Collateral Damage in the Spam War

MarkedMan writes "The link points to a well researched article on Spam lists and those innocently appended to them. I have seen this myself with MailWasher. A posting will come through as potential spam, with the the bounce already red-flagged, but it is actually from a legitimate source. Only happens once or twice a month but still cause for worry. " I've found that Spam Assassin has made life easier, but I still have to ban domains like yahoo.com, hotmail.com, mail.com - and *.ru and *.cn. I sort through the spam periodically, but the collateral damage is still there.

Comments

This happens to me all the time

[sllort]

I keep sending CmdrTaco email that says 'I LOVE YOU' in the subject, and I think he's filtering it somehow.

No replies yet.

Re:This happens to me all the time

[justletmeinnow]

That's because he doesn't love you back silly. Did he mention anything about the restraining order yet? If not, expect to be served soon...

Re:This happens to me all the time

[Anonymous Coward]

WTF? That's just plain humour, not "Overrated". Sllort never sent CmdrTaco those emails!

Re:This happens to me all the time

[Anonymous Coward]

Check you karma today?

Re:This happens to me all the time

[Anonymous Coward]

Offtopic question: My Karma does not show a score right now (i should have 50 karma). Instead it says "Excellent." What is going on?

Re:This happens to me all the time

[Rick the Red]

The least they could do is update the FAQ when they change the system's behavior.

No, I'm wrong: the least they could do is what the actually do, which is nothing. Fucking stupid lazy /.

If they don't want off-topic posts about /. itself, why don't they provide a forum for discussing /.? Oh, I forgot, it's because they're fucking stupid lazy /.!

Re:This happens to me all the time

[Anonymous Coward]

Run along now, little high school SpoogeBoy. MASCO must really suck as a school if their products are fucking losers like you.

Network Solutions, One domain per user?

[dada21]

The only people I got spam from was from the e-mail address I used to register domain names with through netsol.

I dumped that address (100 spams a day).

What I've done is registered a domain name (say fatgeeks.com) and when I have to use my e-mail address at a website, I'll append the website to the user name, such as:

dada_slashdot@fatgeeks.com

or

dada_msn@fatgeeks.com

When spam appears, I kill off that user name (very easy to do in any POP3 e-mail program) and then go to the website that sold my address and yell.

This helps track websites that "lie" about reselling your e-mail address.

No spam. No collateral damage.

Re:Network Solutions, One domain per user?

[Mr_Silver]

This helps track websites that "lie" about reselling your e-mail address.

Is there a page out there that details which websites sell your email addresses? It would be rather useful.

Personally I nominate hotmail.com - unless you're telling me that ibtagmrq@hotmail.com is a popular name.

Re:Network Solutions, One domain per user?

[Anonymous Coward]

Such a website would be in very hot water. You usually can't prove who sold your address. And it's even harder to validate if someone who claims that someone else is selling addresses is telling the truth or if he is just trying to make his competitor look bad.

Re:Network Solutions, One domain per user?

[natefaerber]

I do the same thing but use aliases and just point it to /dev/null if I start getting spammed. I wish I would have thought of it sooner, like before I registered with netsol and dice and hotjobs and monster and well, you get the picture.

Re:Network Solutions, One domain per user?

[great throwdini]

[U]nless you're telling me that ibtagmrq@hotmail.com is a popular name.

Unless you're telling me that some of these people don't have the time to just randomly generate email addys @hotmail.com just to see what turns up...

Re:Network Solutions, One domain per user?

[Anonymous Coward]

I used to do this but stopped for one reason: Especially when registering online, I don't want to give out more information about me than what they already have or require. A mail address with your own domain gives them your full address, backup email address and phonenumber (depends on the registry). These pieces of information are probably not harvested right now, but they definitely could be. Since most users who use this scheme have their mailserver in catch-all mode, some software could also check for the service name and remove it before selling the address. To make this really failsafe, you would have to generate random addresses, put them in a database together with the associated service name and reject mails to addresses which are not in the database.

Re:Network Solutions, One domain per user?

[pixelpusher220]

It is now ;-)

Re:Network Solutions, One domain per user?

[timeOday]

Using a-z and 0-9 gives you 36 characters, so the number of email addresses that long or shorter is 2.9017e12 - yes, about 3 trillion.

In other words I think your explanation is wrong.

Re:Network Solutions, One domain per user?

[timeOday]

I do this to, but it won't help when you need the address to be (more or less) public, like on a resume, or a contact address on a web page.

Also, you may be able to do this without owning your own domain using the "percent hack" - you prepend somestring% to your email address and everything previous to the percent sign is not used in addressing the mail, but you can filter on it.

Re:Network Solutions, One domain per user?

[Computer!]

Randomly? Yes, that's wrong. However, you can cut that 3X10^12 down to aroung 3X10^6 merely by running a dictionary file filled with common last names and append one or two letters after. How do I know this? My personal email address is mccallclAThotmailDOTcom, and many of the spams I recieve are also addressed to mccallca, mccallcb, mccallcc and so on.

Re:Network Solutions, One domain per user?

[great throwdini]

Randomly? Yes, that's wrong. However...

Yes. I was a bit too loose with my quick reply.

Re:Network Solutions, One domain per user?

[jarrell]

Check out spamgourmet.com. It institutionalizes that idea. Once you're registered you can create self-destructing email accounts, that accept N number of messages. The slick thing is that it creates them on the fly, the first time you send email to it, so after having visited them, you never have to go there again to actually create these accounts.

Re:Network Solutions, One domain per user?

[_Wrath_]

I dunno but you are pretty narrow minded to think the crawlers haven't learned to look for *AT*DOT*

Re:Network Solutions, One domain per user?

[mjh]

Depending on which MTA you're using, you can do this with address extensions too. Sendmail uses + as it's address extension, and postfix/qmail use - for address extensions. So for my email, for example, mark-foobar@hornclan.com will get delivered to the same mailbox as mark@hornclan.com. The MTA simply ingores everything after and including the extension delimiter.

TMDA takes advantage of this sort of thing. So it does what you're talking about, but it also adds a cryptographic hash onto the extension to verify that you infact were the person who generated the extension. So my equivalant of what you're doing would be:

mark-keyword-slashdot.abc123@hornclan.com
mark-keyword-msn.a1b2c3@hornclan.com

The generation of the hash depends on a secret 140bit key that only I know. Thus I can create these things whenever I want and use them without modification to my mailsetup and be confident that no one else can generate these things that will get into my mailbox.

Other types of addresses that tmda generates:

• Dated addresses - addresses that will work for a certain amount of time, and then expire. Great to use when posting to USENET, and as the default for all outgoing email.
• Sender addresses - addresses that will work if used by a particular sender. Great for subscribing to mailing lists with.

Anyway, I'm pretty pleased with TMDA, although, as I say in another post, it can impact one's ego.

Re:Network Solutions, One domain per user?

[macdaddy]

Whoops. You showed the wrong syntax. Did you mean dada+slashdot@fatgeeks.com instead of dada_slashdot@fatgeeks.com? The underscore is a valid character in a user name. The plus sign however is called plus notation. I use it myself. Say I sign up for a demo of ProductX, I'll use the email address of userid+productx@domain.tld. MTAs are supposed to ignore everything between the "+" and the "@". Plus notation. It works pretty slick too. I use it for magazine subscriptions and what not too.

Something I've started using more is simple mail aliases. Since I run many MTAs, I've taken one of my own domains and create an alias for a mail recipient for when I need to sign up for something. Let's say I order some X10 stuff. I'll create a quick mail alias called "x10" and point it at my usual mail account. I'll add a comment with a date, maybe a URL, etc.. to it and rebuild my aliases.db. There are 2 upsides to this. 1 is that I can easily make that a real account someday and spamtrap all that junk if needed. It's also garunteed to be accepted on every web form I come across. Occasionally I'll come across a web form that only accept alphanumeric characters (and the @) in the email address. Some webmaster thought he was being security-wise and didn't follow the RFCs. Whoops. No biggie. This method gets you around that little problem. The only real downside is that it takes a couple extra seconds to create that alias and add some comments about it. Oh wait, there's another plus. Some mass mailers strip out the plus notation from email addresses. Giving your address to, say, Citibank or CapitolOne as joeblow+citibank@domain.tld might confuse the person or raise suspicion if you're entering your address in a spamtrap. With the email alias, you can use an acronym, gibberish, or whatever you want for your particular situation.

Re:Network Solutions, One domain per user?

[Mike Schiraldi]

This helps track websites that "lie" about reselling your e-mail address.

Even honest companies are a problem -- i do the same trick you do, and about a year ago, i started getting porn spam to the address i used only at 1800flowers.com. They swore they didn't give it to anyone, and i believe them.

What i'm sure happened is this: Some DBA, or some temp, or whatever, did a one-line SQL query to pull out every email address in their database, and then sold that list.

So even if you trust the company to not sell your address, it just takes one bad employee to screw you over.

Of course, their database also has my credit card, so the same DBA could have run off with that. So far, i haven't had any fraudulent charges. But that's what you gotta read over every single charge on your credit card bill, every single money.

Re:Network Solutions, One domain per user?

[Mike Schiraldi]

s/money/month

Re:Network Solutions, One domain per user?

[invenustus]

you are pretty narrow minded to think the crawlers haven't learned to look for *AT*DOT*

That brings up one of the questions I've been pondering lately in regard to spam.

Spammers always seem to be coming up with newer and better ways to thwart our attempts to avoid them. But do the people who go to such lengths to avoid spam EVER buy anything from spammers? EVER?

I always hear "Spam works because people like your grandmother buy stuff from them, and if they get one sale, that makes it worthwhile." To which I respond, "My grandmother's alive?!" But crawling for *AT*DOT* isn't going to catch such un-tech-savvy people. Those people are going to leave their addresses unencrypted.

So let me pose this question: has spam become less a means of advertising than an all-out war, with nothing at stake other than showing that you can beat the other side?

Re:Network Solutions, One domain per user?

[gid]

hrm, when trying to send a mail like that to exim I get a "unknown local part" error message on send. Maybe it's something that got inadvertantly turned off on our mail server. unfortunately searching stuff like that on www.exim.org is like "hey it's needle in haystack time". That definitely sounds like something I'd be interested in. But I kind of like the idea that I can totally turn off the email address, not just bitch about then spam as it comes in because I know how it came from.

Re:Network Solutions, One domain per user?

[Fluid Truth]

Depending on which MTA you're using, you can do this with address extensions too. Sendmail uses + as it's address extension, and postfix/qmail use - for address extensions. So for my email, for example, mark-foobar@hornclan.com will get delivered to the same mailbox as mark@hornclan.com. The MTA simply ingores everything after and including the extension delimiter.

Quick note: for qmail, you have to have a .qmail-default in place (either blank, which goes to your default delivery destination, or sent to somewhere specific) for this to work for an arbitrary address. Otherwise, it won't get delivered unless you specify the "extension" (ie. .qmail-foobar will allow email to mark-foobar@hornclan.com in the example above).

This also allows you to send specific addresses elsewhere automatically. If you know that mark-foobar is always crapola, then you can setup rules for just that address, leaving all of the still good ones alone.

For more info, check out Life With qmail.

Re:Network Solutions, One domain per user?

[palme999]

...running a dictionary file filled with common last names and append one or two letters after.

That could very well be the case, but have you also considered that the harvested email db the spammer is using is simply sorted alphabetically? They aren't 'generated' but rather bought from a harvester and sorted by alpha by domain and sent in chunks. I personally witness this behavior because my home email is not in a dictionary or a common name but a creation spawned by my wife's and my intials. So I see spam addressed to me that is in the middle of a sorted group that contains address that are much more dissimilar than the last two letters.

Re:Network Solutions, One domain per user?

[Asprin]

Is there a page out there that details which websites sell your email addresses? It would be rather useful.

Personally I nominate hotmail.com - unless you're telling me that ibtagmrq@hotmail.com is a popular name.


For the life of me, I can't understand how anyone can even *use* a service that is so hopelessly targeted as Hotmail.

I have a hotmail account (created just before MS bought them) which I use for exactly one purpose: I give it out to assheads who demand an email address on a web registration or reply form.

Now, this was not my intention when I opened the account; originally, I hoped to use it to *replace* my Yahoo! email account because several people recommended it as a slightly-more-functional alternative.

However,

After I opened the hotmail account and verified I could log in, I went away and forgot about it. When I came back a week later, my mailbox was full - there were over 200 (!) SPAMs waiting for me. This, by the way, without telling a single person about the new address or sending a single email from the account.

The spammers beat me before I even got to the starting line with Hotmail. A lot of them come in with randomly generated recipient lists, so MS doesn't even have to sell addresses - they've got random number generators for that. In fact, this might be the ONE argument in favor of ridiculous email addresses like "superbob8337264fromtulsa@hotmail.com, because I'm sure that the longer your email address, the fewer SPAMs you get, even by only a couple.

Re:Network Solutions, One domain per user?

[jpdbest]

I agree totally, spamgourmet.com is great. I've been using this for a while now and I use it anywhere that requires you to enter in a valid (e.g. getting software eval keys) e-mail address. Like jarrell says, after you've setup a forwarding address at spamgourmet.com, you can create e-mail alias' whenever you need and it's as simple as:

<watchword>.<#>.<spamgourmet userid>@spamgourmet.com

<watchword> - a virtual e-mail address identity; you create these on-the-fly
<#> - the number of e-mails received by the watchword alias that will be forwarded to your real e-mail account before being sent to spam limbo
<spamgourmet userid> - the userid that is created on spamgourmet.com that relates to your real e-mail address

At this point it's zero maintenance, but some people probably wonder what will stop spammers from figuring out how the system works and create their own watchwords. Well, if that ever happens, this site also gives you advanced control over your account, where you can restrict what watchwords are useable, re-configure the number of forwarded e-mails to be allowed (more or less), and if that's not enough - create a prefix (kinda like a passphrase, which determines if the e-mail can pass (and you can change this whenever required).

<prefix>.<watchword>.<#>.<spamgourm et userid>@spamgourmet.com

And hey, it's free (as in beer). Here's some stat's for anyone who is interested:

623 days, 12,314 user accounts
37,907 disposable addresses
146,592 msgs delivered, 799 today
1,268,724 msgs eaten, 5,512 today

Re:Network Solutions, One domain per user?

[timeOday]

I'm aware of this, but the username in question was "ibtagmrq" which to me doesn't look susceptible to dictionary attack.

To me this username looks like a pretty fair password. It only has two vowels and uses a 'q' (without a 'u', no less). It doesn't use any numbers, but that might be good in this case as numbers are so commonly used on hotmail addresses, especially at the end.

You're claiming there's enough structure in this username to increase it's liklihood by 6 orders of magnitude. I just don't see that.

Re:Network Solutions, One domain per user?

[Anonymous Coward]

Do I have this right: mccallclAThotmailDOTcom means mccallcl@hotmail.com ?

Re:Network Solutions, One domain per user?

[duren686]

My hotmail address gets no spam.. Even after signing up for 5 newsletters and things (at least 5, I don't remember any more).. It's about half a year old, too.

I guess I forgot to check the "Spam me" option.

Re:Network Solutions, One domain per user?

[Anonymous Coward]

But that's what you gotta read over every single charge on your credit card bill, every single month.

Not only that, but you need to keep the receipts and double-check the amounts. Several times, I've had the wrong amount punched in... $57.95 instead of $27.95 is pretty easy to mis-type...

Re:Network Solutions, One domain per user?

[Anonymous Coward]

Whoops, I posted earlier what I thought was your email, but I think it's actually mccallc@rappcollins.com. Please pardon my sloppy posting!

Re:Network Solutions, One domain per user?

[PineGreen]

does exactly this (for free)

Re:Network Solutions, One domain per user?

[rifter]

Both in spam and telemarketing the biggest business is not in doing business in these ways but rather in selling lists to people who want to spam and be telemarketers. This is why spammers and telemarketers actually *want* to be able to bother people they know do not want to be bothered and will never buy their products, because that adds names to the lists. Both industries have continually lobbied in congress against any attempt to make laws which might allow someone to subscribe to a national list and therefore remain unmolested by these entities.

Re:Network Solutions, One domain per user?

[rifter]

One other thing I forgot to add. It is provably impossible for your grandmother to actually buy anything from spammers. Studies in which people gathered spam and attempted to contact the company to actually buy something came up with exactly none of the numbers or addresses being valid places with which to conduct business. They could find no way to send money to the spammers. Most of this is because the numbers and websites get cut off within minutes of spam being sent.

There is one other way to make money with spam, and it was outlined in a Wired article. That is to con companies into paying you for sending spam for them. There the spammer makes money, but again because there usually ends up being no way to ac tually contact the company, the company makes nothing.

Both spam and telemarketing are nothing but scams and should be outlawed, IMHO.

Re:Network Solutions, One domain per user?

[PacoTaco]

But do the people who go to such lengths to avoid spam EVER buy anything from spammers? EVER?

I think non-technical users are increasingly the people who send the spam. Check out some of the sites listed here. Most of them appeal to the inexperienced. ("Send millions of messages in minutes!")

Spam is a multi-level scam. I think the only people making real money are those who sell address lists and spam software to clueless newbies trying to make a buck.

Re:Network Solutions, One domain per user?

[Jenova]

I haven't got a single UCE in my hotmail account:

No one knows the address. I've only subscribed to a financial institute that periodically send news and updates to me.

The account handle is just a normal phrase.

Hotmail probably does not sell the list or I would have gotten a lot of junk already.

Re:Network Solutions, One domain per user?

[Anonymous Coward]

test

Re:Network Solutions, One domain per user?

[Anonymous Coward]

>started getting porn spam to the address i used only at 1800flowers.com.

1800flowers is notorious for sending spam. they have a referal program where they encourage people to get hits to their website for $, etc

http://groups.google.com/groups?sourceid=navclie nt &q=1800+flowers+spam

Re:Network Solutions, One domain per user?

[Mr_Silver]

I'm aware of this, but the username in question was "ibtagmrq" which to me doesn't look susceptible to dictionary attack

It was set up purely in the interests to see how quickly it would receive spam if every option was off. I picked random letters and not someones name so if spammers were using a list of popular names and generating random hotmail addresses they wouldn't be likely to catch it.

The letters actually stand for "I Bet This Account Gets Mailed Real Quick" :)

In other words, i was looking for something so close to being completely impossible to just guess.

It took 4 weeks before the spam started. Although to be honest, it's dead now as I haven't logged in for over 6 months.

Re:Network Solutions, One domain per user?

[Computer!]

Nice work, fucktard. I hope you get the gift of anal rape for your 15th birthday.

Sometimes "collateral damage" is intentional

[RollingThunder]

Several of the more hardcore lists will quite gladly blacklist an entire ISP for hosting spammers. Doesn't matter if you're squeaky clean with a five year contract with the ISP, they'll just say "get a new ISP, they've broken their contract with you"... all in the interests of peer pressure.

I haven't been hit myself by that, but I can sure empathise with the poor bastards that have.

Re:Sometimes "collateral damage" is intentional

[mr_z_beeblebrox]

The company I work with is switching our hosting away from Earthlink for that reason. We send mail from our domain but its reverse lookup is earthlink.net...Some of our clients deny mail from them as they have open mail relays. Bad for us Karl

Re:Sometimes "collateral damage" is intentional

[sawilson]

When I used to work at the better half of that company a long time ago before the lame name change *cough* we spent a considerable amount of time trying to figure out who the traitor was inside selling lists of email addresses. We knew it was going on, but never caught the guy.

Re:Sometimes "collateral damage" is intentional

[King_TJ]

I think the "peer pressure" idea is becoming a bit of a "dinosaur" from the days of the mom-and-pop ISP. In the past, except for AOL, you didn't really have many large ISPs that kept on large numbers of spamming users.

The small ISPs would be pretty responsive to complaints, or if they weren't - they'd feel the pain of getting blacklisted, and would usually give in and kick off their problem users.

Nowdays, with most customers on one of a handfull of giant ISPs, it's no longer effective or realistic to ban the whole ISP. (EG. With the number of customers Earthlink has, can you really expect them to always keep *every* user with an open-relay off of their network? Even if they hired whole teams of people just to perform that one task, new people with open-relays would subscribe faster than they could discover them. Hence, Earthlink would almost always be on a blacklist.)

