Slashdot Mirror
Spam Increases Make Things Tough For Companies
dosten sent us a link to a story running
on Cnet about the spam epidemic. My favorite stat is that by 2006, we'll be getting 1400 spam
a year. Of course, I already get that every week. Talks about
foreign spam relays, block lists, and so on. Decent piece explaining
a huge problem that's only getting worse.
The biggest offender for me? Resume bots. I post my resume to see if people are hiring, and I get 12 messages a day from OTHER resume posting sites trying to get me to go there and post again.
If they're smart enough to grab my email addy, why can't they harvest my resume too and leave me alone?
-skip
The Chinese government ignored SPAM problems, until enough people blacklisted China and then they took notice.
Maybe we should forward all the spam that we receive to congress, with a little note attached. Maybe they would take notice, then.
Fight Spammers!
The 1400 number is a bit sketchy; I think to assume that SPAM will continue to grow at a current rate for four years is more than a bit unreasonable.
On the contrary, I think one of two things will happen:
1. SPAM will explode long before 2006 - the number of messages will grow to such an extent that a political solution will become unavoidable. In effect, the SPAMers will SPAM themselves out of existence - but not without paralyzing the net for some time.
2. SPAM click rates will continue to fall, and bandwidth costs will soar, so eventually the point will be reached that most SPAM will no longer be viable economically- this may be some time away, but I think it is certainly a possibility.
Even if costs increase, something tells me that 1) is far more likely to occur than 2)..... But the most likely thing to happen will be that I move to a address-book-only-accepted mailbox setup... Sigh.....
I recently sent a reply to a spam I recieved demanding $110 for my troubles. Maybe if everyone starts taking legal action against spammers, they'll get a clue, and stop bombarding us with this junk.
Maybe the spammers should focus on only AOL addresses since their members seem to like daily solicitation, and leave the rest of us alone!
Here is, what I believe to be, a better approach to fighting SPAM: Tagged Message Delivery Agent(TMDA)
--It's Pimptastic!--
Internet researcher Jupiter Media Metrix estimates that consumers will receive about 206 billion junk e-mailings in 2006--an average of 1,400 per person, compared with about 700 per person this year.
Still, that's only about 4/day which seems very conservative to me.
Find your lawmakers home emails - city council, county council, city prosecuting attorney,state reps, governor, state attorney general, federal delegations ...
And change your settings to "reply to" the spamsters that send you spam with their info.
They'll fix it fast if it affects them. That's why we have some of our state's laws about credit reports - it directly affected my senator's daughter (he's retired from the senate now).
Nothing like making it personal.
[note - I am not advising you do this - just pointing out what will happen if some people did this - caveat emptor]
-
--- Will in Seattle - What are you doing to fight the War?
I noticed a massive increase in the amount of spam that I was getting. Fortunately I am running my own FreeBSD server for mail and I simply updated access lists for the frequent offenders. That blocked some, but I was still getting a great deal of mail coming in.
Finally I was told that I can identify countries by their IP block. Now that I block Korea, Russia and other countries I am not back down to my normal daily allowance of 2 pieces of spam a day.
I also have a spam blocking strategy others may want to use. Since I run my own domain I create an alias for every website which wants me to register. For example, here I have an alias for slashdot@offwhite.net which is posted along with my comments. I also have one for cdnow.com@offwhite.net, cnn.com@offwhite.net, etc. When I sign up for a newsletter or post comments I will know where the incoming spam originated. Unfortunately I found that my slashdot alias was the culprit for much of the mail. Spammers are obviously scraping this site.
After I put my spam blocking lists in place, in addition to the normal RBL features you can do with spam I am block tons of mail for me and all the users on my server. And in a single day the daily report that FreeBSD sends out shows that I blocked 111 pieces of mail just for my offwhite.net domain.
Perhaps eventually I can release some of these offending domains from my access/blocking list, but for now I am simply returning an obscure message that the user was not found. It is my hope that they simply remove my name from their lists. One can only hope.
Brennan Stehling - http://brennan.offwhite.net/blog/
As others have pointed out, this is 1400 a year, not per day. Malda needs to learn to read.
Secondly, I find the figure of $1 per spam to be kind of ludicrous. It takes me about 5 seconds to recognize a piece of mail is spam and delete it. 5 seconds of my time isn't worth $1. And the 10k it took the mail server to store the message and fraction of a penny in bandwidth aren't worth a dollar either.
If corporate anti-spam offices are costing that much, then they're wasting their money. Let employees delete their own spam messages. It's really not that hard. It wastes maybe 5 minutes per week of my time. Is it annoying? Absolutely. Is it an "epidemic"? I don't think so.
