Collateral Damage in the Spam War

MarkedMan writes "The link points to a well researched article on Spam lists and those innocently appended to them. I have seen this myself with MailWasher. A posting will come through as potential spam, with the the bounce already red-flagged, but it is actually from a legitimate source. Only happens once or twice a month but still cause for worry. " I've found that Spam Assassin has made life easier, but I still have to ban domains like yahoo.com, hotmail.com, mail.com - and *.ru and *.cn. I sort through the spam periodically, but the collateral damage is still there.

Comments

Network Solutions, One domain per user?

[dada21]

The only people I got spam from was from the e-mail address I used to register domain names with through netsol.

I dumped that address (100 spams a day).

What I've done is registered a domain name (say fatgeeks.com) and when I have to use my e-mail address at a website, I'll append the website to the user name, such as:

dada_slashdot@fatgeeks.com

or

dada_msn@fatgeeks.com

When spam appears, I kill off that user name (very easy to do in any POP3 e-mail program) and then go to the website that sold my address and yell.

This helps track websites that "lie" about reselling your e-mail address.

No spam. No collateral damage.

Re:Network Solutions, One domain per user?

[Mr_Silver]

This helps track websites that "lie" about reselling your e-mail address.

Is there a page out there that details which websites sell your email addresses? It would be rather useful.

Personally I nominate hotmail.com - unless you're telling me that ibtagmrq@hotmail.com is a popular name.

Re:Network Solutions, One domain per user?

[Computer!]

Randomly? Yes, that's wrong. However, you can cut that 3X10^12 down to aroung 3X10^6 merely by running a dictionary file filled with common last names and append one or two letters after. How do I know this? My personal email address is mccallclAThotmailDOTcom, and many of the spams I recieve are also addressed to mccallca, mccallcb, mccallcc and so on.

Re:Network Solutions, One domain per user?

[jarrell]

Check out spamgourmet.com. It institutionalizes that idea. Once you're registered you can create self-destructing email accounts, that accept N number of messages. The slick thing is that it creates them on the fly, the first time you send email to it, so after having visited them, you never have to go there again to actually create these accounts.

Re:Network Solutions, One domain per user?

[mjh]

Depending on which MTA you're using, you can do this with address extensions too. Sendmail uses + as it's address extension, and postfix/qmail use - for address extensions. So for my email, for example, mark-foobar@hornclan.com will get delivered to the same mailbox as mark@hornclan.com. The MTA simply ingores everything after and including the extension delimiter.

TMDA takes advantage of this sort of thing. So it does what you're talking about, but it also adds a cryptographic hash onto the extension to verify that you infact were the person who generated the extension. So my equivalant of what you're doing would be:

mark-keyword-slashdot.abc123@hornclan.com
mark-keyword-msn.a1b2c3@hornclan.com

The generation of the hash depends on a secret 140bit key that only I know. Thus I can create these things whenever I want and use them without modification to my mailsetup and be confident that no one else can generate these things that will get into my mailbox.

Other types of addresses that tmda generates:

• Dated addresses - addresses that will work for a certain amount of time, and then expire. Great to use when posting to USENET, and as the default for all outgoing email.
• Sender addresses - addresses that will work if used by a particular sender. Great for subscribing to mailing lists with.

Anyway, I'm pretty pleased with TMDA, although, as I say in another post, it can impact one's ego.

Re:Network Solutions, One domain per user?

[macdaddy]

Whoops. You showed the wrong syntax. Did you mean dada+slashdot@fatgeeks.com instead of dada_slashdot@fatgeeks.com? The underscore is a valid character in a user name. The plus sign however is called plus notation. I use it myself. Say I sign up for a demo of ProductX, I'll use the email address of userid+productx@domain.tld. MTAs are supposed to ignore everything between the "+" and the "@". Plus notation. It works pretty slick too. I use it for magazine subscriptions and what not too.

Something I've started using more is simple mail aliases. Since I run many MTAs, I've taken one of my own domains and create an alias for a mail recipient for when I need to sign up for something. Let's say I order some X10 stuff. I'll create a quick mail alias called "x10" and point it at my usual mail account. I'll add a comment with a date, maybe a URL, etc.. to it and rebuild my aliases.db. There are 2 upsides to this. 1 is that I can easily make that a real account someday and spamtrap all that junk if needed. It's also garunteed to be accepted on every web form I come across. Occasionally I'll come across a web form that only accept alphanumeric characters (and the @) in the email address. Some webmaster thought he was being security-wise and didn't follow the RFCs. Whoops. No biggie. This method gets you around that little problem. The only real downside is that it takes a couple extra seconds to create that alias and add some comments about it. Oh wait, there's another plus. Some mass mailers strip out the plus notation from email addresses. Giving your address to, say, Citibank or CapitolOne as joeblow+citibank@domain.tld might confuse the person or raise suspicion if you're entering your address in a spamtrap. With the email alias, you can use an acronym, gibberish, or whatever you want for your particular situation.

Re:Network Solutions, One domain per user?

[Mike Schiraldi]

This helps track websites that "lie" about reselling your e-mail address.

Even honest companies are a problem -- i do the same trick you do, and about a year ago, i started getting porn spam to the address i used only at 1800flowers.com. They swore they didn't give it to anyone, and i believe them.

What i'm sure happened is this: Some DBA, or some temp, or whatever, did a one-line SQL query to pull out every email address in their database, and then sold that list.

So even if you trust the company to not sell your address, it just takes one bad employee to screw you over.

Of course, their database also has my credit card, so the same DBA could have run off with that. So far, i haven't had any fraudulent charges. But that's what you gotta read over every single charge on your credit card bill, every single money.

Re:Network Solutions, One domain per user?

[Mike Schiraldi]

s/money/month

Re:Network Solutions, One domain per user?

[invenustus]

you are pretty narrow minded to think the crawlers haven't learned to look for *AT*DOT*

That brings up one of the questions I've been pondering lately in regard to spam.

Spammers always seem to be coming up with newer and better ways to thwart our attempts to avoid them. But do the people who go to such lengths to avoid spam EVER buy anything from spammers? EVER?

I always hear "Spam works because people like your grandmother buy stuff from them, and if they get one sale, that makes it worthwhile." To which I respond, "My grandmother's alive?!" But crawling for *AT*DOT* isn't going to catch such un-tech-savvy people. Those people are going to leave their addresses unencrypted.

So let me pose this question: has spam become less a means of advertising than an all-out war, with nothing at stake other than showing that you can beat the other side?

Re:Network Solutions, One domain per user?

[Asprin]

Is there a page out there that details which websites sell your email addresses? It would be rather useful.

Personally I nominate hotmail.com - unless you're telling me that ibtagmrq@hotmail.com is a popular name.


For the life of me, I can't understand how anyone can even *use* a service that is so hopelessly targeted as Hotmail.

I have a hotmail account (created just before MS bought them) which I use for exactly one purpose: I give it out to assheads who demand an email address on a web registration or reply form.

Now, this was not my intention when I opened the account; originally, I hoped to use it to *replace* my Yahoo! email account because several people recommended it as a slightly-more-functional alternative.

However,

After I opened the hotmail account and verified I could log in, I went away and forgot about it. When I came back a week later, my mailbox was full - there were over 200 (!) SPAMs waiting for me. This, by the way, without telling a single person about the new address or sending a single email from the account.

The spammers beat me before I even got to the starting line with Hotmail. A lot of them come in with randomly generated recipient lists, so MS doesn't even have to sell addresses - they've got random number generators for that. In fact, this might be the ONE argument in favor of ridiculous email addresses like "superbob8337264fromtulsa@hotmail.com, because I'm sure that the longer your email address, the fewer SPAMs you get, even by only a couple.

Re:Network Solutions, One domain per user?

[PineGreen]

does exactly this (for free)

Re:Network Solutions, One domain per user?

[rifter]

Both in spam and telemarketing the biggest business is not in doing business in these ways but rather in selling lists to people who want to spam and be telemarketers. This is why spammers and telemarketers actually *want* to be able to bother people they know do not want to be bothered and will never buy their products, because that adds names to the lists. Both industries have continually lobbied in congress against any attempt to make laws which might allow someone to subscribe to a national list and therefore remain unmolested by these entities.

Re:Network Solutions, One domain per user?

[rifter]

One other thing I forgot to add. It is provably impossible for your grandmother to actually buy anything from spammers. Studies in which people gathered spam and attempted to contact the company to actually buy something came up with exactly none of the numbers or addresses being valid places with which to conduct business. They could find no way to send money to the spammers. Most of this is because the numbers and websites get cut off within minutes of spam being sent.

There is one other way to make money with spam, and it was outlined in a Wired article. That is to con companies into paying you for sending spam for them. There the spammer makes money, but again because there usually ends up being no way to ac tually contact the company, the company makes nothing.

Both spam and telemarketing are nothing but scams and should be outlawed, IMHO.

Re:Network Solutions, One domain per user?

[PacoTaco]

But do the people who go to such lengths to avoid spam EVER buy anything from spammers? EVER?

I think non-technical users are increasingly the people who send the spam. Check out some of the sites listed here. Most of them appeal to the inexperienced. ("Send millions of messages in minutes!")

Spam is a multi-level scam. I think the only people making real money are those who sell address lists and spam software to clueless newbies trying to make a buck.

Re:Network Solutions, One domain per user?

[Mr_Silver]

I'm aware of this, but the username in question was "ibtagmrq" which to me doesn't look susceptible to dictionary attack

It was set up purely in the interests to see how quickly it would receive spam if every option was off. I picked random letters and not someones name so if spammers were using a list of popular names and generating random hotmail addresses they wouldn't be likely to catch it.

The letters actually stand for "I Bet This Account Gets Mailed Real Quick" :)

In other words, i was looking for something so close to being completely impossible to just guess.

It took 4 weeks before the spam started. Although to be honest, it's dead now as I haven't logged in for over 6 months.

Sometimes "collateral damage" is intentional

[RollingThunder]

Several of the more hardcore lists will quite gladly blacklist an entire ISP for hosting spammers. Doesn't matter if you're squeaky clean with a five year contract with the ISP, they'll just say "get a new ISP, they've broken their contract with you"... all in the interests of peer pressure.

I haven't been hit myself by that, but I can sure empathise with the poor bastards that have.

Re:Sometimes "collateral damage" is intentional

[mr_z_beeblebrox]

The company I work with is switching our hosting away from Earthlink for that reason. We send mail from our domain but its reverse lookup is earthlink.net...Some of our clients deny mail from them as they have open mail relays. Bad for us Karl

Re:Sometimes "collateral damage" is intentional

[sawilson]

When I used to work at the better half of that company a long time ago before the lame name change *cough* we spent a considerable amount of time trying to figure out who the traitor was inside selling lists of email addresses. We knew it was going on, but never caught the guy.