Re:Sometimes "collateral damage" is intentional

[sawilson]

Before the earthlink "merger of equals", Mindspring had Harry. Harry absolutely rocked the abuse department. He worked together with the other admins (helped he was a Senior Admin in skill level) and they'd think up all kinds of interesting ways to "abuse" spammers. We'd catch them pretty fast if they were spamming from our network. One of my favorites was sending +++ATH0 in a formatted ping packet to their modem to disconnect them, sending thousands of spam messages back to their email client depending on what they used. Their port would be disconnected quickly. I think we had a 3 strikes and you are an ex-customer rule. Jan also rocked the news servers. I'm not sure how earthlink is handling things now post merger. I didn't hang around. :) At the time, were were number 2 in the world, and fighting spam very well. The "SPAMINATOR" product was very much loved by customers. I heard through the grapevine that it's basically a joke now, and doesn't work.

Re:Sometimes "collateral damage" is intentional

[Zathrus]

Well, whoever it was they had pretty good access. The first 3 emails to my mindspring account were spam.

The spaminator service must be doing some good though - my address was obviously sold at some point, but it's not getting deluged in spam.

Re:Sometimes "collateral damage" is intentional

[RollingThunder]

It's a tough call for the guys taking the hardline.

On one hand, their main weapon is escalation. First they would ban the server, then the domain, then the hosting ISP... and then the ISP's connectivity - presumably at that stage, the ISP would have to choose between dropping the spammer or losing their connectivity.

On the other hand, every time they escalate, there's a chance outsiders looking in will go "good god, what a bunch of lunatics" and not opt to go with that blacklist... and as is pretty obvious, the power a blacklist wields is pretty directly related to the number of mailboxes it protects.

The discussions on the newsgroup certainly do lend themselves to LART-based amusement, though. :)

Re:Sometimes "collateral damage" is intentional

[schon]

With the number of customers Earthlink has, can you really expect them to always keep *every* user with an open-relay off of their network?

Yes, absolutely.

Even if they hired whole teams of people just to perform that one task, new people with open-relays would subscribe faster than they could discover them.

Try this: "With the number of customers Earthlink has, can you really expect the to maintain a helpdesk that can answer the question of *every* user that has a problem?"

Keeping your network secure is part of being an ISP. If they have that many users, then they'll be making enough money to hire people to keep the network secure.

Re:Sometimes "collateral damage" is intentional

[Tackhead]

> Jan also rocked the news servers. I'm not sure how earthlink is handling things now post merger. I didn't hang around. :)

You didn't miss much.

When Jan left, news.mindspring.com completion went into the toilet. About 25% of articles vanished, resulting in (multipart binary) completion rates of 1-2%.

It took over a year for the fucknozzles at Earthstink to even acknowledge the problem. Earthstink's news swerver wasn't much of a prize, either.

It's not as bad now - most of the remaining vict^H^H^H^Hcustomers have either left, gone to third-party premium news service, or (in the past month or two), switched over to one of the two "test" newsswervers Earthstink's trying to set up. While slow, at least one of them's functional.

You guys rocked. So long, and thanks for all the fish. If I'd had any brains I'd have switched to a reputable ISP the day Jan left.

Re:Sometimes "collateral damage" is intentional

[Anonymous Coward]

but guess what, the servers making use of those lists WANT it that way. they could randomly block domains ending in 'y' if they wanted to. your email privileges end at my server. i could block your email because i want to. if users of my server complain, i will rexamine the policy.

so if someones on an ISP that allows spam. tough luck for them. i CHOOSE to deny emails from that ISP, including legit ones. its not my responsibility that they chose a bad ISP.

the fact is that block lists are voluntary, admins choose to implement them. if the users of that service dont like it, they complain and the admin will choose to do something else.

Re:Sometimes "collateral damage" is intentional

[macdaddy]

Honestly I don't much earthlink.net spam. In fact I can't remember the last time I got earthlink.net spam, even raping an open relay.

However I have gotten tons of broadwing.net spam. You (and I both) wouldn't believe the number if I could compile it. They ignore LARTs. They sign on known-spammers without regard. They simply don't care. Myself and many others blacklist them because of their in-action. I don't know if collateral damage is enough anymore though. The RBL was the best place to lay down some collateral damage. I wish it was used more.

Re:Sometimes "collateral damage" is intentional

[Vainglorious Coward]

can you really expect them to always keep *every* user with an open-relay off of their network? Even if they hired whole teams of people ...

Absolutely I expect this, or close to it. Rather than hiring hordes of staff to perform the task, why don't they [gasp] use a computer to track and monitor open relays? It works for ORDB

Re:Sometimes "collateral damage" is intentional

[Anonymous Coward]

Then it is starting to work.

There are NO innocent bystanders when it comes to spam. There are only spam supportiers and victims. If earthlink isn't cleaning up its act, anyone giving it money is supporting spam.

Re:Sometimes "collateral damage" is intentional

[RollingThunder]

Guess what else?

I agree that it's the right of each admin to do whatever he likes regarding accepting mail.

That doesn't change my ability to empathize with the poor bastards caught in the crossfire.

Re:Sometimes "collateral damage" is intentional

[blinkylights]

...can you really expect them to always keep *every* user with an open-relay off of their network?

Earthlink (or any of the big ISP's) could go a long way towards keeping their legitimate emails from slipping down a blackhole if they were willing to do this:

• Voluntarily submit all of their dynamic IP pools to the blacklists.
• Insure that static IP's assigned to customers resolve either to the customer's domain, or to a default domain that Earthlink has voluntarily submitted to the blacklists.

Re:Sometimes "collateral damage" is intentional

[crucini]

With the number of customers Earthlink has, can you really expect them to always keep *every* user with an open-relay off of their network? Even if they hired whole teams of people just to perform that one task, new people with open-relays would subscribe faster than they could discover them. Hence, Earthlink would almost always be on a blacklist.

First, I checked Earthlink's main web and mail IP's (as representatives) and they seem to be on only one blacklist: blars.org.
Second, the only thing expected of ISP's is that they read their abuse mail at least once a day and upon verifying abuse they promptly terminate the accounts in question. ISP's need abuse departments, and the more accounts the ISP has the more people it needs in its abuse department. The abuse department does not need to discover open relays or other network abuse; it merely needs to read, investigate, and act on complaints.
Failure to maintain an effective abuse department will result in the network becoming a haven for abusers, and that will cause the ISP's netblocks to be blacklisted.

Re:Sometimes "collateral damage" is intentional

[AndroidCat]

Yep, it's a damned shame. Damned shame. Pass me another clip?

Re:Sometimes "collateral damage" is intentional

[gorbachev]

Several blocklists have listed major providers, such as Qwest, Sprint, Broadwing and UUNet. Several of them are listing some of them at this very moment.

This approach has been particularly effective with the SBL (Spamhaus BlockList), which has "encouraged" several large providers to begin paying attention to Internet abuse from their customers.

Steve Linford, who runs Spamhaus, has even got the Chinese networks to pay more attention to their open proxy and spam hosting problems. That alone would qualify him as the Internet Man of the Year in my books.

Proletariat of the world, unite to kill spammers!

Re:Sometimes "collateral damage" is intentional

[13013dobbs]

One of my favorites was sending +++ATH0 in a formatted ping packet to their modem to disconnect them,

Back in the day(tm), we had a string we could send that would reset their modem to a 300baud connection then save to memory. :)

Re:Sometimes "collateral damage" is intentional

[Saint Aardvark]

Sorry...what's a formatted ping packet to a modem? I don't understand that line...

Re:Sometimes "collateral damage" is intentional

[Eggplant62]

Several of the more hardcore lists will quite gladly blacklist an entire ISP for hosting spammers. Doesn't matter if you're squeaky clean with a five year contract with the ISP, they'll just say "get a new ISP, they've broken their contract with you"... all in the interests of peer pressure. I haven't been hit myself by that, but I can sure empathise with the poor bastards that have.

What you fail to understand is that the mantra, "get a new ISP, they've broken their contract with you..." is not the only mantra being spoken by the blocklist administrators. There are several other things one who's been blocklisted as collateral damage can do to resolve their situation.

First, one can bitch at the ISP being blocklisted--daily if possible--about the situation. The blocklisting would not be in effect if the blocklisted ISP were quick about nuking spammers from their network. If one were to use google to look through news.admin.net-abuse.sightings, one would find hundreds, if not thousands, of complaints regarding spammers for blocklisted ISPs over weeks/months of time. Most ISPs won't hesitate to nuke a spammer from their network in less than a weeks time given a sufficient number of believable complaints. Why is it that some ISPs seem not to give a shit about hosting spammers? Is it because of the money?? *smirk*

A collaterally damaged network can also arrange for email connectivity via a third party, non-blocklisted provider, then deduct the expense from the bill for the blocklisted provider. One might also ask that the ISP protecting their networks with blocklists whitelist one's mail server IPs.

However, since any company lending financial support to any spam-friendly ISP by paying them money for partial connectivity is in essence part of the spam problem, the best idea is for a collaterally-damaged network tell the blocklisted ISP to FOAD and get a new ISP that isn't blocklisted. Why would you want to keep spammers and spam-friendly ISPs in business? Welcome to 21st century Internet ecomnomics. Blocklists are meant to act as a virtual boycott of the spammers and spam-friendly ISPs.

Believe me when I say it, if comcast.net gets my IP range into a blocklist because a spammer's money is somehow more important to them than my connectivity, they can rightly go screw themselves. I won't hesitate to call them daily to bitch, all while arranging for an alternative host.

Re:Sometimes "collateral damage" is intentional

[elemental23]

Please post the fully qualified name or IP address of a single open mail relay on Earthlink's mail network. Please also include complete headers of an e-mail you've relayed through that server from somewhere off-network.

I highly doubt you have anything to back this up.

Re:Sometimes "collateral damage" is intentional

[FueledByRamen]

In a ping, the computer receives the data and sends it back verbatim. If you have a ping packet that contains something like this:

(cr/lf)
+++ATH0
(cr/lf)

and the modem sees that as it is echoed back out, it takes it as a command and hangs up. It has to be sent by the computer that the modem is connected to, or it won't acknowledge it. Ping works perfectly for this

Re:Sometimes "collateral damage" is intentional

[Saint Aardvark]

Aha...neat, I didn't know that. Thanks for the reply.

I am now blessing your formatted ping packet...

Re:Sometimes "collateral damage" is intentional

[Anonymous Coward]

You dont need a blacklist for that, Ive banned the entire earthlink subnet range at my router. Ive had enough of the spam coming from that network that I dont care about the innocent people anymore

Re:Sometimes "collateral damage" is intentional

[Anonymous Coward]

We dont need to, Earhtlink harbours more than enough spammers to warrant its blacklisting

Re:Sometimes "collateral damage" is intentional

[King_TJ]

Ok, I'd have to argue that your wishes are unrealistic. In reality, maintaining a help-desk is much more central to your profitability than dealing with users running open-relay mail servers.

Even so, many customers of large ISPs *do* complain about poor quality of service when calling the help desk.

In any case, I'm not intending to pick on Earthlink in particular. Perhaps they do a pretty good job of killing spammers off of their systems. I don't have statistics to prove or disprove that. I just use them as an example of a very large ISP compared to the old days of the "mom and pop" local ISP.

Keeping your network secure is *primarily* about making sure hackers don't get in and do damage to your own servers or steal customer records/information. It's secondarily about eliminating issues such as users abusing your "terms of service agreement" with spamming, etc.

I can almost guarantee that the vast majority of spam problems come from large nation-wide (or world-wide) ISPs, or from regional ISPs owned and operated by telcos/cable companies - as opposed to local mom-and-pop operations. This is no accident, IMHO. When you're the "little guy", you have to more carefully manage the resources you have and concentrate on keeping an "above average" level of service. Otherwise, you'll be crushed by the "big ISPs".

Re:Sometimes "collateral damage" is intentional

[mr_z_beeblebrox]

I highly doubt you have anything to back this up.

You are so right. I was making it all up. For a while I had no direct internet link for my server at home and up until about five weeks ago I was bouncing it off of vipmail.earthlink.net. Perhaps five weeks ago they finally stopped, that does not make them angels. So, nice of you to defend them.

Re:Sometimes "collateral damage" is intentional

[mr_z_beeblebrox]

I did not include headers in the previous message bacause I am not an amateur selling my companys info. Since you obviously work for earthlink I would hate to allow our e mail addys to be harvested so easily.
LOL, troll

Re: Sometimes "collateral damage" is intentional

[elemental23]

Troll? Hardly. I suggest you look up the meaning of the term. You'll see that my post was in no way a troll.

You made a fairly unbelievable[1] claim and when I asked for evidence (the burden of proof being on you, the one making the claim) you are either unwilling or unable to provide it. So yes, I think you are likely mistaken. And you call me a troll. *yawn*

[1] Unbelievable because it's unlikely that Earthlink has open relays and have somehow evaded being listed on the MAPS RSS and similar blacklists.

Re: Sometimes "collateral damage" is intentional

[mr_z_beeblebrox]

You made a fairly unbelievable[1] claim and when I asked for evidence (the burden of proof being on you, the one making the claim) you are either unwilling or unable to provide it. So yes, I think you are likely mistaken. And you call me a troll. *yawn*

Come now, right in this thread I named a server and you didn't respond to that. Your proof was so burdensome. Yes, trying to get people to post e mail headers in my opinion is trolling for targets. But, then again seeing that you are defending earthlink you probably are unaware of any useful info in the headers so what harm....

Do what my friend does...

[kraksmokr]

Ban email from EVERYBODY by default, and only ALLOW email from certain people.

Re:Do what my friend does...

[mr_z_beeblebrox]

Great when you are a 1337 d00d at home. The real issue though is when you are an admin for a solvent corporation. Draconian e mail becomes very tough.
Karl

Re:Do what my friend does...

[mr_z_beeblebrox]

Draconian e mail becomes very tough.
Stateful email!!! Lose only 75% of your customers LOL...

Karl

Isn't it ironic

[iONiUM]

but I still have to ban domains like yahoo.com
Does anybody else find it funny that this article is from yahoo.com?

Re:Isn't it ironic

[flitrmaus]

Most spam coming in from Yahoo isn't from yahoo. Look at the headers. The "From" field is often _@yahoo.com, but look at the IP address it came from and the routing information. It's usually from some realy in a foreign nation who hasn't configured thier mail server properly.

Re:Isn't it ironic

[indiigo]

Not at all. Please explain the significance and the scoring for the post.

Re:Isn't it ironic

[Entropy_ajb]

There is a Reason that the people that work at yahoo don't actually have @yahoo.com e-mail addresses. For this exact reason they have @yahoo-inc.com e-mail addresses

Re:Isn't it ironic

[Anonymous Coward]

A dime bag of humboldt chronic.

Re:Isn't it ironic

[Anonymous Coward]

course the reason that yahoo employees dont use yahoo email addresses could be because the yahoo namespace would force them to have areyousureiworkatyahoo@yahoo.com ...

Solution to spam

[maynard-lag]

I've found that once I stopped checking my email, I stopped getting spam.

Now, why haven't I heard from my girlfriend while she's been away at school.

Re:Solution to spam

[DrVxD]

> Now, why haven't I heard from my girlfriend while she's been away at school.
Because you've filtered her out as spam?

Re:Solution to spam

[Anonymous Coward]

> Now, why haven't I heard from my girlfriend while she's been away at school.

Trust me, it has nothing to do with checking your email...

Re:Solution to spam

[Anonymous Coward]

> Now, why haven't I heard from my girlfriend while she's been away at school.

She says it's because you can't please her like I can...

Re:Solution to spam

[Lemmy Caution]

Now, why haven't I heard from my girlfriend while she's been away at school.

Since you passed up all those opportunities at penis enlargement she's been sending you, she's probably moved on to another guy.

Re:Solution to spam

[GigsVT]

I've found that once I stopped checking my email, I stopped getting spam.

Ah, the Knuth method. Just hire a secretary to sort through your faxes every 3 months and filter your mail daily.

Re:Solution to spam

[Anonymous Coward]

Now, why haven't I heard from my girlfriend while she's been away at school

that's funny, I hear from her every day. And my neighbors hear her every NIGHT.

Re:Solution to spam

[AndroidCat]

No no, it's only spam if it's unsolicited. I'm sure he must have solicited his girlfriend. ;^)

Re:Solution to spam

[KUHurdler]

that's funny, I hear from her every day. And my neighbors hear her every NIGHT.

Maybe you should let her go then. The "Help, Help" screams means she probably doesn't want to be there anymore.

Re:Solution to spam

[Anonymous Coward]

Now, why haven't I heard from my girlfriend while she's been away at school.

Because blow-up dolls don't go to school?

Re:Solution to spam

[DrVxD]

Sure, but his spam filter is a little overaggresive. And it's filetering out non-spam as if it were spam.
As to whether his girlfriend solicits or not, I can't say :)

Be careful when you Bcc...

[Omega]

A number of spam filters and spam blocking agents will mark a message as SPAM if it is only Bcc'd or CC'd. If you're going to Bcc -- at least make sure you have 1 To recipient else you may end up in the SPAM Folder.

Re:Be careful when you Bcc...

[RollingThunder]

Obviously, the simplest solution there is send it to yourself, and bcc everyone else. That way, no new data is introduced for the recipients to see.

And SpamAssassin (v2.20) rates "TO_EMPTY" at 2.541, and "TO_NO_USER" at 1.928 - putting you less than .5 away from getting dumped by the default threshold of 5. The two may be exclusive though... but they're still pretty large hits.

SpamBouncer Spam Assassin

[Binestar]

I've been using spambouncer for quite a long time and I've found that it catches more spam than Spam Assassin does.

As with any anti-spam measure you have to keep an eye on it when you set it up that everything is working and you aren't blocking legitimate mail. Any anti-spam software you use will either let some spam through, or catch legitimate mail. Add some procmail scripts to catch any mailing list mail you are on into thier folders, block To: Friend@Public.com and the like and you have a pretty robust system.

I've also found that blocking messages with malformed headers helps alot on spam... For example, the following Procmail recipe blocks all messages that are HTML only without a charset, which is common on spam mailings, and has never caught a legitimate mail for me:


* ^Content-type: text/html
* ! html; charset=
* ! from hotmail
| ${FORMAIL} -A"X-Spammers: text/html only message"


Your Milage May Vary

Klez virus and spam

[pubjames]

Since the Klez virus can be sent as if it was from your email address even when it has not come from your computer, is it possible that you could get put on a antiSPAM list because someone else has got the Klez virus?

Re:Klez virus and spam

[Binestar]

It is possible, but *most* of the people running the spam lists such as DNSBL's have a clue as to whats what and will not put those type of issues into the blocking lists.

BTW: That brings up another point, never never never trust a spam From: Header, you should always track it down to the system sending the spam, not rely on what the From: Header says.

Re:Klez virus and spam

[Anonymous Coward]

the klez virus doesnt send several HUNDRED THOUSAND emails out.

and the fact that its not an open relay either helps.

klez is sent to a small number of people. spam is sent to HUGE numbers

Re:Klez virus and spam

[rworne]

BTW: That brings up another point, never never never trust a spam From: Header, you should always track it down to the system sending the spam, not rely on what the From: Header says.

I was Joe-jobbed on my hotmail account last month. It was fascinating to watch the inbox fill up with bounces to invalid emails over the period of a week.

What suprised me is that I received *zero* complaints from people who got the spam, I thought I would have gotten a few hate-mails from people who don't read headers. Examples of the spam didn't even show up on Usenet's net-abuse forums.

Hotmail itself didn't communicate with me at all, except to tell me my mailbox was dangerously full and would I like to pay them for more space.

The headers showed the mail coming from an open relay on Earthlink, the mail advertising "You Won" in the subject.

Either apathy is worse than I thought, of everyone had a clue. Somhow I think it is the previous. Still it was a refreshing departure from the penis/breast enhancements, hot snatch, life-experience diplomas and toner/inket cartridges I get every day.

one down!

[Mr_Silver]

I've found that Spam Assassin has made life easier, but I still have to ban domains like yahoo.com, hotmail.com, mail.com - and *.ru and *.cn. I sort through the spam periodically, but the collateral damage is still there.

I see that sending the boys round to Hemo's house for a good beating with the procmail man page worked.

Right ... one down ... anyone know Taco's home address?

Concept for Fighting Spam...

[dmarien]

I once, after installing, needed to raise a concern to the author, djb. I e-mailed him, and instantly recieved an automatic response.

The automatic reply stated that djb recieves an enourmous amount of mail, spam, and technical support inquiries. If I really wanted to e-mail him, the letter went on, I would have to reply to the automatic reply and copy in a 12 digit code which the automatic reply included.

I did that, and then recieved a 2nd automatic reply, stating that the code I entered was correct, and that djb would recieve my mail.

I imagine that a mail system setup in that regard would be the most potent weapon a mail server could utilize against spam!