I hate spam as much as the next guy, but a sense of perspective is important. The technology to filter spam is rapidly advancing, and ISP's often *do* respond to complaints. Once Asia gets with the program, I'd expect this problem to subside somewhat.
(Disclaimer: not directly relevant, but I thought I'd share.) My email address is scannable from Usenet posts made when I was young and foolish, so there is no hope of it not being available to spammers. But, since using Spamcop, my spam levels decreased, and today at 9 AM MST, for the first time in years I checked my mail and it was spam free. I'm starting to suspect that spammers now keep lists of email addresses of people who are vigilant in reporting spam, and deleting them from their lists. (My hope is, that the CDs in which my email address resides, are now considered "no good," not just my address.) So, there is hope.
We are trying to cling to a system not designed with spammers in mind.
Instead of trying to make it illegal to send spam [which is not going to stop it anyways] why not just invent whole new protocols?
Primarily I'd add a hashcash payment system. Where in order for you to send me a message [that I would eventually see] you *must* do some work [e.g. find an N-bit collision].
The idea is simple and if implemented correctly will be a huge deterrent to sending spam. Specially if it takes you 2 seconds or so to prepare the email!
I think as a project I will implement a trivial version of this over TCP. In reality though it would be nice to see real professionals tackle something like this.
Face it SMTP is outdated and wholly inappropriate!
Tom
Someday, I'll have a real sig.
The easiest way to avoid most spam is to use disposable email addresses - open an account with Hotmail or Yahoo, etc. and use that as your "sign-up"/"service" email. Use your personal/work email just for that - work and personal correspondence. I rarely, if ever, get spam in my personal accounts.
The effect will hopefully be twofold:
1. You don't get spam where you don't want it.
2. Choke Hotmail & Yahoo with spam, turning it into a corporate nuisance. Then they might move to actually blocking it - say by blacklisting mail servers. After all, there's nothing like a little corporate sponsorship to get the job done in the U.S.
Yup - i'm drowning in spam like the rest of us.... a 'typical' day is somewhere around 80 mails. Weekends are much worse....
BUT.......
There are MANY big name commercial companies that are spamming. They aren't stupid enough to spam themselves, they subcontract it to some other weasel who gets click-thru fees for the referrals that their spam generates.
My two biggest offenders are NetFlix and 1-800-Flowers.
Every piece of spam i get associated with a 'legit' company i make sure to forward to every address I can find on their web site, and make it very clear that I will NEVER do business with them as long as they maintain the practice.... and will discourage anybody who will listen to me to do the same.
It won't stop everything. I still get tons of 'Cum Guzzling Co-Ed's', 'Increase your Penis Size', 'Viagra without a prescription', and 'REPAIR YOUR CREDIT NOW' mail, but every little bit helps....
BOYCOTT NETFLIX
BOYCOTT NETFLIX
BOYCOTT NETFLIX
BOYCOTT NETFLIX
BOYCOTT NETFLIX
BOYCOTT NETFLIX
BOYCOTT NETFLIX
A strange game. The only winning move is not to play. How about a nice game of chess? - Joshua (Wargames)
Lost productivity figures are a strange and inexplicable number, like budget surplusses.
It's silly. I mean, lets say you're paid $50/hour when expenses are included. That means you're at about $1 / minute. Now - to lose $1 in productivity you'd have to spend 1 minute deleting the spam. I mean, 1 minute. Here in our office our most inexperienced computer user wouldn't even spend 5 seconds deleting spam. I don't see how bandwidth or storage space could even get you to that $1.
Spam is a problem, but these statements like $1 of lost productivity are pretty dubiuos. If you measure it like that the cost of my window would be enourmous, and the price of slashdot on the world economy billions per day.
Before, when it was just the individual that was getting bombarded by offers of barely legal pr0n and penis enhancers, Big Brother (the govt) didn't really seem to care. Sure, a few states have instituted laws.. but honestly, how effective has the "ADV" required by CA law been, if at all?
Finally, we're seeing reliable, solid information from big companies on how much these bits of unwanted flotsam are costing in actual dollars. This is exactly what it takes to get the Govt. to stand up and take notice. The big guys have the money, power, and voice to get the message heard and force action.
Unfortunately, even once laws are in place, I don't see much of a decrease in spam. The senders are getting smarter and smarter, the harvesting techniques are getting better, and their obfuscated headers and relays make them damned hard to track. Add in the fact that a lot of this stuff is across international boundaries, which makes local laws difficult if not impossible to enforce, so even if you can track down the offender, you end up with an incredibly difficult case to litigate.
I can see the same thing happening in this situation that has happened with online casinos: when things get unfriendly, they'll simply move their base of operation to a country that doesn't much care what they do as long as they're spending money. And with the right set up, it doesn't matter if they're spamming from NYC or Antartica... their damned message will still get through to cost you time and headaches.