Re:Sometimes "collateral damage" is intentional

[King_TJ]

I think the "peer pressure" idea is becoming a bit of a "dinosaur" from the days of the mom-and-pop ISP. In the past, except for AOL, you didn't really have many large ISPs that kept on large numbers of spamming users.

The small ISPs would be pretty responsive to complaints, or if they weren't - they'd feel the pain of getting blacklisted, and would usually give in and kick off their problem users.

Nowdays, with most customers on one of a handfull of giant ISPs, it's no longer effective or realistic to ban the whole ISP. (EG. With the number of customers Earthlink has, can you really expect them to always keep *every* user with an open-relay off of their network? Even if they hired whole teams of people just to perform that one task, new people with open-relays would subscribe faster than they could discover them. Hence, Earthlink would almost always be on a blacklist.)

Re:Sometimes "collateral damage" is intentional

[sawilson]

Before the earthlink "merger of equals", Mindspring had Harry. Harry absolutely rocked the abuse department. He worked together with the other admins (helped he was a Senior Admin in skill level) and they'd think up all kinds of interesting ways to "abuse" spammers. We'd catch them pretty fast if they were spamming from our network. One of my favorites was sending +++ATH0 in a formatted ping packet to their modem to disconnect them, sending thousands of spam messages back to their email client depending on what they used. Their port would be disconnected quickly. I think we had a 3 strikes and you are an ex-customer rule. Jan also rocked the news servers. I'm not sure how earthlink is handling things now post merger. I didn't hang around. :) At the time, were were number 2 in the world, and fighting spam very well. The "SPAMINATOR" product was very much loved by customers. I heard through the grapevine that it's basically a joke now, and doesn't work.

Re:Sometimes "collateral damage" is intentional

[RollingThunder]

It's a tough call for the guys taking the hardline.

On one hand, their main weapon is escalation. First they would ban the server, then the domain, then the hosting ISP... and then the ISP's connectivity - presumably at that stage, the ISP would have to choose between dropping the spammer or losing their connectivity.

On the other hand, every time they escalate, there's a chance outsiders looking in will go "good god, what a bunch of lunatics" and not opt to go with that blacklist... and as is pretty obvious, the power a blacklist wields is pretty directly related to the number of mailboxes it protects.

The discussions on the newsgroup certainly do lend themselves to LART-based amusement, though. :)

Re:Sometimes "collateral damage" is intentional

[macdaddy]

Honestly I don't much earthlink.net spam. In fact I can't remember the last time I got earthlink.net spam, even raping an open relay.

However I have gotten tons of broadwing.net spam. You (and I both) wouldn't believe the number if I could compile it. They ignore LARTs. They sign on known-spammers without regard. They simply don't care. Myself and many others blacklist them because of their in-action. I don't know if collateral damage is enough anymore though. The RBL was the best place to lay down some collateral damage. I wish it was used more.

Re:Sometimes "collateral damage" is intentional

[RollingThunder]

Guess what else?

I agree that it's the right of each admin to do whatever he likes regarding accepting mail.

That doesn't change my ability to empathize with the poor bastards caught in the crossfire.

Re:Sometimes "collateral damage" is intentional

[crucini]

With the number of customers Earthlink has, can you really expect them to always keep *every* user with an open-relay off of their network? Even if they hired whole teams of people just to perform that one task, new people with open-relays would subscribe faster than they could discover them. Hence, Earthlink would almost always be on a blacklist.

First, I checked Earthlink's main web and mail IP's (as representatives) and they seem to be on only one blacklist: blars.org.
Second, the only thing expected of ISP's is that they read their abuse mail at least once a day and upon verifying abuse they promptly terminate the accounts in question. ISP's need abuse departments, and the more accounts the ISP has the more people it needs in its abuse department. The abuse department does not need to discover open relays or other network abuse; it merely needs to read, investigate, and act on complaints.
Failure to maintain an effective abuse department will result in the network becoming a haven for abusers, and that will cause the ISP's netblocks to be blacklisted.

Re:Sometimes "collateral damage" is intentional

[Eggplant62]

Several of the more hardcore lists will quite gladly blacklist an entire ISP for hosting spammers. Doesn't matter if you're squeaky clean with a five year contract with the ISP, they'll just say "get a new ISP, they've broken their contract with you"... all in the interests of peer pressure. I haven't been hit myself by that, but I can sure empathise with the poor bastards that have.

What you fail to understand is that the mantra, "get a new ISP, they've broken their contract with you..." is not the only mantra being spoken by the blocklist administrators. There are several other things one who's been blocklisted as collateral damage can do to resolve their situation.

First, one can bitch at the ISP being blocklisted--daily if possible--about the situation. The blocklisting would not be in effect if the blocklisted ISP were quick about nuking spammers from their network. If one were to use google to look through news.admin.net-abuse.sightings, one would find hundreds, if not thousands, of complaints regarding spammers for blocklisted ISPs over weeks/months of time. Most ISPs won't hesitate to nuke a spammer from their network in less than a weeks time given a sufficient number of believable complaints. Why is it that some ISPs seem not to give a shit about hosting spammers? Is it because of the money?? *smirk*

A collaterally damaged network can also arrange for email connectivity via a third party, non-blocklisted provider, then deduct the expense from the bill for the blocklisted provider. One might also ask that the ISP protecting their networks with blocklists whitelist one's mail server IPs.

However, since any company lending financial support to any spam-friendly ISP by paying them money for partial connectivity is in essence part of the spam problem, the best idea is for a collaterally-damaged network tell the blocklisted ISP to FOAD and get a new ISP that isn't blocklisted. Why would you want to keep spammers and spam-friendly ISPs in business? Welcome to 21st century Internet ecomnomics. Blocklists are meant to act as a virtual boycott of the spammers and spam-friendly ISPs.

Believe me when I say it, if comcast.net gets my IP range into a blocklist because a spammer's money is somehow more important to them than my connectivity, they can rightly go screw themselves. I won't hesitate to call them daily to bitch, all while arranging for an alternative host.

Re:Sometimes "collateral damage" is intentional

[elemental23]

Please post the fully qualified name or IP address of a single open mail relay on Earthlink's mail network. Please also include complete headers of an e-mail you've relayed through that server from somewhere off-network.

I highly doubt you have anything to back this up.

Re:Sometimes "collateral damage" is intentional

[King_TJ]

Ok, I'd have to argue that your wishes are unrealistic. In reality, maintaining a help-desk is much more central to your profitability than dealing with users running open-relay mail servers.

Even so, many customers of large ISPs *do* complain about poor quality of service when calling the help desk.

In any case, I'm not intending to pick on Earthlink in particular. Perhaps they do a pretty good job of killing spammers off of their systems. I don't have statistics to prove or disprove that. I just use them as an example of a very large ISP compared to the old days of the "mom and pop" local ISP.

Keeping your network secure is *primarily* about making sure hackers don't get in and do damage to your own servers or steal customer records/information. It's secondarily about eliminating issues such as users abusing your "terms of service agreement" with spamming, etc.

I can almost guarantee that the vast majority of spam problems come from large nation-wide (or world-wide) ISPs, or from regional ISPs owned and operated by telcos/cable companies - as opposed to local mom-and-pop operations. This is no accident, IMHO. When you're the "little guy", you have to more carefully manage the resources you have and concentrate on keeping an "above average" level of service. Otherwise, you'll be crushed by the "big ISPs".

Isn't it ironic

[iONiUM]

but I still have to ban domains like yahoo.com
Does anybody else find it funny that this article is from yahoo.com?

Solution to spam

[maynard-lag]

I've found that once I stopped checking my email, I stopped getting spam.

Now, why haven't I heard from my girlfriend while she's been away at school.

Re:Solution to spam

[Lemmy Caution]

Now, why haven't I heard from my girlfriend while she's been away at school.

Since you passed up all those opportunities at penis enlargement she's been sending you, she's probably moved on to another guy.

Be careful when you Bcc...

[Omega]

A number of spam filters and spam blocking agents will mark a message as SPAM if it is only Bcc'd or CC'd. If you're going to Bcc -- at least make sure you have 1 To recipient else you may end up in the SPAM Folder.

Re:Be careful when you Bcc...

[RollingThunder]

Obviously, the simplest solution there is send it to yourself, and bcc everyone else. That way, no new data is introduced for the recipients to see.

And SpamAssassin (v2.20) rates "TO_EMPTY" at 2.541, and "TO_NO_USER" at 1.928 - putting you less than .5 away from getting dumped by the default threshold of 5. The two may be exclusive though... but they're still pretty large hits.

SpamBouncer Spam Assassin

[Binestar]

I've been using spambouncer for quite a long time and I've found that it catches more spam than Spam Assassin does.

As with any anti-spam measure you have to keep an eye on it when you set it up that everything is working and you aren't blocking legitimate mail. Any anti-spam software you use will either let some spam through, or catch legitimate mail. Add some procmail scripts to catch any mailing list mail you are on into thier folders, block To: Friend@Public.com and the like and you have a pretty robust system.

I've also found that blocking messages with malformed headers helps alot on spam... For example, the following Procmail recipe blocks all messages that are HTML only without a charset, which is common on spam mailings, and has never caught a legitimate mail for me:


* ^Content-type: text/html
* ! html; charset=
* ! from hotmail
| ${FORMAIL} -A"X-Spammers: text/html only message"


Your Milage May Vary

Klez virus and spam

[pubjames]

Since the Klez virus can be sent as if it was from your email address even when it has not come from your computer, is it possible that you could get put on a antiSPAM list because someone else has got the Klez virus?

Re:Klez virus and spam

[Binestar]

It is possible, but *most* of the people running the spam lists such as DNSBL's have a clue as to whats what and will not put those type of issues into the blocking lists.

BTW: That brings up another point, never never never trust a spam From: Header, you should always track it down to the system sending the spam, not rely on what the From: Header says.

one down!

[Mr_Silver]

I've found that Spam Assassin has made life easier, but I still have to ban domains like yahoo.com, hotmail.com, mail.com - and *.ru and *.cn. I sort through the spam periodically, but the collateral damage is still there.

I see that sending the boys round to Hemo's house for a good beating with the procmail man page worked.

Right ... one down ... anyone know Taco's home address?

Concept for Fighting Spam...

[dmarien]

I once, after installing, needed to raise a concern to the author, djb. I e-mailed him, and instantly recieved an automatic response.

The automatic reply stated that djb recieves an enourmous amount of mail, spam, and technical support inquiries. If I really wanted to e-mail him, the letter went on, I would have to reply to the automatic reply and copy in a 12 digit code which the automatic reply included.

I did that, and then recieved a 2nd automatic reply, stating that the code I entered was correct, and that djb would recieve my mail.

I imagine that a mail system setup in that regard would be the most potent weapon a mail server could utilize against spam!