The mail server could keep a database of known senders who entered the code correctly, and thereafter automatically accept their 'friendly' e-mail.

I forsee a potential abuses for this though. Annoying "spam bots" could learn to decipher the first automatic reply containing the code and then automatically send the spam, and contain the code which will allow the mail server to recieve the mail.

I would ask that if anyone knows how to install/administer the add on to qmail which performs this to please let me know! I recieve a tonne of spam, and becuase I get everything sent to the domain 'dmarien.com', I'll sometimes get upwards of 100/day.

Also, if anyone has a qmail server setup in this manner please let me know how satisfied they are with it's performance, and whether they get complaints -- and even if spam get's through -- i'd love to know.

Thanks!

Re:Concept for Fighting Spam...

[infiniti99]

Yes! See my other post about TMDA in the comments. It does exactly this.

By the way, your potential abuse is not as bad as it sounds. The spammer would need to use a valid return address in order to receive the confirmation. This means they could be tracked and stopped, etc. The most serious problems with SPAM right now are how there are so many open-relays and that addresses can be spoofed.

Re:Concept for Fighting Spam...

[pete-classic]

I forsee a potential abuses for this though. Annoying "spam bots" could learn to decipher the first automatic reply containing the code and then automatically send the spam, and contain the code which will allow the mail server to recieve the mail.

One of the primary charactaristics of SPAM is bogus From: and Reply-To: headers. If replies were actually recieved by the bot it would be an improvement.

-Peter

Re:Concept for Fighting Spam...

[timeOday]

I forsee a potential abuses for this though. Annoying "spam bots" could learn to decipher the first automatic reply containing the code and then automatically send the spam, and contain the code which will allow the mail server to recieve the mail.

Anybody smart enough to make a spam bot work around this sort of thing in general will win a Nobel Prize.

There are many ways to throw them off, from the typical "remove NOSPAM from the email address to reply," to "remove the name of a bird from the email address to reply" (where the email address is FalconGeorge@home.com), and on to things like using scanned images of your email address, in handwriting.

Re:Concept for Fighting Spam...

[Isthistakenyet?]

One way to overcome the spam bots is to display the code in an image. A lot of web sites do this to thwart automatic registration agents. However, people using text-only displays or screen readers wouldn't be able to read the code.

Re:Concept for Fighting Spam...

[pbryan]

Anybody smart enough to make a spam bot work around this sort of thing in general will win a Nobel Prize.

Nobel Prize? For what? Pissing off hundreds of thousands of netizens? :P

Re:Concept for Fighting Spam...

[Dwedit]

Great, use the from header to flood innocent people with confirmation messages...

Re:Concept for Fighting Spam...

[Anonymous Coward]

You could append a random jpg from a selection holding the "code" in various colors/ways that cannot be deciphered by a bot. The jpg would have to be viewed by an actual person, which would defeat the perpose of spam (IE: cheap advertising). The result? Spamfree email.

Death_Claw

Yahoo and Hotmail DONT Open Relay

[Anonymous Coward]

If you'll trace the messages 99.9% of the time it's not from the return address (which is usually hotmail or yahoo). So simply blocking yahoo and hotmail seems kind of wasteful. Simply look at the black lists of open relays. They are the problem.

Re:Yahoo and Hotmail DONT Open Relay

[EvilBudMan]

Yes, blocking yahoo and Hotmail doesn't seem the way to go. We have too many cudtomers that use those.

I gave this link a go and it seems to help after about a month.
http://www.opt-out.cdt.org/

Re:Yahoo and Hotmail DONT Open Relay

[Jucius Maximus]

"If you'll trace the messages 99.9% of the time it's not from the return address (which is usually hotmail or yahoo). So simply blocking yahoo and hotmail seems kind of wasteful."

A better solution would be to block @hotmail.com, @yahoo.com, etc., only in cases where the IP is not from those e-mail service providers.

Re:Yahoo and Hotmail DONT Open Relay

[FuzzyBad-Mofo]

Pretty stupid of people to filter @yahoo.com or @hotmail.com, sure you may see less spam but you will lose the legitimate email too.. better to reject mail on account of forged headers or the like.

Re:Yahoo and Hotmail DONT Open Relay

[The Turd Report]

I filter yahoo and hotmail, but only if the email didn't come from an yahoo or hotmail mail server.

Re:Yahoo and Hotmail DONT Open Relay

[Anonymous Coward]

No?

Return-Path:
Received: from mxzilla4.xs4all.nl (mxzilla4.xs4all.nl [194.109.6.48])
by maildrop6.xs4all.nl (8.11.6/8.11.1) with ESMTP id g4VMiM384297
for ; Sat, 1 Jun 2002 00:44:22 +0200 (CEST)
(envelope-from uhyjacqueline@yahoo.com)
Received: from web14106.mail.yahoo.com (web14106.mail.yahoo.com [216.136.172.136])
by mxzilla4.xs4all.nl (8.12.3/8.12.3) with SMTP id g4VMiLFj028641
for ; Sat, 1 Jun 2002 00:44:21 +0200 (CEST)
Message-ID:
Received: from [209.29.80.219] by web14106.mail.yahoo.com via HTTP; Fri, 31 May 2002 15:43:20 PDT
Date: Fri, 31 May 2002 15:43:20 -0700 (PDT)
From: Burnell Adorna
Subject: Do u like gorgeous chicks nude, here are they:
To: danwalsh@sprintmail.com

Re:Yahoo and Hotmail DONT Open Relay

[1u3hr]

A better solution would be to block @hotmail.com, @yahoo.com, etc., only in cases where the IP is not from those e-mail service providers.

In that case. you'd block me out, since I use yahoo as my mailbox and reply address, while actually sending via my ISP's SMTP server.(Since it's faster and doesn't append advertising to my messages.) But I'm in Hong Kong, so all these smug Americans who "just IP block Asia" won't see me anyway. WTF am I supposed to do, dial up an ISP long distance?

No matter how the message has been routed, almost ALL spam originates from the US. If you're unleasing Ashcroft, let the prick use Carnivore to track the spammers down and put them in cages in Guantanamo.

mod parent up!

[Anonymous Coward]

that is an excellent idea! but I think she/he meant to say "after installing qmail..." on the first line.

Re:I think it's safe to blame the root cause.

[Anonymous Coward]

"If everyone did what they're supposed to do, there'd be no need for lawyers"

-- a lawyer

Forged filter?

[fm6]

I still have to ban domains like yahoo.com, hotmail.com, mail.com

I don't know about hotmail.com or mail.com, but Yahoo is pretty good at keeping its accounts from being used to send spam. It's true you see "yahoo.com" in a lot of spam headers, but these are almost always forged. And forged headers are pretty easy to detect. I'm suprised your filters can't tell the difference.

Bcc:

[Evro]

Most spam I receive has a blank To: header and a forged From: header, so this tactic is not exactly foolproof (I've been using it for a while).

Re:Bcc:

[shine-shine]

Everything can be traced back. Ever looked at the headers?

Re:Bcc:

[Hammer]

Yes,
But the fact that he got in the mailbox x_hotmail@xyz.com means that the address was harvested of or sold by hotmail

He would then scrap x_hotmail@xyz.com.
No more spam just an angry email to some executive at hotmail (cc to lawyer...)

Re:Bcc:

[Evro]

Yes, of course. Here's a nice one:


Received: from server.canieti.com.mx (dns.canieti.com.mx [200.53.198.53]) by us with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21)
id M8HF6GZR; Sat, 29 Jun 2002 07:52:15 -0400
Received: from answer-us.com (IDENT:root@localhost.localdomain [127.0.0.1])
by server.canieti.com.mx (8.11.6/8.11.6) with ESMTP id g5T1ZYK24777;
Fri, 28 Jun 2002 20:35:35 -0500
Message-Id:
From: support@answer-us.com
Subject: Make Money Now! MLM High Tech Key Positions Available
Reply-To: support@answer-us.com
Date: 28 Jun 2002 22:33:31 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_nays1r1E_bnP6ynAX_MA"


Of course, this can be traced back, but most POP3 clients can't filter when there's no "to" header, and Forged/random From: and Received: headers. If you run the mail server, it's a somewhat different story, as you can subscribe to a blackhole list and keep known spamming hosts from connecting to your relay, but if you don't want to run a mail server you're left with the limitations of your POP3 client. Filtering out "$" and "Money" and "Penis" "viagara" etc would probably help a lot, though at work we get ones like this:

Received: from mail.wzptt.zj.cn (202.96.106.130 [202.96.106.130]) by us with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21)
id M8HF6GPZ; Wed, 26 Jun 2002 04:11:53 -0400
Received: from localhost([61.174.185.142]) by mail.wzptt.zj.cn(JetMail 2.5.3.0)
with SMTP id jm393d19a631; Wed, 26 Jun 2002 08:12:44 -0000
MIME-Version: 1.0
From: chnze@mail.wzptt.zj.cn
Content-Transfer-Encoding: 8bit
X-Priority: 1
Subject: Supply electric appliance
Content-Type: text/plain



I've ip-banned most of Asia (210.x.x.x and 211.x.x.x, I believe) due to the spam and that simple act cut our spam by 90%, and since we don't deal internationally right now, it's not really a big deal.

Re:Bcc:

[Evro]

Ah, well, I assumed he meant he was setting up email aliases rather than separate POP3 mailboxes. I am limited to 5 POP3 boxes on my host, so I use aliases most of the time, so anything@myhost.com goes to me@myhost.com, which leaves you with the problem of not knowing the To: header. Having separate inboxes is more robust, but also probably a pain to manage, I would guess

Re:Bcc:

[Anonymous Coward]

A good mailserver does not change the "To:" header. It's not needed to redirect. Instead it should add a "Delivered-To:" header with the real address.

Re:Bcc:

[totallygeek]

If you run sendmail with -X you can dump to a file all the information. Black To: lines can be seen as an RCPT TO: command to the mail server. Try it, it is pretty cool.

Re:Bcc:

[Jetson]

Most spam I receive has a blank To: header

A blank To: header would make filtering a no-brainer. I wouldn't even bother saving those in a bin for later false-positive searches.

There only seems to be two effective answers to spam that don't have collateral damage problems:
1) pay-per-send
2) whitelists.

Whitelists are more trouble to initiate than blacklists because you have to manually add all your "known good" automated sources (such as mailing lists and e-bill services) rather than simply accepting whatever default values the block lists supply. The up-side is that even your grandma can hit "Reply" when the automated confirmation message arrives.

SpamAss and tuning...

[DraKKon]

SpamAssassin with DCC works real good.. Razor is a little bit buggy at the moment.. I have tuned my spam assassin a bit and have a HIGH count folder.. (any spam that scores over 12) for the past month, it's had a 100% hit rate. No false positives. Then there's my Score of 5 to 11.9999999999 folder.. it's about 80% spam, 20% that would be spam if I didn't actually know the person) "Come to my show my band is playing here 18+" stuff like that.. so my white list is growing.. and spam is going away.

You also have to realize that NOTHING will be perfect. Razor is a good Idea, but when you have ONE person report a CERT advisory, or other mailling lists, the false positives rise.

Even if SpamAssassin/DCC/Razor took one piece of spam out of my mailbox, it would be worth it.

Score -1 poser

[I.T.R.A.R.K.]

"If idiotic pricks didn't try to fill email boxen up with ads for stupid crap."

Warning: Stupid "I think I'm l33t and I want the world to know" Buzzword alert!

Re:Score -1 poser

[sawilson]

That's pretty lofty coming from "I.T.R.A.R.K.". It's a term I've been using for over 20 years. Go hack a website or something.

Re:Score -1 poser

[sawilson]

get a job hippy

Re:Score -1 poser

[sawilson]

HAHAHAHAHAHAHHA!!

Re:Score -1 poser

[I.T.R.A.R.K.]

"It's a term I've been using for over 20 years.

And it still makes you look like a twat. Take a hint.

Too bad about Yahoo

[Weasel Boy]

Anyone who blocks Yahoo.com won't get any mail from me. I like Yahoo's web mail, and use it in preference to the one I actually pay for.

Re:Too bad about Yahoo

[fmaxwell]

Anyone who blocks Yahoo.com won't get any mail from me. I like Yahoo's web mail, and use it in preference to the one I actually pay for.

So we should all unblock Yahoo! and get tons of spam because Weasel Boy might want to send us e-mail?

Re:Too bad about Yahoo

[Anonymous Coward]

All the spam you think comes from yahoo actually comes from open servers. A good procmail script will serch for messages with "from:.*yahoo.com.*" and not "received.*yahoo.com.*" and trash those.

Moron.

Re:Too bad about Yahoo

[fmaxwell]

Moron.

Suck me. It's damned unlikely that you have anything even approaching the sophistication of the spam filtering that I run. On my mail server, I have autoresponders telling people how to resend non-spam, blind-copied messages caught by my filters. I have IP-based filters for foreign domains. I have filters to catch HTML-only e-mail that's blind-copied to me. I have filters based on the e-mail encoding, character set, and content. I create addresses on my mail server that can only be reached from an individual domain. I have trusted sender and domain lists. I have an auto-complaint generator for Brazillian spam. I regularly track down the spam to its source, perform open relay tests, and submit open relays to open relay databases.

So what do you have? Hotmail with the spam filter box checked?

Next time don't make stupid assumptions, dick-head.

Re:Too bad about Yahoo

[Anonymous Coward]

No, you suck me.

I have a turbo multigizigiwat generator with thee times the auto-complaint generating power for TAIWANEESE spam than your puny mind could even imagine.

However, I don't block email actually from Yahoo.

Columbine

Banning .cn

[JoeBuck]

Q. How can the Chinese authorities get around the fact that the Great Firewall of China is doomed to be imperfect?

A. Get all westerners to ban .cn as spam. Then Chinese dissidents will be unable to communicate with the outside world.

Personal domain

[crow]

For heavy Internet users, having your own domain is wonderful. I do the same thing you describe. I'm hosted at pair.com (no affiliation other than as a customer), and for about $6/month, they host my personal web pages and let me put arbitrary filters on any incoming email address. I've killed off a few that have gotten spam from web sites releasing the address. I've killed off a few that I used when posting to mailing lists that are archived on the web.

But mostly, I've found I just don't get much spam because I protect my email address. For example, when placing my email address on my web page, I use JavaScript to encode it, so a web robot that doesn't parse the script won't see the address. I've never received spam at an address protected that way.

Re:Personal domain

[Anonymous Coward]

So your email address is "pc-web@crowcastle.net"? I just want to verify that the Javascript works correctly.

Cloudmark is a P2P Spam Eliminator

[TheCodeFoundry]

I've been using a beta of Cloudmark's SpamNet for about a month with no false positives. Seems to do a good job, plus you can mark SPAM that you might get and it will update it on everyone's (that is using SpamNet) spam signatures.

Re:Cloudmark is a P2P Spam Eliminator

[SerpentMage]

Ok...

But that is for Outlook only. As such I have been using Spam Dectective and have to say I am impressed. It is nice because it sits like a tray on my desktop and periodically checks my email.

Nice application...

Re:Cloudmark is a P2P Spam Eliminator

[spydir31]

there's a *nix version, IIRC called razor

If RBLs actually worked...

[Anonymous Coward]

We wouldnt need spamassassin, DCC, vipuls razor, etc.

RBLs are like chemotherapy. They are dangerous treatment for a disease, as the damage they inflict can be huge, even significantly disproportionate with the threat.

The only way to make a truly secure RBL based filter is to use the TCP Wrappers /etc/hosts.deny type mechanism, and specifically deny all hosts mailers, except ones in the /etc/hosts.allow. Otherwise, you invite the spammers to easily get around the RBLs by doing dialup, or ip spoofing, or whatnot else. Changing IPs is too easy, and RBLs fundamentally protect based upon that mechanism.

It is time to retire them in preference for the better technology of distributed signature detection. There is too much damage being done to reasonable end users. The policies for entry/exit of these lists are inconsistent, and far too many sysadmins blindly trust these policies <strong>event when they are wrong or inconsistent.</strong>

I have had my systems blacklisted not for having open relays (which I test for) but for being in a range where a spammer was once observed. When I complained in the past about this practice, the various sysadmins grumbled about having to update their lists.

If you are going to grab the authority, you better be prepared to take on the responsibility.

Use the distributed signature systems. Toss the RBLs out.

SpamCop chain test

[Animats]

One of the better features of SpamCop is the "chain test". SpamCop's header parser looks at all the "Received:" lines and figures out which ones are fake. It matches DNS names and IP addresses, and checks those "Received A from B", "Received B from C" relationships. The point at which the chain ceases to be valid identifies fake headers.

This is essential if you want to report spam to the sender's ISP. Otherwise, you report addresses being abused by spammers. It's also a useful filtering tool; an e-mail with inconsistent headers is probably spam.

ahhh

[Zabu]

I can't controll the primitive physical urges that I get...

When a perfectly good e-mail address has been gang-spammed.

Collateral Damage with snail-mail junk mail?

[GGardner]

I get a ton of junk mail. Who doesn't? It usually gets tossed, unopened. Every now and then, I've tossed non-junk mail, as it looked like junk mail. It would be interesting to measure this "cost" of junk-mail.

Re:Collateral Damage with snail-mail junk mail?

[Fluid Truth]

It happens with e-mail, too. I bought a license for something (Pocket Quicken) and they sent the registration code via email. Since this was the license for my wife's PIM, I had it sent to her. Too bad I didn't warn her that she'd be getting e-mail from LanWare. She assumed it was more spam and deleted her registration code.

They re-sent it, of course, but it still got deleted because it was lost in the fray.

Re:Collateral Damage with snail-mail junk mail?

[Anonymous Coward]

Today, I had my first physical junk mail addressed to an on-line pseudonym. The junk mail itself is quite insidious. It looks official, like a domain name renewal, but it is a transfer request.

I don't see how the scam can be profitable either. Assuming a 1% response rate (optimistic), postage exceeds revenue. And assuming profits in subsequent years ignores other sharks in the market.

- Tippus Tailus

Re:Collateral Damage with snail-mail junk mail?

[dvd_maximus]

I started getting snail-mail from "The Private Eye Clinic". Meant nothing to me; but my sister had mentioned that she was thinking of getting a private detective's licence, so I figured they'd got my address from her, and were direct-marketing me. Into the rubbish bin. Regularly, for almost a year.

Then I got a threatening letter from a lawyer. Turns out "The Private Eye Clinic" was a group of opthalmologists, one of whom I'd seen for an eye examination (and paid no attention to the cutesey business name of the clinic). They wanted me to pay the bill.

For that matter, almost any mail that arrives for me in a window-face envelope from a source I don't recognise, particularly if my name is mis-spelled, risks being junked.

What about individual users

[rutledjw]

I have had my yahoo.com e-mail address since they offered it YEARS ago. For a while I used it as a SPAM trap and just deleted the whole thing periodically. I finally decided I wanted to use it and have set up a number of filters to take out crap.

Stuff like "Casino", "Porn", "u.n.i.v" in the subject and china.com, and .br (since for some reason I've been getting hit from Brazil) in the from line all go to the Trash.

Is blocking entire domains and nations blocking out potential legit e-mail? Yep, sure is! Am I losing sleep? H3ll no! Look, I'm very sorry if you're unable to do some things on the net b/c you're domain is blacklisted, but that's just too bad. Then complain to your ISP to do something. If enough people scream to their providers to do something, the ISPs will HAVE to do something or else lose users and hence - business.

I'm not going to endure the kind of garbage I have in the past. As for legit businesses that get blacklisted, well, as the article said, it was resolved in a day...

One thing that is interesting is Yahoo!s little feature of marking a message as SPAM. Apparently, they review it and use it to update their filters. I'd be interested to know how well it works...

Spam Assassin

[sapphire42]

We also use Spam Assassin. It's really nice with
IMAP, because I have a special IMAP folder, and
SA sorts all of the incoming spam right into the spam folder. Once a week I do a quick skim and make sure nothing important got stopped, and then it gets the old dumperoo. You can't do that with POP3, but it really doesn't stop that many that are legit, unless they are mailing list e-mails from crap like Yahoo groups and such. I like the various criteria it uses for what is considered spam, it has to get a certain score before it is considered spam. Combine that with the use of AmaViS for virus filtering, and you're good to go. We've had great luck with it.

If only domains told the truth...

[dasmegabyte]

I've had a number of people complaining about spam email originating from our server. A quick look at these emails from somebody who knows "a little something" about email shows that the email was an almost guaranteed forgery...the mail servers that relayed the message had nothing to do with us, besides which the user does not exist on our servers and the domain they sent from belongs to developers I know wouldn't fool with this stuff.