Moral indignation is jealousy with a halo - H. G. Wells
This has been mentioned before (but I'm too lazy to search for the artcile), but blacklists aren't the answer. As inconvenient as it sounds, whitelists are the way to go. If your e-mail address isn't on the whitelist, your message doesn't get delivered. When a message is received that isn't on the whitelist, an automated message is sent to the sender informing them that they can be added to the whitelist by replying to this e-mail with a provided hash/password. Once they reply to the notification e-mail, they are whitelisted and their original message is delivered. Anyone who wanted to maintain a whitelist could do so, those who didn't want to bother with it could deal with the spam.
Maybe the spammers should focus on only AOL addresses since their members seem to like daily solicitation, and leave the rest of us alone!
Maybe we should enlarge the spammers penises. There is a variety of heavy machinery that could be used to result in a much larger (but paper thin) penis. Or perhaps we should shove bottle after bottle of their "herbal Viagra" down their throats until they are unable click the 'send' button.
'sigh' [deletes another batch of spam]
Starsucks
It helps if you run your own mail server, I do.
Three months ago I changed my email address. I told all my friends and created a new email address for them. Then, for every site I registered with, I used a slightly different address. I created a few generic addresses as well, for online shopping or one-time stuff.
So far, only places I actually visited have sent me spam, but now it's easy enough to cut them off.
And the mail is not annoying, I don't mind getting a buy.com sale email, because I buy from them.
It's a simple solution, and it works well.
As the number of email addresses grow, so does the spammer's lists. Also, it doesn't take any more effort for them to click and send 4 million spams as it does for them to send 40 million. It's still just one click to a harvested list, and they never have to see or pay for the damage and headaches they cause.
The problem is no one in power wants to admit that spam is getting to critical mass. Right now we're in an arms race as better blocking methods come up and better ways to run around those blocks are formed. The only sure way not to get spammed right now is to try to keep your email address private, but even that's failing as spambots get smarter about guessing valid addresses and databases of valid addresses get built. I even get spammed occassionally at work, and I've NEVER released that address to anyone.
Until someone (read major corporation) comes up and says "Hey, this is a problem that's costing us money" the situation is just going to get worse. The spamming situation is reaching a point where it cannot be controlled without intervention via legislation. I'm not a big fan of governement control, but this is the sort of thing that should be looked at heavily...not whether Billy downloaded a copy of Britney Spear's latest single.
Electronic Frontier Foundation for online civil rights information
And this goes beyond just making rules or blocking all spam - after all, I do want to know about the $120 round trip ticket offers for Myrtle Beach or the discounted digicam at ThinkGeek.
The AI can work the same way Tivo does in being sensitive to the kind of email you prefer to get and maybe even smart enough to unsubscribe you from lists that you don't want to belong to or to reply to emails in your place.
Give it a voice recognition program and it can be your phone receptionist, too.
As the anti-spam vigilantes have become more shrill, more dogmatic, more draconian, and have moved into causing "collateral damage" to sites whose only crime is being neighbors of a spam sewer, the spam continues to increase.
I submit that DNSBL and public blacklists are a failure. They have not done anything substantial to stem the tide of junk email, as this article shows.
In fact, from what I can tell, the spammers use the various DNSBL, especially the ones that list open relays, in order to locate their next set of victim relays. They could not care less that a relative handful of fanatics who use the DNSBL as intended will not be seeing their message. In fact, they are probably happy to ensure that their message will not be seen by those who are most likely to report them and try to get their activities shut down.
Edith Keeler Must Die
Since around Dec 7, 2000, (the date I installed Spamassassin [a really great spam-catcher I must say!] on my mail server) I have received around 650 spam messages.
By the way, spamassassin is really really good. I have not had any mail that was personal get flagged as spam, (only a few list-serv messages) and out of all those spams, about 5, certainly less than 10 spam messages actually made it through without being flagged as spam!
If you get a chance, try spamassassin. It uses razor, and many of the RBL lists, as well as key-words. Plus it's really configurable, to match your prefs.
I'm probably going to install spamassassin on several of my clients mail servers to block spam site-wide.
Cheers!
This reminds me of a quote from the recent article regarding Simpsons math references:
ian.
ian
That's not a lot, by a friggin longshot. I know Taco is in a unique situation, where people would put him on a list for paybacks or vendettas or whatever form of agression they are taking for not having their story accepted. Me, in a position where I really, really try to keep spam out of my inbox by only giving it to places I deem worthy, and removing myself from lists where I believe that will do me any good, I still get about 15 a day. Filtering out 90% helps, which might make it to 1400 spams a year that reach my inbox. But whoever is doing this study must really know how to repevent the uncolicited crap away If 4 a day is too much for them to handle.