The mail server could keep a database of known senders who entered the code correctly, and thereafter automatically accept their 'friendly' e-mail.

I forsee a potential abuses for this though. Annoying "spam bots" could learn to decipher the first automatic reply containing the code and then automatically send the spam, and contain the code which will allow the mail server to recieve the mail.

I would ask that if anyone knows how to install/administer the add on to qmail which performs this to please let me know! I recieve a tonne of spam, and becuase I get everything sent to the domain 'dmarien.com', I'll sometimes get upwards of 100/day.

Also, if anyone has a qmail server setup in this manner please let me know how satisfied they are with it's performance, and whether they get complaints -- and even if spam get's through -- i'd love to know.

Thanks!

Re:Concept for Fighting Spam...

[infiniti99]

Yes! See my other post about TMDA in the comments. It does exactly this.

By the way, your potential abuse is not as bad as it sounds. The spammer would need to use a valid return address in order to receive the confirmation. This means they could be tracked and stopped, etc. The most serious problems with SPAM right now are how there are so many open-relays and that addresses can be spoofed.

Re:Concept for Fighting Spam...

[pete-classic]

I forsee a potential abuses for this though. Annoying "spam bots" could learn to decipher the first automatic reply containing the code and then automatically send the spam, and contain the code which will allow the mail server to recieve the mail.

One of the primary charactaristics of SPAM is bogus From: and Reply-To: headers. If replies were actually recieved by the bot it would be an improvement.

-Peter

Yahoo and Hotmail DONT Open Relay

[Anonymous Coward]

If you'll trace the messages 99.9% of the time it's not from the return address (which is usually hotmail or yahoo). So simply blocking yahoo and hotmail seems kind of wasteful. Simply look at the black lists of open relays. They are the problem.

Forged filter?

[fm6]

I still have to ban domains like yahoo.com, hotmail.com, mail.com

I don't know about hotmail.com or mail.com, but Yahoo is pretty good at keeping its accounts from being used to send spam. It's true you see "yahoo.com" in a lot of spam headers, but these are almost always forged. And forged headers are pretty easy to detect. I'm suprised your filters can't tell the difference.

Banning .cn

[JoeBuck]

Q. How can the Chinese authorities get around the fact that the Great Firewall of China is doomed to be imperfect?

A. Get all westerners to ban .cn as spam. Then Chinese dissidents will be unable to communicate with the outside world.

Personal domain

[crow]

For heavy Internet users, having your own domain is wonderful. I do the same thing you describe. I'm hosted at pair.com (no affiliation other than as a customer), and for about $6/month, they host my personal web pages and let me put arbitrary filters on any incoming email address. I've killed off a few that have gotten spam from web sites releasing the address. I've killed off a few that I used when posting to mailing lists that are archived on the web.

But mostly, I've found I just don't get much spam because I protect my email address. For example, when placing my email address on my web page, I use JavaScript to encode it, so a web robot that doesn't parse the script won't see the address. I've never received spam at an address protected that way.

Cloudmark is a P2P Spam Eliminator

[TheCodeFoundry]

I've been using a beta of Cloudmark's SpamNet for about a month with no false positives. Seems to do a good job, plus you can mark SPAM that you might get and it will update it on everyone's (that is using SpamNet) spam signatures.

Re:Cloudmark is a P2P Spam Eliminator

[SerpentMage]

Ok...

But that is for Outlook only. As such I have been using Spam Dectective and have to say I am impressed. It is nice because it sits like a tray on my desktop and periodically checks my email.

Nice application...

SpamCop chain test

[Animats]

One of the better features of SpamCop is the "chain test". SpamCop's header parser looks at all the "Received:" lines and figures out which ones are fake. It matches DNS names and IP addresses, and checks those "Received A from B", "Received B from C" relationships. The point at which the chain ceases to be valid identifies fake headers.

This is essential if you want to report spam to the sender's ISP. Otherwise, you report addresses being abused by spammers. It's also a useful filtering tool; an e-mail with inconsistent headers is probably spam.

Collateral Damage with snail-mail junk mail?

[GGardner]

I get a ton of junk mail. Who doesn't? It usually gets tossed, unopened. Every now and then, I've tossed non-junk mail, as it looked like junk mail. It would be interesting to measure this "cost" of junk-mail.

What about individual users

[rutledjw]

I have had my yahoo.com e-mail address since they offered it YEARS ago. For a while I used it as a SPAM trap and just deleted the whole thing periodically. I finally decided I wanted to use it and have set up a number of filters to take out crap.

Stuff like "Casino", "Porn", "u.n.i.v" in the subject and china.com, and .br (since for some reason I've been getting hit from Brazil) in the from line all go to the Trash.

Is blocking entire domains and nations blocking out potential legit e-mail? Yep, sure is! Am I losing sleep? H3ll no! Look, I'm very sorry if you're unable to do some things on the net b/c you're domain is blacklisted, but that's just too bad. Then complain to your ISP to do something. If enough people scream to their providers to do something, the ISPs will HAVE to do something or else lose users and hence - business.

I'm not going to endure the kind of garbage I have in the past. As for legit businesses that get blacklisted, well, as the article said, it was resolved in a day...

One thing that is interesting is Yahoo!s little feature of marking a message as SPAM. Apparently, they review it and use it to update their filters. I'd be interested to know how well it works...

If only domains told the truth...

[dasmegabyte]

I've had a number of people complaining about spam email originating from our server. A quick look at these emails from somebody who knows "a little something" about email shows that the email was an almost guaranteed forgery...the mail servers that relayed the message had nothing to do with us, besides which the user does not exist on our servers and the domain they sent from belongs to developers I know wouldn't fool with this stuff.

And yet, the damage has been done. These users don't trust me as a provider even when I explain how we lock down our server & prevent spam. They don't trust our domains, which means they block the ip -- an ip which may be mapped to 50 or more virtual sites. And all of this because our domain was the root of it all...a simple forgery that no email client really checks for validity because internet mail is designed to bounce anonymously from server to server. I've gotten spam that was "sent" from my own email address...which is silly, because why should I trust a company's services when they try to convince me _I'm_ marketing to myself?

What email needs is a set up like SSL -- a trusted third party to verify the validity of an email from a key generated by the sender when the receiver gets the mail. If the sender proves to be a spammer, the third party drops support...and charges a large fee for breaching a contract. We need this to occur without unwieldy programs (PGP) or user eductation...just some way to get a lock in the corner of a user's screen to let them know for a fact that user X sent message Y, and that if it was unwanted they have a recourse.

This new "Secure mail" could become popular very quickly, as many companies that communicate solely over email could use the security that nobody can send an email as ceo@trustycorp.com without the server's permission. The key is ease...SSL may have its problems (certs kind of expensive, monopoly of cert providers due to reliance on deals with certain monopolistic browsers, slowwww responses) but it has become a mainstay of secure communications for people who understand it (unlike my wife, who despite a BS in chemical anthropology believes that submitting her credit card via SSL over WEP 802.11b means a guy with a ham radio can read her number, so she places orders via cordless phone instead). Mail hasn't significantly changed in ten years...maybe it's time for smail!

Re:If only domains told the truth...

[Detritus]

The single biggest complaint has been that MTA documentation is in English (perhaps Spanish and French) and not in their native languages.

There is Sendmail documentation in English?

ORDB is the Answer

[DaveAtFraud]

Quote:

...but I still have to ban domains like yahoo.com, hotmail.com, mail.com

My e-mail address was recently harvested by a spammer. I started getting SPAM from the listed domains but the only problem was the mail didn't show up as from yahoo, hotmail or mail in my mail log. Turns out the spammer was forging the return address and sending through an open relay. So I learned about how to set up sendmail to filter incoming mail through the Open Relay Database (ORDB). That particular spam problem has now disappeared. It helps when you run your own mail server but if I can figure this out in less than a day then a paid sysadmin at an ISP, company or school should also be able to do it.

You can find out more about the ORDB here and this site has very simple instructions for setting up sendmail to use the ORDB filter. Sendmail.org has quite a bit of additional stuff you can do to filter SPAM and still let legitimate e-mail through. ORDB also has solutions for people who don't run their own mail server and just connect someplace with a mail client to get their mail.

how to filter asian spam

[Anonymous Coward]

after filtering the Content-Type: for ks_c_5601-1987
(upper and lower case) I havnt recieved an asian spam mail, given that I used to get 20+ asian spam a day this helps a lot. In Outlook you cant(I think) filter on specific headers, but filtring on all Headers should do.

my $0.02

TMDA

[infiniti99]

(this is similar to a comment I posted to the other recent fax SPAM story. it has been expanded.)
------

I highly recommend using TMDA on your mail server to defeat SPAM. It works by maintaining a whitelist of valid senders. If someone emails you and they are not in the whitelist, then they receive a confirmation request email. They must reply to it in order to be added to the whitelist (at which point, TMDA will deliver their original message, and allow all new ones to pass through). No having to report SPAMs, no worry of maintaining a never ending blacklist. No blocking of entire domains, no having to "sort through the spam periodically". TMDA does it all for you, putting a minor inconvenience on first-time senders.

The end result is that I get no SPAM. Zero, zlich, nada, not one -- with no effort on my part.

I believe there are other packages out there similar to TMDA that you may want to try. Regardless, I'm convinced that a whitelist-centric strategy is the way to beat SPAM.

Note: You still must take into account mailinglists or other situations where you are going to receive mail from an unknown source that won't be able to process the confirm request (such as some online purchase confirmation), and this is where qmail aliases can come in handy. Ie, justin-linux, justin-sears, etc, and just throw them away if you ever get SPAM. TMDA even has some features to help with this, such as hash-generated addresses that self-destruct after a period of time.

Still, for all other purposes you can keep your normal address. No need for SPAM armoring ever again :)

-Justin

Re:TMDA

[mjh]

Yeah, since I started using TMDA, I've had a mild case of depression. Besides mailing lists, I never really get any email. I used to be able to delude myself into thinking people liked me because I got so much email -- but it was mostly spam. So, apparently, I'm not that popular!

So be careful if you choose to use TMDA. It might impact your ego.

Re:TMDA

[pbryan]

TMDA does have a disadvantage over blacklists: it doesn't reduce wasted server bandwidth. Not only do I want to keep my INBOX neat and tidy, I also don't want spammers to usurp the bandwidth that I pay $$$ for.

Blacklists would allow my MTA to reject the email before the body is even sent. TMDA receives the body, stores the message and attempts to send a confirmation request to the spammer, all taking bandwidth.

TMDA is ideal if nobody cares about bandwidth utilization, but today spam is costing me more. If traffic continues to grow at existing rates, spam will account for more traffic than my web services in a matter of months.

Re:TMDA

[infiniti99]

Yes, I noticed this too. I tend to check my mail very frequently, and not much is there these days. Maybe I should install a biff of sorts..

