Slashdot Mirror


Lessig On Bounties For Spamhunters

An anonymous reader submits: "Digital rights (as in yours, not the RIAA's) guru Lawrence Lessig comes up with a Swiftian idea of how to fight spammers -- $10,000 for the first ubergeek to hunt the offender down. The column is at CIO Insight. Wonder if it'll reach its audience there."

130 of 293 comments (clear)

  1. How much... by T3kno · · Score: 5, Funny

    How much would I get if I blew up the building that housed hotmail.com?

    --
    (B) + (D) + (B) + (D) = (K) + (&)
    1. Re:How much... by Tackhead · · Score: 5, Informative
      > How much would I get if I blew up the building that housed hotmail.com?

      Nothing. The spam doesn't come from Hotmail. Spammers forge hotmail.com dropboxes into the headers, but typically spam through dedicated machines hosted by spam-friendly providers.

      If someone were to go apeshit with a SuperSoaker full of saline solution in ELI.NET's or Level3's datacenter, for instance, your load of inbound spam would probably decrease substantially.

      There are some "ISPs" allegedly in Mexico and Brazil (but hosted via US-based backbones) that are no more than spammer fronts.

    2. Re:How much... by Doppler00 · · Score: 3, Funny

      Probably 20 years to life in prison.

    3. Re:How much... by AntiNorm · · Score: 2

      The spam doesn't come from Hotmail

      Some of it does. Hotmail likes to send its users MSN spam about once a month.

      --

      I pledge allegiance to the flag...
      of the Corporate States of America...
    4. Re:How much... by nizo · · Score: 3, Funny

      I couldn't tell from the article, do I have to bring the whole body in to collect, or is the head sufficient?

    5. Re:How much... by PhotoGuy · · Score: 2
      The spam doesn't come from Hotmail

      Is this true? I thought it was commonly known that if you create a hotmail account with a suitably obscure name xyxxaqqf2, and use it for nothing, and don't give out the address, you will receive spam (even after turning on hotmail's spam filters).

      This is either caused by MS allowing or sending the spam, or selling the addresses of all accounts (which is just as bad).

      Anyone know the true lowdown on this?

      --
      Love many, trust a few, do harm to none.
    6. Re:How much... by Dimensio · · Score: 2

      Hey, I'd pay if someone caused (and then demonstrated responsibility) the complete thermal annihilation of Level3's HQ.

      Or Qwest. A Qwest customer used Qwest's network to commit fraud, trespass, harassment and denial of service. Qwest's response was to give him a *WARNING*. Qwest openly tolerates criminal activity from their customers (Which shouldn't be surprising as Qwest has demonstratably engage in criminal activity in the past).

    7. Re:How much... by fliplap · · Score: 4, Funny

      Translation: I got owned by some 10 year old with netbus who stole my geocities password and replaced pictures of my wife with pictures of tranvestites.

    8. Re:How much... by Dimensio · · Score: 2

      No, dumbass, a crook named Clark Mankin (most ten year olds are smarter than he) signed up my e-mail address to hundreds of FFA links, resulting in a deluge of e-mail to my account.

    9. Re:How much... by God!+Awful · · Score: 2


      Is this true? I thought it was commonly known that if you create a hotmail account with a suitably obscure name xyxxaqqf2, and use it for nothing, and don't give out the address, you will receive spam (even after turning on hotmail's spam filters).

      When you sign up, the service will ask if you would like to be listed in the directory. Say no.

      -a

    10. Re:How much... by greenrd · · Score: 2
      Um no, isn't the more likely conclusion that the headers were forged?

      Always remember rules 1, 2 and 3. Spammers Lie.

  2. well, it's a start by Em+Emalb · · Score: 4, Interesting

    but it will only catch the stupid ones. The "smarter" ones, and I use the term loosely, will endure.

    --
    Sent from your iPad.
    1. Re:well, it's a start by Vinum · · Score: 4, Interesting

      Hmm... that kind of gave me a crazy idea.. but I am sure a lot of these spammers are also into credit card fraud. A corporation like VISA could collect spam and use a dummy credit card number that would validate normally... except that instead of them getting a check with money at the end of the month... the companies ability to clear cards through visa would be revoked. Furthermore, if the government would just make spam a freaking crime... this would be a nice way to bust the people doing this stuff..

      Because face it, most of these spammers are located in America even if they are going through Chinese relays and such.

      I am sure someone will reply to this and give me 10 reasons why this will never work. But either way, its fun for discussion. :)

    2. Re:well, it's a start by m0nkyman · · Score: 2

      Not just the smarter one, but also the spammers from every other country. Looking at my Junk box, I'd say that 90% is from Korea, 5% Russia, and the rest is unknown. In other words, yipee skipee.

      --
      ~ a low user id is no indication I have a clue what I'm talking about.
  3. Take a lesson from astronomy by PD · · Score: 5, Funny

    The first one to find a spammer gets to name it. Well, maybe not such a good idea after all...

  4. Bounty Application for BC by FFFish · · Score: 2

    I've been thinking the same thing, but applied to my Provincial Government. Start up a pool, a buck per citizen. Whoever removes Gordon Campbell, our current, fascist prick-in-office, takes the pot.

    I'm pretty sure there'd be enough donations to make it well worth someone's time...

    --

    --
    Don't like it? Respond with words, not karma.
    1. Re:Bounty Application for BC by slickwillie · · Score: 2

      In the 50's (make that the 1950's), in an effort to reduce to coyote population, the state of Kansas offered $50 for a pair of coyote ears. How about $5000 for each spammer's ear?

  5. The opposite is needed by PD · · Score: 5, Interesting

    For a period of one month, all filters on spam and spam hunting should be suspended. Part of the problem is that anti-spam activities are masking the true magnitude of the problem. A wake-up call is needed. When people realize just how much spam is being sent out, the villagers will take to the streets with pitchforks and torches.

    1. Re:The opposite is needed by taernim · · Score: 5, Funny

      In a related story:

      tired of spam?
      we am sure you are too! my government has agreed to pay the sum of $34,004,267 to help you fight these spam persons. yes, it sounds much too good. but yes, this is truth. if you would like to join the fight, we only need your bank routing number and complete address. we will soon win by helping you help us help you.

      (Check out this article if you somehow miss the irony...)

      --
      "PC Load Letter? What the $@#% does that mean?!"
    2. Re:The opposite is needed by neuroticia · · Score: 2, Interesting

      No. For a period of one month, the Government needs to cease and desist anti-spam filters, and Bush needs to read his own email.

      After the 908'th offer for viagra, he'll either cave and buy it (and then hire an intern) or get pissed off and do something about it.

      Stopping the filters on the accounts of people who know about Spam isn't going to do a goddamned thing. WE're already pissed off by it. It's the gov't officials whose email is pre-filtered, sanitized, and delivered for their viewing pleasure, who need to experience the deluge.

      Better yet- remove their filters, and put their email addresses on the internet. Someplace like Slashdot.

      -Sara

  6. Privacy implications are dire by I+Am+The+Owl · · Score: 3, Interesting
    Why the sudden turn around in Slashdot rhetoric?

    I can see the sense in promoting our rights to privacy online, as michael and timothy (bless them) are wont to do, but then we see a sudden reversal. Sure, I guess it's a real pain when spammers send hundreds of unwanted messages over the Internet every day, but is offering a bounty to rob them of their right to privacy really the answer? This is just the government turning citizen against fellow citizen in a foul ploy to get us to turn in our rights to online privacy. Let's look at what's happened so far:

    • Spammers send spam
    • Geek gets pissed, deletes spam
    Now that isn't that terrible, is it? Do we really need to go out and promote a database state and tie together all a person's Constitutionally private information into one big heap of spying and ratting out? I dislike spam as much as the next man, but I draw the line at violating others' online rights. It's a line nobody should be willing to cross.
    --

    --sdem
    1. Re:Privacy implications are dire by kevin+lyda · · Score: 2

      in normal human interaction i get to see who i'm talking to. no one has the right to one-way communication between private parties.

      there might be some concern about communications between a private person and a person acting on behalf of the government, but then again that's not what we're talking about.

      to put it more directly: you've dressed up mr. strawman all cute-n-cuddly but ya know what? he's still a fucking bundle of straw. piss off.

      --
      US Citizen living abroad? Register to vote!
    2. Re:Privacy implications are dire by Lord_Slepnir · · Score: 3, Interesting
      What about my rights to not have my inbox clogged up with offers for inkjets and penis enlargements. 10 spams a day is an annoyance, but my university account gets 50-60+ a day if i turn off the spam filters. So now not only do i have to configure my spam filters on my mail server and waste CPU time and disk space, (I know that they're small, but my mail server is a P/166 that i got for $30, so every bit counts) but I have to figure out which ones of the few that get through are legit and which ones aren't.

      It wasn't so bad before, with spammers being blatent, but now that they are using more under-handed by disguising their addresses and subjects to look legit. Do you know how many times I've opened an e-mail that has a subject as just "hi" or "a quick question" and having some really disgusting porn pop up on my computer.