Th
No. No. No. What I mean is many contituents, each sending their 200 spams a day to their congressperson. Ie. Do select all text, reply, change the reply address to the congressperson's address (instead of the spammers), add a note at the top saying, "Here is another spam that I got. Please pass a law outlawing spamm."
Fight Spammers!
It's perfect for registering online or leaving a temporary contact address. I've used it almost exclusively for one of my accounts, and I get virtually no spam on that account. It's a lifesaver.
I can highly, HIGHLY recommend that you sign up with them. You'll thank me later.
Mr. Ska
Back when e-mail was invented, say, in 1623 (I'm too lazy to do actual research), people used it as a basis of instant communication between two or more parties.
(Some people used it as a basis of communication between only one party; however, these people were usually either the types who needed to write themselves little sticky notes, or they had disassociative identity disorder.)
Considering how small the 'Internet' was back during the days of the first e-mail (I use quotes because, again, I've not done my research; and I'm uncertain whether e-mail or the 'net itself came first), e-mail was developed with a very open set of rules:
I create a server.
I set up a few accounts.
I open a port to allow for e-mails to be sent to me.
People connect to my computer, write me a message, and then magically disappear.
In time, relaying was invented, and was implemented such that the existing mail servers could be used as relay points -- I send an e-mail from my computer, it gets bounced around until it reaches its recipient.
Thus, the entire idea of e-mail.
I hate to say it, but... This world of e-mail is greatly polluted. I'm not talking about Gulf of Mexico polluted -- this is pre-1972 Lake Erie polluted.
So... Why not re-invent the wheel? We've been so concerned with building filtering applications, and layers upon layers over the basic SNMP protocol that we've forgotten that no matter how many bridges we build, we're still going to be able to look down and see the same polluted water.
With this in mind, I call for a new type of e-mail service to be offered by various providers. One that explicitly denies old protocol e-mails. Something akin to Internet2, but for the public masses. Built-in encryption, a prerequisite (as well as several mechanisms) to determine that not only is the sender valid, but the router its sent from is uncompromised.
While this won't solve all the problems associated with spam, it'll certainly alleviate them. With a protocol designed from the ground up to disallow things such as anonymous e-mails or misrepresented e-mail addresses; as well as several other measures which would make for not only for a secure, but unpolluted e-mail atmosphere, we can abandon the current system which has become so polluted with the waste, filth, and garbage known as 'spam'.
Thank you.
Fight Spammers!
Of course, with 45,000 employees at $5 an hour, payroll alone costs them $1.8 million a day, but your point is well-taken.
Here's a hint. Don't give spammers your e-mail address in the first place.
Don't give it to shady businesses or websites, don't give it to amateur websites run by people you don't know, don't give it to small or medium sized businesses, don't give it to well known or big online or meat-space companies that have a reputation of being irresponsible in such matters, and don't give it to anyone whose privacy/non-use clauses don't look sincere or aren't backed by anyone you know.
And munge your e-mail address when used on Usenet.
That's it. I haven't gotten ONE SINGLE piece of spam in 4 years. I give my e-mail address to my friends and co-workers, the only people in the world who need it. It's on my website which is hosted from my ADSL line on dyndns.org, and it's never been reaped. It's in my profile at some online-groups and semi-private blog places (my CS clan's web-forum for example), and they've never been reaped.
An ounce of prevention is worth a pound of cure!
All that we need is a honest to goodness education campaign by the ISPs to clue in their lusers.
Yes, there are folks who keep rather detailed records of how much spam they receive.
Check google groups for news.admin.net-abuse.email for "spam stats" and you should find some information from various users. Of course, their amounts may be inflated, but the general trend is clear - the amount of spam is increasing quickly.
It is estimated that by this June, more spam will have been sent this year than ALL OF LAST YEAR. That's over 100% growth.
From what I'm seeing, this estimate is dead on target so far... I used to get ~10-20 a day. Now I'm getting 30-40+. Over half are blocked by my filters, but still, 20 spams at 10Kbyte each is a lot of email traffic that simply gets deleted.
It does exactly what you are talking about, only you dont need to run your own mail server. They forward to your real address. You can set each alias to allow all, deny all, allow all except specifically blocked (per sender), or block all except specifically allowed (per sender).
So basically I have a slashdot alias, but slashdot@slashdot.org is the only person who can send mail to that alias ;-) All the other emails are put into a "mail-dam" that I periodically check for anything of real value. You can also set it to instantly trash mail from senders you dont allow.
I run ORDB on my mail server as well, and I will soon be blocking all of APNIC, I go several days now with no spam while receiving tons of legitimate email.