And yet, the damage has been done. These users don't trust me as a provider even when I explain how we lock down our server & prevent spam. They don't trust our domains, which means they block the ip -- an ip which may be mapped to 50 or more virtual sites. And all of this because our domain was the root of it all...a simple forgery that no email client really checks for validity because internet mail is designed to bounce anonymously from server to server. I've gotten spam that was "sent" from my own email address...which is silly, because why should I trust a company's services when they try to convince me _I'm_ marketing to myself?

What email needs is a set up like SSL -- a trusted third party to verify the validity of an email from a key generated by the sender when the receiver gets the mail. If the sender proves to be a spammer, the third party drops support...and charges a large fee for breaching a contract. We need this to occur without unwieldy programs (PGP) or user eductation...just some way to get a lock in the corner of a user's screen to let them know for a fact that user X sent message Y, and that if it was unwanted they have a recourse.

This new "Secure mail" could become popular very quickly, as many companies that communicate solely over email could use the security that nobody can send an email as ceo@trustycorp.com without the server's permission. The key is ease...SSL may have its problems (certs kind of expensive, monopoly of cert providers due to reliance on deals with certain monopolistic browsers, slowwww responses) but it has become a mainstay of secure communications for people who understand it (unlike my wife, who despite a BS in chemical anthropology believes that submitting her credit card via SSL over WEP 802.11b means a guy with a ham radio can read her number, so she places orders via cordless phone instead). Mail hasn't significantly changed in ten years...maybe it's time for smail!

Re:If only domains told the truth...

[jdreed1024]

What email needs is a set up like SSL -- a trusted third party to verify the validity of an email from a key generated by the sender when the receiver gets the mail.

Good idea. Who's the trusted third party? Microsoft? Not unless we only want e-mail on Windows. (And maybe a Mac release two years later). Verisign? 'Cause we all know how well they check the authenticity of certificate requests. A non-profit group? Like ICANN? They're proved themselves to be incompetent many times.

So what do we do? Several things need to happen: It needs to be more difficult to get a free e-mail account. Some sort of authentication needs to happen. Something as minimal as a credit card check might suffice. Ideally, however, the company you sign up with (Yahoo, Hotmail, etc) should send a letter to the address you provide, with a document that you sign, and then return before your account can be activated. That's the way it worked with Freenets back in the day. Of course, it'll never happen, but it would solve the problem.

The biggest thing, however, is that open relays need to be shut down. Most of the open relays exist in countries where English is not the first language. The single biggest complaint has been that MTA documentation is in English (perhaps Spanish and French) and not in their native languages. I'd venture to say that within the anti-spam community, there are people who speak Chinese, Japanese, Korean, Russian, Ukranian, and many other languages. Instead of complaining or adding more and more domains to blacklists, people should take the initiative and start a project to translate sendmail documentation (and documentation for any other MTA) into these different langauges, and get them out on prominent sites where they will be noticed. Sure, there will always be people who run open relays because they feel it's their right (like that wanker whose name I can't remember but claimed it was some free as in speech thing), but a lot of the ones in Asia exist because of ignorance (which is different from incompetence). Let's fix that.

Re:If only domains told the truth...

[unixfd0]

We need this to occur without unwieldy programs (PGP) or user eductation...

A little user education goes a long way.

What I used to do is whenever a friend or familly member sent me something like "M$ will give you $$$ to forward this to ten people" is write that person back explaining how email tracking could work...then I give them some links to some hoax sites...then I explain the difference between bcc and cc...then I give them a call and ask if they understand what I was talking about in the email...then I tell them to tell their friends. Of course everything is explained in friendly and "accessible" terms.

The little bit of time I spent teaching the others around me save me a lot of heart ache. No spam in my inbox, no dumb "forward this for that" emails, just emails that *might* mean something. :P

We need to invest in user education. How are we ever gonna get to a Star Trek level if everything is dumbed down?

Re:If only domains told the truth...

[Munky]

I've gotten spam that was "sent" from my own email address...which is silly, because why should I trust a company's services when they try to convince me _I'm_ marketing to myself?

Yeah, I've gotten these as well. Quite annoying. However, what really pissed me off was a bunch of people on our domain got the same e-mail, with my name in the from: line. So, I had a bunch of angry people thinking I was sending them spam. Good job, Mr. Spammer...

Re:If only domains told the truth...

[Detritus]

The single biggest complaint has been that MTA documentation is in English (perhaps Spanish and French) and not in their native languages.

There is Sendmail documentation in English?

Re:If only domains told the truth...

[Anonymous Coward]

I think what you're referring to is called 'Palladium' and unfortunately the potential for abuse far outweighs the benefits...

No Spam For Me...

[nomel]

I make multiple accounts (like I'm sure everyone does), one for spam and one for real emails. I'm very cautiouse in where I put my real email address, never anywhere that web crawlers can access. Put the address in an image if you have to put it somewhere (on your webpage).

One thing that you can do to find where some of these spam lists are getting your name is to put a unique name or identifier for the name section when you fill out any online forms (nomel(0), nomel(1), etc). When you get a spam message you will then be able to see who gave it to the spammer from the unique name. Sometimes it's surprising to find who gives out your info... :)

Re:No Spam For Me...

[gaudior]

never anywhere that web crawlers can access.

That works until your Auntie Em forwards a message from you to her Quilter's List, and it ends up in a web archive.

Re:No Spam For Me...

[Anonymous Coward]

So your address would be nomel@leaked.info, right?

The last time....

[Gabreal]

I talked to a company that uses span, they told me that they use it for ads and I told them B.S.

ORDB is the Answer

[DaveAtFraud]

Quote:

...but I still have to ban domains like yahoo.com, hotmail.com, mail.com

My e-mail address was recently harvested by a spammer. I started getting SPAM from the listed domains but the only problem was the mail didn't show up as from yahoo, hotmail or mail in my mail log. Turns out the spammer was forging the return address and sending through an open relay. So I learned about how to set up sendmail to filter incoming mail through the Open Relay Database (ORDB). That particular spam problem has now disappeared. It helps when you run your own mail server but if I can figure this out in less than a day then a paid sysadmin at an ISP, company or school should also be able to do it.

You can find out more about the ORDB here and this site has very simple instructions for setting up sendmail to use the ORDB filter. Sendmail.org has quite a bit of additional stuff you can do to filter SPAM and still let legitimate e-mail through. ORDB also has solutions for people who don't run their own mail server and just connect someplace with a mail client to get their mail.

how to filter asian spam

[Anonymous Coward]

after filtering the Content-Type: for ks_c_5601-1987
(upper and lower case) I havnt recieved an asian spam mail, given that I used to get 20+ asian spam a day this helps a lot. In Outlook you cant(I think) filter on specific headers, but filtring on all Headers should do.

my $0.02

go.com versus hotmail.com

[Thinkit2]

I've been at go.com for years and not had a _single_ piece of spam, while hotmail dishes it up immediately. A lot of this is just protecting your e-mail address.

Do not ban Hotmail and Yahoo from your client

[Anonymous Coward]

A LOT of REAL people are using these emails when they are at work! They might emailing you for a good reason.

A bit of truth in a website full of crap

[Anonymous Coward]

Linux users were described as 'elitist nerdy shmucks'. Sadly this is true for much of the 'community'. Too many consider themselves better than the rest of the world because they run Linux.

Re:A bit of truth in a website full of crap

[AndroidCat]

You're refering to Three Dead Trolls in a Baggie's Every OS Sucks The other one in my sig is pretty funny too.

What about the users of Hotmail?

[Megumi_Slashbot]

Hotmail users seem to have it tough. They have four levels of junk mail filtering only... from 'none', to 'low', to 'high', to 'exclusive'. If you turn the filter on high, even, you still tend to get 10+ junk mail messages per day. When I turned 'exclusive' on, even the messages from my contact list were deleted immediately, as I set junk mail for immdediate deletion. If only there could be solutions for hotmail... but there don't seem to be, so I use my hotmail address for MSN Messenger Service and an outlook client otherwise. That email address, I don't give out... and I haven't gotten spam on it yet! Perhaps that's a good idea, too. Make sure your email is not easily harvestable. This is a good way to avoid spam without any other programs.

Re:What about the users of Hotmail?

[Anonymous Coward]

That's a nice picture! Can I email you at score_-1_troll@AsianAvenue.com?

What About IP Spoofs

[5h4k4-2u1u]

I've seen a disturbing trend of people getting added to spam databases when someone was spoofing their IP... This recently happened to a friend of mine because their (PacBell mail server!) IP was added to an open-relay list...

Are the maintainers of these databases going to have to start doing more homework on these IPs before they ban them, or are we going to see more and more collateral damage due to unethical spammers?

The problem is that these guys (spammers) keep upping the ante!

Re:What About IP Spoofs

[AndroidCat]

I've seen spoofed From lines, spoofed Received lines (after the top trusted one). I've never seen the IP in the top Received line spoofed.

Are you sure that your friend wasn't blocked because PacBell did have an open relay? Check the list web site. Most provide evidence for their blocks.

Some collateral damage is deliberate. The ISP has to choose between spammers and legit customers.

Re:What About IP Spoofs

[The Turd Report]

I've never seen the IP in the top Received line spoofed.
I have seen it, but (anymore) it is rare. Usually a spammer direct-to-MXing a Sendmail8.6 or a Exchange5.0 server.

TMDA

[infiniti99]

(this is similar to a comment I posted to the other recent fax SPAM story. it has been expanded.)
------

I highly recommend using TMDA on your mail server to defeat SPAM. It works by maintaining a whitelist of valid senders. If someone emails you and they are not in the whitelist, then they receive a confirmation request email. They must reply to it in order to be added to the whitelist (at which point, TMDA will deliver their original message, and allow all new ones to pass through). No having to report SPAMs, no worry of maintaining a never ending blacklist. No blocking of entire domains, no having to "sort through the spam periodically". TMDA does it all for you, putting a minor inconvenience on first-time senders.

The end result is that I get no SPAM. Zero, zlich, nada, not one -- with no effort on my part.

I believe there are other packages out there similar to TMDA that you may want to try. Regardless, I'm convinced that a whitelist-centric strategy is the way to beat SPAM.

Note: You still must take into account mailinglists or other situations where you are going to receive mail from an unknown source that won't be able to process the confirm request (such as some online purchase confirmation), and this is where qmail aliases can come in handy. Ie, justin-linux, justin-sears, etc, and just throw them away if you ever get SPAM. TMDA even has some features to help with this, such as hash-generated addresses that self-destruct after a period of time.

Still, for all other purposes you can keep your normal address. No need for SPAM armoring ever again :)

-Justin

Re:TMDA

[mjh]

Yeah, since I started using TMDA, I've had a mild case of depression. Besides mailing lists, I never really get any email. I used to be able to delude myself into thinking people liked me because I got so much email -- but it was mostly spam. So, apparently, I'm not that popular!

So be careful if you choose to use TMDA. It might impact your ego.

Re:TMDA

[pbryan]

TMDA does have a disadvantage over blacklists: it doesn't reduce wasted server bandwidth. Not only do I want to keep my INBOX neat and tidy, I also don't want spammers to usurp the bandwidth that I pay $$$ for.

Blacklists would allow my MTA to reject the email before the body is even sent. TMDA receives the body, stores the message and attempts to send a confirmation request to the spammer, all taking bandwidth.

TMDA is ideal if nobody cares about bandwidth utilization, but today spam is costing me more. If traffic continues to grow at existing rates, spam will account for more traffic than my web services in a matter of months.

Re:TMDA

[infiniti99]

Yes, I noticed this too. I tend to check my mail very frequently, and not much is there these days. Maybe I should install a biff of sorts..

Still, it does feel good to be able to say, "I don't get SPAM, period." Oops there goes my ego.

Re:TMDA

[infiniti99]

Good point.

Perhaps the ultimate SPAM-killer would be some combination of the two. Blacklists to prevent bandwidth loss, and whitelists to kill anything that slips through.

I assume it's pretty easy to chain MAPS before TMDA in my qmail setup, maybe I should look into it.

Re:TMDA

[Devil Ducky]

You can rather easily set tmda to auto-blacklist any of the people who don't reply. You'll use the bandwidth for the first message but not the second.

I like it this way, I'm not in a very big worry about bandwidth and this keep my inbox sparkling clean, but also does save some bandwidth and processing time.

Re:TMDA

[Anonymous Coward]

Great! I'd like to chat about it. You're at infiniti@affinix.com, right?

Re:TMDA

[Anonymous Coward]

I see by your email address you want to avoid spam to greynold@sylvaninc.com, and that's very wise.

Re:TMDA

[Zaiff Urgulbunger]

This is fantastic - I'm only irritated that I didn't think of it myself!

It would be absolutely brilliant if ISP's started to offer this as standard. This could make SPAM non-profitable its that cool.
To address the (only possible?) issue of automated bots responding to the fixed structure, the ISP just needs to change the layout frequently, but this is simple.

The big benefit of ISP's running this is that it removes the latency between your TMDA software collecting mail and responding - this is a big deal if you're on a dialup & only collect once a day I'd guess.

Sooo, a call to arms - everyone who is pissed with SPAM, lobby your ISP to provide this software!

Oh and call it the "Zaiff Urgulbunger" movement. (that last part is particularly important)!

Re:TMDA

[__aakpxi9117]

Has no-one read my how-to on spam/e-mail viri blocking? It is the only bullet-proof way to filter e-mails you want, from ones you don't.

It's at: http://slashdot.org/~ryancooley/journal/9467

You see, the problem with white-list style systems is that it can be automatically circumvented. And it will be circumvented as soon as enough people use it that it makes a dent in spam.

And for those that don't know, all it takes is one piece of e-mail getting through to notify the spammer that you are alive and reading your e-mail.

Read the article about that information leak at: http://slashdot.org/~ryancooley/journal/9467

Re:TMDA

[Anonymous Coward]

There's no need to add defenses against automatic confirmations. Spammers use open relays and don't receive the reply requests. If they were using their own infrastructure to send the spam, they would have much higher bandwidth bills and they could be tracked and blacklisted.

Re:TMDA

[infiniti99]

Nice try. It all goes through the same filter. Have fun :)

Re:TMDA

[infiniti99]

Your idea of a key phrase is good, but perhaps it is overkill?

First, I think it will be a long time before the whole world is using a whitelist-based protection mechanism. We'll probably have a better email protocol before spammers would even worry about circumventing whitelists.

It has been mentioned in quite a few threads already that a spammer would have to use a valid return-address in order to receive the confirmation email. I think this would be enough to stop them cold. Spammers rely on being able to spoof addresses.

A better circumvention measure would be for a spammer to spoof the address of someone in my whitelist (maybe this is what Outlook-addressbook viruses will do in the future).

Re:TMDA

[pbryan]

Apparently, the MTA still accepts the message in its entirety before filtering it through TMDA, thus consuming bandwidth even for blacklisted senders. Furthermore, veteran spammers use random addresses in order to bypass email-address blacklists.

Ultimately, bandwidth waste will probably be most important to service providers, while clean INBOXes will probably be most important to end-users.

I've come to the conclusion that a two-tiered approach to spam reduction will be most effective in my environment:

The first line of defense is a realtime IP-address-blacklist (e.g. RBL, SpamCop), which allows the MTA to reject messages outright before they're sent.

The second line of defense is a message filter (e.g. procmail, TMDA, SpamAssassin), which allows messages themselves to be filtered for content and possibly intervene on behalf of the recipient to request confirmation before delivering the message.

Re:TMDA

[__aakpxi9117]

We'll probably have a better email protocol before spammers would even worry about circumventing whitelists.

Yeah, and software using two digits to represent the year would probably be gone long before year 2000.

WEP would probably be secure enough until the next revision.

If my point isn't clear enough yet, you should never go for something that's good enough for right now. If you do, you'll end up upgrading constantly.

I outlined a system whereby, even in theory, there is no way to circumvent. Why not just go to that step, and know you will not recieve any unwanted mail, ever again? Know you are not going to have to change your e-mail system again.

Besides, white-listing doesn't do a thing to protect you from e-mail viruses. There could soon be an e-mail bug that does nothing but collect addresses!

In addition, you should remember that it only takes a single unwanted e-mail getting through to make you a known-live target.

When Spam stops getting through, spammers will work around white-lists. It's a system that is self-defeating. If more people adopt it, it will become useless (kind of like Gnutella that way).

New approach

[Rupert]

Maybe we could get a mainstream news source to report that terrorists are using spam to communicate with each other. That would get it banned instantly.

Qmail

[crow]

My mail gets processed by qmail, and it seems to automatically add X-Envelope-To: header lines, so you can see what address received the message.

Your mail server has to know who it is supposed to be delivering the mail to, and in most cases this is made available to mail filters in one form or another. Of course, if you're filtering it on the client side after it's been delivered to your mail box, you may be out of luck. (I've always been of the opinion that filtering should be on the server side, for this and other reasons, but people make do with what they can get.)

Re:Qmail

[macdaddy]

I've always been of the opinion that filtering should be on the server side, for this and other reasons, but people make do with what they can get.

I more or less feel the same way. However I think that the obvious filtering should be done on the server. For example the DNS blacklists and the obvious spamming domains like "highspeedmailers.com" and "spamyouforadollar.net" should be filtered on the server. As well as the malformed messages; ie, the ones without properly formatted MessageIDs, malformed recipient fields, etc... I do think there is a benefit to spam scoring as well as this obvious filtering. I can't block an entire country at the MTA level. I can't block eudormail.com, yahoo.com, or hotmail.com either. I can't even blacklist amazon.com, ebay.com, or apple.com (all of which either spam (amazon & ebay) or run single opt-in lists (apple). My users would get pissed and I'd end up declaring a bunch of SPAMFRIENDs. That would defeat the purposes of filtering. As an ISP I'm filtering to reduce my consumed resources (bandwidth, drive space, processor time, etc..) and make my users happy (less spam in inbox). If I have to declare them to be SPAMFRIENDs because they want to buy from amazon.com, it hurts me. However, if I can pass the controversial filtering down to the user and let them filter it, I'm in the clear. I've used some of my resources that I wouldn't have used if I'd 55x the message, but I am keeping my users happy. For example, if I receive a message from Japan, I'll automatically add a couple points to the spam score. Then I'll run it through the rest of the spam scoring checks and let them judge the message as needed. In the end, I'll pass the message to the user and let them use the score I put in the header to decide on whether or not to keep the message. I've done my part by helping them filter spam. Now it's up to them to make the final call.

I think approach is best. Filter the obvious ones on the server, score the controversial ones & pass the final call on to the user's MUA.

Play their own game...

[ZaneMcAuley]

I use eMailTrackerPro from VisualWare and Visual Route
http://www.visualware.com/emailtrackerpro/index. ht ml

I get their location (for the non faked emails) and mail their ISP point of contact with the mail, pictures etc.

Nowdays they are FAKING emails to be from YOU to YOU. Alot are faking or creating yahoo emails so you cant block yahoo.com or u block ur friends. Some are using MSN Member services as a fake.

Simple, BLOCK EVERYTHING except those on an OK list (buddy lists etc).

Yes, you're dreaming.

[Ungrounded Lightning]

If idiotic pricks didn't ...

I'm dreaming of course.

Yes, you're dreaming.

About one in 100 (somewhere between 1 in 50 and one in 200) people in the general population is a psychopath. This is a (set of?) brain disfunction(s) that amounts to "no conscience". (Think "colorblind" but with respect to harm-to-others. But it's not known yet whether it's genetic, foetal insult, or what.) Additionally there are "sociopaths" - similar symptoms but as a result of training and social factors rather than an organic problem.

Some fraction of these people learn a moral, ethical, or legal code to compensate for their affliction. They can become honest, productive, and/or beneficial citizens. In some positions (such as political or military leadership or business administration) they can even excell, because their judgement about actions that will hurt other people is not as biased by immediate emotional concern. But many do not learn a code (or learn a defective one). From these come the bulk of the criminals, scam artists, tyrants, white-collar crooks, and so on.

In the absense of compensation a psychopath will be looking out solely for number one. It's not well correlated with intelligence - some are stupid, some very smart. A significant number will be able to handle spamming tools, and be willing to go for the immediate benefit to them (even if it's small), regardless of the damage to others or even long-term consequences.

Yes, Virgina, there ARE evil people.

Much of the social and legal institutions of all civilizations are dedicated to the problem of this small-but-effective population of psychopaths. In particular, legal systems exist to give them a set of rules to live by, a set of personal bad consequences for violating them (so acts that harm the law-abiding become bad for "number one"), and to remove from circulation those who just don't get it.