      In short, a spammer does have a right to free speech, but that right ends where my right to not be harrassed begins. (yes, i know that the right to not be harrassed isn't a constitutionally protected right)

    3. Re:Privacy implications are dire by silentbozo · · Score: 2

      Do you know how many times I've opened an e-mail that has a subject as just "hi" or "a quick question" and having some really disgusting porn pop up [goatse.cx] on my computer.

      I run Eudora 1.5.1 to avoid HTML and nasty javascript payloads like that. That maybe taking things a little far, but I like having a mail client that doesn't spread worms, and is able to hold an inbox of 8000 messages without crashing. On another note, I really need to take some vacation time and get through that backlog of e-mail...

      Oh, and if you have shell access to your mail account, and procmail capability, consider installing Spamassassin. It catches 95% of the spam that comes my way, with maybe a .5% false positive (both of which are easily adjusted by adding and subtracting names and domains from the user-configurable whitelist/blacklists.)

    4. Re:Privacy implications are dire by Anonymous Coward · · Score: 2, Interesting
      "I can see the sense in promoting our rights to privacy online"


      1. Advertisers have no such right. They are legally obligated to both identify theselves and to truthfully describe the product they are selling

      2. Violators of the rights of others have no such right. Both the government and the individuals violated have the right to use such information to seek a remedy.


      Spammers gave up their right to privacy when they used my e-mail account (which I, not they, pay for) without my express permission. At the very least, as the rightful owner of the account and all e-mails therein, I should be free to distribute and use the information I have on spammers as I see fit.

      "Spammer sends spam, Geek gets pissed, deletes spam Now that isn't that terrible, is it?"

      Geek owns e-mail account. Geek pays for upkeep of e-mail server, be it directly or indirectly. Geek works for a living to pay for these luxuries. Spammers use other peopless property without either permission or compensation for personal gain.

      Yes, it is that terrible

      "I draw the line at violating others' online rights"

      Huh? Do you work for a spammer or something?

      Stop trying to sugar-coat this issue with words like "free speech" and "on-line privacy." Spam boils down to the even more basic right of property ownership. The First Amendment doesn't say you can spraypaint your speech on somebody else's wall. The Fourth Amendment doesn't prevent Blockbuster Video from requiring you to identify yourself before renting you their movies.

      When you start violating other peoples' rights, including property rights, you "lose" many of your own. The owner of the property has the right to seek compensation from the violator and the government exists to help them. Suddenly, seizures like putting a lien on a spammer's car become "reasonable" in the eyes of the courts.

      The only person's rights who have been violated are my own. If anything, the Fourth Amendment is on my side, guaranteeing my right to track down and bill/sue the spammers for using my personal effects unreasonably.
    5. Re:Privacy implications are dire by silentbozo · · Score: 2

      It's a great mail client - and the Applescript support is an excellent! But you have to admit, version 1.5.1 (the one from 1995, pre-dating Qualcomm, and Eudora Pro/Light, and thus, pre-dating HTML mail support) is a bit old...

      I couldn't read HTML mail even if I wanted to!

    6. Re:Privacy implications are dire by djrogers · · Score: 2

      Right to privacy? Hunh? Spam is one of two things

      1) Fraudulent
      2) A Legitimate commercial offer

      How do you extend a PERSONAL right of privacy to either of the above? If it's 1 it's illegal, and if it's 2 it's a business. Where's the personal privacy issue?

      --
      Think outside the... Hey, where'd the friggin' box go?
    7. Re:Privacy implications are dire by neocon · · Score: 2

      Interesting. So can we assume that you never send or receive postal mail? Really?

    8. Re:Privacy implications are dire by kevin+lyda · · Score: 2

      really, you mean the service in the states that's policed by the us postal inspectors? you're aware that if i were to receive pretty much any spam i now get by email by the usps instead i could report it to the uspi, yes? most spam i get is illegal - pyramid schemes, fraud and illegal services. and the only way to economically do mail shots is to get the mail registered as junk mail which the post office can track.

      so yeah, i do get mail. and while it can be one-way comms if it's in any way illegal i can get my government to track those people down.

      --
      US Citizen living abroad? Register to vote!
    9. Re:Privacy implications are dire by neocon · · Score: 2

      None of which interferes with your ability to send postal mail anonymously or even untraceably, both abilities which we as a society have decided we consider valuable.

      Besides -- if tracking illegal postal mail were as easy as you seem to suggest, we would have arrested the Anthrax terrorist some time ago, now wouldn't we have?

  7. uhh, missing something here by Telastyn · · Score: 5, Interesting
    from the article:

    But at least with the spam problem, there is a much simpler solution that, so far, Congress has failed to see. Imagine a law that had two parts--a labeling part and a bounty part. Part A says that any unsolicited commercial e-mail must include in its subject line the tag [ADV:]. Part B says that the first person to track down a spammer violating the labeling requirement will, upon providing proof to the Federal Trade Commission, be entitled to $10,000 to be paid by the spammer.


    From California Spam law:
    (g) In the case of e-mail that consists of unsolicited advertising material for the lease, sale, rental, gift offer, or other disposition of any realty, goods, services, or extension of credit, the subject line of each and every message shall include "ADV:" as the first four characters. If these messages contain information that consists of unsolicited advertising material for the lease, sale, rental, gift offer, or other disposition of any realty, goods, services, or extension of credit, that may only be viewed, purchased, rented, leased, or held in possession by an individual 18 years of age and older, the subject line of each and every message shall include "ADV:ADLT" as the first eight characters.


    and

    (f) (1) In addition to any other action available under law, any electronic mail service provider whose policy on unsolicited electronic mail advertisements is violated as provided in this section may bring a civil action to recover the actual monetary loss suffered by that provider by reason of that violation, or liquidated damages of fifty dollars ($50) for each electronic mail message initiated or delivered in violation of this section, up to a maximum of twenty-five thousand dollars ($25,000) per day, whichever amount is greater.


    Very similar...

    1. Re:uhh, missing something here by Alsee · · Score: 5, Insightful

      ($50) for each electronic mail message initiated or delivered in violation of this section, up to a maximum of twenty-five thousand dollars ($25,000) per day

      That part of the law is severely broken. They hit the $25,000 cap after the first 500 spams per day. The bigger spammers send MILLIONS of spams per day. At 1 millions spams per day the fine is 2.5 cents per spam, and at 10 millions spams per day the fine is one-fourth of a cent.

      As they can crank up the volume of spam the fine approaches zero. The fine becomes an acceptable cost of doing bussiness.

      Before anyone replies to point out the phrase "whichever amount is greater", that phrase reffers to proving "actual monetary loss suffered" which aint gonna happen.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    2. Re:uhh, missing something here by Random+Data · · Score: 2, Interesting

      That part of the law is severely broken. They hit the $25,000 cap after the first 500 spams per day. The bigger spammers send MILLIONS of spams per day. At 1 millions spams per day the fine is 2.5 cents per spam, and at 10 millions spams per day the fine is one-fourth of a cent.

      IANAL, nor do I play on on /. . But I did notice that this is applicable to "any electronic mail service provider whose policy... is violated". Run your own mail server? Then you've got the right to seek civil damages. Unless you're getting in excess of 500 messages a day from a single source, you're not going to hit that cap. If the admin of every server the mail passed through sought damages the expenses mount up very quickly. And realistically $25K a day is going to pay for a shitload of bandwidth in receiving that spam. Now I'm just waiting for the 1) Receive spam post....

    3. Re:uhh, missing something here by Alsee · · Score: 2

      Hmmm, good point. I didn't realize it was phrased as $25,000 per target. I pretty much thought about it from the point of view of a class-action suit.

      IANAL, nor do I play one on TV, but maybe I play an actor (who plays a lawyer on TV) on TV.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    4. Re:uhh, missing something here by poot_rootbeer · · Score: 2


      Paying the fines can only become an 'acceptable cost of business' if the spammers are pulling in enough money to be able to afford a $25,000 in fines every day, plus legal costs... I'm sure there are some spamhauses that are big, but not THAT big.

  8. Re:Good idea by shess · · Score: 2

    Huh, so I guess that means you didn't read the article, eh?

  9. First Caught Spammer by DarkHelmet · · Score: 5, Funny

    I have a bunch of female friends that forward letters endlessly to the point that they're no longer my friends. I'd love to put one of their heads on a stick and turn them in for 10k. Do they count? :)

    --
    /^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
    1. Re:First Caught Spammer by fobbman · · Score: 2

      I filter emails looking for the character sequence FW in the subject. Gets `em every time.

    2. Re:First Caught Spammer by unicron · · Score: 2

      You lie, you don't know any chicks. :)

      Triumph: Have you ever talked to a woman without first having to give your credit card number?

      --
      Finally, math books without any of that base 6 crap in them.
    3. Re:First Caught Spammer by rossz · · Score: 2

      I have subject filters in sendmail that bounces any message with two or more of fwd: or fw:. I allow the single forward through because they are almost always legitimate.

      I installed the filters because of my two sisters and my mother. They simply refused to believe me when I told them to "stop sending me that shit!".

      Another filter I'm considering but haven't gotten around to writing is one that counts the number of recipients and bounces if it is over a threshold. You know those emails. Sent to 200 people you don't know and BCC was not used (followed up by several dozen reply-all's from more clueless idiots).