Still, it does feel good to be able to say, "I don't get SPAM, period." Oops there goes my ego.

Re:TMDA

[infiniti99]

Good point.

Perhaps the ultimate SPAM-killer would be some combination of the two. Blacklists to prevent bandwidth loss, and whitelists to kill anything that slips through.

I assume it's pretty easy to chain MAPS before TMDA in my qmail setup, maybe I should look into it.

Re:TMDA

[Devil Ducky]

You can rather easily set tmda to auto-blacklist any of the people who don't reply. You'll use the bandwidth for the first message but not the second.

I like it this way, I'm not in a very big worry about bandwidth and this keep my inbox sparkling clean, but also does save some bandwidth and processing time.

Re:TMDA

[infiniti99]

Nice try. It all goes through the same filter. Have fun :)

Re:TMDA

[infiniti99]

Your idea of a key phrase is good, but perhaps it is overkill?

First, I think it will be a long time before the whole world is using a whitelist-based protection mechanism. We'll probably have a better email protocol before spammers would even worry about circumventing whitelists.

It has been mentioned in quite a few threads already that a spammer would have to use a valid return-address in order to receive the confirmation email. I think this would be enough to stop them cold. Spammers rely on being able to spoof addresses.

A better circumvention measure would be for a spammer to spoof the address of someone in my whitelist (maybe this is what Outlook-addressbook viruses will do in the future).

Re:TMDA

[pbryan]

Apparently, the MTA still accepts the message in its entirety before filtering it through TMDA, thus consuming bandwidth even for blacklisted senders. Furthermore, veteran spammers use random addresses in order to bypass email-address blacklists.

Ultimately, bandwidth waste will probably be most important to service providers, while clean INBOXes will probably be most important to end-users.

I've come to the conclusion that a two-tiered approach to spam reduction will be most effective in my environment:

The first line of defense is a realtime IP-address-blacklist (e.g. RBL, SpamCop), which allows the MTA to reject messages outright before they're sent.

The second line of defense is a message filter (e.g. procmail, TMDA, SpamAssassin), which allows messages themselves to be filtered for content and possibly intervene on behalf of the recipient to request confirmation before delivering the message.

New approach

[Rupert]

Maybe we could get a mainstream news source to report that terrorists are using spam to communicate with each other. That would get it banned instantly.

Qmail

[crow]

My mail gets processed by qmail, and it seems to automatically add X-Envelope-To: header lines, so you can see what address received the message.

Your mail server has to know who it is supposed to be delivering the mail to, and in most cases this is made available to mail filters in one form or another. Of course, if you're filtering it on the client side after it's been delivered to your mail box, you may be out of luck. (I've always been of the opinion that filtering should be on the server side, for this and other reasons, but people make do with what they can get.)

Re:Qmail

[macdaddy]

I've always been of the opinion that filtering should be on the server side, for this and other reasons, but people make do with what they can get.

I more or less feel the same way. However I think that the obvious filtering should be done on the server. For example the DNS blacklists and the obvious spamming domains like "highspeedmailers.com" and "spamyouforadollar.net" should be filtered on the server. As well as the malformed messages; ie, the ones without properly formatted MessageIDs, malformed recipient fields, etc... I do think there is a benefit to spam scoring as well as this obvious filtering. I can't block an entire country at the MTA level. I can't block eudormail.com, yahoo.com, or hotmail.com either. I can't even blacklist amazon.com, ebay.com, or apple.com (all of which either spam (amazon & ebay) or run single opt-in lists (apple). My users would get pissed and I'd end up declaring a bunch of SPAMFRIENDs. That would defeat the purposes of filtering. As an ISP I'm filtering to reduce my consumed resources (bandwidth, drive space, processor time, etc..) and make my users happy (less spam in inbox). If I have to declare them to be SPAMFRIENDs because they want to buy from amazon.com, it hurts me. However, if I can pass the controversial filtering down to the user and let them filter it, I'm in the clear. I've used some of my resources that I wouldn't have used if I'd 55x the message, but I am keeping my users happy. For example, if I receive a message from Japan, I'll automatically add a couple points to the spam score. Then I'll run it through the rest of the spam scoring checks and let them judge the message as needed. In the end, I'll pass the message to the user and let them use the score I put in the header to decide on whether or not to keep the message. I've done my part by helping them filter spam. Now it's up to them to make the final call.

I think approach is best. Filter the obvious ones on the server, score the controversial ones & pass the final call on to the user's MUA.

Yes, you're dreaming.

[Ungrounded Lightning]

If idiotic pricks didn't ...

I'm dreaming of course.

Yes, you're dreaming.

About one in 100 (somewhere between 1 in 50 and one in 200) people in the general population is a psychopath. This is a (set of?) brain disfunction(s) that amounts to "no conscience". (Think "colorblind" but with respect to harm-to-others. But it's not known yet whether it's genetic, foetal insult, or what.) Additionally there are "sociopaths" - similar symptoms but as a result of training and social factors rather than an organic problem.

Some fraction of these people learn a moral, ethical, or legal code to compensate for their affliction. They can become honest, productive, and/or beneficial citizens. In some positions (such as political or military leadership or business administration) they can even excell, because their judgement about actions that will hurt other people is not as biased by immediate emotional concern. But many do not learn a code (or learn a defective one). From these come the bulk of the criminals, scam artists, tyrants, white-collar crooks, and so on.

In the absense of compensation a psychopath will be looking out solely for number one. It's not well correlated with intelligence - some are stupid, some very smart. A significant number will be able to handle spamming tools, and be willing to go for the immediate benefit to them (even if it's small), regardless of the damage to others or even long-term consequences.

Yes, Virgina, there ARE evil people.

Much of the social and legal institutions of all civilizations are dedicated to the problem of this small-but-effective population of psychopaths. In particular, legal systems exist to give them a set of rules to live by, a set of personal bad consequences for violating them (so acts that harm the law-abiding become bad for "number one"), and to remove from circulation those who just don't get it.

Short of genocide against psychopaths we will continue to have a plague of spammers for at least as long as people think there's money to be made (or fun to be had) and it won't get you busted.

Re:Yes, you're dreaming.

[Junks Jerzey]

Short of genocide against psychopaths we will continue to have a plague of spammers for at least as long as people think there's money to be made (or fun to be had) and it won't get you busted.

It's ridiculous to equate psychopaths and spammers.

Spam map

[Alien54]

Slash had a story on just such a place just a few weeks ago

It's called the Spamdemic map, but they had to pull the plug due to bandwidth cost issues

Have to be careful with your e-mail address.

[RobinH]

When I was in university and making web pages and stuff, I used to get tonnes of spam. When I posted to newsgroups I got tonnes of spam. However, these days, I just have two addresses... one for personal email, and the other for work email, and I rarely ever get spammed.

My personal email address is a yahoo account, and work email is provided from the company I work for. I give out my email addresses to friends and lots of contacts from work (and it's printed on my business cards).

I NEVER do these things:
-post to newsgroups with a real address,
-put my personal address on a website,
-give a real address when filling out surveys, etc. online
-sign up for newsletters
-give my email to anyone who asks over the phone ("Sorry, I don't have a computer, but yes, I'd like to order that CD-ROM drive")
-give my email address to Radio Shack
-enter my personal info into my browser

Basically, I just refuse to allow my email address to proliferate. If I do happen to get spammed, I just don't reply, and it tends to go away, but it's really rare anyway.

Of course, if I ran a website, I'd create a unique email address just for that purpose, and I'd expect to have the sh!t spammed out of it, but at least it would be separate from my real addresses.

Re:Have to be careful with your e-mail address.

[Lord Ender]

Your technique won't work. If you give your address to friends and family, they will either send a forward (which ads your email address to the headers and is picked up by spammers) or get a virus, which can also pick up your email address. And anybody running an SMTP server that records email addresses could harvest you for spam.

Re:Have to be careful with your e-mail address.

[Isofarro]

[Usenet email address munging] Any programmer could whip up a short bit of code in about 5 seconds that would strip that sort of primitive obfuscation out and return a real address...

I use a real proper email address on Usenet (as required by netiquette), but I'm only seeing three emails a week of spam (as compared to my normal email address of 10-16 spam a day).

I use domain names and user names with the word spam in them. So I duck under the "clever spammers". Its worked so far.

Re:Have to be careful with your e-mail address.

[RobinH]

Your technique won't work.

It has for (literally) years.

If you give your address to friends and family, they will either send a forward (which ads your email address to the headers and is picked up by spammers)

I guess I don't tend to forward jokes. I've seen them all, and tend to believe that most of my friends/colleagues have too. My friends also know that I don't like getting forwards, so they tend not to send any to me. The few that do have caved into putting me on the list as a Bcc.

or get a virus, which can also pick up your email address

As has been pointed out in other discussions, when you don't use MS Outlook, you don't get viruses.

And anybody running an SMTP server that records email addresses could harvest you for spam.

Fortunately, Yahoo seems to be pretty good about not doing that (and not selling my address in general, unlike other web email services).

Back to my first point... it HAS worked. I didn't say I don't get any spam, just that i get NEARLY none.

Re:Have to be careful with your e-mail address.

[Lord Ender]

"As has been pointed out in other discussions, when you don't use MS Outlook, you don't get viruses."

If your mom gets a virus and has your name in her address book, it will send crap all over the net using your address. So there is a hole in your plan you hadn't considered. I have tried your method. It doesn't work. You say you get some spam? If the guy who has your address starts selling his list, you are screwed. There would be nothing you can to to stop yourself from being burried except use filters.

Re:Too bad about Yahoo

[fmaxwell]

Anyone who blocks Yahoo.com won't get any mail from me. I like Yahoo's web mail, and use it in preference to the one I actually pay for.

So we should all unblock Yahoo! and get tons of spam because Weasel Boy might want to send us e-mail?

Spam outta control

[Tablizer]

The only viable legislative solution I see is to require all senders to pay a small fee for every message they send out. No bulk deals, also.

It would not eliminate spam, but may greatly reduce it.

The fee should not affect the cost of services if you are not a spammer ISP because you will get the senders' revunue to pay for accounting efforts.

Collateral damage is a benefit

[FearUncertaintyDoubt]

"Their philosophy appears to be that if innocent businesses and individuals on the periphery of spam-house blocklists are affected, then those innocents will have no other choice but to pressure their upstream provider to remove the spammers from their blocks, thereby solving the spam problem bit by a bit. Draconian, yes. Effective? Sure."

Absolutely. Without pitting customers of ISPs against each other, i.e., the legitimate ones against the spammers, the ISPs will be happy to serve both. I'd suggest that if an ISP allows any spamming, block it -- wholesale. Either you have an agressive policy against SPAM or you lose your privilege to send mail to my servers. Your customers don't like it? Tough. Make your network spam-unfriendly.