Short of genocide against psychopaths we will continue to have a plague of spammers for at least as long as people think there's money to be made (or fun to be had) and it won't get you busted.

Re:Yes, you're dreaming.

[Anonymous Coward]

...as long as people think there's money to be made (or fun to be had) and it won't get you busted.

the problem: there IS money to be made. a shitload of it too. even if anti-spam laws are passed AND enforced, spammers are brought to 'justice' and everyone on here who wants to get paid their $.10 per spam e-mail gets paid directly by the spammers, it WON'T stop spam. Spammers HAVE the money to pay lawyers and fees that may arise. (I had to pay my ISP 'fines' a couple times) But ya know what? I'm still here, AND making more than my parents combined (I'm a 19 year old college kid) So now.. if a 19 year old college kid can do this on his days off from school, do you really think spam is gonna stop? HELL NO. The ONLY solution to stop spam totally is laws against the sponsors who pay the spammers per signup or sale. Until companies stop paying spammers, they will never dissappear.

Re:Yes, you're dreaming.

[gafferted]

About one in 100 [...] people in the general population is a psychopath.

So why are there never enough psychopaths to assasinate the spammers?

Re:Yes, you're dreaming.

[Junks Jerzey]

Short of genocide against psychopaths we will continue to have a plague of spammers for at least as long as people think there's money to be made (or fun to be had) and it won't get you busted.

It's ridiculous to equate psychopaths and spammers.

Re:Yes, you're dreaming.

[Anonymous Coward]

It _is_ ridiculous to equate psychopaths & spammers. The correct equation is:

spammers psychopaths.

Re:Yes, you're dreaming.

[gorbachev]

Re: It's ridiculous to equate psychopaths and spammers.

More accurately...spammers are sociopaths.

Proletariat of the world, unite to kill spammers.

Spam map

[Alien54]

Slash had a story on just such a place just a few weeks ago

It's called the Spamdemic map, but they had to pull the plug due to bandwidth cost issues

Have to be careful with your e-mail address.

[RobinH]

When I was in university and making web pages and stuff, I used to get tonnes of spam. When I posted to newsgroups I got tonnes of spam. However, these days, I just have two addresses... one for personal email, and the other for work email, and I rarely ever get spammed.

My personal email address is a yahoo account, and work email is provided from the company I work for. I give out my email addresses to friends and lots of contacts from work (and it's printed on my business cards).

I NEVER do these things:
-post to newsgroups with a real address,
-put my personal address on a website,
-give a real address when filling out surveys, etc. online
-sign up for newsletters
-give my email to anyone who asks over the phone ("Sorry, I don't have a computer, but yes, I'd like to order that CD-ROM drive")
-give my email address to Radio Shack
-enter my personal info into my browser

Basically, I just refuse to allow my email address to proliferate. If I do happen to get spammed, I just don't reply, and it tends to go away, but it's really rare anyway.

Of course, if I ran a website, I'd create a unique email address just for that purpose, and I'd expect to have the sh!t spammed out of it, but at least it would be separate from my real addresses.

Re:Have to be careful with your e-mail address.

[Nogami_Saeko]

Posting to newsgroups with your email address is probably one of the easiest ways of getting on spamlists.

Like you, I NEVER use my real email when posting (certainly not in the headers), and if I find if necessary to have people contact me, I'll just create a unique address (I run my own mailserver), then delete it when I'm done.

It still suprises me how many people think that simply adding "NOSPAM", "REMOVE ME" "MYNAME DOT ORG" or something to their email address is going to protect them from getting on spam lists. Any programmer could whip up a short bit of code in about 5 seconds that would strip that sort of primitive obfuscation out and return a real address...

Oh yes, and I never use my real email address when going to a webpage to download software. If they need to send me a reg code, then again, I'll create a temporary throwaway for a few days.

I still get bits of spam, but probably only 3 or 4 messages a day. Not too bad.

Re:Have to be careful with your e-mail address.

[Lord Ender]

Your technique won't work. If you give your address to friends and family, they will either send a forward (which ads your email address to the headers and is picked up by spammers) or get a virus, which can also pick up your email address. And anybody running an SMTP server that records email addresses could harvest you for spam.

Re:Have to be careful with your e-mail address.

[Isofarro]

[Usenet email address munging] Any programmer could whip up a short bit of code in about 5 seconds that would strip that sort of primitive obfuscation out and return a real address...

I use a real proper email address on Usenet (as required by netiquette), but I'm only seeing three emails a week of spam (as compared to my normal email address of 10-16 spam a day).

I use domain names and user names with the word spam in them. So I duck under the "clever spammers". Its worked so far.

Re:Have to be careful with your e-mail address.

[RobinH]

Your technique won't work.

It has for (literally) years.

If you give your address to friends and family, they will either send a forward (which ads your email address to the headers and is picked up by spammers)

I guess I don't tend to forward jokes. I've seen them all, and tend to believe that most of my friends/colleagues have too. My friends also know that I don't like getting forwards, so they tend not to send any to me. The few that do have caved into putting me on the list as a Bcc.

or get a virus, which can also pick up your email address

As has been pointed out in other discussions, when you don't use MS Outlook, you don't get viruses.

And anybody running an SMTP server that records email addresses could harvest you for spam.

Fortunately, Yahoo seems to be pretty good about not doing that (and not selling my address in general, unlike other web email services).

Back to my first point... it HAS worked. I didn't say I don't get any spam, just that i get NEARLY none.

Re:Have to be careful with your e-mail address.

[Lord Ender]

"As has been pointed out in other discussions, when you don't use MS Outlook, you don't get viruses."

If your mom gets a virus and has your name in her address book, it will send crap all over the net using your address. So there is a hole in your plan you hadn't considered. I have tried your method. It doesn't work. You say you get some spam? If the guy who has your address starts selling his list, you are screwed. There would be nothing you can to to stop yourself from being burried except use filters.

Re:Have to be careful with your e-mail address.

[RobinH]

I have tried your method. It doesn't work.

Lay off on the pr0n sites for a while.

Spam cost me my girlfriend

[Anonymous Coward]

My girlfriend was finishing up military school. We'd bounced mail back and forth a bit, and she'd promised to mail me the time for the finishing ceremonies so I could attend and then take her home.

The mail never arrived, and I later got a call from her, utterly pissed that I'd missed the ceremony, pissed that she'd had to get a ride home with another cadet, and breaking off because after riding home with him, she'd had a grand time and thought it might be better to date someone in the military.

Things were iffy prior to this, owing to the difficulties of a relationship turning into a distance relationship because of her military training. We'd likely have patched things up when we were able to spend time together again, but now I dont' get a chance.

The reason? SpamAssassin flagged her mail as spam for excitedly using too many exclamation marks and similar, and dropped it into the spam folder.

I could still be dating a military chick if it weren't for spammers.

Re:Spam cost me my girlfriend

[AndroidCat]

I could still be dating a military chick if it weren't for spammers.

A military chick that uses too many exclaimation marks? Trust me man, you're safer this way.

shocker

[tps12]

So is Hemos surprised that his approach of blocking two entire countries worth of email addresses resulted in some "collateral damaga?" It's knee-jerk responses like "I'll ban East Asia" that are going to Balkanize the Internet until it looks like a bunch of isolated BBSes again.

Hey, 1994 was a good year for computing; maybe it won't be so bad, after all.

Why stick with one stage?

[TheHawke]

When one can block and file complaints?

My system contains SpamAssasin and SpamCop.
The assasin takes care of everyone that uses it (i shut off the filing option on it). And then I post the full email to Spamcop to put the spammer on notice... So far its been a effective approach. Since the Great Spam Flood that started earlier this year, my spam has gone fron 12/day to nearly 3/week!

Now only if someone would take out those idiot Level 3 spammers, my day would be made..

Re:Why stick with one stage?

[blincoln]

I'm a little concerned with the prospect of SpamAssassin combined with automated notification of ISPs for two reasons:

SpamAssassin - it's overzealous, at least in some configurations. I replied to a "free computer parts" email I got through a friend (it was from his coworker) saying "sure, I'd be interested in a couple of those things" and it got dumped into his spam box because his original message had mentioned the words "toner cartridge" in relation to a printer he was giving away. Since he followed the "check the spam box once a week or so" philosophy, by the time he saw my message he'd already sent all the stuff to the recycler since he thought no one wanted it.

Automated reporting - IMO, it's a cool concept, but a bad idea in practice. I've been tagged at least once by a script like that, with root@myisp, postmaster@myisp, etc all spammed because I'd used one of the key phrases in a post on Usenet or a mailing list (it was awhile ago, I can't remember the exact details).

Automated systems are great for bringing things to people's attention, but it's unfair to expect everyone else to suffer the consequences of arbitrary rules set for them by their maintainers when they take action on their own. Another example is a music-related mailing list I'm on. One of the subscriber's (corporate) mailservers is set up with a filter to block and reply with a canned message to anything with the word "hot" in the title. Someone started a thread along the lines of "hot tips for the S-760" and we all ended up getting a ton of the autoreplies for several days afterwards. It's not as bad as the sysadmins at your ISP being told that "one of your users is a spammer!!! look!!" but it's an example of what happens when someone with good intentions goes over the top (and then doesn't specify an address to contact if there are problems with the filter).

Re:Why stick with one stage?

[TheHawke]

Sorry, I misstyped that.. IT was SPAMNET instead of SpamAsassin.. ish.. my bad!

Re:Why stick with one stage?

[Anonymous Coward]

Yes, you should have multipler filters to protect rchapin@2fords.net, as that's a valuable tool for communication.

Re:Why stick with one stage?

[Anonymous Coward]

I agree with this post! Email the author at blincoln@blarg.net to give him/her some encouragement!

Re:Why stick with one stage?

[blincoln]

OMG! So clever! And you're so proud of your achievement that you post anonymously.

Fun with AI

[Anonymous Coward]

This might not lead to any practical solutions, but just for the hell of it, it would be cool to see just how far AI can go in distinguishing between spam and legitimate email. For example, someone might experiment with genetic algorithms, feeding his normal daily email to the programs as input and manually "grading" the responses, and see how well they learn to detect spam. The results might be surprising and interesting.

--- Brian

Re:Fun with AI

[Irate User]

Hm, I've been thinking along those lines myself.
I wouldn't expect the result to be really useful, but a GA might find some interesting trends.

Problem is, we're talking semantics, which is a real pain to handle programmatically.
The same sentence can be expressed (and misspelled) in a plethora of different ways.
The GA would probably have to rely on some predefined framework for handling sentences
(ideas, anyone of you GA hackers?).

Some obvious criteria defining spam are of course:
* messages with ALL CAPITAL SUBJECTS
* messages stating "This message is not spam"
* messages containing "earn $"
* etc

There are other criteria, like the message has no sender, or it contains forged header tags,
but for starters the GA could concentrate on the subject and the body text.

Spam outta control

[Tablizer]

The only viable legislative solution I see is to require all senders to pay a small fee for every message they send out. No bulk deals, also.

It would not eliminate spam, but may greatly reduce it.

The fee should not affect the cost of services if you are not a spammer ISP because you will get the senders' revunue to pay for accounting efforts.

Collateral damage is a benefit

[FearUncertaintyDoubt]

"Their philosophy appears to be that if innocent businesses and individuals on the periphery of spam-house blocklists are affected, then those innocents will have no other choice but to pressure their upstream provider to remove the spammers from their blocks, thereby solving the spam problem bit by a bit. Draconian, yes. Effective? Sure."

Absolutely. Without pitting customers of ISPs against each other, i.e., the legitimate ones against the spammers, the ISPs will be happy to serve both. I'd suggest that if an ISP allows any spamming, block it -- wholesale. Either you have an agressive policy against SPAM or you lose your privilege to send mail to my servers. Your customers don't like it? Tough. Make your network spam-unfriendly.

The last thing the ISPs want is for their regular customers to be aware that they are allowing spammers to use their network. It's kind of like the phone company selling caller ID block to telemarketers and caller ID and privacy manager to residential customers. If the spam blacklists cause users to confront the reality that their ISP is knowingly hosting spammers or not bothering to monitor people sending out 10e+06 emails at a time, then they might just demand that their ISP get out of the spam business. Because unlike (most) telcos, ISPs don't have monopolies, and customers can switch.

Re:Collateral damage is a benefit

[AnotherBlackHat]

Absolutely. Without pitting customers of ISPs against each other, i.e., the legitimate ones against the spammers, the ISPs will be happy to serve both. I'd suggest that if an ISP allows any spamming, block it -- wholesale. Either you have an agressive policy against SPAM or you lose your privilege to send mail to my servers. Your customers don't like it? Tough. Make your network spam-unfriendly.

Sadly, for some strange reason the people who get blocked seem to think it's because of some action
taken by the maintainer of the block list.
No matter how often you repeat the statement that's it's their ISPs fault, they still think it's because you listed them.

-- this is not a .sig

Sign your mail!

[Viceice]

I think the solution to this is something we have implemented with care in the real world regarding our mail, but somehow failed to do in our e-mail.

Think of a real world companies mailroom. Say it's a big company that gets thousands of letters each day. Some of it is business related and is important, some 'thank you's and 'well done's from customers, some 'your stuff sucks' also from customers and lots and lots of junk/spam/flame that is only good for recycling.

Sorting out all the mail takes time, so how do you make sure that the legit mail gets to you quick and the Spam stays in the Spam basket? Well you send registered mail. See, we know that certain mail is important when someone takes the trouble to take it to the post office and register it and pay more for it's delivery or call a courier to do the same. It's all barcoded so we can scan it, see who it's from and build a "trusted" mail list and rush it through.

Sound familiar? You bet! But the trouble is almost nobody beliefs in PGP signing their e-mail. All our mail programs can do it, but we just don't. Imagine, if it were that every piece of mail sent is signed, all we need is a simple filter to see what is spam and sort it out, dead on, with no legit mail getting junked.

just yell?

[www.sorehands.com]

Instead of yelling, what about filing a small claims action.

If they have to pay out money, they may clean up their act.

bounce

[lobsterGun]

but I still have to ban domains like yahoo.com

funny you mentioned that. A few weeks ago my company was shopping for a wed developer and I was exnchanging email with lots of salesmen. I kept getting bounce messages on my replies to one of them. At first Ifigured that it was a mail header problem and resent the message to his real address, but that bounced too. Then I actually read the bounce message: "Remote host said: 550 5.0.0 spam not accepted here".

It was quite convenient really... I had been looking for a way to pare down the vendow list without having to sit through a dozen demos.

Re:bounce

[Anonymous Coward]

Yep - better off to hook up with web developers who don't mind being flooded with spam. Why would you want to trust anything to a guy who refuses offers to make his stomach smaller, wallet/penis/breasts larger, and won't even watch live nude teens screwing otters?

Long Live /etc/aliases

[QuantumRiff]

if you run your own linux server, just edit /etc/alias with something like:
ebay: me
then save, and run "newaliases"
on the web form for ebay, then type in:
ebay@mydomain.net

Re:Long Live /etc/aliases

[tedtimmons]

If you are running your own linux server, install qmail and use a dot-qmail file.

-ted

You did not try!

[www.sorehands.com]

You set up a couple of dummy addresses. When they get spammed, you track it to the spammer. You find their source. They will cooperate, if it comes out of their pocket. Or, you see about criminal charges for illegally accessing your computer under the federal computer and tresspass law.

spam spam spam

[greymond]

Why is this surprising - First off NO ANTI-SPAM SOFTWARE IS PERFECT - don't get me wrong - spamassassin, block lists, and junk mail folders are great tools, but they are not going to be 100% accurate 100% of the time - get real. The programs are meant to help filter MOST of the junk out - BUT occasionally you WILL have legitimate email that gets flagged as spam for BEING IN ALL CAPS (because your grandma just got email and couldn't find the aps lock key) or maybe its from a foreign site *.ru, *.uk (A friend on vacation is using there new russian friends email to send you a note) who knows SOMETHING CAN AND WILL OCCASIONALLY GO WRONG - it happens all the time - until we are perfect creatures of pure thought provoking goo as in EVA we will have missed emails and spam - it might not always be AS BAD but it WILL NEVER BE PERFECT

Re:spam spam spam

[Anonymous Coward]

OK, THANKS FOR THE INFO

Re:spam spam spam

[Anonymous Coward]

Not true.

TMDA and several others use a verification method to designate acceptable messages.

Zero spam, zero false positives.

TMDA ROCKS!

Why hasn't email protocol been changed?

[bwt]

It seems to me that most spam leverages flaws in the email protocol. The ability to spoof an email address and the lack of built-in and automatic digital signing both enable spam to flourish.

Perhaps its time to write a completely new email protocol that supports these features.

I don't think it's so much to ask that when an email header says its from joe_blow@yahoo.com that it really is from that address. I understand that this would cause anonymous email to be impossible, but it should be the recipient's choice as to whether they want to use an email protocol that allows spam and anonymous mail or not.

Re:Why hasn't email protocol been changed?

[Anonymous Coward]

its just as anonymous as it is now.

the server is only verifying that joe@yahoo.com did indeed send that email.

how you protect your identity attached to that email is your own business (as it currently is)

Don't blame the programs....

[Andrewkov]

Don't blame the spam filters for not being perfect. No matter how intelligent these programs get they will never be perfect. Even if you hired someone to go through your mail box every day, that person wouldn't know what you consider spam and what you want to read. For example, if an old friend you hadn't talked to in years sent you a job offer, that would kind of look like spam, but you would still want to read it. Anyway, these spam blocking programs are much better than nothing.

false positives don't affect me...much...

[mddevice]

I personally check my spam folder many times a day, so it's no big deal if I get a false positive from spamassassin. "But what's the point in a spam filter at all if you check it all the time", you ask? For me, the annoyance of spam is getting interrupted by the delicate chimes that announce your new mail, and then racing excitedly to your mail app only to discover that a HOT TEEN is waiting for YOU! I don't mind sorting my spam folder, so long as it's on my time and not interrupting something important. I usually do it anytime I get any legitimate mail, so it's rare that there's more than 1 or 2 emails in the folder. A false positive will usually just result in delaying me from reading someone's mail for a few hours.

If I got so much spam that this system became unwieldy, I would probably set up several spam folders corresponding to the spam level assigned by spamassassin. Anything between 2-5 would go in a folder that I check whenever I get a real email, because a false positive is almost guaranteed to be below 5. Anything over 5 is pretty much guaranteed to be legitimate spam, and I would check that every few days. I don't do this, however, because I simply don't get the 100+ spam emails a day that the ./ editors claim.

Re:false positives don't affect me...much...

[Anonymous Coward]

False positives are very annoying. I think fclbnc001@sneakemail.com has some good ideas.

Message delivery is not guaranteed.

[cbass377]

"Will the message get through"?
Message delivery is not guaranteed. Even in the RFC's it is considered a best effort delivery. It works so much of the time, people assume it is 100%. It is not. So send your email, if it doesn't make it, send it again. If it still doesn't make it, then break out 35 cents (or whatever it is now) and mail it. You will have just as good a chance of it making it. The only thing I guarantee is that there are no guarantees.

Even if you do everything right and aren't blacklisted it still may fail at Joe Blow's Excellent SMTP server.

Flame on.

Ruined

[SomeOtherGuy]

Bottom line -- Spam (and the tools required to fight spam) are the biggest reasons we will still be using stamps and snail mail in the years to come. Spam has taken the "killer app" of the information age -- and crippled it beyond use.

It's a catch 22 because if you don't filter spam the signal to noise ratio is way to high to make email a valid source of legit communication. If you do filter -- the better you filter, the higher the chance of important bits going to /dev/null. I would go into more detail -- but one look into most mail boxes that have been around the internet for long would speak louder than a thousand words.

Re:Ruined

[Anonymous Coward]

If I send an email to deskjock@firstlinux.net, can you tell me your postal address? I totally agree about using stamps in this day and age.

The best spam lists

[daves]

IMHO, in rough order of value:
SpamCop - Catches by far the most spam. Falses rarely, though yahoo shows up from time to time.
Spews - Known spam sources. Never falses.
ORDB - Fair false rate, and a lot of overlap with SpamCop.

Re:The best spam lists

[Anonymous Coward]

SPEWS is one of the worst for collateral damage -- It's aggrevated by the lack of accountability and has created an almost arrogant attitude by their apologists.

I know, I've seen it. The abuse list is full of collaterals pleading for relief from SPEWS. As for me, I've asked politely for more information about why specifically a particular route is blacklisted and got little or no help. I've explained to them that specific info is needed for an ISP's customers to put the pressure on. Silence.

I cannot recommend SPEWS because there is no reliable way for corrections to feedback into the database. Assassinseems to work well for me -- I recommend rule based approaches.