      --
      -- Will program for bandwidth
    4. Re:First Caught Spammer by GigsVT · · Score: 2, Funny

      You've got to understand, women are, in general, stupid and gullible. Religious older women are at least doubly more so. They have no concept of reality, past what is told them, so when someone says that LSD has rat poison in it, or that someone woke up with their kidneys missing, they are likely to believe it. I mean, if they buy the stuff about a big imaginary old white guy that is all powerful and all good, other things are trivial in comparison.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    5. Re:First Caught Spammer by dvk · · Score: 2

      > You have female friends? As a female this surprises me.

      I fail to see why you'd be surprised?

      If you were referring to him being anti-female, all I can say is: I'm not mysoginistic (sp?) for most part, but ALL (100%) of the mega-forwarded crap I've been sent (totalling over 1000 pieces over the years by my estimate), was sent by women, mostly friends and relatives. Crap = urban legents, stupid petitions, chain letters, etc... Some came from women who were just plain dumb, some from women who generally were VERY intelligent (including my mom, who probably has better IQ than me overall :)

      If you refer to the fact that he (/.-ing geek) has any female friends: I used to have TONS of female friends, precisely due to the qualities which made me the uber-geek undesirable for dating :)

      [ then again, those same qualities were one of the reasons my wife said "yes" when I proposed, so not all is lost for us geeks as species ;) ]

      > But consider yourself lucky -- most slashdotters would kill to be in your position.

      Actually, i would guess those male /.ters who have been in that position might disagree - having lots of female friends will not benefit ones romantic life, and may actually mean a lot less sucess with women (usually - although not always - female friend is a woman who thinks you're a nifty guy to get help/advice/psychological support from but not good/hot enough to date. That means you spend more time socializing with them - detracting from time avialable for romantic life; and may also mean a lot of women don't see you as the dateable type, for whatever reason).

      Cheers,
      DVK

      --
      "The right to figure things out for yourself is the only true freedom everyone shares. Go use it"-R.A.Heinlein
  10. This problem cannot be solved! by FreeLinux · · Score: 4, Insightful

    The thing is that SPAM works! If it wasn't profitable no one would bother with it but, it is profitable. Highly profitable! So long as people keep buying from spammers spam will continue to infest the internet.

    Just like the Nigerian money scam, so long as people continue to fall for it, it will continue to circulate. Blacklists and other technology solutions will never be able to keep out all the spam. Legislation will never be effective against it. The only way to make it die is for people to stop buying from it and so far, it seems that there are far too many people who are insecure about their penis size for the spam to stop.

    1. Re:This problem cannot be solved! by jon787 · · Score: 2, Insightful

      It is profitable only because it is so cheap to do. If a spammer sends out 1 million messages and 1 person buys something he is making a profit!

      --
      X(7): A program for managing terminal windows. See also screen(1).
    2. Re:This problem cannot be solved! by Alsee · · Score: 5, Interesting

      The problem with spam is that the cost is basicly zero per-message. $X to send Y pieces of spam, X divided by Y works out to zero point zero cents per spam.

      The only way to make it die is for people to stop buying from it

      Not possible. Spam works at a response rate of 1 in 10,000. The general population contains a far higher rate of mental illness, senility, and retardation, not to mention just plain gullibility and stupidity.

      To to missquote something P.T. Barnum never said,
      The internet: a million suckers log on every minute.

      It seems to me that the only solution will come by a switch over to a new E-mail system that can link a non negligible co$t to all E-mail, or just to offending E-mail. This could be done with crypographicly signed "stamps".

      Would you be willing to attach 2 cents to each E-mail where the recipient of the mail gets the money? Send mail to your friend and he gets 2 cents, he send you mail and you get the 2 cents back.

      The other proposal I saw has much more expensive stamps, from 32 cents up to a few dollars. In that plan you you can keep re-using your stamps unless the recipient "redeems" the stamp. The idea is that it is generally "rude" to redeem a stamp. If you get legitimate mail from a friend or stranger you do nothing and it costs the sender nothing, if you get spam or otherwise offensive mail you click a button to redeem the stamp and the sender is out the money.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    3. Re:This problem cannot be solved! by Dynedain · · Score: 2

      I have been recieving spam since mid-1996. On average, accross the past years and my many email accounts, I can estimate 75 pieces of spam per day (most through AOL and hotmail of course).

      6 years x 75 spams/day = somewhere on the order of 164000 pieces of spam received.

      Of all of those, I have purchased something based on a spam-ad exactly once. And that was a special offer (buy anything and we'll throw this in free) from a reputable retailer I was planning on purchasing from anyways. The spam didn't originate from the retailer but from an advertising/spamming service. When I made my purchase/order I stripped all the identifying information from the URL so that the spammer wouldn't get the commission anyways.

      Where's the profit?

      --
      I'm out of my mind right now, but feel free to leave a message.....
    4. Re:This problem cannot be solved! by fermion · · Score: 2, Insightful
      Many of these proposals are good, however they require the cooperation of the same ISP who are currently cutting deals with spammers to increase their falling revenue. Likewise, cutting off open relays is also a good idea, but the whiners come back and complain that they did nothing wrong.

      The fact is I get junk mail, phone calls, and email. These cost me almost no money directly. It costs the phone company, post office, and ISP money. The phone company and post office are remunerated through charging higher fees. I assume, due to the lack of concern from ISPs that they are also remunerated for their costs.

      Don't believe me, let's look at the facts. I get a spam message with a forged Hotmail or Yahoo address. I send a note to this effect. I receive a reply saying that the address if forged and there is nothing they can do. I look up the address of the spammers site and send a note to everyone all the up to NetSol or RIPE. I invariably get a not back saying that the registrars are only responsible for the registration and not the content.

      As always, the truth is found by following the money. If spam was a real money losing issue, such as music piracy, the industry would be all over it. However, all we get are public relation solutions such as spam filter and denial or responsibility. I think the truth is obvious. There is way too much money to be made with spam on all levels to let it go.

      --
      "She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
    5. Re:This problem cannot be solved! by Our+Man+In+Redmond · · Score: 2

      Forget money. Time is more expensive to a spammer. If the default on mail systems were set to only send one email every fifteen seconds for any given connection, it wouldn't affect normal users who just want to mail something to a dozen people, it might allow a sysadmin to stop someone from sending that really funny joke to "all@mybigcorp.com", and it would make spam prohibitive because a million-piece run would take over three months to send.

      That or the spammer would have to make a million connections to send a million mails in a short period of time. Someone would notice.

      --
      Someone you trust is one of us.
    6. Re:This problem cannot be solved! by Alsee · · Score: 2

      Many of these proposals are good, however they require the cooperation of the same ISP who are currently cutting deals with spammers

      No, they don't. Both proposals I listed were based on including a crypographic stamp in the email. The "stamp" is nothing more than a fancy piece of text. No need to involove any ISPs. All is takes as a smart mail-reader and someone running a webserver issuing stamps.

      It would be a completely voluntary choice to reject all e-mail without a stamp. Once a critical mass of people are using it, it would rapidly become a universal default and the spam will be dead.

      I hesitate to suggest it, but Microsoft could wipe out spam within 2 or 3 years if they tried. It would have to be done in a genuinely public-interest manner to work though. Release an OS with a stamp-enabled mail program. Release free updates for their mail programs back to at least Win95, and prefferably for Windows 3 as well. A DOS version would be icing on the cake. They need to run a server generating stamps. They also need to release OPEN SPECS so that this can be implemented on ALL operating systems, and so that others can run stamp servers as well.

      cutting deals with spammers to increase their falling revenue...
      I assume, due to the lack of concern from ISPs that they are also remunerated for their costs...
      If spam was a real money losing issue...
      There is way too much money to be made with spam on all levels to let it go.


      Yes, someone profits off of spam, but only at the unfair expense of other people. Those comments of yours all boil down to the same spammer fiction. The fiction that because the spammer is paying his ISP to send spam - perhaps even paying inflated rates for his connection - that what he is paying covers the costs of the spam. Spam arrives 50% postage due. Paying to send it does not pay the cost of delivery. It is easy to come up with cases were the receipient of the spam has to pay more in download costs than the spammer paid to sent it. And don't even try to say spam advertizing is like TV advertizing, it isn't. TV commercials pay for the TV programming. SPAM is in no way linked to any positive benefit to the receiver.

      But really, the cash costs are small. It is the cumulative cost in time that is the real problem. In an article a spammer was quoted as sending 20 million spam per week. Lets assume that it takes an average of one second per spam to look at the spam subject/sender, spot that it is spam, and delete it. That means it takes 20 million seconds to delete. That is 5555.5 man-hours killed just to delete ONE spammer's BATCH-OF-THE-WEEK! Even at minimum wage that is a cost of over $28,000.

      That kind of cost to the pubic, per spammer, per week, is a problem that cannot be toterated, and it's only getting worse. Selfishly profiting at the unfair expense of other people is a pretty good definition of "evil". More and more people are getting internet access every day. The spam problem must be eliminated for e-mail to become more useful.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    7. Re:This problem cannot be solved! by Alsee · · Score: 2

      Yeah, it might happen, but that's fine by me.

      Bcc: { insert 5 million other suckers }

      He just spent $100,000 in stamps.