The last thing the ISPs want is for their regular customers to be aware that they are allowing spammers to use their network. It's kind of like the phone company selling caller ID block to telemarketers and caller ID and privacy manager to residential customers. If the spam blacklists cause users to confront the reality that their ISP is knowingly hosting spammers or not bothering to monitor people sending out 10e+06 emails at a time, then they might just demand that their ISP get out of the spam business. Because unlike (most) telcos, ISPs don't have monopolies, and customers can switch.

Re:Collateral damage is a benefit

[AnotherBlackHat]

Absolutely. Without pitting customers of ISPs against each other, i.e., the legitimate ones against the spammers, the ISPs will be happy to serve both. I'd suggest that if an ISP allows any spamming, block it -- wholesale. Either you have an agressive policy against SPAM or you lose your privilege to send mail to my servers. Your customers don't like it? Tough. Make your network spam-unfriendly.

Sadly, for some strange reason the people who get blocked seem to think it's because of some action
taken by the maintainer of the block list.
No matter how often you repeat the statement that's it's their ISPs fault, they still think it's because you listed them.

-- this is not a .sig

Sign your mail!

[Viceice]

I think the solution to this is something we have implemented with care in the real world regarding our mail, but somehow failed to do in our e-mail.

Think of a real world companies mailroom. Say it's a big company that gets thousands of letters each day. Some of it is business related and is important, some 'thank you's and 'well done's from customers, some 'your stuff sucks' also from customers and lots and lots of junk/spam/flame that is only good for recycling.

Sorting out all the mail takes time, so how do you make sure that the legit mail gets to you quick and the Spam stays in the Spam basket? Well you send registered mail. See, we know that certain mail is important when someone takes the trouble to take it to the post office and register it and pay more for it's delivery or call a courier to do the same. It's all barcoded so we can scan it, see who it's from and build a "trusted" mail list and rush it through.

Sound familiar? You bet! But the trouble is almost nobody beliefs in PGP signing their e-mail. All our mail programs can do it, but we just don't. Imagine, if it were that every piece of mail sent is signed, all we need is a simple filter to see what is spam and sort it out, dead on, with no legit mail getting junked.

Long Live /etc/aliases

[QuantumRiff]

if you run your own linux server, just edit /etc/alias with something like:
ebay: me
then save, and run "newaliases"
on the web form for ebay, then type in:
ebay@mydomain.net

Re:Long Live /etc/aliases

[tedtimmons]

If you are running your own linux server, install qmail and use a dot-qmail file.

-ted

Why hasn't email protocol been changed?

[bwt]

It seems to me that most spam leverages flaws in the email protocol. The ability to spoof an email address and the lack of built-in and automatic digital signing both enable spam to flourish.

Perhaps its time to write a completely new email protocol that supports these features.

I don't think it's so much to ask that when an email header says its from joe_blow@yahoo.com that it really is from that address. I understand that this would cause anonymous email to be impossible, but it should be the recipient's choice as to whether they want to use an email protocol that allows spam and anonymous mail or not.

Don't blame the programs....

[Andrewkov]

Don't blame the spam filters for not being perfect. No matter how intelligent these programs get they will never be perfect. Even if you hired someone to go through your mail box every day, that person wouldn't know what you consider spam and what you want to read. For example, if an old friend you hadn't talked to in years sent you a job offer, that would kind of look like spam, but you would still want to read it. Anyway, these spam blocking programs are much better than nothing.

false positives don't affect me...much...

[mddevice]

I personally check my spam folder many times a day, so it's no big deal if I get a false positive from spamassassin. "But what's the point in a spam filter at all if you check it all the time", you ask? For me, the annoyance of spam is getting interrupted by the delicate chimes that announce your new mail, and then racing excitedly to your mail app only to discover that a HOT TEEN is waiting for YOU! I don't mind sorting my spam folder, so long as it's on my time and not interrupting something important. I usually do it anytime I get any legitimate mail, so it's rare that there's more than 1 or 2 emails in the folder. A false positive will usually just result in delaying me from reading someone's mail for a few hours.

If I got so much spam that this system became unwieldy, I would probably set up several spam folders corresponding to the spam level assigned by spamassassin. Anything between 2-5 would go in a folder that I check whenever I get a real email, because a false positive is almost guaranteed to be below 5. Anything over 5 is pretty much guaranteed to be legitimate spam, and I would check that every few days. I don't do this, however, because I simply don't get the 100+ spam emails a day that the ./ editors claim.

Ruined

[SomeOtherGuy]

Bottom line -- Spam (and the tools required to fight spam) are the biggest reasons we will still be using stamps and snail mail in the years to come. Spam has taken the "killer app" of the information age -- and crippled it beyond use.

It's a catch 22 because if you don't filter spam the signal to noise ratio is way to high to make email a valid source of legit communication. If you do filter -- the better you filter, the higher the chance of important bits going to /dev/null. I would go into more detail -- but one look into most mail boxes that have been around the internet for long would speak louder than a thousand words.

No wonder they're complaining...

[Caradoc]

"Recent complaints about blocklists have come from companies and organizations, including British Telecom, the Libertarian Party and News.com publisher CNET Networks, among others."

btinternet is complaining about getting blocked because they don't bother to nuke their spammers. CNET doesn't verify e-mailed subscriptions, so just about anyone can sign someone else up.

Is it any wonder that they're complaining about being blocked?

"Well-researched" my ass.

Urban Myth: banning CN spam hurts China dissidents

[dananderson]

It's a myth that banning .cn spam is hurting dissidents. They can still surf the web and use 3rd-party web-based email. I ban all email from all Chinese, Hong Kong, Japan, and South Korean IP address blocks. I still get email from Chinese asking for technical help (Solaris on Intel and what not), which I answer.

As for dissident email, I never received any and don't expect to. I'm sure the few Chinese dissidents are beaten down quickly and probably communicate with others who can help.

Hopefully, the Chinese will wake up and realize that to be responsible Netizens, they shouldn't be spam generators for the rest of the world.

Damage

[macdaddy]

I wish there was a way to reduce the collateral damage caused by blacklisting. Then again, sometimes it's intentional. Take me for example. I've gotten more spam from Broadwing.net customers than I've ever gotten from anyone else. Broadwing.net doesn't give a damn about it either. I've LARTed them many times with spam. They don't even auto-ack you. Because of their in-action, I've blacklisted every broadwing.net netblock I can find. I want to get their attention by hitting them where it counts, their bottom line. I listed them with the intentions of a) stopping their spam, and b) getting their customers to complain about their inability to send mail to me and find out the real truth for themselves. There's no other way to get through to Broadwing unless your state has an anti-spam law that also finds fault with pro-spam ISPs. Then I have to sue which costs me time and money. This is really the only method of getting their attention. The collateral damage I'm creating by doing this is intentional. Most DNS blacklists don't do this. Some do though. The RBL will through a lengthy nomination process. SPEWS does it when all else fails. I use SPEWS. I also use their tactics. When I LART spam to an ISP numerous times and never hear back, or while researching spam I see that an ISP has been LARTed by other anti-spammers many times, I'll consider blacklisting them. I try to give them the benefit of the doubt though. Broadwing used up all their benefits and obliterated all my doubts long ago.

All that said, I think that collateral damage is acceptable in most cases. I think there's a reason behind it that some don't grasp right away. When you've LARTed an ISP a dozen times over one IP or one of their customers and they haven't done jack about it, you'll understand the usefulness of collateral damage.

My $.02

Overkill

[Jobe_br]

Killing of all mail from yahoo/hotmail is pretty severe. Many, many people (who might have other legit addresses) maintain yahoo/hotmail addresses for when they're on the road. Many other people who want to keep the same address, regardless of what ISP they're using at the moment also use Yahoo/Hotmail. I recently did a search through a client's newsletter subscription database (to compile a list to send the newsletter out to) and over 50% of the addresses were either yahoo or hotmail domains.

I don't see why (with SpamAssassin) you would need to be so draconian. SpamAssassin catches all my spam, regardless of where it originated. If your installation isn't catching what you consider spam, adjust the rules a bit. There's a lot of good documentation on how to do this and it isn't real hard (mine seems to be working fine, out-of-the-box). Now, its very possible that a person would get legit email from yahoo/hotmail addresses that they simply don't *want* to get ... fine, but that's not SPAM.

Re:Overkill

[Jobe_br]

Be my guest ... though the email address is obfuscated by /. for a reason ... posting it in an unobfuscated fashion circumvents that pretty effectively :(

Who cares?

[dh003i]

Hey, tough shit.

My personal solution to SPAM is to ban all e-mails from anyone I don't know. If I get an e-mail from someone not on my address book or accepted e-mails list, its automatically deleted before I see it.

This requires actively maintaining a list of e-mails, but it is fool-proof for elminating spam, and won't filter out many legitimate messages from people you WANT to get messages from.

Re:Too bad about Yahoo

[fmaxwell]

Moron.

Suck me. It's damned unlikely that you have anything even approaching the sophistication of the spam filtering that I run. On my mail server, I have autoresponders telling people how to resend non-spam, blind-copied messages caught by my filters. I have IP-based filters for foreign domains. I have filters to catch HTML-only e-mail that's blind-copied to me. I have filters based on the e-mail encoding, character set, and content. I create addresses on my mail server that can only be reached from an individual domain. I have trusted sender and domain lists. I have an auto-complaint generator for Brazillian spam. I regularly track down the spam to its source, perform open relay tests, and submit open relays to open relay databases.

So what do you have? Hotmail with the spam filter box checked?

Next time don't make stupid assumptions, dick-head.

Re:Bcc:

[totallygeek]

If you run sendmail with -X you can dump to a file all the information. Black To: lines can be seen as an RCPT TO: command to the mail server. Try it, it is pretty cool.

spamcop.net thoughts.

[joeldg]

Buy a new domain. Start receiving 60 spams per day on each email, even though you have not posted them anywhere yet. Start reporting them to spamcop.net for some reason spamcop decides that it is a good idea to check the box next to *your* service providers name automatically. Sends report to my service provider. My service provider in getting so many of these all the time, don't bother to look at them and realize I am the one reporting this crap. My domain hosting is turned off without warning or even an email explaination of why. Total time.. one week. On a bright note, I talked with them and they went and looked a the reports and realized the error and turned my account back on within one hour. But still.. this should *not* have happened.. Yea.. Collateral damage (to myself)

Re:No Spam For Me...

[gaudior]

never anywhere that web crawlers can access.

That works until your Auntie Em forwards a message from you to her Quilter's List, and it ends up in a web archive.

How to block 90% of SPAM

[TheFlu]

I'm not sure about everyone else, but a good 90% (or more) of my SPAM comes from Asia Pacific networks. In order to combat this, I have used the access_db feature of Sendmail to block these off.