Re:The best spam lists

[The Turd Report]

Compared to the number of legit customers to number of spammers, spammers might give an ISP 1% of its revenu. Spammers don't help these ISP as much as you would think.

No wonder they're complaining...

[Caradoc]

"Recent complaints about blocklists have come from companies and organizations, including British Telecom, the Libertarian Party and News.com publisher CNET Networks, among others."

btinternet is complaining about getting blocked because they don't bother to nuke their spammers. CNET doesn't verify e-mailed subscriptions, so just about anyone can sign someone else up.

Is it any wonder that they're complaining about being blocked?

"Well-researched" my ass.

Reverse Filtering == No Spam

[Alethes]

I've been using this procmail script for quite a while now. Basically, it implements an "accept list" as described in this OSOpinion article, whereby only people that respond to an auto-reply are added to the accept list, which means that none of the automated spam apps can get their crap through to you. I can't remember the last time I got any spam.

Urban Myth: banning CN spam hurts China dissidents

[dananderson]

It's a myth that banning .cn spam is hurting dissidents. They can still surf the web and use 3rd-party web-based email. I ban all email from all Chinese, Hong Kong, Japan, and South Korean IP address blocks. I still get email from Chinese asking for technical help (Solaris on Intel and what not), which I answer.

As for dissident email, I never received any and don't expect to. I'm sure the few Chinese dissidents are beaten down quickly and probably communicate with others who can help.

Hopefully, the Chinese will wake up and realize that to be responsible Netizens, they shouldn't be spam generators for the rest of the world.

Exactly but not the actual site itself. Qmail rox!

[Anonymous Coward]

I just wanted to point that out b/c I have learned more than I ever wanted to know about email in an attempt to migrate my email servers from Exchange/Winblows to Qmail/Linux. I would have tried BSD (since that is what it was developed on) but I have more experience with Linux.

Since I really DIDNT want to be an open relay I tested and tried a load of configurations. Sadly I was open for about 1/2 of a day (and of course some jackass sent about 20 messages through my server).

I've found the best way to setup QMail is to combine 3 sources (Life with Qmail, his book (which contains significantly more info and is DEFINATELY worth the price), and reading EVERY PROGRAMS file/man page to see how they are implemented (uscpi, daemontools, checkpassword, qmail, relay-ctrl, ...). If you take it slow the first time it works quite well.

Now just to get Courier/Horde/IMP installed.

My former university is using QMail for their Sooner Information Network On-line Mail. It seems pretty cool.

Damage

[macdaddy]

I wish there was a way to reduce the collateral damage caused by blacklisting. Then again, sometimes it's intentional. Take me for example. I've gotten more spam from Broadwing.net customers than I've ever gotten from anyone else. Broadwing.net doesn't give a damn about it either. I've LARTed them many times with spam. They don't even auto-ack you. Because of their in-action, I've blacklisted every broadwing.net netblock I can find. I want to get their attention by hitting them where it counts, their bottom line. I listed them with the intentions of a) stopping their spam, and b) getting their customers to complain about their inability to send mail to me and find out the real truth for themselves. There's no other way to get through to Broadwing unless your state has an anti-spam law that also finds fault with pro-spam ISPs. Then I have to sue which costs me time and money. This is really the only method of getting their attention. The collateral damage I'm creating by doing this is intentional. Most DNS blacklists don't do this. Some do though. The RBL will through a lengthy nomination process. SPEWS does it when all else fails. I use SPEWS. I also use their tactics. When I LART spam to an ISP numerous times and never hear back, or while researching spam I see that an ISP has been LARTed by other anti-spammers many times, I'll consider blacklisting them. I try to give them the benefit of the doubt though. Broadwing used up all their benefits and obliterated all my doubts long ago.

All that said, I think that collateral damage is acceptable in most cases. I think there's a reason behind it that some don't grasp right away. When you've LARTed an ISP a dozen times over one IP or one of their customers and they haven't done jack about it, you'll understand the usefulness of collateral damage.

My $.02

Outlook filters

[Shadow Wrought]

I was stupid enough a few years back to give my e-mail address at the Jack in the Box website. The Jack e-mails started after awhile and they were annoying, but I knew I only had myself to blame. So I set up the filter on Outlook to send the Jack e-mail straight to the trash. Which it did. Along with every other e-mail that began with the letter "J". Penance sucks.

Or you could, *heavens no* ...

[txdadu]

just get off your lazy arse and delete spam yourself.

I think you might be dreaming a little.

[sawilson]

In corporate america, your definition of a psychopath is pretty much held up as the example to follow. They used to use war euphemisms in business, until that became unpopular. Now it's sports euphemisms. I think the idea being that games of sport are tactical and emotionless like war is supposed to be. To give you an idea where I'm coming from, I find it truly amazing that we've been wasting time on this system of chasing little green pieces of paper around the planet (blatant douglas plagerism) instead of working together to expand our understanding of that whole universe out there. It's sad that we have a system of reward based on material possession and creature comfort. The goal of which is have so many pieces of paper, you don't have to do anything, and you can control others. Surprisingly, more often than not it's those people that make decisions for all of us. Survive at all costs. It's a model mirrored in nature by lesser lifeforms. We should be better than that. Considering we are our own worst natural preditor, I'd rather have someone making decisions that is intelligent and sympathetic, rather than someone that is an expert survivalist and game fixer. I don't hate the player mind you, I hate the game. We should take these people out of power, and get them the help they need. And yes, I AM dreaming. But everyone that has bought into the system in place might be dreaming someone else's dream.

Re:I think you might be dreaming a little.

[Anonymous Coward]

All that karma whoring, and the best you could manage was 1.

1. Not 2, even, just a shitty 1.

Pathetic. Get a fuckin' life.

Maybe

[Danielle Gatton]

Subject: *****SPAM***** ZDNET NEWS: Spam blocklists going too far?
Date: Fri, 12 Jul 2002 06:21:05 -0700 (PDT)
From: "ZDNet News E-mail Alert"

SPAM: -------------------- Start SpamAssassin results
SPAM: This mail is probably spam. The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM:
SPAM: Content analysis details: (6.1 hits, 5 required)
SPAM: SUBJ_ENDS_IN_Q_MARK (-0.1 points) Subject: ends in a question mark
SPAM: FROM_HAS_MIXED_NUMS (2.6 points) From: contains numbers mixed in with letters
SPAM: GAPPY_TEXT (0.4 points) BODY: Contains 'G.a.p.p.y-T.e.x.t'
SPAM: DOUBLE_CAPSWORD (1.1 points) BODY: A word in all caps repeated on the line
SPAM: CLICK_BELOW (1.5 points) BODY: Asks you to click below
SPAM: LINES_OF_YELLING (-0.0 points) BODY: A WHOLE LINE OF YELLING DETECTED
SPAM: LINES_OF_YELLING_3 (0.5 points) BODY: 3 WHOLE LINES OF YELLING DETECTED
SPAM: LINES_OF_YELLING_2 (0.1 points) BODY: 2 WHOLE LINES OF YELLING DETECTED
SPAM:
SPAM: -------------------- End of SpamAssassin results

Re:Maybe

[Anonymous Coward]

I have a question about my SpamAssassin results. Can I mail it to dgatton45@hotmail.com?

Overkill

[Jobe_br]

Killing of all mail from yahoo/hotmail is pretty severe. Many, many people (who might have other legit addresses) maintain yahoo/hotmail addresses for when they're on the road. Many other people who want to keep the same address, regardless of what ISP they're using at the moment also use Yahoo/Hotmail. I recently did a search through a client's newsletter subscription database (to compile a list to send the newsletter out to) and over 50% of the addresses were either yahoo or hotmail domains.

I don't see why (with SpamAssassin) you would need to be so draconian. SpamAssassin catches all my spam, regardless of where it originated. If your installation isn't catching what you consider spam, adjust the rules a bit. There's a lot of good documentation on how to do this and it isn't real hard (mine seems to be working fine, out-of-the-box). Now, its very possible that a person would get legit email from yahoo/hotmail addresses that they simply don't *want* to get ... fine, but that's not SPAM.

Re:Overkill

[Anonymous Coward]

I agree that killing off mail to yahoo is bad. May I email you at bdruth@yahoo.com to discuss the ramifications?

Re:Overkill

[Jobe_br]

Be my guest ... though the email address is obfuscated by /. for a reason ... posting it in an unobfuscated fashion circumvents that pretty effectively :(

My latest Spam idea...

[cmark]

I am going to forward all of the spam I recieve to my states Congressional Representatives. If anyone else thinks this is a good idea, here is a web page that has contact info.

http://www.house.gov/house/MemberWWW_by_State.ht m
http://www.senate.gov/senators/senator_by_state .cf m

If I get way too much spam and you get way too much spam, just think how much spam they will get if 5% of us do this :-)

Re:My latest Spam idea...

[Van Halen]

Yeah, and they won't even notice because no legislator actually reads his/her own email. That's what interns are for - they sort through all the spam and random, incoherent ramblings of wacko constituents to find the messages that are actually worthwhile. Most of these get a nice form letter reply several months later, and the few who are lucky enough to be considered really important by the intern are printed out and put on the legislator's desk.

While I'm sure some legislators are computer-savvy enough to read email (and do), don't think it's not filtered by another human first. As I was telling a friend just last night, I don't think there will be any serious legal crackdown on spam until legislators have to deal with it personally. A few steps have been taken in the right direction in a few places, but by and large it's a non-issue to them. If anything, many are probably afraid to do something because it "could hurt the economy." Oh, the poor spammers, they might have to get real jobs... :)

Who cares?

[dh003i]

Hey, tough shit.

My personal solution to SPAM is to ban all e-mails from anyone I don't know. If I get an e-mail from someone not on my address book or accepted e-mails list, its automatically deleted before I see it.

This requires actively maintaining a list of e-mails, but it is fool-proof for elminating spam, and won't filter out many legitimate messages from people you WANT to get messages from.

spamcop.net thoughts.

[joeldg]

Buy a new domain. Start receiving 60 spams per day on each email, even though you have not posted them anywhere yet. Start reporting them to spamcop.net for some reason spamcop decides that it is a good idea to check the box next to *your* service providers name automatically. Sends report to my service provider. My service provider in getting so many of these all the time, don't bother to look at them and realize I am the one reporting this crap. My domain hosting is turned off without warning or even an email explaination of why. Total time.. one week. On a bright note, I talked with them and they went and looked a the reports and realized the error and turned my account back on within one hour. But still.. this should *not* have happened.. Yea.. Collateral damage (to myself)

Re:spamcop.net thoughts.

[sfjoe]

OK, so now you've learned to actually look at your spam reports instead of blindly clicking the 'Submit' button. Sounds like Spamcop is working perfectly. If you shoot yourself in the foot, don't blame the gun.

I AM AFFECTED Re: "collateral damage"

[Anonymous Coward]

I am one of those admins that is dealing with "collateral damage".

While I understand the needs of the community and will work for them, some of this outright vigilante action has to stop. I am willing to work with these people and my persistence internal to my company has paid off, but I get nothing but jeers and flames from a majority. This has left me pretty demoralized, and it's really not appreciated.

Granted, I understand why these people bear such enmity to my company, and I know that this fight has become extremely polarized, but don't make life harder for me. The treatment of myself as I plead is irrelevant; I was already working on changing the internal climate towards abuse.

The one positive thing of being blacklisted is that it helped my case as the CEO is very customer service oriented. My case was furthered greatly when we had a few complaining customers (note: even then, most of the customers were pissed at the companies subscribing, not us).

So, in a bittersweet way, I'd like to thank some of those people, but I would also like to question the larger companies that subscribe to this list: do you really want to risk commerce for the sake of reducing spam?

-- youll.ngo.who.I.am.if.youre.in.the.ngo

How about SPAM==DoS... any takers?

[RallyNick]

I'm not sure if there are any laws against DoS but I'm sure people have been prosecuted for it already. And as far as I'm concerned if my mailbox gets full of spam while I'm away and my account is closed, I can accurately claim that my email account has been DoS'ed by any definition of a DoS attack. It's true that the perpetrators are ipossible to find and sue (overseas), but each piece of spam comes with a link or telephone number identifying the company that paid the spammer to do what he did. Now if you knowingly buy a stolen item you're going to jail because you effectively paid the thief to steal it for you. Then why isn't anyone suing the companies linked in spam for knowingly and directly financing a global DoS attack on everyone's email accounts, even though someone else is executing it (the thief)?

How to block 90% of SPAM

[TheFlu]

I'm not sure about everyone else, but a good 90% (or more) of my SPAM comes from Asia Pacific networks. In order to combat this, I have used the access_db feature of Sendmail to block these off.

Over the past week since I've done this, I've blocked in excess of 100 pieces of SPAM from my INBOX. It seems to be working very, very well. You can read the article I wrote on how to accomplish this right here. The article just discusses the access_db file, but the comment right below lists the networks that I blocked.

I'm well aware this solution will not work for everyone, but for my needs, it has been a godsend.

Re:How to block 90% of SPAM

[immortal]

Agreed. I did the same thing with sendmail. I went further and set my firewall to block any access to the the port for smtp from any asian country except Japan. I have a few people there I know. I wonder if there is any list of IP block that list by country. I would like to allow only mail from servers whos IP are in the US only. Then the rest of the world can go to hell.

Re:How to block 90% of SPAM

[TheFlu]

A start would be to take this list of IP address info (including country) and parse out just the IP's. I quickly scanned thru it and it looks like it only contains a handful of US entries, that you could easily remove.

I believe APNIC offers a similar list (I saw this last week, but forget the exact link) that you could scan thru as well.

Another option would be to grab the ARIN database of US entries (if it's even offered, and create a white list from that).

Spam USED to bother me

[kaoshin]

Until I required a password in the subject of mail for anyone not in my contact list. I haven't recieved a single spam mail in one year.

Re:Spam USED to bother me

[AndroidCat]

Spam used to bother me, but now all the email I get says "This is not SPAM". I mean, they wouldn't lie to me or anything would they?

Re:Urban Myth: banning CN spam hurts China disside

[silentbozo]

According to a usenet post from what seems to be the only China admin who has been taking the issue seriously, China Telecom is finally waking up to the fact that SPAM IS BAD. Evidently it took legal papers from overseas delivered to their headquarters before they decided to take a look at the problem. Whether this means that they'll do something about the spam is another issue...

best spam filter

[ElectricMayhem]

What is the best email filter that you guys have found? The one that I am under is SublimeMail. It works great! It's pretty new, but it has hit some pretty important milestones for messages caught. Any other good ones?

Asia's IP space

[The Turd Report]

Is listed here: http://ftp.apnic.net/stats/apnic/apnic-2002-07-01

Use encryption

[Hoi Polloi]

If you insist on using the terms "incest", "enlarge your penis", "make money fast", or "you requested to receive e-mail" in your personal correspondence then use encryption and sign your email so you don't get filtered out. If you are on a node that is blacklisted then either complain to your provider or move to a more responsible one.

Your own TMDA system

[dh003i]

Someone mentioned TMDA, which is basically similar to the system I use.

Here's my system.

1. Make a comprehensive address book, listing all known contacts and companies you want information from.

2. Set up a filter to let any e-mail through which is in your address book or allowed senders list, OR to allow any e-mail through which has your "ok password" on it (i.e., anything with "32dje573hkjd3k:" is let through), unless an exception is noted.

3. Set up a web page which displays your "ok password" as a GRAPHIC IMAGE, not a text image.

4. Set up a filter such that any e-mail not from a known contact or without your "ok password" on it is automatically deleted, and a message sent back to the originator, "Your e-mail has been automatically deleted from that person's account, as you are not a trusted source. If you want to sent that person a message, go to http://www.persons-webpage.com and find his 'ok password'. Put his 'ok password' on your message title followed by a colon and the rest of the title, then re-send the message. The person you are trying to e-mail will then receive your message and evaluate whether or not your are a trust-worthy source. If he decides you are a spammer, flamer, or anything else of the kind, he'll take further measures to avoid getting e-mail from you".

5. Anyone who's a legit e-mail sender will do this. Then you can get their messages and add their e-mails to either your address book or "accepted e-mails list". Some spammers may do it to, but these will be few and far between; and then you can filter them out specifically.

APPENDIX: A note on your "ok password". Your "ok password" should NOT be static. It should change daily; and there should be multiple "ok passwords" daily which will be randomly displayed to each different user who enters the site. Use a random password generator to generate different passwords at various intervals, convert the text to a jpg graphic, and post it on your web-page.

Re:Your own TMDA system

[dh003i]

An alternate solution is simply to set up a random response system such that each "non trusted source" is sent an e-mail with your "ok password on it" but the "ok passwords" are generated dynamically and randomly by a random password generator, and each "ok password" is linked to a specific e-mail address, and will only work if used in correlation with that e-mail address.

To accomodate for potential contacts who may change e-mails rapidly, you may want to create one master "ok password" and give it only to people who your really trust. This would be a convenience for them when switching e-mails; however, it is a potential security flaw.

Block lists as old as the internet???

[rick_campbell]

One claim made in the article seemed particularly erroneous to me: ``Blacklists are as old as the Internet.''

It wasn't until the late 80s, maybe even '90 or '91, that I got my first spam. I knew one person who was starting to get spammed somewhat regularly -- he ran a pretty large mailing list for a free software development project. Canter and Siegel -- the ``first spammers'' -- didn't start their Green Card Spam until 1994 -- not even 10 years ago!

MAPS RBL (started in 1997) is what I recall as being the first organized blacklist. Somewhere between my first spam and C&S I'd started my own personal list, as had lots of folks, but throughout the 80's I can't imagine that most internet users would have seen the point.

Windows users?

[Anonymous Coward]

What options do us Windows users (i.e. non-Unix zealots) have?

Re:Windows users?

[mother pussbucket]

Walt Mossberg reviewed a product this week in the WSJ called ChoiceMail from Digiportal.

From the article: "Here's how the program works. ChoiceMail examines every e-mail that comes in before it shows up in the inbox of your e-mail program. If the sender is on an approved list, easily created when you install the program, the e-mail immediately passes through. If the sender is on a rejected list, the e-mail is blocked and deleted.

If the sender is on neither list, ChoiceMail automatically sends an e-mail explaining that you are using a "permission-based" system. The e-mail asks the sender to go to a Web page and fill out a permission form. The request is then sent to you for approval. If you accept it, the e-mail is delivered to you. If not, the e-mail is killed."

The program can import your Eudora or OE address book and add the contents to the non-blocked list. Doesn't work with Mac or *nix, so I've no idea whether it's good or bad. The concept is interesting though...

Re:Windows users?

[Anonymous Coward]

Sadly, not much, unless perhaps you're actually running a Windows mailserver (I use Windows, am fairly clueless about linux, but cringe at the idea of windows servers...).

For the usual home user it comes down to:
- munging the email address and hope it works and hoping it doesn't tick off
those who expect just clicking reply to work.
- going with a spam-unfriendly ISP if at all possible. If you're lucky they filter incoming email. (Mine
CLAIMS to, but I still get tons of crap in big5 from ISPs with NO legitimacy at all - despite me
repeatedly forwarding the offending message, with headers, to the address they claim to use
for gathering info for their filters..*grr*)
- Using an email client that leaves the message on the server and just downlaods the headers,
and deleting the obvious crap before downloading.
- Using an email program with a good filtering setup so at least the crap goes right to the trash.
(Can be inspected, just in case, before deletion, but the inbox is mainly non-junk)

If I'm wrong about something, please tell me the right stuff. I'd LOVE to bounce the crud with a 550 message, but as far as I know a simple client won't work for that and I'd need a domain of my own. Failing that, I'd like to have a simple way to forward the crud to the right place. The reasons I stopped forwarding to my ISP's junk email address were that I was spending WAY too much time just finding the real offender (sender) and it didn't seem to be effective. I don't need to block all of China, for example, but damn I'd love to block parts of it!

The cost of faking email addresses

[Hoi Polloi]

Right now some poor guy named "HomerSimpson@aol.com" is getting pounded with spam.

Asia better get its ass in gear then

[The Turd Report]

Lots of people are blocking all of asia. Before I blocked them, I never saw a single legit packet come from Asia. All I saw from there was spam and scans. I used to send abuse reports to asain admins, but I would never get an answer (which is ok), but I would never see any results either. Just more spam and scans.

But you need spam!

[Hoi Polloi]

If you don't get spam how will you ever learn how to "MAKE MONEY FAST!" or how to "ENLARGE YOUR PENIS!"?

What's the big deal?

[mmuskratt]

I have a yahoo account for spam, a personal account for friends/family/important personal business, and a work email account.