On the off chance I get a spam, I immediately report it to spamcop.net
You need to attack spam on many many levels for it to be effective ;-)
No way this will ever happen! Ever hear of junk mail (not spam email, real paper junk mail)? Has it become unviable? No. As a matter of fact, it is the most effective form of advertising. As more and more people worldwide use email, targeted spam will become as effective as the direct mail is now.
The spam is green. It is still in its infancy as a marketing medium.
Curb CO2 emissions: Kill yourself today!
My modest proposal is that we have to make it legal for people and service providers to charge spammers for the traffic they create.
If you can make a profit in hunting down spammers, i bet a lot of people would jump at the chance.
A federal spamm license requiring spammer to register, etc, pay huge taxes to the government, complete with cute little orange tag for the ear.
and allowing people to charge them for the hassle. did I mention tthat yet?
people would get rich off this, hunting down illegal spammers, collecting fees for ISPs, etc.
"It is a greater offense to steal men's labor, than their clothes"
when my ISP decided to block ALL inbound mail coming from Asia. the spam dropped from 30 a day to FOUR. then under pressure they opened back up and now I am getting 50+ !! :) after all thats what friends do for each other.
*sigh* I hate spammers with a passion. A good friend decided to start spamming from his computer to promote his new business, so I Dos attacked him until he stopped
if you want "No More Hiroshimas" then I say "You First. No More Pearl Harbors."
Obviously an automated email verification system won't understand the whitelist notice message and the whole thing will fail miserably.
So you decide to create an address that doesnt block non-whitelisted emails and now that address is vulnerable to spam.
I would say that you are very lucky. Or you don't do much on the net. [grin]
I've found spam much easier to deal with now that I own a domain. I created an email address (nospam@weightjournal.com) and use that email address anywhere that is supsicious (or anywhere that requires me to register an email address, but that I am not interested in receiving email from). I have a recipe at the top of the list that moves all email TO nospam@weightjournal.com to the Spamfilter mail folder.
So far, the mail delivered into this mailbox has been 100% spam.
--- Biffster.org
"Bite my shiny metal ass."
Well, let's say your moral compass has been permanently derailed and you are planning to enter the "spamming industry." You can buy CDs with e-mail lists for cheap (I believe it's something in the order of 1 million names for $100). You also would use a program to find open relays and exploit them (why run your own mail server when you can hijack someone else's for less dough). Then you forge your e-mail headers (after all, you don't want to deal with messy details like bouncing e-mails and angry recipients).
Now say you send out a million spam e-mails. Your cost is $100 or so (the cost of the list) and whatever you're using for your Internet connection. That's less than a penny per person. If one hundredth of one percent of those names were to send $5 each, you'd take in $500, or about $400 profit. And that's just from one mailing. You'd ignore any "remove me off this #&*#&@ list" e-mails (actually, with the forged headers you wouldn't see them) and send another round hoping to lure in more suckers.
Now these aren't hard and fast numbers, but you can see how some people are lured into the "easy money." Of course, breaking into people's homes and taking valuables is "easy money" also, but spammers somehow convince themselves that they have a constitutional right to misuse other people's bandwidth and time for their own personal gain.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
All the SPAM'ers cite freedom of speech. Well, I wanna know what the hell happened to your rights ending where mine begin?
The problem of SPAM on fax machines back in the 80's, due to the fact that paper/toner/etc. cost $$ as well as tying up a business' fax line prompted a law that bans SPAMing fax machines. It was the use of resources and stopping of business that got this law passed.
Well, bandwidth is a resource, and if a major ISP's mail service is unusable for a good chunk of time, that's a stopping of business.
I pay for my bandwidth to run my own server. Using my resources (bandwidth), for a purpose I don't approve of, should be considered theft. It might be different for a dialup user (the end user doesn't pay for bandwidth, they pay a monthly fee for access, the ISP pays for the bandwidth, usually).
I'm so incredibly sick of SPAM! Oh, and by all means, I don't want to limit SPAM to commercial mail. I think any email that is soliciting, be it a campaign contribution, a donation to the kidney fund, or religion oriented ("come join us in fellowship", blah) should be considered SPAM as well.
Although, having said all that, I think that legislation is only part of the problem. I think what we need is a modification to the SMTP protocol itself that makes it easy and lightweight to identify and handle these types of email, and legislation enforcing this.
Something like identifying the message as spam immediately after the HELO or RCPT TO, or perhaps even requiring spam to use another port!
But even that's not enough because you know those direct marketing jackasses will still send it without the proper identifiers.
I'm real close to setting up a system where you have to give me your email address and I have to approve you to send me email or I'll never see it. (with a seperate dump account for registrations for web boards, etc.)
Is it possible to file a bug against an RFC? If so, I'm going to post to bugtraq about RFC 2821.