Over the past week since I've done this, I've blocked in excess of 100 pieces of SPAM from my INBOX. It seems to be working very, very well. You can read the article I wrote on how to accomplish this right here. The article just discusses the access_db file, but the comment right below lists the networks that I blocked.

I'm well aware this solution will not work for everyone, but for my needs, it has been a godsend.

Re:How to block 90% of SPAM

[TheFlu]

A start would be to take this list of IP address info (including country) and parse out just the IP's. I quickly scanned thru it and it looks like it only contains a handful of US entries, that you could easily remove.

I believe APNIC offers a similar list (I saw this last week, but forget the exact link) that you could scan thru as well.

Another option would be to grab the ARIN database of US entries (if it's even offered, and create a white list from that).

Re:Urban Myth: banning CN spam hurts China disside

[silentbozo]

According to a usenet post from what seems to be the only China admin who has been taking the issue seriously, China Telecom is finally waking up to the fact that SPAM IS BAD. Evidently it took legal papers from overseas delivered to their headquarters before they decided to take a look at the problem. Whether this means that they'll do something about the spam is another issue...

Re:What About IP Spoofs

[AndroidCat]

I've seen spoofed From lines, spoofed Received lines (after the top trusted one). I've never seen the IP in the top Received line spoofed.

Are you sure that your friend wasn't blocked because PacBell did have an open relay? Check the list web site. Most provide evidence for their blocks.

Some collateral damage is deliberate. The ISP has to choose between spammers and legit customers.

Use encryption

[Hoi Polloi]

If you insist on using the terms "incest", "enlarge your penis", "make money fast", or "you requested to receive e-mail" in your personal correspondence then use encryption and sign your email so you don't get filtered out. If you are on a node that is blacklisted then either complain to your provider or move to a more responsible one.

Your own TMDA system

[dh003i]

Someone mentioned TMDA, which is basically similar to the system I use.

Here's my system.

1. Make a comprehensive address book, listing all known contacts and companies you want information from.

2. Set up a filter to let any e-mail through which is in your address book or allowed senders list, OR to allow any e-mail through which has your "ok password" on it (i.e., anything with "32dje573hkjd3k:" is let through), unless an exception is noted.

3. Set up a web page which displays your "ok password" as a GRAPHIC IMAGE, not a text image.

4. Set up a filter such that any e-mail not from a known contact or without your "ok password" on it is automatically deleted, and a message sent back to the originator, "Your e-mail has been automatically deleted from that person's account, as you are not a trusted source. If you want to sent that person a message, go to http://www.persons-webpage.com and find his 'ok password'. Put his 'ok password' on your message title followed by a colon and the rest of the title, then re-send the message. The person you are trying to e-mail will then receive your message and evaluate whether or not your are a trust-worthy source. If he decides you are a spammer, flamer, or anything else of the kind, he'll take further measures to avoid getting e-mail from you".

5. Anyone who's a legit e-mail sender will do this. Then you can get their messages and add their e-mails to either your address book or "accepted e-mails list". Some spammers may do it to, but these will be few and far between; and then you can filter them out specifically.

APPENDIX: A note on your "ok password". Your "ok password" should NOT be static. It should change daily; and there should be multiple "ok passwords" daily which will be randomly displayed to each different user who enters the site. Use a random password generator to generate different passwords at various intervals, convert the text to a jpg graphic, and post it on your web-page.

Re:Your own TMDA system

[dh003i]

An alternate solution is simply to set up a random response system such that each "non trusted source" is sent an e-mail with your "ok password on it" but the "ok passwords" are generated dynamically and randomly by a random password generator, and each "ok password" is linked to a specific e-mail address, and will only work if used in correlation with that e-mail address.

To accomodate for potential contacts who may change e-mails rapidly, you may want to create one master "ok password" and give it only to people who your really trust. This would be a convenience for them when switching e-mails; however, it is a potential security flaw.

The cost of faking email addresses

[Hoi Polloi]

Right now some poor guy named "HomerSimpson@aol.com" is getting pounded with spam.

But you need spam!

[Hoi Polloi]

If you don't get spam how will you ever learn how to "MAKE MONEY FAST!" or how to "ENLARGE YOUR PENIS!"?

Re:Spam USED to bother me

[AndroidCat]

Spam used to bother me, but now all the email I get says "This is not SPAM". I mean, they wouldn't lie to me or anything would they?

How else can you boycott the ISP w/o collateral

[Skapare]

How else can you boycott the ISP w/o collateral damage? SPEWS does not list the ISP, and hence, no collateral damage, until the ISP has had plenty of time to cut off the spammer. In order to increase the level of pressure on the ISP, more of their address space has to be listed to "encourage" them to cut off the spammer. The usual first listing is the whole /24 the spammer is in (if they weren't doing it from the whole /24 in the first place). Maybe they will start listening once their own customers complain (and that's the proper place for the customers to complain to, their ISP). If they continue to ignore the problem, then eventually the whole ISP will be listed. If it's a multi-level ISP, their upstream starts to get listed, too.

The philosophy SPEWS appears to be using, and one I now agree with (previously I did not, but sometimes my opinions do change ... hey, I'm open minded), is that the spam problem will not go away by blocking only the spammers. ISPs have to play a part by not signing up known spammers, and cutting off spammers that got signed up because they were not known at first. Blocking spammers alone will be a never-ending battle because then there is no incentive for any ISP to turn them away and they just keep moving around to evade the blocking. To end spamming, the ISPs have to quit offering them services, or we have to quit accepting traffic from the set of ISPs that do harbor spammers.

It looks like collateral damage, but it's just another form of boycott. If I organize a boycott against my local newspaper, then the advertisers suffer because fewer people read their ads. And such boycotts are known to even extend to boycotting the advertisers if things get bad (and spam right has gotten very bad already). Is that fair to the advertisers? Of course not. But that's the nature of the activity; it is, among other things, trying to encourage the advertisers to cease advertising there. So in the same way, by boycotting a whole ISP address space, the idea is to encourage their customers to change to another ISP, until the ISP changes their ways.

Re:My latest Spam idea...

[Van Halen]

Yeah, and they won't even notice because no legislator actually reads his/her own email. That's what interns are for - they sort through all the spam and random, incoherent ramblings of wacko constituents to find the messages that are actually worthwhile. Most of these get a nice form letter reply several months later, and the few who are lucky enough to be considered really important by the intern are printed out and put on the legislator's desk.

While I'm sure some legislators are computer-savvy enough to read email (and do), don't think it's not filtered by another human first. As I was telling a friend just last night, I don't think there will be any serious legal crackdown on spam until legislators have to deal with it personally. A few steps have been taken in the right direction in a few places, but by and large it's a non-issue to them. If anything, many are probably afraid to do something because it "could hurt the economy." Oh, the poor spammers, they might have to get real jobs... :)

Re:It's not full proof

[infiniti99]

And to do that they have to use a valid return address, thus ending their SPAM operation quickly (see other threads about this).

Do you punish the innocent to get at the guilty

[btempleton]

What amazes me about the spam fight is how much it has led people to promote the idea of punishing the innocent in order to get at the guilty.

People who would have fought with vigour against punishing the innocent in other fields seem willing to give it up, in of all places, the free speech question of who can email whom.

Yikes. We are willing to let murderers go to make sure we don't punish the innocent. Yet for some reason spam makes people think it's OK to trample on the free speech rights of the innocent to get not a murderer, but a spammer. I hate spammers as much as anybody -- I get 120 per day -- but let's keep them in perspective.

The most common justification is the canard that it's not about speech it's about property. Problem is all use of the internet involves using somebody else's property. On the internet there is no speech without the use of other people's property, and thus no unsolicited communication without the unsolicited use of somebody else's property. This makes it very tough to solve by thinking of it as a property issue.

There are other, better methods that don't generate false positives or generate extremely few. I've written extensively on them.

Re:Do you punish the innocent to get at the guilty

[buss_error]

What amazes me about the spam fight is how much it has led people to promote the idea of punishing the innocent in order to get at the guilty.

My take on this is that it is the fault of the ISP that won't take action against spammers. If all it took to stop spam was to inform the ISP of the violation, then there wouldn't be a need for RBL's.

The most common justification is the canard that it's not about speech it's about property.

Then can I use your computing resources for things you don't want me to do? Can I dump the contents of the pig sty in your car because I don't want to pay someone to haul it away? You see, the issue is exactly property. If some one wants to sell herbal Viagra, fine. Don't use my computer to do it. Is that unreasonable? Does that mean I don't support free speach?

Yikes. We are willing to let murderers go to make sure we don't punish the innocent.

There isn't anything innocent about spamming. You are doing it to make a buck or are too lazy or ignorant to secure your server. Unlike murder, spam sources can be traced back to someone. Real life crimes can't, always. At least, not beyond a reasonable doubt. Notable exceptions aside.

On the internet there is no speech without the use of other people's property,

I never visit the www.bestbeast.com web page, and I don't care to. Ipso facto it doesn't use my property to engage in speech. On the other hand, splattering their spam all over my e-mail account (100 at last count) DOES use my property, and it pisses me off.

There are other, better methods that don't generate false positives or generate extremely few. I've written extensively on them.

So where are the links to this?

Re:Do you punish the innocent to get at the guilty

[ShaunC]

What amazes me about the spam fight is how much it has led people to promote the idea of punishing the innocent in order to get at the guilty.

That's the rub, though; some of us don't see the "innocents" as innocent at all. Non-spamming customers of a spam-friendly ISP are paying money to that spam-friendly ISP, and thus supporting the spam-friendly ISP. That's not really innocent in my book.

People who would have fought with vigour against punishing the innocent in other fields seem willing to give it up, in of all places, the free speech question of who can email whom.

It isn't a free speech question. The internet is not owned by the government, my mail server is not owned by the government, blocklists are not operated by the government (at least not any that I'm aware). Thus the "free speech" argument doesn't apply. These are private servers owned by private companies and individuals who are free to make their own rules. Having your host or IP range placed onto a blocklist doesn't magically prevent you from sending email; someone on the other end has to willingly implement that blocklist, the intended recipient has already made the choice that they don't want to hear from you. So long as it's not the government doing the implementing, free speech is a red herring.

Yikes. We are willing to let murderers go to make sure we don't punish the innocent. Yet for some reason spam makes people think it's OK to trample on the free speech rights of the innocent to get not a murderer, but a spammer.

Murder is a crime. Murderers are often punished by being thrown in jail for life, or even executed in some places. There's absolutely zero room for false positives or collateral damage when it comes to these punishments. I think a comparison between murder and spam is a bit severe, especially at a point where spamming itself (ignoring common side effects like potentially criminal abuse of open relays, etc) is not a crime in many places. And again, it's not a free speech issue.