      I only have two pennies to rub together, and I just spent them sending you this very email message.

      Maybe I'll think "thanks for the 2 cents" while I hit the delete key.

      I don't see a problem :)

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    8. Re:This problem cannot be solved! by Alsee · · Score: 2

      If the default on mail systems were set to only send one email every fifteen seconds for any given connection

      The big problem with that system is that it fails if any mail server does not implement the restrictions, or does not implement them perfectly, or gets hacked, or decides to cheat. All it itakes is one person to change the default delay to zero.

      If any of those things happens in the systems I described the system does not fail, the spam is rejected by all receivers who are using the system. The only points of vulnerability are the cryptographic system and the stamp servers. Having multiple stamp servers may increase the chance one will be compromized, but leaves the others intact. Recovery is as simple as taking that stamp server off your "approved" list.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  11. Disgusting. by Fat+Casper · · Score: 2, Interesting
    I think I'm going to be sick.

    The author compares the bill that the RIAA bought to allow them to crack any box they want with the "spam vigilantes" that blacklist sites that don't obey "proper" e-mail etiquette and then by organizing automated boycotts of the sites on the list.

    His explanation of the bill is Through his bill, these vigilantes would be granted immunity from liability as they deployed tools to hack peer-to-peer systems that they "reasonably believe" violate copyright laws. He compares the two as unaccountable processes that wrongfully victimize people.

    He then proposes (drum roll) a law that spammers would have to follow, and a reward for geeks who catch them if they don't. Like they'll follow laws. Blacklisting servers is better; it slaps the stupid admins pretty hard for victimizing everyone else. It also slaps folks like that stupid "internet lawyer" and Bernie Schifman. There's a public good- actual, relevant punishment for offenders.

    --
    I spent a year in Iraq looking for WMD and all I found was this lousy sig.
    1. Re:Disgusting. by Sylver+Dragon · · Score: 2

      Not to mention that he missed one very important difference between hacking my system and blocklists.
      Choice.
      I don't have to subscribe to a blocklist. I can choose to accept all e-mail or to use the list and block the servers listed on it. Even on free e-mail sites, such as Yahoo!, I can turn the spam filter on or off, at my discresion. The filtering of e-mail through the use of block lists is a very good way of exercising my rights. Sure, you have the right to say what you want, but I don't have to listen to you.
      There is nothing being done, with blocklists, that prohibits, or detracts from free-speech. All it does is provide a ready-made filter that removes content which the subscriber does not want to hear.
      On the other hand, Lessing brings up the Berman bill. Which, as we all know, allows people to access your system, without your consent, or knowledge. And protects them from liability if they do any damage in the process. I don't have any choice in the matter, they decide they want to format my hard-drive, they can do it.
      The article is comparing two completly disseparate things. Apples and oranges, as the saying goes. A service that I can pay for if I want it, and a free license to DoS someone.
      Though, on a side note, if Berman's bill does pass, anyone up for starting a group that holds patents, and then goes around the net cracking un-protected systems and deleting the entire contents of people's hard-drives. Maybe start off poking around the RIAA's and MPAA's networks. Afterall, they might have had some of the copyrighted works on thier system, and we would not be held liable for losses or damages if Berman get's his way.

      --
      Necessity is the mother of invention.
      Laziness is the father.
  12. Related point: by mmol_6453 · · Score: 2

    Does my family get paid compensation if I get gunned down while searching?

    This is big business...with only slightly more positive moral compunctions than drugs.

    --
    What's this Submit thingy do?
  13. Hunt them down... and then what? by MongooseCN · · Score: 2

    Does he want them dead or alive? Or maybe just their head?

    1. Re:Hunt them down... and then what? by Dr+Caleb · · Score: 2
      Does he want them dead or alive? Or maybe just their head?

      Hehehehe....Fwwweeze wabbit!

      But I caution you, the meat is gamy and the pelts are useless...

      --
      "History doesn't repeat itself, but it does rhyme." Mark Twain
  14. ADV tagging useless to real advertisers by gentlewizard · · Score: 2

    The problem with tagging all commercial email with an identifier such as "ADV:" is that most recipients will simply create an email rule to auto-delete it and never even know it arrived.

    That's great for the recipients, but it does nothing to reduce the load on ISP servers; in fact, it may increase it as the advertisers will have to send out MORE mail to make sure at least somebody opens it.

    Also, such a solution does nothing to help legitimate advertisers, who need to know the demographics of who is actually reading their ad. If there is an easy way to filter, they may buy a list that is 90% middle class professional office workers, but they have no way of telling what mix actually read their ad. So they would never buy a service that operated under the "ADV" rules. Result: only the scam companies would ever send the mail.

    1. Re:ADV tagging useless to real advertisers by thogard · · Score: 2

      It would reduce the load on my server. The regex filters in sendmail can be triggered before the body is read. All the spam headers a week still aren't even as big as just one of the bodies from marketing I bounce because of its size.

      I've got patches for sendmail that let you filter the message body as well but you have to let it in first but you can bounce the messages at the SMTP transport level.

    2. Re:ADV tagging useless to real advertisers by Anonvmous+Coward · · Score: 2

      "I think the key word "unsolicited" commercial mail. So legitimate mail will be unaffected."

      Slightly off topic, but I've had good luck filtering SPAM by deleting mails with the word 'unsolicited' in them. I've never gotten a message that said "This mail was not sent unsolicited" and have it be true.

    3. Re:ADV tagging useless to real advertisers by Adam9 · · Score: 2

      The real point is that if everyone's deleting spam marked as ADV, then it becomes unprofitable. Guess what happens next? No spam.

    4. Re:ADV tagging useless to real advertisers by letxa2000 · · Score: 2, Interesting
      The problem with tagging all commercial email with an identifier such as "ADV:" is that most recipients will simply create an email rule to auto-delete it and never even know it arrived.

      I go one step better. My sendmail server hangs up on the SMTP connection as soon as it finds ADV: in the subject line of an incoming message. They don't even get to finish unloading their message. As soon as it says ADV:, they're gone.

      That's great for the recipients, but it does nothing to reduce the load on ISP servers; in fact, it may increase it as the advertisers will have to send out MORE mail to make sure at least somebody opens it.

      More ISPs can do what I'm doing and hang-up as soon as they see ADV: in the subject.

      In the short term it doesn't solve the problem, but when absolutely no-one is reading spam then the response rate will drop to zero--at that point there will be no-one that WANTS to spam.

      Also, such a solution does nothing to help legitimate advertisers, who need to know the demographics of who is actually reading their ad.

      What is a "legitimate advertiser?" Anyone that is mailboming advertisements to me isn't legitimate regardless of whether they are selling penis cream or Norton products (seems to be the latest thing I've seen in spam) or discount airfares.

      If there is an easy way to filter, they may buy a list that is 90% middle class professional office workers, but they have no way of telling what mix actually read their ad.

      I also don't care if an advertiser "needs" to know if I read their advertisement. That's none of their business. They have no clue who reads their advertisements in a newspaper nor who hangs around during commercials on TVs... Why do they suddenly "need" to know if I click their email?

      So they would never buy a service that operated under the "ADV" rules

      Good! The idea isn't that the whole world does bombing runs with ADV:. The idea is that the ADV makes it so easy to filter that NO-ONE reads the spam and, in short order, spam as a method of advertising goes away.

      Result: only the scam companies would ever send the mail.

      Which is MOSTLY the case now. This is where the bounty comes in... If you get spam that isn't identified with ADV, the spammer has broken the law and under the law you're entitled to $10k from the spammer if you are the first to identify him. A few of those and the scam companies will stop sending spam because it's no longer a good business model. So "legitimate" companies don't spam because all their spam is filtered with ADV, and "illegal" spammers stop doing it because they'll be liable for $10k.

      Of course, the idea won't work. As others have said, it's too easy to frame an innocent person or company. Unless the spammer shows you his email log, how can you really "prove" he did it? You could just be making up the logfile that shows a conection from 192.110.121.99, or whatever.

      The problem is that most spam isn't prosecuted based on other violations of the law. Porn spam should be blatantly illegal since much of it goes directly to the inbox of minors. The owners of porn sites that spam should be sought out by the FBI and charged with corruption of minors. Most of the rest of the spam is fraudulent or deceptive in some way--it should be prosecuted by the FTC or FDA. The problem is they apparently don't have time, which is sad since it's currently one of the largest sources of blatant fraud operating in broad daylight, and so many of them would be open and shut cases. You just have to go get the perpetrator.

    5. Re:ADV tagging useless to real advertisers by dubl-u · · Score: 2

      The regex filters in sendmail can be triggered before the body is read.

      Is that allowed in the RFCs? I thought that once the DATA command was in progress, you couldn't interrupt it. So you'd probably have to take the data, anyhow unless you were willing to just drop the connection. And if you do that, the originating server is likely to just try again.

      Better just to accept the whole message and return a 5xx. Unless you want to cause trouble for the spammer, in which case you should just keep returning a 4xx and waste his bandwidth.

    6. Re:ADV tagging useless to real advertisers by AndroidCat · · Score: 2
      I had one spammer that kept sending me the same spam, and I swear that the "affiliate" name was randomly generated each time.