Spam is a problem for users. But the problem that users have pales in comparison to the problem that ISPs and other providers have.
Most of the available solutions are catch-up solutions, which, like virus detection software, always arrives too late and is easily defeated (and in any case not the best way to solve the problem).
Anyhoo, why is spam the ultimate DoS? Very simple. Spammer sends 50,000+ emails to 50,000+ addresses using a forged "From: fooXK343@forgedfrom.tld" header. 49,987 of the spam emails bounce, and where to they go? You guessed it, right to fooXK343@forgedfrom.tld. fooXK343@forgedfrom.tld doesn't exist, of course, so the messages get double-bounced to postmaster@forgedfrom.tld.
What can postmaster@forgedfrom.tld do? Very little.
Can he block the incoming connections? No, they are coming from 49,987 different sources, most of which are valid functioning SMTP servers.
Can he contact the admin of the machine or relay where the spam is coming from? Sure, if he magically has 37 hours in his day. But, the relay server is most likely a rooted machine on the other side of the world. Good luck there. Or, the machine belongs to one of the 15 largest ISPs on the planet, in which case he will have to jump through 7 different hoops to talk to the person that can fix the problem. And even if he does get through to that person and the offending dialup account is shut down, the spammer usually has 15 more compromised accounts to choose from and is active on the same ISP within days. Would the large ISP share information so postmaster@forgedfrom.tld can track down the spammer? Doubt it.
Can't postmaster@forgedfrom.tld just send all incoming messages to fooXK343@forgedfrom.tld to the bitbucket? Sure. Will that save his bandwidth and prevent the DoS? Nope.
That's why Spam is the Ultimate DoS. A bug should be filed against RFC 2821. The implications of this type of DoS becoming widespread are serious.
I think SPAM could be limited if our government dedicated more resources to white collar crime and fraud than to other pursuits like the war on drugs.
Most of what passes for SPAM in my mailbox is either prima facie fraudulent products (penis enlargers) and offers (stock "tips") or setups to fraudulent web sites for porn or related items.
If people who did these scams were actually investigated and ultimately jailed with great frequency we would have fewer SPAM messages. They have to be invetigatable because there has to be a way for them to get money from your pocket to theirs.
Also, I think that there'd have to be few convictions. Merely having the FBI/SEC/ATF show up and start doing a serious investigation is enough to scare a lot of people into other lines of fraud.
This wouldn't do anything for offshore scammers, but I have a feeling that the offshore places are going to have to get their shit together or they will start finding lots of the 1st world net blackholed to all of their data.
b) It's clear that a technological filtering solution is probably not the ideal way to go because ultimately, any filtering scheme doesn't address the issue that the SPAM is out there and it's still flooding our networks, regardless if you detect it as a SPAM or not.
The only conclusion is that we really need to fix the problem at it's source. Change the SMTP protocol to include a handshaking/whitelisting layer. Is there a reason why the big mail server makers and mail client makers couldn't get together and work on an extention of the protocol that would make the protocol secure?
To me, this is a no brainer and it's probably the only way to go at this point.
Read it again. You will see he says 1400 a year is what the article states, but that he himself gets 1400 a week. Not a day. Where'd that come from?
I wish I could find the email that a friend of mine at my ISP sent me a while back (irony at its best).
Basically he has some software that parses emails and assigns it a 'spam value'. That is, it searches for various patterns, and cumulatively adds up the 'weights' for each pattern that matches. Because there are common threads throughout spam, and because a typical spam contains many identifiable factors, this software makes it possible to filter on patterns that you don't want to just filter outright (eg. HTML emails, or mail that contains porn-related swear words).
Can anyone remember the name of this software? I'm not familiar enough with unix administration to remember exactly what it's called or the gory implementation details.
These guys set up a fun little system: incoming spam is stripped down to plain text, fed into a text-to-speech program, and then set to music. They broadcast 24 hours a day, and I've got to say that it becomes kind of hynotic...
I think it also has great business potential; spammers could use the stream as the hold music for their phone systems -- when people call up to complain about having been added to a "permission based" list without doing anything, they have to listen to spam while they wait.
Just a joke... =)
* * *
It is a dada story -- it has no moral.
I'm pretty sure I have some scores well into the 30's...
I'll check...
Cheers!
I've only had Spamassassin going a couple weeks, but I've been very pleased so far.
My e-mail address is 7 years old, so I must be on nearly every spam list in existence. Without filters I'd get at least 10 spam messages a day. Spamassassin tags over 90% of it.
The only false-positives so far have been stupid auto notification crap from a final four pool website. It's not as if I really missed those anyway.
It would be nice to have two-level selection, so that e-mails that score over 10 (for example) get automatically deleted. E-mail that scores over 5 merely gets a warning attached.
