace them back and make an example of them.
They are clearly a professional operation so bad press is going to make them look really bad in front of their existing clients, and if you tried hard enough you could have great fun suing them for all they were worth...
Maybe if AT&T disconnected some of the half-dozen active spammers on their network I keep complaining about, they'd get some sympathy.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
Perhaps we need to educate the sysadmnins who keep relays open that the spammers are stealing their bandwidth and system resources, not just those of the people who get spammed.
You heard right: gunpowder wasn't invented in China. "Black powder" came from China, which is not exactly the same thing.
Since guns (invented in Europe -- see http://www.uselessknowledge.com/word/gun.shtml for an odd knowledge history of the term "gun") postdate these elemental explosive chemicals, it's a rather large claim to credit Chinese history with inventing something that would centuries later acquire a completely different use in another continent altogether. That would be like me claiming to have invented the pocket radio because I first detected radio waves.
Just something that's always bugged me. Arabic mathematicians invented the number zero by the way. History is full of twists...
Since spammers by their very nature do what they can to hide in anonymity (both to make it hard to filter repeat offenders and hard to track them down to "cancel" them), it makes me wonder if a push to fully authenticated e-mail might solve this.
I'd hate to label every piece of e-mail with a valid certificate (forcibly associating someone's words with their identity), though, but given the way things are moving, I can foresee this in the next 10-20 years.
Everybody will have a digital certificate, and every e-mail will be transparently and automatically signed with this certificate. People on the receiving end will know who's sending the message not by looking at the From: header but by examining the identity of the certificate, and users will be given the option to reject or accept messages that aren't signed (meaning the identity of the person can't be trusted). Since a high and growing percentage of this anonymous mail will be spam, eventually more and more people will start rejecting it, and spam will neatly kill itself off (at the same time killing off the ability for people to send e-mail anonymously).
It's a sad state of affairs, but it's going to be impossible in the near future to differentiate between e-mail sent from someone you don't know, and mass e-mail sent from a spammer.
I have a honeypot domain of sorts that I collect spam with. Not to analyze the spam, but to analyze how it got there. On a number of web sites I'm using a little CGI script that generates a dynamic e-mail address based on the IP of the visitor (and any forwarding-for information if it's a proxy) and the date/time. That way, when they spam the address, just by looking at the address I can tell how it was harvested and when.
I don't know if ISP's ever do anything with these types of complaints, though, so I don't know if this will ever be fruitful, but it's enough to satisfy curiosity..
Dear Mr. Silas,
/. post, I feel I can trust you with a proposition that is not fully legal but that you will find to be potentially advantageous. My name is Mbutu Rasavi. I am the son of the under-secretary of human disposal in Nigeria. Due to political instability in my country, my family and I will soon be forced to leave. We have $47,563,083 in discreet funds that we must quickly transfer to a foreign account. If you would be willing to proxy this transaction through your own account, we will reward you with 10% of the funds.
I am in urgent need of your assistance. Based on your
You are my only hope.
If you are interested in this proposition, please save time by putting $10,000 in a brown paper bag, along with your own severed head, and ship it to the following address:
1337 Llama Dr.
IKantBLevHowDumbPplR, Nigeria
Hurry.
-Mbutu
is to extend SMTP to include the ability to require a username/password to send mail. I realize this would not solve all problems but, it is a better solution than the current kludge most people use (requiring a POP3 login first). It will take a while to become supported, but then again, it is a good first step.
I'm a signature virus. Please copy me to your signature so I can replicate.
We actually have a very strong antispam law here. All you have to prove is either the subject line is misleading, another's domain name was used without their permission, or the point of origin/transmission path is forged. Basically, this covers about 99% of spam. Individual consumers can sue the spammers for $500 per message, an "interactive computer service" can sue for $1,000 per message. I have one case pending now and several more in the pipeline.
/. . . .
Check your facts before you run off at the mouth. No, wait, this is
Opt-In email. Rather than blindly accepting every message that comes in, why not deny every message that comes in - except for those on a specific accepted senders list?
Of course there's several issues with this...
How do you know someone you want to talk to is sending you an email?
You could setup the server to accept the first message from a particular sender and then ask the user if they want to see messages from this person ever again, by domain or by specific email address.