      Spammer heads on pikes, can you and your affiliates arrange that for me, Mr Morden?

      --
      One line blog. I hear that they're called Twitters now.
    7. Re:ADV tagging useless to real advertisers by jbolden · · Score: 2

      That's why I think the solution is using IPChains. Drop the communication from bad ISP into the internet blackhole. If even half the routers follow these rules this ISP's will stop being able to do anything.

    8. Re:ADV tagging useless to real advertisers by jbolden · · Score: 2

      Well that's easy enough to cure. Define solicited mail as for an American company as requiring an American company to provide opt-in. That way American companies cannot receive opt-ins from foreign companies.

  15. Beats Berman's proposal by scubacuda · · Score: 2

    With Berman's proposal, the "vigilante" does the damage (DoS, etc.) before there is any proven wrongdoing. (What if a legit song happened to be labeled the same as a pirated one?)

    With Lessig's idea, the vigilante reports the wrongdoing and lets the proper authority take care of it. (A solution I like better. Imagine if there was an all out DoS war between the vigilantes, RIAA, MP3 traders, and all of us in between.)

    One can't help but wonder: if this works for spammers, why couldn't it work for MP3s?

    A bill like this is perilously close, if you ask me. If this works, the RIAA could start handing out $$$$ incentives for ratting out (illegal) MP3 traders.

  16. it's a stretch to claim that spam is a right by keithmoore · · Score: 4, Insightful
    I don't think that spam is a right any more than driving around in a loudspeaker-laden truck that is playing incessant advertisements in the middle of the night is a right. and I don't think that spammers have any more right to privacy than others who disturb the peace or engage in petty theft. the public has a greater interest in having the names of accused be in the public record than in keeping their names secret. (this actually helps discourage false accusations by the government)

    having said that, it's also clear that having a way to identify the source of a potential spam would create serious privacy concerns - what's to stop that method from being used to identify the source of any email? nor does "identifying the spammer" seem to be as useful as "marginalizing the spammer" - i.e. making sure that spammers are likely to have to pay so dearly that it's not profitable for them. strictly speaking, we may not need to identify them to achieve this result.

    so what we really need is a way to marginalize real spammers without sacrificing others' privacy rights in the process.

    1. Re:it's a stretch to claim that spam is a right by hysterion · · Score: 2
      having a way to identify the source of a potential spam would create serious privacy concerns - what's to stop that method from being used to identify the source of any email?
      Note that the article itself has an answer to that:
      The one thing we know about the vast majority of spammers is that they are in business to make money. And the only way to get money from the sap who received the spam is to provide a simple way for the sap to link back to the spammer. If there's a way to buy something from the spammer, there's a way to charge the spammer if you catch him.
  17. More by John Kascht (the cartooner) by scubacuda · · Score: 2

    See more of his stuff here. They're great!

  18. interesting idea... by Kunta+Kinte · · Score: 2

    I think is not a bad idea at all. The reward is high though, so I suspect a few people might find some way to abuse the system.

    But what if someone creates a site were you can put a bounty on a particular spam message and add to the pot on locating the spammer ( for legal action, of course ). I don't mean just finding originating network, but the real contact information of the individual or company responsible.

    So say you get a particular "work at home" message once a day. You can post your message on there and put $5 in the collection for finding the prick who's harassing you. If he/she is annoying you, chances are there are others who are being annoyed as well. If there is a match in the database, then your money is added to others.

    I am sure there are lots of capabable people out there, given $100 bucks to find a spammer *will* find them.

    This site could also be used to organize groups of people who would like to sue spammers. So instead of one person footing the bill, if your spammer is being sued, you can join the fun as well.

    --
    Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
  19. Automating vigilante process? by scubacuda · · Score: 2

    What would you do to automate the hunting-down-spammers process?

    Perhaps something you could put on your servers? Once certain thresholds and/or parameters are reached, you could have another program kick in that could track them down.

    A $10K reward would definitely get people working together in novel ways. Imagine if several ISPs/homeusers/businesses started working together to track these fuckers down.

  20. good idea by scubacuda · · Score: 2

    This is a really good idea.

    There are lots of us who want to stop this kinda shit, but have no idea where/how to start.

  21. RBL bad? by phriedom · · Score: 4, Insightful

    I don't understand his objection to the RBL. It has checks and balances. It is democratic. Use of the RBL is volentary. It doesn't involve expensive court actions or investigations paid for by taxpayers. It takes no direct action. But if you don't play nice, then others may choose not to play with you. If you don't self-police, others stop listening. Its quite a stretch to say that "restricts the freedom of email" and that it has not "done anything except make e-mailing more difficult." The RBL sure hasn't made my emailing more difficult or restricted my freedom.

    I think good laws would add to the effectiveness of the RBL, don't get me wrong. But to hear the spammers tell it, the RBL has made their cost of business much higher, so I wouldn't say it is a detriment.

    --
    Don't moderate flamebait as Troll. Know the difference or you will be Meta-moderated.
  22. True by scubacuda · · Score: 2

    ...and if a fraction of the people (such as myself) who get that ADV e-mail set up an auto-reply ("Don't ever send me this shit again!"), the problem could get MUCH worse in terms of mail server loads...

    1. Re:True by AndroidCat · · Score: 3, Informative

      Umm, that's not a good idea. Just who are you going to reply to? Spammers tend to forge headers for a reason. If the spam "payload" was a URL link in the body rather than a dropbox in the From or Return-Path, you've just sent an unsolicited email to whoever the spammer wanted to abuse. (Also known as a "joe-job".)

      --
      One line blog. I hear that they're called Twitters now.
  23. Re:the fine line... by scubacuda · · Score: 2

    The trick will be *where* you draw the line. Who has to use the ADV header and who doesn't? The mailings you're talking about are solicited e-mails.

    I'm cool with people getting bulk e-mails if they've signed up for free shit. I'm NOT cool with people getting bulk e-mail if they A) haven't enlisted, or B) can't ever opt out.

    I think that Lessig is getting at the lists that never let you opt out. Someone gets your name, spams you, you reply with REMOVE, you get on their short list, and then they sell you (at a premium) to another spammer. That's the shit that should be regulated with the ADV header.

    Legit opt-in mailing lists should NOT be affected.

  24. Here's MY deal. by unicron · · Score: 5, Funny

    "Alright. I'll kindnap him for 50, deprogram him for 50, and I'll kill him for 100!"

    "No, just the first 2!"

    "Alright, I'll throw in the killin' for free."

    --
    Finally, math books without any of that base 6 crap in them.
  25. Re:2 YRO in a row? by Anonvmous+Coward · · Score: 2

    "Wow, two Your Rights Online articles in a row. Our legal rights being threatened twice ine one hour. What kind of world are we living in?"

    Sorry Mr. Spade, I don't think any +1 Funnys will be flung your way.

  26. What an asshole by Gruturo · · Score: 5, Insightful

    Once added to the list, there is no way to appeal the blocking or to fight such policies

    This is bullshit, and he knows it, but he has to exaggerate and distort the truth in order to highlight his fashionable Bounty idea.
    I inadvertedly ran an open relay and quickly ended up on Ordb, and rightfully, I might add. My mail server logs had this nice explanation given in the error message from other servers, complete with a helpful link explaining how to fix and get delisted (fix your server, resubmit its IP for checking, get automatically removed).

    3 hours and a sendmail.cf later I was back with the good guys, and had this nice warm feeling :-)

    --

    Vacuum cleaners suck. Kings rule.
    1. Re:What an asshole by hysterion · · Score: 4, Informative
      Once added to the list, there is no way to appeal the blocking or to fight such policies

      This is bullshit, and he knows it, but he has to exaggerate and distort the truth in order to highlight his fashionable Bounty idea. I inadvertedly ran an open relay and quickly ended up on Ordb [ordb.org],

      This is out-of-context, selective quoting, and you know it, since right after this he continues with: ``Sometimes, the spam vigilantes offer people a way to appeal, but not always. Spews.org, for example, blocks without any appeal allowed.'' So,
      • He does nuance his assertions. You `exaggerate and distort' them.
      • He's talking about Spews.org, not Ordb.org.
    2. Re:What an asshole by Erik+Fish · · Score: 2
      Spews.org, for example, blocks without any appeal allowed

      Those listed in SPEWS are encouraged to post to news.admin.net-abuse.email with the specifics of their situation. In that froup the claims will be examined, poked, prodded and if possible shot full of holes.

      If your claims can stand up to scrutiny in nanae then you can expect to be removed from SPEWS anywhere from a few hours to a few days.

    3. Re:What an asshole by KjetilK · · Score: 2

      Lessig is also quoting out of context. The next few lines in the same FAQ states that you go to NANAE to present your case. Everybody who is participating in SPEWS are expected to read NANAE, so that is the forum they are presenting. This is a completely open forum, in fact, more open than /. where you can be modded into oblivion. In fact, go to the SPEWS site and look for delistings. They do listen. Lessig has no point here at all. However, I nevertheless think that blacklists should be abandoned, see my other post.

      --
      Employee of Inrupt, Project Release Manager and Community Manager for Solid
    4. Re:What an asshole by Electrum · · Score: 2

      This is bullshit, and he knows it, but he has to exaggerate and distort the truth in order to highlight his fashionable Bounty idea.