Maybe I'll have a look at the code this weekend... It's not as if I have a date. :-)
I was young and stupid, and years ago I used my real, work address on Usenet. I answered a lot of newbie questions, so I wanted to make it easier for them to reply. Back then, I got 2 or 3 pieces of SPAM an hour, so didn't seem to cause much damage.
Now I get that in an hour. I got a big spike when Google brought back old posts. We have Netscape Messenger Service as our mail server. I usually use IMAP, though there is a web interface I sometimes am stuck with. Is there a way of filtering this account? Supposedly you can do server based filters in some clients, but our NMS doesn't seem to support this. I'm on a W2K box, so i'm not sure if fetchmail is an option.
Fight Spammers!
1. Never sign up for a pr0n site.
2. Do not post your primary address to a public forum.
3. Don't piss people off.
If you are getting 40 spams a day, you are doing something stupid.
Conformity is the jailer of freedom and enemy of growth. -JFK
Subject: Sick of spam?
Sick and tired of unsolicited email? Our new Spam Laundry Disc (tm) with its patented HotWetNudeTeenSlut technology will eliminate all your spam problems while enlarging your breast size (even if you're a man) while allowing you to Make Money Fast by selling the Spam Laundry Disc (tm) in an innovative new Newtwork Marketing Scheme!
To unsubscribe from this silliness, just hit delete because as we all know any attempt to respond means you're interested in this product.
/Brian
By my calculations I currently get over 3000 spams in a year. Thank goodness I have filters to block some of this and earthlinks spaminator.... I think every ISP/mail service should have a spaminator...
Only 'flamers' flame!
Lots of people.
Based on my collections, you can expect around 700, just like the article predicts. (The prediction comes from the brightmail people, so it's not surprising that it's accurate.)
Despite the claims of 100-200 spams a day, most people get less than 10 a day, even old timers whose email address shows up everywhere. The average spam size is between 5K and 6K, so a years worth is going to be less than 4.5 megabytes. If you have an old address that's been heavily published, then you can expect around 10 times that amount. Just try saving spam for a week - you'll probably get enough data to convince yourself that the numbers listed in the article are resonable.
-- Spam Wolf, the best spam blocking vaporware yet!
I think we're going about this all wrong, why should industry the military and government care that much about SPAM if it isn't a problem for them too?
Maybe we should be sharing the spam with those who have the power to stop it, or those who's voices will be heard.
We should be putting these people's email address on lists which constantly send offers for penis enlargement. So much so that it interferes with thier work and they start asking for people's heads.
"Communism is like having one [local] phone company " - Lenny Bruce
If they think it's OK to abuse a resource, they must think it's OK to get abused as well, right?
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Then setting procmail to put stuff without an explicit To: line with my e-mail on it into a separate mailbox gets most of what gets by Razor, although that box needs to be checked occassionally, since there are legitimate e-mails that end up there. The other stuff is easy to report to Razor through a key assignment in mutt.
If enough people are using Razor, especially with honey-pot type mailboxes feeding reports directly to it, it should only get better.
___
"with their freedom lost all virtue lose" - Milton
My solution: All email from amazon.com is automatically deleted.
Microsoft started sending me some newsletter I never requested about five years ago. The newsletter states that I can stop the mailings by visiting a certain page on MS's site. I visit the page, and it asks me to log in. Since I've never signed up for anything, I can't log in and can't get them to stop sending the mail.
My solution: All email from microsoft.com is automatically deleted.
About 50% of the spam I get is received from outblaze.com servers. Some of it is from legitimate companies I know I have given my email address to, some is from legitimate companies I know I never gave my email address to, and the majority is from your typical "enlarge your penis/fire your boss" spammers.
Outblaze's front page actually has a link to a statement that effectively says, "we're not spammers, we're victims just like you. Our customers are legitimate businesses who send you useful information you want to read." Bull. I have received thousands of emails from outblaze (that I have read), and not one of them was solicited or of interest to me.
My solution: All email with outblaze.com in the "received" headers is automatically deleted.
I've been reporting all spam recived for a couple months now, with appearently no let up. still it makes me feel good that i'm doing something. I intend to subscribe, even if they don't seem to help much. If nothing else maybe I can solve the problem...
The spam figures amaze me, i work as an IT manager and post on many newsgroups, i have hotmail address and i spend about 12 hours a day on line yet my spam haul is about 4-5 emails a day across 6 accounts ! Yes i post to usenet and i post to support forums and i use my hotmail .