How do you easily delete all messages from a particular user/subject etc.?
This would easily be accomplished by using a sql based storage system on the backend. It would be trivial to delete all messages from a particular email/ip/etc when everything is a quick sql statement. Additionally it would make for easy load balancing if the config was on the sql box and the front end servers could deal with the setup/teardown of smtp/pop/http sessions.
What happens when the spammers realize this and start to search to find accepted senders?
The server could easily be setup to deny all email from a particular domain/ip when a percentage of all emails are rejected or when it's viewed as sending too many messages at once. Send 100 emails and 25 are rejected? You're on the ban list. Send 10 messages in a row that are all bad? You're on the ban list. The ban list could be stored via sql as well so that front end servers could all instantly be notified of bans acrossed server farms.
I've suggested to several different people this way to make email 100% spam free, but noone has seemed to like the idea so far, so what does the slashdot crew think? Is it time to setup a project on sourceforge? Or does someone know of a server that does this already?
Blocking spam is almost futile. Spam is always changing, and new spam is always being created.
Traditionally e-mail has been a open system, and we try to solve the spam problem by black-listing spam. However, because it doesn't look like open-relays will be going away anytime soon, the only way we can effective make spam a dead-end is to use a white-list strategy.
An alternative to Vipul's Razor trying to Block spam is TMDA.
Implicitly all "good" emails are reply-able to, and once they confirm themselves, they can be on your whitelist and will be able to send email to you from that point forward. While it is a bad thing (tm) to close the openess of email (the true nature of the Internet is the free flow of information), this may be the only way to effectively stop spam from being a viable means for spammers to get their messages out. Only by making it totally worthless will spammers ever stop.
First we've gotta get Cox to reveal his identity...
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Block, Ignore, Delete. Net effect: Nothing - The spammer still spams.
Most effective is drilling down to their "payment provider" including the full headers of the spam and mentioning that the payment provider, aka credit card processor has an anti-spam policy.
Dozens of spammers were left with a product to sell, but no way for anyone to purchase the product.
SpamCop was an excellent tool to provide a complete history of the "chain of evidence."
Do not try this with SpamCop unless you want to be banned from reporting, as was I for "altering" the spam even though there is no FAQ regarding this and the SpamCop Deputies continue to encourage users to alter the spam when SpamCop chokes on fake HTML headers and ones name is embedded in the spam.
I received a single warning eMail and upon questioning the policy, instant ban with no explanation via email or the ng.
For now, I hit delete and adopt the attitude of SpamCop "filters" which simply hide it from view.
Bob
That is when you're not too busy surfing for kiddie porn, eh, Nazi pig?
However, there are a few guidelines to avoid 99% of all spam:
- Don't use your ISP-provided email address. ISPs nearly always sell their email address list to email collectors to make extra money.
- Never get a free email address.
- Never use an un-spamproofed email address when registering a domain name. (There are some sadistic harvesters that crawl WHOIS registries for email addresses.)
- For high-spam zones, use a spamcop email address (if there is an offchance you'll get any good/positive/important messages, like in a Usenet group). [This was more cost-effective when you could purchase by the megabyte instead of having a flat-rate as all new registrees get.]
- Similarily, send any spam immediately to Spamcop.
- Use a different email address for each automated registration form. If you can't use a fake email address (this inability is becoming more and more commonplace on message boards), be EXTREMELY certain that you want to sign up for whatever service this is.
- Never ever EVER use Bravenet. Even when you stop your service and put your email address in their unsubscribe form, you STILL aren't unsubscribed.
- Similarily, never ever EVER use CrushLink. Not only is the entire concept stupid, you will be spammed into the ground.
There are some other things you can do, but these are just a few good ideas. (One thing that works terribly well to eliminate telemarketers is to have a phone line activated but not have it connected to a telephone for a few months. As different telemarketing offices call the number and don't get an answer, you are weeded out of the system. This handly little bit thanks to a data line which we later started using as a voice line when DSL became available.)[insert witty comment here]
To try something like a server-side permitted originator list? That way the downstream bandwidth from the SMTP destination to the client wouldn't be burnt up and the SMTP server could return errors to someone trying to send to a destination which had not authorized them.