I get maybe, MAYBE, one or two spams a day...mostly in the bulk mail of my yahoo account. I register online in a ton of places...and it just isn't an issue for me to once in a while get an unregistered unsolicited email or two. What's the big deal?

Re:What's the big deal?

[krinsh]

The BIG DEAL is those of us that receive on average 280 pieces of spam per day; often multiples of the same one. I used to use my hotmail account to subscribe to newsletters and trade publications as well as listserv digests; now I have to specifically find out which address each 'bot' is sending from so that I can make sure I get them. I've had to set each of my (now two; it used to be five but I closed them because I could never receive legitimate email they would lock up after the first 75 spams) accounts to accept only those addresses I manually enter in my address book in order to avoid huge amounts of time and energy wasted deleting the spam before I can get to the good stuff... and the collateral damage? New penpals have to make sure they share with me their address right away or the email is blocked; I have to email list admins to allow their stuff through - and I've already mentioned all the time I waste cleaning the stuff that manages to get through.

bogus address typos

[smartfart]

My personal email address is mccallclAThotmailDOTcom, and many of the spams I recieve are also addressed to mccallca, mccallcb, mccallcc and so on.

Yeah, I get stuff like that too, but I strongly suspect that it's smoke and mirrors, an attempt to make it look like it got sent to me by mistake --- in other words, they they supposedly typoed the "real" address (the database barfed, or the secretary hit paste and bobbled the address string) and "accidentally" ended up sending it to me in addition to the "real" recipient.

Sleazeballs.

How else can you boycott the ISP w/o collateral

[Skapare]

How else can you boycott the ISP w/o collateral damage? SPEWS does not list the ISP, and hence, no collateral damage, until the ISP has had plenty of time to cut off the spammer. In order to increase the level of pressure on the ISP, more of their address space has to be listed to "encourage" them to cut off the spammer. The usual first listing is the whole /24 the spammer is in (if they weren't doing it from the whole /24 in the first place). Maybe they will start listening once their own customers complain (and that's the proper place for the customers to complain to, their ISP). If they continue to ignore the problem, then eventually the whole ISP will be listed. If it's a multi-level ISP, their upstream starts to get listed, too.

The philosophy SPEWS appears to be using, and one I now agree with (previously I did not, but sometimes my opinions do change ... hey, I'm open minded), is that the spam problem will not go away by blocking only the spammers. ISPs have to play a part by not signing up known spammers, and cutting off spammers that got signed up because they were not known at first. Blocking spammers alone will be a never-ending battle because then there is no incentive for any ISP to turn them away and they just keep moving around to evade the blocking. To end spamming, the ISPs have to quit offering them services, or we have to quit accepting traffic from the set of ISPs that do harbor spammers.

It looks like collateral damage, but it's just another form of boycott. If I organize a boycott against my local newspaper, then the advertisers suffer because fewer people read their ads. And such boycotts are known to even extend to boycotting the advertisers if things get bad (and spam right has gotten very bad already). Is that fair to the advertisers? Of course not. But that's the nature of the activity; it is, among other things, trying to encourage the advertisers to cease advertising there. So in the same way, by boycotting a whole ISP address space, the idea is to encourage their customers to change to another ISP, until the ISP changes their ways.

It's not full proof

[Anonymous Coward]

Spammers could modify their spam software of choice to automate replying to TDMA messages...

Re:It's not full proof

[infiniti99]

And to do that they have to use a valid return address, thus ending their SPAM operation quickly (see other threads about this).

Re:I AM AFFECTED Re: "collateral damage"

[blinkylights]

These big companies are on those lists because they risk commerce by not reducing spam.

Dude, see my previous post. The problem isn't that you're being victimized by the blacklists, you're being victimized by the customers who get you put on those lists.

Make the lists work for you: put your own dynamic IP's on the lists so that spammers can't use your dial-up accounts as throw-aways, and when you assign static IP's to a customer, make sure those IP's resolve either to a domain of yours which you have voluntarily blacklisted, or to the customer's domain so that they can be listed without taking down your other customers.

If one of your customers has an open relay, and you get a warning from the blacklist maintainers, don't wait around and let them add you to their lists, send them your customers' IP block and let your customer fight to get off.

Another choice to help fight....

[Mhrmnhrm]

In the States, the federal trade commission has set up a special "spam-fighting" email address (uce@ftc.gov) to forward your spam to. Now it's not like I expect my single emails to really do much, so I take a different approach... You'll notice that almost all spam emails have a "click here to unsubscribe" link. Rather than click on that link directly, I copy it to the clipboard, and tweak it so that instead of linking *my* email address, it contains the FTC's address. So while the sites that honor their unsub requests have no trouble, the ones that use the request as a confirmation flag now pipe their spam directly into the FTC's anti-spam taskforce. For the same reason, any webform email request gets that same uce@ftc.gov address. I'll also track down the "I'd like to subscribe" forms for spammers (online casinos especially) that don't have an "opt-out" link. If my tax money is going to go towards fighting this stuff, I might as well give the good guys the cleanest data possible :)

Re: This is the big deal

[gorbachev]

http://www.clifto.com/8345.html

That's why spamming has to be destroyed NOW and not when it REALLY becomes a problem.

Proletariat of the world, unite to kill spammers!

MailWasher

[aongus]

Hey, at least MailWasher lets you check what's tagged, and does it before you download. Nobody else that I'm aware of does this.

I've been running MailWasher on my Windows box, and I've reduced my spam by about 75%, due to MailWasher's bounce feature. My name is getting deleted from the spam lists, by the spammers. This is the best solution yet.

Re:I AM AFFECTED Re: "collateral damage"

[Anonymous Coward]

First, actually read what I wrote.

Two, we don't do dial-up or DSL. We're a ds1+ circuit provider.

Three, I wrote that I understand why we ended up there in the first place. I came back to this company after having setup several years ago. I came back to an unmaintained abuse box. The problem is, as I fought to change the culture, I was earning more and more punitive damages against just more than one class c. I don't claim to be a victim, but I got very little understanding as I tried to communicate with the maintainers of the list and I felt the communication actually earned us MORE action.

Tough luck

[Anonymous Coward]

I don't take kindly to people communicating to me via messages in a beer bottle thrown onto my lawn.

I also don't take kindly to people who leave a polite note at the front door if they are riding in the same car as the people who threw the beer bottle.

End justifies the means?

[fractalus]

We all agree that spammers are scum and should be expunged from the net. No argument.

Let's say I'm trying to set up shop somewhere where I don't really have my choice of ISPs. If I want to connect to the net, I have one or two real options. And that option happens to be with an ISP that isn't tough enough on spam for the liking of some of the more aggressive (belligerent?) blacklisters, so they not only block the spammer they don't like, but the spammer's upstream provider... which happens to be my upstream provider, too. The blacklisters are basically saying it's OK for them to DoS ME because someone else on the network did something they don't like.

Now let's kick it up a notch, because you're probably thinking that if it's just me setting up through a small, remote ISP, it's not a big deal. Let's say I'm in a small city where I have my choice of ISPs, but there are only one or two regional providers who connect those small ISPs to the larger net. When one of those regional ISPs gets blacklisted, you effectively DoS a large, large area. Yes, you put pressure on the ISP to remove the spammer... but in the meantime, you've DoSed a lot more people than the spammer did.

So: at what point does the collateral damage become too expensive to put up with?

Do you punish the innocent to get at the guilty

[btempleton]

What amazes me about the spam fight is how much it has led people to promote the idea of punishing the innocent in order to get at the guilty.

People who would have fought with vigour against punishing the innocent in other fields seem willing to give it up, in of all places, the free speech question of who can email whom.

Yikes. We are willing to let murderers go to make sure we don't punish the innocent. Yet for some reason spam makes people think it's OK to trample on the free speech rights of the innocent to get not a murderer, but a spammer. I hate spammers as much as anybody -- I get 120 per day -- but let's keep them in perspective.

The most common justification is the canard that it's not about speech it's about property. Problem is all use of the internet involves using somebody else's property. On the internet there is no speech without the use of other people's property, and thus no unsolicited communication without the unsolicited use of somebody else's property. This makes it very tough to solve by thinking of it as a property issue.

There are other, better methods that don't generate false positives or generate extremely few. I've written extensively on them.

Re:Do you punish the innocent to get at the guilty

[Anonymous Coward]

Wow! Those are some amazing ideas! bt@templetons.com would be a good person to email about them!

Re:Do you punish the innocent to get at the guilty

[buss_error]

What amazes me about the spam fight is how much it has led people to promote the idea of punishing the innocent in order to get at the guilty.

My take on this is that it is the fault of the ISP that won't take action against spammers. If all it took to stop spam was to inform the ISP of the violation, then there wouldn't be a need for RBL's.

The most common justification is the canard that it's not about speech it's about property.

Then can I use your computing resources for things you don't want me to do? Can I dump the contents of the pig sty in your car because I don't want to pay someone to haul it away? You see, the issue is exactly property. If some one wants to sell herbal Viagra, fine. Don't use my computer to do it. Is that unreasonable? Does that mean I don't support free speach?

Yikes. We are willing to let murderers go to make sure we don't punish the innocent.

There isn't anything innocent about spamming. You are doing it to make a buck or are too lazy or ignorant to secure your server. Unlike murder, spam sources can be traced back to someone. Real life crimes can't, always. At least, not beyond a reasonable doubt. Notable exceptions aside.

On the internet there is no speech without the use of other people's property,

I never visit the www.bestbeast.com web page, and I don't care to. Ipso facto it doesn't use my property to engage in speech. On the other hand, splattering their spam all over my e-mail account (100 at last count) DOES use my property, and it pisses me off.

There are other, better methods that don't generate false positives or generate extremely few. I've written extensively on them.

So where are the links to this?

Re:Do you punish the innocent to get at the guilty

[ShaunC]

What amazes me about the spam fight is how much it has led people to promote the idea of punishing the innocent in order to get at the guilty.

That's the rub, though; some of us don't see the "innocents" as innocent at all. Non-spamming customers of a spam-friendly ISP are paying money to that spam-friendly ISP, and thus supporting the spam-friendly ISP. That's not really innocent in my book.

People who would have fought with vigour against punishing the innocent in other fields seem willing to give it up, in of all places, the free speech question of who can email whom.

It isn't a free speech question. The internet is not owned by the government, my mail server is not owned by the government, blocklists are not operated by the government (at least not any that I'm aware). Thus the "free speech" argument doesn't apply. These are private servers owned by private companies and individuals who are free to make their own rules. Having your host or IP range placed onto a blocklist doesn't magically prevent you from sending email; someone on the other end has to willingly implement that blocklist, the intended recipient has already made the choice that they don't want to hear from you. So long as it's not the government doing the implementing, free speech is a red herring.

Yikes. We are willing to let murderers go to make sure we don't punish the innocent. Yet for some reason spam makes people think it's OK to trample on the free speech rights of the innocent to get not a murderer, but a spammer.

Murder is a crime. Murderers are often punished by being thrown in jail for life, or even executed in some places. There's absolutely zero room for false positives or collateral damage when it comes to these punishments. I think a comparison between murder and spam is a bit severe, especially at a point where spamming itself (ignoring common side effects like potentially criminal abuse of open relays, etc) is not a crime in many places. And again, it's not a free speech issue.

Since you mentioned murder, I'll add my own parallel to offline crime. When a strip club is caught offering "escorts" (wink) to customers who request them, what happens? Around here, the entire strip club is shut down. Law-abiding customers get caught up as "collateral damage" since they can't visit that club anymore. They wind up having to find a new shake joint, one that isn't a party to prostitution. While this analogy, too, is a bit tangential to the spam problem, I think it's a bit more in line with what blocklists accomplish. If you're using an ISP who proudly pimps for spammers, don't be surprised if the place is shut down (either in a literal sense, or an "I can't email anyone anymore" sense) and you have to find a new one.

The most common justification is the canard that it's not about speech it's about property. Problem is all use of the internet involves using somebody else's property. On the internet there is no speech without the use of other people's property, and thus no unsolicited communication without the unsolicited use of somebody else's property. This makes it very tough to solve by thinking of it as a property issue.

I don't find it tough at all. My server, my rules, I'll accept mail from whomever I want and I'll refuse mail from whomever I want. I don't receive legitimate communications from China or Korea so I don't see a need to accept mail from those places. I do get legitimate email from AOL, so (perhaps begrudgingly) I have to accept their traffic. You're free to do the exact same thing, suited to your own requirements. Where's the problem?

Shaun

Re:Do you punish the innocent to get at the guilty

[btempleton]

So where did you stand when laws wanted to blame the ISP for porn, or copyright violations by their users? But the ISPs aren't the innocent I'm talking about? I'm talking about the users. If a murderer was hiding in a neighbourhood, would you kill one innocent neighbour per hour until the neighbours got together and rooted him out?

All internet traffic uses the property of others. We designed the internet on an "I pay for my end, you pay for your end and we don't sweath the packets" basis. Why not fight spam without tearing that down, without declaring that communication is property abuse. How can you have a free society if communication is property abuse?

Re:Do you punish the innocent to get at the guilty

[Skapare]

If you don't boycott the bad ISPs ... the ones that keep signing up spammers who leave their previous ISP so they can have new address space not yet listed ... then spammers will constantly be showing up at new addresses, and listing them does little good. You have to boycott bad ISPs (the ones who harbor spammers) to make them either turn good, or move the good customers off to a better ISP. Of course there will be "collateral damage" ... but not to the ISPs that respond appropriately and cut off spammers. The non-spamming customers can complain to the ISP (this is part of the motive) or just move to another ISP.

Being listed in a blacklist is not the same as being indicted for a crime. It's a boycott. Different rules. Different standards. If you think that SPEWS, for example, has more collateral damage than you want your mail server to participate in, then don't use it.

Free speech is not about making sure everyone gets to say whatever they want to whoever they want however they want. It's about making sure government doesn't step in and limit it. Free speech cannot be used to justify stealing my printing press. Indeed, such a theft would deprive me of my right to free speech in such a case. Likewise, you have no right to steal my network server time for your own speech. I own it for mine (or that of my customers who pay me for its use). This is why it's a property issue. It's no tougher for me to deal with theft of my server time than dealing with theft of my printing press.

If you are communicating with me about matters we have a relationship based common interest in, then that is expected and fine. For example if you were to e-mail your reply to this post, that is reasonable to expect because by posting this (even if it wasn't in response to yours), there is an implied expectation of a response. Trying to sell me penis enlargers, golf balls, ink cartridges, and mortgages is not applicable communication, unless I asked (in some form) where I could find those things to buy.

If you really have written about better methods that don't generate false positives, then please show me, and please point out specific ways these methods work to drive incentives to ISPs to disconnect spammers and to not sign up at all known spammers. Spamming will not decline if ISPs have no counter incentive (to the revenues) to choose to not allow spammers in their network.

Re:Do you punish the innocent to get at the guilty

[btempleton]

Free speech is about free speech. The first amendment is about limiting the government's ability to infringe on free speech.

Do you really believe that only the government has a moral duty to consider how their actions affect free speech? Yes, the government is the one with the <b>legal</b> duty to not infringe on free speech, but free speech is more than just the law, it's a good idea!

Yes, we <i>can</i> boycott who we chose, including the innocent. But should we? Is it a desireable state? We're replacing the old means of speech with a new one, one that relies entirely on private property. How should we design it? Does designing it to run entirely on private property mean that we want private property rights to trump the old rights the founders of the USA felt fit to write into the constitution?

These are hard questions, not necessarily rhetorical, since clearly some writers here do think that now that we've escaped the bounds of government we should ignore the principles it was designed with in free states.

There are other ways to punish bad ISPs without blocking the mail of innocent users. In particular, the obvious one rarely implemented is not to block mail from sites but to throttle its volume down, so that individual mails go through and bulk mails are blocked. A coordinated effort to do this, as I have written about on my web site, would cause vastly less collateral damage.

Do we have a duty to not cause collateral damage? I think so.

Re:Do you punish the innocent to get at the guilty

[Halo1]

But the ISP's only exist by the grace of the users. The users pay the ISP's, without them there wouldn't be an ISP. And you analogy is completely bogus: people aren't being killed (ie. their IP-addresses aren't being "destroyed" forever). A better analogy, which is often used, is that the spam-supporting (or-ignorant) ISP is similar to bad neighbourhood with lots of gangs and junks etc, and that the recipient of the mails refuses to do business with anyone from there based on that fact.

The only thing necessary to rectify this situation, is that the neighbourhood must be cleaned up. And contrary to "cleaning up a neighbourhood" in real life, cleaning up an ISP by kicking all the spammers is doable in a fairly short period with not that much effort (unless the spammers sue the ISP, although in the end they've always lost until now).

The Internet was indeed designed with the philosophy you mention. And unfortunately, due the spammers, it's become impossible to keep working that way. Just read this article: AT&T's spamfilter fails during a spam avalanche -> their mail servers get overloaded, spam costs the total economy worldwide about $8.6 billion a year, ... Isn't that property abuse? Note that no-one is saying that communication an sich is property abuse, but using other people's equipment (without their conscent) to distribute your commercial messages is. It's as if telemarketeers would call you and you had to pay for that. Would you accept that also in the name of freedom of communication?

It's the same with mail servers: originally, they were setup so that anyone could send mail through any mailservers. But then the spammers started using those servers so that a) they can send one copy of the message and 1000 BCC-recipients to it putting most of the distribution burden on that server and b) they are slightly harder to trace, so now all servers should be configured so that they only relay for the intended domains. It's really sad that it has come this far, but I think you cannot blame blacklists for that; after all, they were simply a reaction to the increasing abuse.

On the topic of blacklists: they are all lists of IP-addresses published by individuals or groups of individuals. These people say: we do not accept mail sent from these IP-addresses because (they are open mail relays|they belong to spam-supporting/ignorant ISP's|...). You can also use this list to block mail if you want. No-one's stepping on anyones free speech rights here (the blacklist maintainers simply voice an opinion, they personally don't block mail sent to anyone but themselves). The only problem that can occur here, is that when an ISP uses such a list without clearly informing their customers. But that's a problem with the ISP, not with the list.

After all, even if the list didn't exist, the ISP could still filter mail using its own filters or blacklists. And as long they clearly inform their customers about this, there is no problem: it's their property and their bandwidth that is being used to annoy the hell out of their customers. Some of those customers may prefer to have no filters (since I'm quite sure it's impossible to design a filter without any false positives) and more spam. Then they should not take an account at that ISP (as I've said before, this filtering should be indicated clearly), or maybe the ISP could offer a (more expensive?) unfiltered account to people that want it.

If you don't have that choice for one reason of another, then I still think the only ones to blame for your problem are the spammers: if they didn't spam, there would be no need for blacklists or filtering and everybody would be happy. The rest are just symptoms of the root cause. And while blacklists mainly combat the symptoms (spam instead of the spammers), it's unfortunate that there are simply no better ways (that I know of) in most cases (only if you live in certain states of the US and have lots of time on your hands and manage to track down the spammer, then you can sue him).


Jonas

Re:Do you punish the innocent to get at the guilty

[btempleton]

This is not about whether you can publish or use a blacklist. I think you can (at least until it becomes monopolistic, then other legal questions appear.)

THe issue at hand is the morality of blacklists and other tools which use punishment of the innocent as their means to get at the guilty. We don't tolerate that pratice in the other ways we try to regulate our lives, and it's curious that we tolerate it here.

As noted in the story, blacklisters are blocking off real innocent people. And people who don't know about it and don't ask for it are getting mail blocked that they wanted to receive.

John Gilmore, going to extremes to make a point about his own freedoms, got kicked off the internet not because his system was being used for spamming (he had his own techniques for blocking relay abuse) but because he and the blacklisters disagreed about how he should stop spam on his mailserver.

Doesn't the idea of "Run things our way or you don't get to communicate with others on the internet" bother you at all?

Shouldn't we try other methods, that don't punish the innocent, or which punish them as little as possible, if these methods are available to us?

Like I said, protection of free speech isn't just a law, it's a good idea.

Remember, with this technique it's not collateral damage. Collateral damage is what happens when you are trying to bomb a military target, and civilians are killed by shrapnel.

Blacklisting ISPs is like saying "bomb the civilians until they rise up and destroy the military target in their neighbourhood."

Effective perhaps, but moral? (And not always effective. It's our technique on Iraq right now, starve the civilians until they punt the bad guy.)

Re:Do you punish the innocent to get at the guilty

[Erik Fish]

The internet does not have a police force and it does not have a military to ensure that abuse does not occur. Instead the internet is self-regulating in a very frontier justice fashion: Everyone has a claim staked and if you trespass on someone else's claim and violate netiquette anything might happen -- from "nothing" to "orbital anvil to the skull".