Since you mentioned murder, I'll add my own parallel to offline crime. When a strip club is caught offering "escorts" (wink) to customers who request them, what happens? Around here, the entire strip club is shut down. Law-abiding customers get caught up as "collateral damage" since they can't visit that club anymore. They wind up having to find a new shake joint, one that isn't a party to prostitution. While this analogy, too, is a bit tangential to the spam problem, I think it's a bit more in line with what blocklists accomplish. If you're using an ISP who proudly pimps for spammers, don't be surprised if the place is shut down (either in a literal sense, or an "I can't email anyone anymore" sense) and you have to find a new one.

The most common justification is the canard that it's not about speech it's about property. Problem is all use of the internet involves using somebody else's property. On the internet there is no speech without the use of other people's property, and thus no unsolicited communication without the unsolicited use of somebody else's property. This makes it very tough to solve by thinking of it as a property issue.

I don't find it tough at all. My server, my rules, I'll accept mail from whomever I want and I'll refuse mail from whomever I want. I don't receive legitimate communications from China or Korea so I don't see a need to accept mail from those places. I do get legitimate email from AOL, so (perhaps begrudgingly) I have to accept their traffic. You're free to do the exact same thing, suited to your own requirements. Where's the problem?

Shaun

Re:Do you punish the innocent to get at the guilty

[btempleton]

So where did you stand when laws wanted to blame the ISP for porn, or copyright violations by their users? But the ISPs aren't the innocent I'm talking about? I'm talking about the users. If a murderer was hiding in a neighbourhood, would you kill one innocent neighbour per hour until the neighbours got together and rooted him out?

All internet traffic uses the property of others. We designed the internet on an "I pay for my end, you pay for your end and we don't sweath the packets" basis. Why not fight spam without tearing that down, without declaring that communication is property abuse. How can you have a free society if communication is property abuse?

Re:Do you punish the innocent to get at the guilty

[Skapare]

If you don't boycott the bad ISPs ... the ones that keep signing up spammers who leave their previous ISP so they can have new address space not yet listed ... then spammers will constantly be showing up at new addresses, and listing them does little good. You have to boycott bad ISPs (the ones who harbor spammers) to make them either turn good, or move the good customers off to a better ISP. Of course there will be "collateral damage" ... but not to the ISPs that respond appropriately and cut off spammers. The non-spamming customers can complain to the ISP (this is part of the motive) or just move to another ISP.

Being listed in a blacklist is not the same as being indicted for a crime. It's a boycott. Different rules. Different standards. If you think that SPEWS, for example, has more collateral damage than you want your mail server to participate in, then don't use it.

Free speech is not about making sure everyone gets to say whatever they want to whoever they want however they want. It's about making sure government doesn't step in and limit it. Free speech cannot be used to justify stealing my printing press. Indeed, such a theft would deprive me of my right to free speech in such a case. Likewise, you have no right to steal my network server time for your own speech. I own it for mine (or that of my customers who pay me for its use). This is why it's a property issue. It's no tougher for me to deal with theft of my server time than dealing with theft of my printing press.

If you are communicating with me about matters we have a relationship based common interest in, then that is expected and fine. For example if you were to e-mail your reply to this post, that is reasonable to expect because by posting this (even if it wasn't in response to yours), there is an implied expectation of a response. Trying to sell me penis enlargers, golf balls, ink cartridges, and mortgages is not applicable communication, unless I asked (in some form) where I could find those things to buy.

If you really have written about better methods that don't generate false positives, then please show me, and please point out specific ways these methods work to drive incentives to ISPs to disconnect spammers and to not sign up at all known spammers. Spamming will not decline if ISPs have no counter incentive (to the revenues) to choose to not allow spammers in their network.

Re:Do you punish the innocent to get at the guilty

[btempleton]

Free speech is about free speech. The first amendment is about limiting the government's ability to infringe on free speech.

Do you really believe that only the government has a moral duty to consider how their actions affect free speech? Yes, the government is the one with the <b>legal</b> duty to not infringe on free speech, but free speech is more than just the law, it's a good idea!

Yes, we <i>can</i> boycott who we chose, including the innocent. But should we? Is it a desireable state? We're replacing the old means of speech with a new one, one that relies entirely on private property. How should we design it? Does designing it to run entirely on private property mean that we want private property rights to trump the old rights the founders of the USA felt fit to write into the constitution?

These are hard questions, not necessarily rhetorical, since clearly some writers here do think that now that we've escaped the bounds of government we should ignore the principles it was designed with in free states.

There are other ways to punish bad ISPs without blocking the mail of innocent users. In particular, the obvious one rarely implemented is not to block mail from sites but to throttle its volume down, so that individual mails go through and bulk mails are blocked. A coordinated effort to do this, as I have written about on my web site, would cause vastly less collateral damage.

Do we have a duty to not cause collateral damage? I think so.

Re:Do you punish the innocent to get at the guilty

[Halo1]

But the ISP's only exist by the grace of the users. The users pay the ISP's, without them there wouldn't be an ISP. And you analogy is completely bogus: people aren't being killed (ie. their IP-addresses aren't being "destroyed" forever). A better analogy, which is often used, is that the spam-supporting (or-ignorant) ISP is similar to bad neighbourhood with lots of gangs and junks etc, and that the recipient of the mails refuses to do business with anyone from there based on that fact.

The only thing necessary to rectify this situation, is that the neighbourhood must be cleaned up. And contrary to "cleaning up a neighbourhood" in real life, cleaning up an ISP by kicking all the spammers is doable in a fairly short period with not that much effort (unless the spammers sue the ISP, although in the end they've always lost until now).

The Internet was indeed designed with the philosophy you mention. And unfortunately, due the spammers, it's become impossible to keep working that way. Just read this article: AT&T's spamfilter fails during a spam avalanche -> their mail servers get overloaded, spam costs the total economy worldwide about $8.6 billion a year, ... Isn't that property abuse? Note that no-one is saying that communication an sich is property abuse, but using other people's equipment (without their conscent) to distribute your commercial messages is. It's as if telemarketeers would call you and you had to pay for that. Would you accept that also in the name of freedom of communication?

It's the same with mail servers: originally, they were setup so that anyone could send mail through any mailservers. But then the spammers started using those servers so that a) they can send one copy of the message and 1000 BCC-recipients to it putting most of the distribution burden on that server and b) they are slightly harder to trace, so now all servers should be configured so that they only relay for the intended domains. It's really sad that it has come this far, but I think you cannot blame blacklists for that; after all, they were simply a reaction to the increasing abuse.

On the topic of blacklists: they are all lists of IP-addresses published by individuals or groups of individuals. These people say: we do not accept mail sent from these IP-addresses because (they are open mail relays|they belong to spam-supporting/ignorant ISP's|...). You can also use this list to block mail if you want. No-one's stepping on anyones free speech rights here (the blacklist maintainers simply voice an opinion, they personally don't block mail sent to anyone but themselves). The only problem that can occur here, is that when an ISP uses such a list without clearly informing their customers. But that's a problem with the ISP, not with the list.

After all, even if the list didn't exist, the ISP could still filter mail using its own filters or blacklists. And as long they clearly inform their customers about this, there is no problem: it's their property and their bandwidth that is being used to annoy the hell out of their customers. Some of those customers may prefer to have no filters (since I'm quite sure it's impossible to design a filter without any false positives) and more spam. Then they should not take an account at that ISP (as I've said before, this filtering should be indicated clearly), or maybe the ISP could offer a (more expensive?) unfiltered account to people that want it.

If you don't have that choice for one reason of another, then I still think the only ones to blame for your problem are the spammers: if they didn't spam, there would be no need for blacklists or filtering and everybody would be happy. The rest are just symptoms of the root cause. And while blacklists mainly combat the symptoms (spam instead of the spammers), it's unfortunate that there are simply no better ways (that I know of) in most cases (only if you live in certain states of the US and have lots of time on your hands and manage to track down the spammer, then you can sue him).


Jonas

Re:Do you punish the innocent to get at the guilty

[btempleton]

This is not about whether you can publish or use a blacklist. I think you can (at least until it becomes monopolistic, then other legal questions appear.)

THe issue at hand is the morality of blacklists and other tools which use punishment of the innocent as their means to get at the guilty. We don't tolerate that pratice in the other ways we try to regulate our lives, and it's curious that we tolerate it here.

As noted in the story, blacklisters are blocking off real innocent people. And people who don't know about it and don't ask for it are getting mail blocked that they wanted to receive.

John Gilmore, going to extremes to make a point about his own freedoms, got kicked off the internet not because his system was being used for spamming (he had his own techniques for blocking relay abuse) but because he and the blacklisters disagreed about how he should stop spam on his mailserver.

Doesn't the idea of "Run things our way or you don't get to communicate with others on the internet" bother you at all?

Shouldn't we try other methods, that don't punish the innocent, or which punish them as little as possible, if these methods are available to us?

Like I said, protection of free speech isn't just a law, it's a good idea.

Remember, with this technique it's not collateral damage. Collateral damage is what happens when you are trying to bomb a military target, and civilians are killed by shrapnel.

Blacklisting ISPs is like saying "bomb the civilians until they rise up and destroy the military target in their neighbourhood."

Effective perhaps, but moral? (And not always effective. It's our technique on Iraq right now, starve the civilians until they punt the bad guy.)

Re:Do you punish the innocent to get at the guilty

[Erik Fish]

The internet does not have a police force and it does not have a military to ensure that abuse does not occur. Instead the internet is self-regulating in a very frontier justice fashion: Everyone has a claim staked and if you trespass on someone else's claim and violate netiquette anything might happen -- from "nothing" to "orbital anvil to the skull".

Ever heard of MAPS? They worked very hard to educate spammers and ISPs before blocking the un-educable ones. Why are tougher blocklists that do not provide a strong educational component now employed instead of MAPS? Because the spammers and rogue ISPs abused MAPS by playing dumb and getting extension after extension to clean things up while crying crocodile tears and chuckling up their sleeves.

Your whining about "innocent" people being blocked does not impress me and nor should it impress anyone. These "innocents" are monetarily supporting spam-friendly ISPs and as such should be afforded no more respect than said ISP's themselves. Ignorance is no excuse: They chose to move into a bad neighborhood and now it's time for them to either move out or clean it up because if they don't nobody else is going to clean it up for them.

In case you haven't noticed, the face of the internet has changed a lot since it was first invented. At one time all it would take to stop spam from issuing forth from a host was a harsh word or two. These days complaints are useful only as proof that an ISP ignored them. Furthermore, local filtering/flagging of individual "potential spam" is also useless as it is clearly a temporary fix. How long before spammers and spamware vendors learn how to skirt SpamAssassin's filters? Such filters are inherently flawed as they rely on content while the spam issue is not about content -- it's about consent.

The current blacklists are entirely moral because e-mail is not sacrosanct. Nobody has a right -- morally or legally -- to deliver e-mail to anyone. Morally this is a perfectly reasonable stance as e-mail is not the sole means of communication. If what you have to say is so important that it can't risk getting blocked then you need to put a stamp on an envelope or dial a phone number.