... and it would redefine the term "mail-bombing"....
Yes, this would put some sort of list of who your friends are server-side. A bit of a privacy issue I'd guess (not that having all your e-mail readable might not put that to shame!).
It might also take a bit more work on behalf of the SMTP server, but I don't think this would be a crippling level of work.
Of course, the _other_ option is locating spammers and dropping 1000 lb. LGBs on their locations. That'd fix their wagons....
-- Mal: "Well they tell you: never hit a man with a closed fist. But it is, on occasion, hilarious."
I would like to have an MTA that checks every email server the first time and every 1000 times that it sends a relayed email to see if the other MTA is an open relay and complain to the others abuse email-adress directly and refuse to receive email from them until they fix their server.
If that was part of sendmail it should automagically fix many open relays...
Just saying it like it are.
We really need to work with our ISPs for an "Opt-In" delivery system. That is, everyone would have a list of people from which they are willing to accept mail. That mail goes through directly. Any mail coming from someone not on the list is held and an e-form is emailed back to the sender. The sender then must "fill out" the request to be put on the user's mail acceptance list. The form should be made in such a way that an automated response would not be possible. Since most spammers don't include valid return email addresses they will never get the e-forms and the spam, after being held for a period, could be dumped into a bit bucket.
The race isn't always to the swift... but that's the way to bet!
I admit it's a thought work in progress (and no, I've never managed a system running anywhere near 500.000 mails/day), but the idea was to make it cost something for the sender, not killing the ISPs server delivering it. Of course there's the problem that on the internet, everybody's a server.
Maybe the mail server should start acting like a proxy instead of a relay, how would that work? Instead of Sender -> Local mail server, Local mail server -> Remote mail server, it'd go directly Sender -> Local -> Remote. The cost would be lack of redundancy if the remote server doesn't respond, the local server won't take the responsibility of trying later. There's still a point of going through the local server though, of course to get verification that the email address really belongs to you. With a running connection the feedback link is established and the client can do the factoring, not the server. Likewise any webinterface (yahoo etc.) could offload it to the client through a java applet or similar.
Of course the message itself can be cached on the server as usual, so it won't matter what speed the connection is, as long as the factoring noumbers get transfered properly. Perhaps having the server do the factoring as a "back-up" solution in case of temporary connection failure would work. It'd work with a few remote sites being offline, on the other hand if the connection to the outside goes down and the mail server gets filled, there's trouble in paradise...
I haven't got any idea how much real mail servers do "behind the lines". How often can't it connect at all? How realistic is it really to replace the mail server with something that would be practicly an IM to the remote mail server) + caching proxy? Damned if I know, I just know my bandwidth is being stolen by people sending me advertisements I pay for. And I'm tired of it.
Kjella
Live today, because you never know what tomorrow brings
Okay, how about the reverse. Do a DNS lookup on the name of the originating mail domain. See if the looked up IP matches the sending mail server, or the recorded IP of a mailserver in an earlier Received By header, or the MX record of any such mahcine.
I'll see your senator, and I'll raise you two judges.
Is it just me, or does anyone else wonder about a company like AT&T having massive problems because of a few spammers? Isn't it a little more likely that somebody screwed up the mail routers and they blamed it on spam? I wouldn't expect them make a press release saying "we fucked up email, sorry.".
-- I saw it on the internet, it must be true.
It looks like ATT needs a few more Brightmail servers. At least that way it could handle all the traffic from the MTA validators (Intermail MX).
There's a simpler solution than trying to use micropayments — change email from a push medium to a pull medium.
The way email currently works, a sender can submit a single copy of an email to a server together with a list of addresses and that server does the work of copying the email and delivering it to each of it's recipients who must then pay to store it in their inbox. This has close to zero cost for the sender.
If, instead, the message was stored on the sender's mail server and a small notification was sent to the recipient(s), the recipient is no longer forced to pay the cost of storing the email. Instead of paying your ISP for a 10Mb inbox, you'd be paying them for a 10Mb outbox
With the cost of sending emails shifted back onto the sender, the economics of spamming no longer works. You can even include some sort of credentials in the notification (OpenPGP signature, unique token you generate each time you give out your address, single-line description of the message) so that the recipient can make an informed decision on whether to actually download it or not.