Ever heard of MAPS? They worked very hard to educate spammers and ISPs before blocking the un-educable ones. Why are tougher blocklists that do not provide a strong educational component now employed instead of MAPS? Because the spammers and rogue ISPs abused MAPS by playing dumb and getting extension after extension to clean things up while crying crocodile tears and chuckling up their sleeves.

Your whining about "innocent" people being blocked does not impress me and nor should it impress anyone. These "innocents" are monetarily supporting spam-friendly ISPs and as such should be afforded no more respect than said ISP's themselves. Ignorance is no excuse: They chose to move into a bad neighborhood and now it's time for them to either move out or clean it up because if they don't nobody else is going to clean it up for them.

In case you haven't noticed, the face of the internet has changed a lot since it was first invented. At one time all it would take to stop spam from issuing forth from a host was a harsh word or two. These days complaints are useful only as proof that an ISP ignored them. Furthermore, local filtering/flagging of individual "potential spam" is also useless as it is clearly a temporary fix. How long before spammers and spamware vendors learn how to skirt SpamAssassin's filters? Such filters are inherently flawed as they rely on content while the spam issue is not about content -- it's about consent.

The current blacklists are entirely moral because e-mail is not sacrosanct. Nobody has a right -- morally or legally -- to deliver e-mail to anyone. Morally this is a perfectly reasonable stance as e-mail is not the sole means of communication. If what you have to say is so important that it can't risk getting blocked then you need to put a stamp on an envelope or dial a phone number.

Put shortly: The internet is based on trust and that trust has been abused far too often.

So far I've seen nothing from you but bitching, with no real solutions offered. You don't like blacklists but you can't seem to come up with anything as effective that doesn't offend your delicate morality. Sounds like you've got a personal problem.

Re:Do you punish the innocent to get at the guilty

[btempleton]

I have offered a wide variety of solutions.

however, this is a day old Slashdot thread, and nobody reads them after a day, so I'm out of here.

The solutions are on my web site.

Re:Do you punish the innocent to get at the guilty

[buss_error]

So where did you stand when laws wanted to blame the ISP for porn, or copyright violations by their users?
Firmly against it. As I said, I do support free speech, but I shouldn't have to be forced to contribute to speech I don't agree with.

But the ISPs aren't the innocent I'm talking about?
Yes and no. For instance, the ISP for bestbeast continues to allow the site to host on it's networks. That's fine, as long as BestBeast doesn't spam. When they do spam (and they don't do anything about it), then the ISP is tacsitly approving the use of force to promote speech to people that find that speech offensive. It's one thing to blast out mail to people that are into sex with anaminals, it's another to repeatedly do it to people that find that disgusting, don't want to see it, listen to it, and in fact never indicated they were interested in it. After all, and at least for now, I can hit mute or change channels on ads I don't want to see. BestBeast's ISP failure to take action against the site for spamming is the same as media companies taking over a televison to prevent mute or channel changing during an ad.

Question for you: How would you feel if BestBeast keep e-mailing your kids, even after an opt-out? Why should your kids see this if they never opted in?

If a murderer was hiding in a neighbourhood, would you kill one innocent neighbour per hour until the neighbours got together and rooted him out?
I see your point, and I can to some degree concede it. However, the cases are not exactly parallel. A better analogy would be a case where the LANDLORD was preventing the police from investing, and the police rousted out the neighbors to ask questions. This is what collateral damage to the ISP customers forces. The customers don't want to pay the "rent", 'cause the cops are been a bloody nuisance due to the landlords inaction or action.

All internet traffic uses the property of others. We designed the internet on an "I pay for my end, you pay for your end and we don't sweath the packets" basis.
Granted, and thank goodness too.

Why not fight spam without tearing that down, without declaring that communication is property abuse.
I'd be delighted to do that, and that would be the most rational way to go about it, if we didn't have a few bad apples spoiling the bunch.

How can you have a free society if communication is property abuse?
It isn't, as long as I agree to your communication. If I agree to hear you, no problem.

A good example is the communication I received from a brick-and-morter retail electronics store. (I can't get more specific than that.)

For three months, every week, I got an e-mail from this store listing the specials there. I never asked for these e-mails, they used my e-mail address I gave because the salesman said it would be used only for safty bullitens and recall notices.
Each time for a month, I clicked the "unsubscribe" button. I kept getting it. On the 5th e-mail, I e-mailed them to the postmaster account, with the unsubscribe notices. Two weeks, two more e-mail specials. I sent a registered letter. More time passes, more e-mails. I called, sent faxes, more e-mail, nothing. Only when I got the home phone number for the president of the company and told him I would call him each time I got another e-mail did it stop. (I also sent e-mail to every person's account I could find.) I called, e-mailed, faxed, and sent registered letters to their ISP too. They never responded at all, aside from automated responses.

I shouldn't have to do that, should I?

It's not spam if:

I agree to accept the e-mail contact, and they disclose exactly what e-mail I can expect.

My address isn't traded to onthers to send me things unrelated to what I agree to accept.

They stop the first time I ask. Don't start unless I ask.

They don't contact me about pottery when I signed up for model railroads.

I don't that the above is unreasonable. A web page about pottery doesn't bother me, but an e-mail about it would, when I didn't ask for it. And it would surely result in wrath if it kept being shoved at me when I ask it to stop.

I've viewed your pages, and I respect the contributions you have made. I even respect the views you express here, though I don't agree with them in all points. I think that e-mail is wonderful, and I think that in a world of people willing to live and let live, your point would be the best course. However, we live in a world distored by greed and selfish motives, and in that world, spam is a problem. It steals time, effort, resources, and the ability to communicate with others by increasing the signal to noise ratio. Sure, it's easy to hit delete on one message, but what about 1,400 a day? That's the figure I've seen if every business in the US sent just one e-mail a year to each person. And that isn't something most of use could deal with.

Re:Do you punish the innocent to get at the guilty

[Skapare]

Free speech is about free speech. The <b>first amendment</b> is about limiting the government's ability to infringe on free speech.

Do you really believe that only the government has a moral duty to consider how their actions affect free speech? Yes, the government is the one with the <b>legal</b> duty to not infringe on free speech, but free speech is more than just the law, it's a good idea!

So far I agree with you.

Yes, we <i>can</i> boycott who we chose, including the innocent. But should we? Is it a desireable state? We're replacing the old means of speech with a new one, one that relies entirely on private property. How should we design it? Does designing it to run entirely on private property mean that we want private property rights to trump the old rights the founders of the USA felt fit to write into the constitution?

I don't see private property being the issue. Speech has always been either based on private property (buy a printing press and start publishing) or public property (stand in the town square and start your speech and see if anyone has any interest). We're not designing anything to be private property; it's either private or it's public.

These are hard questions, not necessarily rhetorical, since clearly some writers here do think that now that we've escaped the bounds of government we should ignore the principles it was designed with in free states.

My right to free speech and my right to ignore anyone are equal rights to me. The only reason free speech is such an issue is because governments (and even corporations) so often try to suppress that right. That's been so extreme even hundreds of years ago that some people setting up a new government in the late 1700's decided to specifically address the issue that was a major problem. The right to ignore hasn't been a problem, but that doesn't make it any less of a right.

There are other ways to punish bad ISPs without blocking the mail of innocent users. In particular, the obvious one rarely implemented is not to block mail from sites but to throttle its volume down, so that individual mails go through and bulk mails are blocked. A coordinated effort to do this, as I have written about on my web site, would cause vastly less collateral damage.

While the spammer at an ISP is spewing out millions, I get one or a few. Throttling them has no effect. I still get hit by hundreds of different IP addresses. If the realm of throttling is just one IP at a time, it won't work. If it covers all the IPs as a group, it has adverse affect on everyone.

And worse, this idea removes the incentive, because then the ISP won't be losing customers. There has to be "collateral damage" to make the boycott have an impact on an ISP. Maybe this is surprising to you, but lots of ISPs make the decisions about how they do things based on what will yield them the greatest revenues and profits. If they don't feel that their customers will leave because of some action, then they will have no reason not to do so if they feel it will bring in some revenue. And that action might be to accept a known spammer as a customer.

Do we have a duty to not cause collateral damage? I think so.

What other mechanism of causing customers to leave an ISP is there besides "collateral damage"? Spammers have a duty to stop spamming. Let me know when they stop so I can resume listening to free speech.

Re:Do you punish the innocent to get at the guilty

[Halo1]

As I said in my previous post, blacklists are *not blocking anyone*. People who use the blacklists are blocking other people. If they decide that the advantage of reduced spam outweighs the disadvantage of bouncing some legitimate mails, then this is their and only their choice.


Jonas

Re:Do you punish the innocent to get at the guilty

[btempleton]

So we can't be critical of their choice, and debate the consequences for the future of E-mail as a medium?

Re:Do you punish the innocent to get at the guilty

[Halo1]

In this case, it indeed doesn't matter what you think about these people's choices, just like it doesn't matter what you think about people switching tv-channels when there are commercials playing (causing them to potentially miss the start of a very useful program), throwing away all dead-tree ads they get in the mail (and maybe occasionally a real letter that slipped in between?), ... You're of course free to say what you think about it, but it's not the real issue imho.

As I've said before, these blacklists and filtering are consequences of the spam problem. For several people, spam already makes email unusable as a communication medium if they don't filter it out. And if you don't filter, it's quite possible that you accidentally delete legitimate mails while wading through your spam (it has already happened to me). The only difference with automatic filtering is that you don't have to spend time doing it manually, which is a big plus.


Jonas

Spam Arrest

[Anonymous Coward]

I use "Spam Arrest"; it's pretty cool.

There's no filtering or anything, they require senders to verify themselves, then the mail gets forwarded to you (you use them as your pop server).

Seems to work pretty well, at least it stops anyone using a fake from address or any automated systems.

I did have to go in there and add things like orders@amazon.com, and a couple others, and all my friends.

they have a free trial right now, so it might be worth a shot.

Whitelisting in general

[NFW]

I'm converted to a whitelist solution as well, and there's no way I'm going back. I wrote a procmail-based whitelist but if I was to do it again I'd probably use TMDA or ASK.

It's nice to not have to filter out spam manually anymore. It's so nice I don't even care about the few people who can't figure out how to get through the whitelist confirmation.

all my spam

[AA0]

comes from one source, and I tracked it down over months. Its ICQ.
You enter you mail address there, and I was getting 5-6 a day from them, I removed it, and I'm down to 1 every other day, but I know they are still from ICQ lists, as its the same types of emails.

You can trust most companies and websites, you can't publize the address on a message board, website, or any place that can be automatically stolen by some program.

On my personal email, I get no spam at all, and my web email, I just get the odd one now, it isn't hard, just don't give your address away. I am sure some of it is due to my ISPs filtering techniques, as I can not receive a legit email from someone in russia.

THe BEST defense against spam...

[Anonymous Coward]

is to start charging per e-mail from the sender. Once this occurs, then watch spam die out.

Collateral damage is necessary....

[Anonymous Coward]

....Until either or both of two things happens: One, spam stops; or Two, filters become foolproof. Neither is likely to happen in the forseeable future. Speaking from the standpoint of someone on the very front line of the spam wars, I can tell you that things would be a HELL of a lot worse if it weren't for blacklists. The only language a spam-friendly provider speaks is money-- he isn't interested in your frea speach rights, or even the spammer's-- he's only interested in collecting the checks every month. The usual method of fighting spam is to complain to the rogue ISP, but when that doesn't work (and I could list a number of 'mainstream' providers and backbones where it doesn't) then you have to escalate things. Anti-spammers and the blacklists they maintain are the internet's immune system. They are a natural consequence of how yours and my email boxes have become nearly unuseable because of bulk mail. The only way to bring rogue ISPs into line is by economic pressure, applied by lists such as spews.org and a vanishing subscriber base.

Re:Pass-phrase "authentication"

[Zaiff Urgulbunger]

The problem with requiring a pass phrase is that people need to then remember it. And they won't. Second, if I want email from certain companies (and I do) then they won't remember it. So... I'd get email from no one! (re-thinks.... oh yeah, it DOES work! :P)

Iterative Process of spam removal

[aaron_pet]

We should have a block list.. (in existance)
then an allow list to cover errors to the block list, then another block list, then another allow list... and on and on..

The idea is that everyone will appeal the denial list, but then the people who do spam will be put back on it really quickly.

Sources, please

[alizard]

About one in 100 (somewhere between 1 in 50 and one in 200) people in the general population is a psychopath. This is a (set of?) brain disfunction(s) that amounts to "no conscience". (Think "colorblind" but with respect to harm-to-others. But it's not known yet whether it's genetic, foetal insult, or what.) Additionally there are "sociopaths" - similar symptoms but as a result of training and social factors rather than an organic problem.

I don't necessarily disagree, I just want to know where I can find the numbers, I might want to cite them some time.

Short of genocide against psychopaths we will continue to have a plague of spammers for at least

Why not limit the genocide to repeat spammers?Or simply remove all the civil rights of repeat spammers and let Darwin deal with them.

Postfix uses +

[danny]

Actually, postfix uses + for mail extensions, not -, though that is configurable.

Danny.

Hmmmm

[Convergence]

What do you know, I use TMDA too... Now, will our TMDA's get into an infinite loop asking each other for acknowledgements? If not, then I forge spam to look like a TMDA acknowledgement. And, tough luck.

Another thing about this that bugs me is that it doesn't save any time or solve any problems, it just pushes the problem onto someone else. That is not a solution.

I refuse to respond to any TMDA or other robot autoreply. You use it, and you're immediately added onto my blacklist and bitbucketed.. A blacklist of people who value other people so little that they should be ignored.. A blacklist that is public.

Re:Hmmmm

[Anonymous Coward]

I have no idea if this is really how it works, but here's an obvious way to solve this "problem": TMDA reply requests could be recognized as "control messages" which another TMDA would never show to its user. Instead it autoreplies and thus pushes the original message through. Recipients of your messages are also automatically added to the whitelist, so reply requests will not trigger a reply request loop even if the TMDAs don't recognize eachother.

Re:Hmmmm

[infiniti99]

I refuse to respond to any TMDA or other robot autoreply. You use it, and you're immediately added onto my blacklist and bitbucketed.. A blacklist of people who value other people so little that they should be ignored.. A blacklist that is public.

I think you're taking this a bit too seriously. Consider the Jabber IM protocol, which already has a presence authorization system (ie, whitelist), and a server-to-server "dialback" protocol for preventing server spoofs. No one would ever complain about those features.

So then, why complain about TMDA (or others like it)? IMO, there is nothing wrong with what TMDA does, it is just providing a service that Email really should have had built-in.

Sort by you rISP header duh!

[linuxislandsucks]

People learn the way of the wise spam killelr..

The spammers wil try to fake your ISP header, the one where they list version of mail package and etc..

Waht I do is compare that to the real header that my isp produces..

It eliminates 90% of spam

How? Is real person who actually needs to get a hold of you going to go to all that trouble of faking your isp mail header? NO!

Another tactic that wokrs sometimes..is if the actual person doing the spamming is reachable.. send them a polite note that you charge for UCe messages and that you are posting theri email with full headers for full viewership on the web..:)

collateral damage is necessary

[Anonymous Coward]

Unless there is collateral damage,
there is no pressure on ISPs that host
spammers.

If we could block spam from sprintlink 100%
accuracy without blocking sprint as a whole, then
that frees sprint to sell to more spammers while
we take on the cost. (Or uunet, etc....)

It's only when sprint loses customers because they
lose connectivity that it will take action.

you can use the same address

[acecccp]

as the one you registered with your domain, just set up your filters to deny any direct mailings with "if To doesn't contain @yourdomain.com, deliver to junk"

Re:Urban Myth: banning CN spam hurts China disside

[1u3hr]

It's a myth that banning .cn spam is hurting dissidents. They can still surf the web and use 3rd-party web- based email. I ban all email from all Chinese, Hong Kong, Japan, and South Korean IP address blocks. I still get email from Chinese asking for technical help (Solaris on Intel and what not), which I answer. So I thought people ignored my mail because they were assholes (I live in Hong Kong, therefore I must use a HK ISP). Instead, it's worse, they're blocking mail from 6 million people because some American MLM turd routes spam through some naive ISP here.

Which side am I on?

[ShannaraFan]

I've been experimenting with a few different filtering techniques at work, trying to slow down an increasing flow of spam coming in to some of our users. I thought I had finally hit upon the perfect combination, using ORBS, Dorkslayer, and other RBL's, combined with some Exim filters I cobbled together. All was well, no spam at all, until I began getting complaints about customer emails getting bounced. We're a software company who sells personalization software, and (imagine this), more than one of our customers or potential customers are blacklisted spammers. Our sales folks were none too happy with my explanation that "targeted mailings" or "personalized marketing" are marketing-speak for spam, soooo.... I added logic to my filters to allow everything to pass through for all the sales staff addresses. Kinda hard to fight spam when your employer is trying to make spam "better".

Network (non-)Solutions

[Snover]

The only people I got spam from was from the e-mail address I used to register domain names with through netsol.

Now there's MyPrivacy which is an email forwarding service that automatically sends back a verify message to any address sending email to it. Spammers don't get through. They also have set-up a whitelist for registrars so that you don't lose important information from them. (Just hope Register.com doesn't try to fool you into switching registrars through it.)

Moderators on crack.

[jotaeleemeese]

Do you know what an ironic sentence is?

Re:Moderators on crack.

[Rupert]

Slashdot moderation is like Brownian motion. You can't see the little buggers that are doing it, and you can't know in advance which direction they're going to push you.

And since they're mostly American, I wouldn't expect many of them to understand irony.

Re:Pass-phrase "authentication"

[__aakpxi9117]

people need to then remember it

You shouldn't have just 'skimed' through the article. I did adress this. The passphrase is NOT like a password. They do not need to remember it on the fly, and they don't need to use it often. They only need it when initally sending an e-mail. Any replies will still have the passphrase in the subject line.

I suggested keeping the passphrase in one of the fields in their address book.

if I want email from certain companies then they won't remember it

I also suggested automatically passing e-mail from e-mail addresses when necessecary. It's not a good idea to do so for individual's e-mail addresses, but you are not likely to be getting spam or viruses from companies. Just make sure you minimize the number of addresses passed through unchecked. Otherwise, spammers and e-mail viri may just spoof a source address (like support@microsoft.com) that many people allow through.

SPEWS from a hosting company's point of view..

[dev0n]

"The SPEWS system is unapologetic about false positives and even regards them as a plus. They've taken the 'ends justify the means' argument way farther than I've seen anyone else take it," Donea said.

Absolutely. I work as the Technical Support Manager at a web hosting company, and handling abuse complaints falls into my realm of responsibility. I have a team of employees who handle the complaints themselves, and I work closely with them and our Network Operations staff to make sure we keep our network as spam-free as possible. I am known to be very militant about getting rid of spam and spammers from our network, as is our Network Operations Manager. We shut down as much as possible, and respond as quickly as possible to complaints.

But that didn't stop us from getting placed on the SPEWS blacklist for several days recently. The reason? Because we "ignored" complaint emails about a spammer. The fact that we had already acted upon the complaint emails was irrelevant to the SPEWS people, apparently.

Thousands of our customers were affected by this blacklisting, as SPEWS decided to block our entire IP range.

And when we politely asked to be removed (and provided legitimate justification for our removal) it was suggested by someone on the newsgroup that we should remain on the blacklist for at least a month as punishment. Thankfully, someone at SPEWS disagreed, and removed us.

We would have had no recourse if they'd chosen to punish us in the manner suggested.

I would love nothing more than to remove spam completely from the Internet. I would love nothing more than to see the people who spam get punished. But how is it fair that an anonymous group of people can completely shut down a portion of our business without reason? And how is it fair that if they do blacklist us, the only way we can get in the clear again is to beg on a newsgroup and pray that the anonymous people on the other end are in a good mood? At least with SpamCop and the like, hosting companies have the opportunity to respond to complaints.

Lots of people have commented that hosting companies and ISPs have a responsibility to keep their network free of open relays and evil spammers, and I agree. But I also believe that we should have the right to explain our actions, instead of being deemed guilty - and punished accordingly - until proven innocent.

Non-response from a hosting company and/or ISP when it comes to a spam complaint is unacceptable. But I believe that blocking a hosting company and/or ISP without consulting with them first is just as bad. We talk of spam being the equivalent of a DOS attack and about how terrible it is, and then fight back with pretty much the same tactics? It just makes no sense.

If only the SPEWS people agreed..