      Obviously, you've never had to deal with SPEWS. It is almost impossible to get off their list, regardless of the circumstances.

  27. Re:License to spam??? by scubacuda · · Score: 2

    That's true.

    Lessig's idea would only encourage many spammers to get together mail out all their shit together, rather than do it on their own.

    There needs to be a way to make the punishment to better fit the total number of spammed e-mails...

  28. Lessig has not done his research by gorbachev · · Score: 2, Informative

    SPEWS does not "block with any appeal allowed".

    First of all, SPEWS doesn't block anything. SPEWS only provides the list of scumbags. Its users then decide what they do with the information. Some block Email, some flag Email for filtering by end users, some use the list as evidence of anti-spammer evils.

    Second of all, there is an appeal process. The spammer just needs to stop spamming.

    Thirdly, he seems to imply that it would be common to be listed in SPEWS by mistake. This is simply not true at all. Usually a spammer has to exhibit a pattern of abusive behavior to get listed. There appears to be a human process involved in getting listed by SPEWS, which seems to be very effective in weeding out mistakes and joe-jobs.

    Proletariat of the world, unite to kill spammers. The slower, the better. The more painful, the better. Remember, knees first, so they can't run away.

    --
    In Soviet Russia, I ruled you
    1. Re:Lessig has not done his research by KjetilK · · Score: 2

      Have you looked at Kernel.org lately?

      --
      Employee of Inrupt, Project Release Manager and Community Manager for Solid
  29. Hotmail is not the problem by dananderson · · Score: 2
    Hotmail is not the problem. They are just a very popular email domain that spammers use to fake.

    The real hotmail agressively fights spammers. I know, because I look at the unfiltered spam I receive (for submission to SpamCop and my private blacklist). Rarely do I get spam from hotmail IP addresses.

  30. Ferguson vs. Friendfinder by Animats · · Score: 3, Informative

    There is an attorney trying to collect using California's anti-spam law. The case has been all the way to the California Supreme Court, and is now back at the trial court level. This case has been going on for over two years now, and the plaintiff hasn't collected yet. But they will.

  31. Growing a Spam Killing Community by webword · · Score: 2

    Growing a Spam Killing Community -- "The purpose of this article is to discuss how to eliminate spam through a community of spammer killers. Why take a passive role in spam elimination and why use up precious time and complex tools to track down one spammer? Instead, let's create a community of spammer hunters to track them down and wipe them out, using their own methods against them. Forget killing spam, let's kill the spammers."

  32. That's the plan: make spam useless by Animats · · Score: 2
    That's the idea of the law. The legal concept is that prohibiting somebody from e-mailing may raise constitutional issues, but insisting that they mark advertising as such is clearly permitted.

    It's not working very well, because of weak enforcement. That may change after a few cases are litigated. I do see a hundred or so "ADV:" messages in my trash can right now, placed there by a rule, so it's doing something. But only about 2% of incoming spam is being junked by that rule.

  33. Lessig needs someone to whack him with a cluestick by silentbozo · · Score: 3, Interesting

    Read the article. The 10k bounty for not labeling spam as spam isn't what you should be paying attention to. It's his attack on volunteer efforts to block spam relays, whom he calls "spam vigilantes", in the worst sense of the word. Essentially, he says that efforts to blackhole servers (presumably, because the admin of that server also needs to be whacked repeatedly with a cluestick) do more harm than good, and that we should just use filtering.

    The 10k bounty is supposed to convince spammers to label their spam so we can effectively filter it.

    Finished laughing? Let's dissect his thinking, shall we? He says we can handle spam just by making sure the spammers label it. This is the thinking behind a lot of bad legislation - it legitimizes it, instead of eradicating it. Second of all, he implies that vigilantism can work with government (finding spammers who don't comply with the ADV: rule) to fix what vigilantism by itself (blacklists) cannot do. Well, blacklists are meant to eliminate spammer havens - and we have plenty of anti-spam people hunting spammers as it is, FOR FREE. What the hell does he think 10k is going to do, if all the bounty-hunter does is turn the spammer's info over to the government? I mean, the FTC doesn't do much to the existing fax-spammers who are in violation of federal law. (The fax.com lawsuit was filed by a private individual, the FTC just levies paltry fines.) Or worse, what is the US government gonna do to foreign spammers who don't comply with our "label law"?

    Essentially, Lessig says we should discard our current system of blocklists and anti-spam tech, in favor of simple client-side filters and a federal mandate to label spam, with a bounty to catch anyone who fails to label their spam. The threat is so feeble, and the undeserved side-effects so beneficial, I'm sure that spammers will love this idea.

  34. How much is the bounty for spam-enabling software? by SN74S181 · · Score: 2

    It sounds like this effort will involve a tracing operation, digging in to find the systems, the software, and the people behind the spam.

    What will the reward be for implicating the spam-enabling software vendors? One in particular that comes to mind is Elcomsoft. Will there be a $10K reward for dragging Dmitry's bizzness into court?

    (note, the 'Advanced Email Extractor' tool linked to above used to be a link right on the elcomsoft.com web page, but that alternative 'MailUtilites' web page still comes up as one of the top five links in Google when you search on 'elcomsoft.' I suspect they're hiding their association with the 'mail utilites' product line to get geek sympathy. Spread the word, they sell tools to the spammers!)

  35. Oregon's Anti-Telemarketer Law by sleepingsquirrel · · Score: 2, Interesting
    Here is one ray of sunshine though. In the state of Oregon you sign up on the No Call List and
    "A telemarketer who unlawfully calls a telephone number on the 'No Call' List violates Oregon's Unlawful Trade Practices Act (ORS 646.605 - 646.656), and is subject to civil penalties of up to $25,000 per violation."

    After signing up, the number of unsolicited phone calls I get has dropped to zero.

  36. Short Swing Trading Enforcement by harlows_monkeys · · Score: 2
    Paying bounties to get third parties to do the work in dealing with a nuisance can be a good idea. It kind of reminds me of the laws that deal with short swing trading. Short swing trading is when you buy or sell a stock that you recently bought or sold. Certain officers of public companies are not allowed to do short swing trading. I forget the exact rule, but basically, you can't change the direction you are going (buying or selling) more than once every several months (I think it is six months).


    So, for example, if Bill Gates sells some MS stock today, he can't buy MS stock tomorrow.


    The way the SEC enforces this is very clever. The law is that any shareholder of the company can sue to nail a short swing trader. If the suit is successful, the short swing trader has to turn over to the company any profit they made, AND they have to pay the attorney fees of the suing shareholder. The profits are calculated in the least favorable (to the short swing trader) way--find the highest selling price he got in the last six months, and the lowest buying price...match those shares up, and count the difference as profit. So, if you buy at 100, sell at 90, buy at 80, and sell at 70, you have really lost 20, but as far as the short swing laws go, you made 10 (the sell at 90 less the buy at 80), and so you have to pay 10.


    The final brilliant piece of the short swing law is that the shareholder who brings suit does NOT have to have been a shareholder at the time of the trading--they only have to be a shareholder at the time of the suit.


    Combine that with the winner getting attorney fees, and what happens is that attorneys check the public records, find dumb corporate officers who tried to sneak in some short swing trading, go out and buy a share of the company to get standing to sue, and sue.


    This has pretty much completely eliminated illegal short swing trading, with the SEC having to spend no money to track it down and enforce the law.

  37. Re:License to spam??? by silentbozo · · Score: 2

    Oh, it's even worse than that. Lessig proposes the 10k fine only for spammers who fail to label their spam with an [ADV:] tag. He essentialy means to leave spammers alone as long as they do that, in order to make client-side filtering 100% effective. Good intentions aside, his idea stinks - I'd rather get rid of them all, than to deal with incoming crap that I'd be trashing ANYWAYS.

  38. Too much freedom? by buss_error · · Score: 2
    From the site
    They looked at the open and flexible system of e-mail that gave birth to much of the Net and decided that this system created too much freedom--at least for spammers.

    Block lists don't take any freedom from spammers. It never prevents them from sending all the e-mail they want. It's just that when it hits a server of someone that doesn't want to hear their speach, the "mute" button gets hit.

    Why spammers think that keeping their message out of my inbox is restricting freedom of speech, I'll never understand. Are they not my eyes, are they not my ears? Can I not decide what I'll use my time to read, to hear, to think about? So what if it's the greatest thing since round wheels. If I choose to close my mind to it, trying to sell me the goose that lays golden eggs isn't going to overcome my "buyers resistance".

    Not only are spammers stupid, they are persistantly stupid. In the Darwinan game of the Internet, they rank below the Doo-doo of the Do Do.

    --
    Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
  39. email stamps by cosyne · · Score: 2

    One solution i've heard was to make emails computationially expensive. Like, if my mailserver doesn't recognize your address, you have to factor the product of a few smallish primes before it will deliver the message. Something not too nasty, but hopefully big enough that you can't just have lookup tables. If you're sending a message to 10 people, it takes maybe a few seconds. If you're sending to thousands of people, it takes longer. You could even set preferences for how ugly you want the factorization to be: if the headers all match up, it's addressed to one person, and there's no html or images or links, make 'em factor 2*7*13. If the subject contains 'debt' or is in all caps, or there are removal instructions in the body, they have to factor something that's almost crypto-grade.
    Put in some work-arounds where someone can email a list admin for permission to mail the list, etc.