The context was corperate users on the road with laptops. That implies some sort of user account on the intranet.
In other cases, there is a simple Free software. Look into the cyrus with SASL. It integrates with sendmail, and provides IMAP services. The SASL feature allows it to have a seperate user database so that a login need not be provided.
What about those of us who use webmail addresses as spam traps? Now we have to use crappy web interfaces to send (or those webmail companies have to set up SMTP AUTH, with which they very well may not want to bother).
They can either set up SMTP AUTH (no problem), or they can stay as they are (O.K. for you) and risk becoming a spam relay. Once abused sufficiently, they will either get AUTH, shut down, or be blocked so widely that it's useless for you anyway.
I know I could probably set something like this up on our network and nobody would say a word.
>much of it these days is originating from Asia
Yes, a great deal of it does come from Asia. And I, for one, don't get any legitimate email from Asia - so I simply deny all incoming SMTP connections from APNIC's IP ranges. That alone does wonders for the amount of spam that I received...
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
SMTP AUTH. Anyone with a POP-3 account can be authenticated to send via SMTP with the same account information, without allowing others to relay.
Though with the number of ISP's blocking outbound port 25, you might also need your server to listen to a different port.
The context was corperate users on the road with laptops.
But the broader context is about changing the way that email works for everyone. There are lots of suggestions that might work for a small subset of users, but fail to satisfy the breadth of needs fulfilled by our current email system.
The SASL feature allows it to have a seperate user database so that a login need not be provided.
Shell accounts are not the point (by "login" I assume you mean shell, since any provision of a username and password is "logging in"). Forwarding addresses now are just entries in the aliases map, without any sort of account at all. (And, before you say it, no server need be an open relay). Now you're asking the sysadmin to maintain a set of SMTP accounts with usernames and passwords, and probably to write a password-changing mechanism (the sysadmin running "saslpasswd" is not acceptable). One might also need a mechanism for locking accounts after a certain number of failed login and presenting the last successful and last failed login attempt to the user. The point is, authentication can be complicated, and "just give them all accounts" can be quite a hefty proposition.
They can either set up SMTP AUTH (no problem), or they can stay as they are (O.K. for you) and risk becoming a spam relay.
OR, as things stand now, without the valid servers published for each domain, users can use their ISP's mail servers. There's nothing that indicates that the webmail companies need to be open relays or that they are now. My point is that they are unlikely to bother setting up SMTP AUTH or to become an open relay, so users who want to send mail as their webmail addresses will be forced to use the web interface.
The other problem with all of this is that every mail client would need to be re-written to make the outgoing SMTP server dependent on the From address. Talk about a user support nightmare...
The real question is: would this stop spam? Much of the spam I get comes from open relays and have faked From addreses (and refers me to a web site or telephone number). What's to stop someone from using as the From? (Remember that if example.com is running an open relay, they can't be relied upon to do anything responsible or not to do anything irresponsible.) The rest of it comes with a "From" on some fly-by-night domain that can set its DNS records however it likes. Some of it sets both the "From" and recipient addresses to my address (and it seems that could be blocked in other ways without a significant change in behavior).
There is some portion that uses a "From" of yahoo.com or hotmail.com, but given all the pain through which this proposal would put non-spamming users and that the spammers would quickly adapt, I'm not sure that it's worth it to block this particular avenue of spamming.
Cleaning up the AT&T house would get rid of more than 20% of of the spam *I* receive.
I think I see the confusion now! I was talking about measures to restrict people from originating mail with a fake from address. You're talking about recieving mail.
The case of a simple mail forwarder is no problem. The final recieving MTA would be able to see that the From address and the originating server match and that the relaying server is a designated mail server in it's domain. Meanwhile, the relay server will presumably have performed similar checks.
None of this will necessarily kill spam, a willing ISP can set up whatever they want in their DNS just as you said. It WILL prevent abuses of innocent ISPs (as originators of spam). With that accomplished, spam servers can be blackholed with confidence and certainty without ISPs having to block outgoing connections to outside SMTP servers.
Authenticated SMTP is old hat. However,
the current direction of IETF is away from
passwords and towards authentication mechanisms
that are more secure.