Put shortly: The internet is based on trust and that trust has been abused far too often.

So far I've seen nothing from you but bitching, with no real solutions offered. You don't like blacklists but you can't seem to come up with anything as effective that doesn't offend your delicate morality. Sounds like you've got a personal problem.

Re:Do you punish the innocent to get at the guilty

[btempleton]

I have offered a wide variety of solutions.

however, this is a day old Slashdot thread, and nobody reads them after a day, so I'm out of here.

The solutions are on my web site.

Re:Do you punish the innocent to get at the guilty

[buss_error]

So where did you stand when laws wanted to blame the ISP for porn, or copyright violations by their users?
Firmly against it. As I said, I do support free speech, but I shouldn't have to be forced to contribute to speech I don't agree with.

But the ISPs aren't the innocent I'm talking about?
Yes and no. For instance, the ISP for bestbeast continues to allow the site to host on it's networks. That's fine, as long as BestBeast doesn't spam. When they do spam (and they don't do anything about it), then the ISP is tacsitly approving the use of force to promote speech to people that find that speech offensive. It's one thing to blast out mail to people that are into sex with anaminals, it's another to repeatedly do it to people that find that disgusting, don't want to see it, listen to it, and in fact never indicated they were interested in it. After all, and at least for now, I can hit mute or change channels on ads I don't want to see. BestBeast's ISP failure to take action against the site for spamming is the same as media companies taking over a televison to prevent mute or channel changing during an ad.

Question for you: How would you feel if BestBeast keep e-mailing your kids, even after an opt-out? Why should your kids see this if they never opted in?

If a murderer was hiding in a neighbourhood, would you kill one innocent neighbour per hour until the neighbours got together and rooted him out?
I see your point, and I can to some degree concede it. However, the cases are not exactly parallel. A better analogy would be a case where the LANDLORD was preventing the police from investing, and the police rousted out the neighbors to ask questions. This is what collateral damage to the ISP customers forces. The customers don't want to pay the "rent", 'cause the cops are been a bloody nuisance due to the landlords inaction or action.

All internet traffic uses the property of others. We designed the internet on an "I pay for my end, you pay for your end and we don't sweath the packets" basis.
Granted, and thank goodness too.

Why not fight spam without tearing that down, without declaring that communication is property abuse.
I'd be delighted to do that, and that would be the most rational way to go about it, if we didn't have a few bad apples spoiling the bunch.

How can you have a free society if communication is property abuse?
It isn't, as long as I agree to your communication. If I agree to hear you, no problem.

A good example is the communication I received from a brick-and-morter retail electronics store. (I can't get more specific than that.)

For three months, every week, I got an e-mail from this store listing the specials there. I never asked for these e-mails, they used my e-mail address I gave because the salesman said it would be used only for safty bullitens and recall notices.
Each time for a month, I clicked the "unsubscribe" button. I kept getting it. On the 5th e-mail, I e-mailed them to the postmaster account, with the unsubscribe notices. Two weeks, two more e-mail specials. I sent a registered letter. More time passes, more e-mails. I called, sent faxes, more e-mail, nothing. Only when I got the home phone number for the president of the company and told him I would call him each time I got another e-mail did it stop. (I also sent e-mail to every person's account I could find.) I called, e-mailed, faxed, and sent registered letters to their ISP too. They never responded at all, aside from automated responses.

I shouldn't have to do that, should I?

It's not spam if:

I agree to accept the e-mail contact, and they disclose exactly what e-mail I can expect.

My address isn't traded to onthers to send me things unrelated to what I agree to accept.

They stop the first time I ask. Don't start unless I ask.

They don't contact me about pottery when I signed up for model railroads.

I don't that the above is unreasonable. A web page about pottery doesn't bother me, but an e-mail about it would, when I didn't ask for it. And it would surely result in wrath if it kept being shoved at me when I ask it to stop.

I've viewed your pages, and I respect the contributions you have made. I even respect the views you express here, though I don't agree with them in all points. I think that e-mail is wonderful, and I think that in a world of people willing to live and let live, your point would be the best course. However, we live in a world distored by greed and selfish motives, and in that world, spam is a problem. It steals time, effort, resources, and the ability to communicate with others by increasing the signal to noise ratio. Sure, it's easy to hit delete on one message, but what about 1,400 a day? That's the figure I've seen if every business in the US sent just one e-mail a year to each person. And that isn't something most of use could deal with.

Re:Do you punish the innocent to get at the guilty

[Skapare]

Free speech is about free speech. The <b>first amendment</b> is about limiting the government's ability to infringe on free speech.

Do you really believe that only the government has a moral duty to consider how their actions affect free speech? Yes, the government is the one with the <b>legal</b> duty to not infringe on free speech, but free speech is more than just the law, it's a good idea!

So far I agree with you.

Yes, we <i>can</i> boycott who we chose, including the innocent. But should we? Is it a desireable state? We're replacing the old means of speech with a new one, one that relies entirely on private property. How should we design it? Does designing it to run entirely on private property mean that we want private property rights to trump the old rights the founders of the USA felt fit to write into the constitution?

I don't see private property being the issue. Speech has always been either based on private property (buy a printing press and start publishing) or public property (stand in the town square and start your speech and see if anyone has any interest). We're not designing anything to be private property; it's either private or it's public.

These are hard questions, not necessarily rhetorical, since clearly some writers here do think that now that we've escaped the bounds of government we should ignore the principles it was designed with in free states.

My right to free speech and my right to ignore anyone are equal rights to me. The only reason free speech is such an issue is because governments (and even corporations) so often try to suppress that right. That's been so extreme even hundreds of years ago that some people setting up a new government in the late 1700's decided to specifically address the issue that was a major problem. The right to ignore hasn't been a problem, but that doesn't make it any less of a right.

There are other ways to punish bad ISPs without blocking the mail of innocent users. In particular, the obvious one rarely implemented is not to block mail from sites but to throttle its volume down, so that individual mails go through and bulk mails are blocked. A coordinated effort to do this, as I have written about on my web site, would cause vastly less collateral damage.

While the spammer at an ISP is spewing out millions, I get one or a few. Throttling them has no effect. I still get hit by hundreds of different IP addresses. If the realm of throttling is just one IP at a time, it won't work. If it covers all the IPs as a group, it has adverse affect on everyone.

And worse, this idea removes the incentive, because then the ISP won't be losing customers. There has to be "collateral damage" to make the boycott have an impact on an ISP. Maybe this is surprising to you, but lots of ISPs make the decisions about how they do things based on what will yield them the greatest revenues and profits. If they don't feel that their customers will leave because of some action, then they will have no reason not to do so if they feel it will bring in some revenue. And that action might be to accept a known spammer as a customer.

Do we have a duty to not cause collateral damage? I think so.

What other mechanism of causing customers to leave an ISP is there besides "collateral damage"? Spammers have a duty to stop spamming. Let me know when they stop so I can resume listening to free speech.

Re:Do you punish the innocent to get at the guilty

[Halo1]

As I said in my previous post, blacklists are *not blocking anyone*. People who use the blacklists are blocking other people. If they decide that the advantage of reduced spam outweighs the disadvantage of bouncing some legitimate mails, then this is their and only their choice.


Jonas

Re:Do you punish the innocent to get at the guilty

[btempleton]

So we can't be critical of their choice, and debate the consequences for the future of E-mail as a medium?

Re:Do you punish the innocent to get at the guilty

[Halo1]

In this case, it indeed doesn't matter what you think about these people's choices, just like it doesn't matter what you think about people switching tv-channels when there are commercials playing (causing them to potentially miss the start of a very useful program), throwing away all dead-tree ads they get in the mail (and maybe occasionally a real letter that slipped in between?), ... You're of course free to say what you think about it, but it's not the real issue imho.

As I've said before, these blacklists and filtering are consequences of the spam problem. For several people, spam already makes email unusable as a communication medium if they don't filter it out. And if you don't filter, it's quite possible that you accidentally delete legitimate mails while wading through your spam (it has already happened to me). The only difference with automatic filtering is that you don't have to spend time doing it manually, which is a big plus.


Jonas

Sources, please

[alizard]

About one in 100 (somewhere between 1 in 50 and one in 200) people in the general population is a psychopath. This is a (set of?) brain disfunction(s) that amounts to "no conscience". (Think "colorblind" but with respect to harm-to-others. But it's not known yet whether it's genetic, foetal insult, or what.) Additionally there are "sociopaths" - similar symptoms but as a result of training and social factors rather than an organic problem.

I don't necessarily disagree, I just want to know where I can find the numbers, I might want to cite them some time.

Short of genocide against psychopaths we will continue to have a plague of spammers for at least

Why not limit the genocide to repeat spammers?Or simply remove all the civil rights of repeat spammers and let Darwin deal with them.

Re:This happens to me all the time

[Rick the Red]

The least they could do is update the FAQ when they change the system's behavior.

No, I'm wrong: the least they could do is what the actually do, which is nothing. Fucking stupid lazy /.

If they don't want off-topic posts about /. itself, why don't they provide a forum for discussing /.? Oh, I forgot, it's because they're fucking stupid lazy /.!

Postfix uses +

[danny]

Actually, postfix uses + for mail extensions, not -, though that is configurable.

Danny.

Hmmmm

[Convergence]

What do you know, I use TMDA too... Now, will our TMDA's get into an infinite loop asking each other for acknowledgements? If not, then I forge spam to look like a TMDA acknowledgement. And, tough luck.

Another thing about this that bugs me is that it doesn't save any time or solve any problems, it just pushes the problem onto someone else. That is not a solution.

I refuse to respond to any TMDA or other robot autoreply. You use it, and you're immediately added onto my blacklist and bitbucketed.. A blacklist of people who value other people so little that they should be ignored.. A blacklist that is public.

Re:Hmmmm

[infiniti99]

I refuse to respond to any TMDA or other robot autoreply. You use it, and you're immediately added onto my blacklist and bitbucketed.. A blacklist of people who value other people so little that they should be ignored.. A blacklist that is public.

I think you're taking this a bit too seriously. Consider the Jabber IM protocol, which already has a presence authorization system (ie, whitelist), and a server-to-server "dialback" protocol for preventing server spoofs. No one would ever complain about those features.

So then, why complain about TMDA (or others like it)? IMO, there is nothing wrong with what TMDA does, it is just providing a service that Email really should have had built-in.

Moderators on crack.

[jotaeleemeese]

Do you know what an ironic sentence is?

Re:Moderators on crack.

[Rupert]

Slashdot moderation is like Brownian motion. You can't see the little buggers that are doing it, and you can't know in advance which direction they're going to push you.

And since they're mostly American, I wouldn't expect many of them to understand irony.