    1. Re:email stamps by jbolden · · Score: 2

      The problem is that is linear which means the cost of being able to do it go down more rapidly than linear as you increase computing power. If the average 486 can do the job in 1 second (say 1 email) the average pentium 4 can do over 100 per second or about 1 million per week. Make it a good quality workstation / cheap solution and you are up around 100m a week again.

      So unless you want to make it real expensive (say 1 minute for the 486) it won't work.

    2. Re:email stamps by jbolden · · Score: 2

      It can't be done in advance for the system to work. It has to be you send the email -> someone sends a question back -> you answer -> the email gets forwarded otherwise you could use the same answer again and again.

    3. Re:email stamps by jbolden · · Score: 2

      How does my system require any trust? System A sends the mail to system B; B's pop server asks for a computation before allowing the mail to go through A computes it and it goes through. If you want use public key signatures to verify you are talking to A's pop server.

  40. Make them pay. by david@ecsd.com · · Score: 2, Funny

    Of course my idea of "make them pay" is perhaps a bit different than the norm. I'm not talking about finding out who they are so they can face the swift hand justice, I'm more of the though of finding out who they so they can face teh swift baseball bats of Guido and Nunzio who, when they're done, break the spammers' fingers so they can no longer type out those emails telling me how easy it is to buy my Viagra.

    Hell, I'd be willing to contribute to a fund which promised such results. I want my mailbox back and I'm tired of coming up with new regular expressions to make the spam go away.

  41. New "Crossing Jordan" episode... by tlambert · · Score: 2

    New "Crossing Jordan" episode: a man is found dead, shot twice. The only clue is a can of Spam jammed in his mouth, unopened...

    -- Terry

  42. Could someone explain this to me? by kikta · · Score: 2

    What I don't understand is why everyone always talk about it being impossible to catch the "smart" spammers. These people aren't sending this shit out for fun. Yeah, they forge headers, return addresses, & so forth. But why does that matter?

    If they're sending these damn things out for commercial gain, at some point they have to get your money. They either have a website (which can be tracked down via the hosting ISP, DNS entries, shit - traceroute the bitch & call the next people upstream), or an address, or a phone number. That should get all of the stateside jackasses. Even the ones who host overseas can have the hurt put on them. They have to take credit cards or paypal or something. That means a paper trail & it means that Discover Card or Visa or whoever can lock them out.

    All that leaves is chain mail (which is stupid, but sent by your buddies that you can tell to fuck off) and people after bank account info (such as Nigerian princes).

    Honestly, why is it claimed to be so hard for spammers to be tracked down? For the average joe, yeah, it's hard. For those enforcing anti-spam laws it should be relatively easy (if a little tedious) to nab the majority. Can someone explain this?

    1. Re:Could someone explain this to me? by Peer · · Score: 2, Interesting

      The reason they're hard to catch is that for legal action, money and time is required. There has to be a real prove to have VISA lock you out. Otherwise a smart spammer could spam around your URL, and you'd be in trouble. So just whois records won't do.

      Also, what about foreign spammers using foreign hosting-companies and banks. They're not likely to stop spamming.

  43. Do they seriously want them dead? by ari_j · · Score: 2

    If I'm granted immunity in all cases where I am responsible for the death of a spammer, and I receive $10,000 for each such death of my own doing, count me in. But if it's just 'turn them in, wah wah wah', then I'll have to pass.

  44. Re:How do you become a spammer by AndroidCat · · Score: 2

    To be a Real Official Spammer, you have to invoke the number of the Murk: S.1618. It never made it into law, they'd still be violating it if it was a law, and I live in Canada -- but spammers still have to quote it their turds. (In many languages too. Weird.)

    --
    One line blog. I hear that they're called Twitters now.
  45. Rhyme with me! by schlach · · Score: 2

    Seeking redress?
    What a shame!
    Your faith is misplaced
    in the RBL.

    If we had their address,
    and a name,
    It would probably
    take care of itself...

    Or, a Limerick:

    Send Congress home -- no laws need be made.
    Save your money -- the price will be paid.
    No judges, no jury,
    have it done in a hurry,
    A real life black hole -- get a spade.

  46. He's talking about SPEWS, not Ordb by phr2 · · Score: 2

    How do you get off of SPEWS once you're listed incorrectly? There's no quick straightforward way.

  47. Re:RBL NOT VOLUNTARY by jbolden · · Score: 2

    The RBL publishes information on how to get off the list; its really not hard. If you can show the address is recent they'll take you off. As for the ratio of customer emails to spam that's going to come down to what customers are worth; which has a great deal to do with the industry.

  48. Re:RBL NOT VOLUNTARY by Erik+Fish · · Score: 2
    The RBL has made life difficult for many companies. Once you are on their list it is difficult, sometimes impossible to get off.

    Are you referring to the MAPS RBL? The RBL that has widely been considered toothless ever since it was sued into unblocking certain spammers? The RBL previously run by the same Paul Vixie who has been caught with his pants down knowingly hosting spammers for the right price? The RBL which previously employed the two patsies who have been "cleaning up" spamhaus PostmasterGeneral/Mindshare Designs for roughly a year now with no results beyond a lot of cashed paychecks?

    No? Then perhaps you're talking about the MAPS RBL that patiently strives to list only spammers and works tirelessly to ensure that the owner of every listed IP is given ample notification and opportunity to realize the course they were headed on and avert it? The RBL which is always willing to have secret negotiations with spammers and spam supporters; To work things out and smooth things over; To make exceptions for any number of reasons not given out to the unwashed masses?

    Nope, doesn't sound like you're talking about that particular MAPS RBL either. It sounds more like you're talking about an RBL that you have fabricated from whole cloth without any external stimuli.

    Quit talking out of your ass.

  49. good point... by scubacuda · · Score: 2

    definitely a brain fart.

  50. It's about consent, not content! by Erik+Fish · · Score: 3, Interesting
    So much for "Lawrence Lessig: Superlawyer". Doesn't he realize that by the time his little idea gets passed into law it will have morphed into the Direct Marketing Association's wet dream?! Even the original is a law that fully legitamizes spam! Does anyone think that the $10k fine will make it through? Even if the figure itself is still around there's no chance of anything resembling teeth being left in it!

    So what if it forces a majority of the spammers into using the [ADV] tag in their Subject headers? What is that going to accomplish? Yes, most ISPs will instantly block anything with [ADV] in the subject header but the spammers will still be using bandwidth to bounce endless waves of spam off of your filters in an attempt to get at the remaining mail servers which don't filter for one reason or another!

    Beyond that, an [ADV] flag is content. As the subject of this post points out: The fight against spam needs to be firmly grounded in a lack of consent -- not the slippery slope which any argument based on content quickly becomes!

  51. It's not enough money by herbierobinson · · Score: 3, Interesting

    It can't be just the first one. It has to be a bounty to everyone who tracks the spammer down and take them to court. Otherwise, it just wouldn't pay to do it. A better scheme:

    1. Allow anyone to take spammers to small claims court for around $2K.

    2. Make the person selling whatever is advertised in the spam be responsible for unless they are willing to file a criminal complaint against the spammer.

    3. Explicitly make is illegal to advertise someone else's product without authorization (it's probably already illegal...). This is to enable #2.

    4. If an ISP cannot identify the spammer, the ISP must pay the fine. This may already be the case, but making is explicit would help.

    --
    An engineer who ran for Congress. http://herbrobinson.us
  52. Re:Lessig needs someone to whack him with a cluest by KjetilK · · Score: 2
    I agree with some of your points. Lessig has really written a very bad piece. I usually quite Lessig when he's quoting Rosen saying that Hollywood should control all distribution of everything, but the quote that you can't contact SPEWS is bullshit to the extend that almost becomes dishonest. I'm not sure I can quote Lessig after this. SPEWS FAQ Q41 states that you talk to SPEWS folks in NANAE. You'll meet them all there.

    For obvious reasons, and "ADV" wont work. Now, Lessig makes the mistake of thinking that the US is the whole world. That's a very bad mistake. Another mistake is not to realize that my mailserver and bandwidth has suffered from the spam if I accept it. These costs are very large indeed. The only way to avoid this cost is that spam is never sent.

    I've been a regular in NANAE for a long time (not right now), and I have supported RBL and SPEWS, and I still see many positive things about them.

    Yet, I don't think people realize how much power they have, and what costs a mistake will have. Use of RBL and SPEWS is voluntary, so Lessigs "vigilantism" reference is highly inappropiate. But effectively, so many people are using them that an error on the part of us is too costly for those that it hits.

    Mistakes are human, and we all make mistakes, but it is easier to make mistakes when you're not working full-time on an issue, when you don't have the time to research properly. Nevertheless, these mistakes are unacceptable. By mistakes I'm not talking about the RBLing of Peacefire. They chose to stand by scumbags and chose to go to the press rather than resolve it in a manner that everybody would benefit from. I'm talking like the case of Ed Felten's "Freedom to Tinker" experiences with SpamCop and the SPEWS listing of The Linux Kernel Archives. These are examples of things that should never happen. Most of us strive for many 9s of uptime, and can appreciate what it is like to be blocked for days. Traumatic, that's what it is. :-)

    Yet, that is going to happen many times more if we continue with current practices.