I believe them - but have no sympathy. AT&T is a
spam supporter, so ity is only fair that they get
a does of their own medicine.
You've got it backwards - there are mail packages such as Spam Bouncer that let you filter based on character set - if you never want to receive email in Korean, Chinese, or Russian, you can discard it all based on character-set headers. If you never want to receive email from Korea, you can even block that too. (That's a bit less reliable, because it's possible that there's someone in Korea you'd want to talk to, but you could probably set an autoresponder rule that tells Koreans that you're blocking email from there due to heavy spam levels, so they should use a non-Korean email system such as Hotmail/Yahoo/etc. to send you mail.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Why not enforce a 0.0001% tax on all outbound email, much like any country's postal system?
And have the U.S. Postal enforce the port 25 usage/filtering and collect the money for all US-bound email receiptent? Block all email until SPAMMER (and legitimate) emailers open an account with the G O V E R N M E N T.
No more Free-SPAM.
Oh, the pain of having a libertarian/republican complex.
Mailing lists are the obvious place where hashcash fails, because as you say, a large real mailing list has the same scaling problems that a large spammer list has. The way to fix that is for hashcash mail systems to use whitelists - if you know the sender isn't a spammer, accept mail from them without hashcash. Of course, that just encourages spammers to join mailing lists and then spam them.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Spam laws won't work until they can be applied effectively everywhere in the world; not a chance. Meanwhile, some of the proposed laws have had significant anti-privacy terms - banning anonymous email, banning mail services that don't insist on getting your personal identification. Here in the US, we've got a First Amendment, and most of the anti-spam laws are much better at trying to weaken it than at actually blocking spam.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I never ever give out my email address to any website or company. I have a spam hotmail account for when I have to give an email address.
But I use a charter.net email address as my primary account for everything else. I have never gotten any spam.
If you don't understand any of my sayings, come to me in private and I shall take you in my German mouth.
So what's the alternative? It's to make sure, as often as possible, to build applications programs that have security tools, and to make them as secure as possible by default. We need to try to anticipate problems that will affect lots of people beyond the intended users.
Economics will be hard to fix, because the whole Moore's Law effect driving our industry is that computation and communications keep becoming radically cheaper, and email has been really cheap for a long time. What we have to do is find ways to use those economics for spam prevention - as pattern recognition becomes easier, it's more usable for tracking down spammers, and you can make it *much* easier by techniques like seeding your websites with bogus email addresses you can use to trigger defensive responses, track down spammers, and get ISPs to block abusers. It's also important to use our communications abilities to coordinate spam detection and blocking - the RBL and its relatives are a beginning for this kind of process. Teergruben are another approach, especially if they can be coordinated. But it's also important to make sure that anti-spam tools aren't easily abused as Distributed Denial Of Service attacks (e.g. forging spam leading to mailbombing or long-term blockading of the forgee), which is amazingly easy (e.g. suppose you reply to a spammer's "remove me" address with a thousand emails of "From: bogusaddress1@bogus.net\nSubject: Unsubscribe\n\nbegin 666 vmunix\n...."
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
An entertaining way to use Teergruben would be to set your DNS server to respond to requests from RBL locations with random teergrube servers. Handout them an MX record for some machine they really don't want to talk to...
If you've got a number of people running teergruben, you can share bogus addresses on each others' domains, you can spread around the damage so that the spammers end up stuck on lots of teergruben at once.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I'm just speculating here, but one reason there's so much spam from Korea is that it's a high-tech country, but another reason is that there are a few million people with cable modems. If they're running software that's got open relay capability, there's a lot of potential spam that can be forwarded. Another reason, of course, is that Korean is a tough, bizarre language that doesn't use a Roman alphabet and isn't close enough to anything else for most non-Koreans to be good at writing useful complaints to administrators....
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Go to www.marketing-2000.net
Guess what business THEY are in?
nslookup www.marketing-2000.net:
12.160.137.140
whois 12.160.137.140@whois.arin.net:
AT&T ITS (NET-ATT) ATT 12.0.0.0 - 12.255.255.255
And yes, AT&T is aware of this. Have been for some time now. They seem not to care.
Build stuff. Stuff that walks, stuff that rolls, whatever.