The thing is i ONLY ever give out my hotmail address when subscribing for something, I never use my personal address at all unless i know and trust the person or org. Hotmail get a lot of abuse on this site i know, and i suspect most of you havent used it in a long time - its now a very good mail system and the spam blocks work very well, you see it once you block it and you dont see it again (the only ones that dont work for this are the degree mill people who run dictionary attacks against hotmail addys from throwaway accounts; but as its one a week im not too bothered.
I dont join any open discussion newsgroups with my real addresses, i use my hotmail or more often my bigfoot auto forwarder (had it for over 6 years) and get the mail forwarded to me, i can then manage it a bit better.
So i dont understand the 30-40 emails a day, that to me is simply someone who doesnt understand how to protect themselves and uses their email everywhere.
I dont subscribe to any porn sites (have you ever heard of newsgroups btw ? they are free you know) and i would never do so using my personal email - thats just stupid, as is posting to usenet with it.
Your mail client can no doubt filter spam (i use the dreaded and horrible outlook (never had a virus from it but maybe its just my systems) and it has very effective spam filters in XP) or set up some rules to handle it - mine just gets deleted immediately (dumped to tghe deleted items)
If you're getting 40 spams a day you've been careless with your email addy and youre reaping the price.
Its something i expect an AOL newbie to do not a software developer.
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
I don't know where they get the figure of 1400 spams per year, because honestly I didn't read the article. But there are over 12 million companies in the United States alone. If a mere one tenth of one percent of them sent you one email per year, you would get over 1000 msgs per month.
1400 per year is only 4 per day. That is an order of magnitude less than the amount of spam I get right now.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
OTOH, that you consider it such explains a great deal.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
the slashdot community is rather advanced, seeing the internet under more experienced eyes than most. most of us already get more that that 1400spam/yr (4spam/day) mark (i'm at twice that).
...we already see this today, but usually the guesses are wrong; for example, i just deleted a message to Harry from Molly about enlarging my cock. i am not Harry, i don't know a Molly, and i'm large enough already.
what do we do when we find spam? we don't fall for the advertisement, we report the spam, and we revise our filters so that we don't see that message again. by 2006, people less tech-saavy will have adopted these practices too (and we can probably double or triple the 1400 rate).
if laws and isps don't help, people will get so fed up and spams will get so numerous that they will undo themselves; people will simply stop listening, and it won't be profitable to spam.
another possibility is (if things get really out of hand) that spammers will have enough information about victims to target them masquerading as friends, including real name and interest of the victim in a suggestion-like spam.
Use my userscript to add story images to Slashdot. There's no going back.
I think it was Alan Ralsky who bragged about that figure per spam run. I remember reading an interview with one of the more persistent spammers who reported a 1-to-100,000 sell rate, but at 10,000,000 spams that's still a hundred sells.
If you google around, you'll find some web sites where anti-spammers (called "anti"s in spammer jargon) post their insight into the spammers world and psyches. One of the best is the venerable Behind Enemy Lines -- Premier Services Exposed" website.
Lots of info on how they communicate, harvest AOL accounts (that's now dated info, they have devised other techniques for their spam runs), and share the loot. A Must Read!
For documentation on organized spamming, there are two repositories with the dull date: SPEWS and spamhaus.
Spam is reaching the epidemic proportion that I now with increasing frequency receive the same spam on the same address several times, spaced a week apart...
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
That 1,400 number may not be surprising to anyone who's been on the net for a while, but you also got to look at the balancing act that kept it that low so far.
Of the spam you receive, chances are that about a third is from spam outfits that spam from their own IP space, and about two thirds is real sleazy stuff sent through compromised servers around the world. Little if any is from companies you want (or need) to do business with.
Those two are not my main concern. The first category can (and eventually will) be blocked by IP address, and the second category will be battled in leaps and bounds by new block list initiatives.
Why is the first category being blocked? Simple: as ISPs get complaints from their customers, an increasing number is going to block them on their customers behalf, with no loss other than the spam messages.
The big thing that most people tend to forget is that the Real Big Firms have not really started spamming you, because of concerns over customer acceptance. If those concerns were to get less, then the real spam barrage starts.
Ever complained to your bank about the leaflets they insist on inserting in your monthly statements? If you expand this to the brave new world of cyberspace, it means you will not have much of a chance to stop the flood without losing your bank statements.
Fear is the only thing that keeps the thing from exploding beyond the current upward slope, and *that*'s why keeping up the pressure is so important.
Look at what happens if a company is near failure these days. In total desperation, an increasing number of them turns to spamming (hint: Google for Enron's involvement in spam).
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
Wholesale blocking can be made to work if done right. Using a blacklist for *@yahoo.com and a whitelist for sistersname@yahoo.com has the right effect. It deletes anyone claiming to be from Yahoo other than those claiming to be his sister. What's the chance of some spammer using his sister's Yahoo address as the FROM address?
now we need to go OSS in diesel cars