    I think the US needs good laws. Here in Norway we have a law that requires confirmed opt-in and bans business to consumer spam. It works quite well. While I get quite a lot of religous spam from US, I get nothing from Norway, though that is not regulated. It could be that the message is quite strong that spamming is unacceptable anyway, so even the morons don't spam.

    While spammers can move off-shore, I wouldn't mind blocking whole countries untill they get good laws. Moving off-shore won't work.

    It will not totally stop spam, but only totalitarian regimes want total solution to problems. With laws in place, we may get a spam a month, I don't mind as long as I can turn the spammer over to the justice system and let them decide whether he overstepped the boundaries or not. That's what the justice system is there for.

    Now, Lessig's proposal is bad from another angle too, and that is that it to a great extent encourages vigilantism. I really don't want a bunch of script-kiddies running around trying to obtain evidence that some randomly accused person committed spamming. Joe-jobs happen a lot, I've been joed myself. True spamfighters know a joe-job when they see it, but a random script-kiddie out to make a fast $10k won't.

    A US ban on spam is needed. Blacklists should be abandoned.

    --
    Employee of Inrupt, Project Release Manager and Community Manager for Solid
  53. It's a slashdot headline... by techstar25 · · Score: 2

    It made it as a slashdot headline, it's already reached it's audience.

  54. Just my 2 cents by grahamsz · · Score: 3

    Brings a whole new meaning to that phrase

  55. They tried that on Usenet by Per+Abrahamsen · · Score: 2

    The cancel-bots went on a strike to show the magnitude of the problem. Few people noticed the difference.

    It is unclear whether this was because the ISP filters already take most of the spam, or because one of the major cancel-bots continued to operate.

    In any case, it was a PR failure for the bot operators.

  56. Re:The Solution to the Problem. by Alsee · · Score: 2

    E-Mail is distributed. There is no way you can establish and maintain such a system.

    All either of the systems requires is a stamp server and for participating users to have stamp-aware mail programs.

    You could require billing information be attached to each e-mail, and collect before finally delivering the mail, but the overhead would begin to make e-mail as expensive as postal mail, and nearly as slow.

    The crypotographic stamp is the "billing information", and in either plan you are rarely, if ever, going to actually withdraw the cash.

    With the 2 cent stamp plan $2 gets you a 100 stamp account, and the 2 cents from any mail you receive will generally just give you a 1 stamp credit for future use. If you still get spam then maybe you withdraw a few $ once a year.

    With the large stamp plan in normal use the stamps should never be redeemed. You send mail with a 32 cent stamp to a friend, they do nothing, and you can keep re-using that stamp. If you get spam or other unwanted mail you redeem the stamp for credit. Either you use the credit to buy stamps yourself, or you cash out a few $ once or twice a year.

    In either case it's mostly just a bookkeeping game on the stamp server to give bulk mail a non-trivial cash cost. You buy in for two to ten dollars, and unless you're a spammer you can entirely forget the system has anything to do with cash.

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  57. DID ANYONE NOTICE by JeanBaptiste · · Score: 2

    when you close the article, you get a pop up? I find pop ups more annoying than spam myself...

  58. Puppet company in America by yerricde · · Score: 2

    Define solicited mail as for an American company as requiring an American company to provide opt-in. That way American companies cannot receive opt-ins from foreign companies.

    If that kind of law passes, the spammers will just set up wholly owned American subsidiaries for the sole purpose of "opting in" spam targets. And if the law is written so as to exclude American companies wholly owned by foreign entities, then it also excludes legitimate outfits such as Nintendo and (once the settlement becomes final) possibly Microsoft.

    --
    Will I retire or break 10K?
    1. Re:Puppet company in America by jbolden · · Score: 2

      American subsidiaries have American owners who can get charged with fraud, perjury, etc...

  59. If they're *that* smart, they could get a real job by aquarian · · Score: 2

    Spam could be fought and cut down drastically. All we need is to rally the industry behind the effort. Sure, a little will always get through. But mostly, it will be due to luck. I don't buy the argument about "smarter" spammers. If they were good enough to consistently defeat well engineered systems, they'd be good enough to get a real job doing something else that pays a lot better.

    C'mon, look at the spam you get. It's real bottom feeder stuff. It probably makes some money for someone, but I can guarantee no one's getting rich. If you really believe it's possible, then I have a great way for you to make money. Have you heard the good news about Herbalife? :-)

  60. ANTI-spam in spam and popups by phorm · · Score: 2

    This is one of the most ironic and ultimately annyoing things for me. Recently, I've been getting more spam from companies sending anti-spam or anti-popup products. In addition, I get popups advertising the same.

    One would think that it doesn't take a brain surgeon to realize that people who dislike spam/popups are going to be doubly annoyed by spam/popups advertising anti-spam/popup solutions.

    Subject: RE: Penis enlargement
    Body: Cheap way to remove your head from your ass...
    - phorm

  61. Re:2 YRO in a row? by Anonvmous+Coward · · Score: 2

    "Damn, and I tried so hard too. Do you see me caring about being modded up? Well, you shouldn't because I don't."

    Okie then, what do ya care about? Obviously my assumption was wrong, so correct me.

  62. Re:2 YRO in a row? by Anonvmous+Coward · · Score: 2

    Are you intentionally being thick so you can avoid what I really asked you? If you are, it means you really were going for a +1 Funny. If you aren't, then my next question would be "Is English your native language?".

    You know damn well I was asking you what you were hoping to accomplish with that post if it wasn't for karma.

  63. Re:The Solution to the Problem. by Alsee · · Score: 2

    I know using the small stamp system, I give away my 100 stamps in about two days

    Why would you send a stamp to someone who doesn't require it, and even if you did, how would it get "canceled"?

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  64. Re:The Solution to the Problem. by Alsee · · Score: 2

    Oops, only sent half a response.

    participation is optional, spammers won't participate, and their aren't any other benefits to using a big clunky stamp system.

    Right, spammers can't participate without paying everyone. And yes, hitting a critical mass of people using the system is the biggest hurdle. Skilling spam is such a pressing need that I think people would jump at the chance to use it.

    AOL and Microsoft are at the top of the list that could easily pull it off, but they're both about the bottom of the list I would expect to do it right though, chuckle.

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  65. Yes he does by Arker · · Score: 2

    I thought he was supposed to be one of the good guys... obviously I was wrong. What a moron.

    --
    =-=-=-=-=-=-=-=-=-=-=-=-=-=-
    Friends don't let friends enable ecmascript.
  66. Re:2 YRO in a row? by Anonvmous+Coward · · Score: 2

    "Come on now. Don't take pot shots at my syntax."

    That wasn't my intention. As a matter of fact, I think grammar/syntax/spelling zealots need to find something better to do. heh. I was actually taking pot shots at your over-literalistic (is that a word? heh) understanding of my question.

    "That's a joke...the kind of joke I expect to get branded a troll for."

    I hear ya. I burn karma all the time by challenging moderations. =)

    "And that's how I stand regarding this issue. I think the answer to your question lies somewhere above. If not, let us continue this wasteful public banter."

    Heh I was just messin with ya. Trolling's probably a better word for it. The good news is that your response was far more intelligent than what I normally get. No fun for me, though because I wasn't able to get ya riled up. Oh well!

    "If not, let us continue this wasteful public banter."

    Aww c'mon, that'd wipe out Slashdot's comments section!

  67. Re:The Solution to the Problem. by Alsee · · Score: 2

    getting several KB of traffic FOR EACH PIECE OF E-MAIL

    The stamp server handles either one or two packets for each piece of mail. No need to route mail the through the stamp server. The stamps would only need to be a few dozzen bytes. If designed efficently it would only require a single packet to the stamp server and back to either request a stamp, validate a stamp, or to redeem a stamp.

    Note that with the 2 cent stamp plan there no need to talk to the stamp server to validate the stamp, you can validate it locally via cryptographic signature. With the "expensive stamp" plan you only need to request a stamp once and you can keep re-using it (once every 2 or 3 days), and they are rarely redeemed.

    you have yet to say how a large mailing list is going to deal with this system

    With the expensive stamps you just give the mailing list a single stamp to use every time it mails you. So long as you don't redeem the stamp it can keep reusing it. Redeeming the stamp would effectively be considered an un-subscribe request.

    With the 2 cent stamps you could subscribe by sending a bunch of 2 cent stamps, each one buys you / pays for one issue. You giove them a few cents and they give it back.

    You could also simply add the newsletter to your mail-readers's "approved" list, and you can accept the mail unstamped.

    Another facinating aspect is that ANYONE can act as a stamp server. You can even print up your own stamps. Of course, only people who have you listed as an approved stamp server will accept them :) You can always approve yourself and print up as many stamps as you like that people can use to mail you. You can also approve all of your friends as stamp servers, and their friends, and so on. If you ever just junk mail from a "chain-of-friends" stamp server, you just revoke that server.

    You generally only need to use the public stamp server when mailing a complete stranger.

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.