NYTimes: Tangled Up in Spam

Kudos to SA. by clueless123 · 2003-02-09 09:24 · Score: 4, Insightful

I been using Spam assassin for a while now, it is sad to say, but email would be almost unusable with out it.

Re:Kudos to SA. by WowTIP · 2003-02-09 10:08 · Score: 3, Insightful

I been using Spam assassin for a while now, it is sad to say, but email would be almost unusable with out it.

But how do people get on the spam-lists to begin with? I mean, I have one email address for work and one private. Neither one of these gets more than one spam/month. Ever. The (obvious) reason for this is that I never use these addresses "in public" (web forms, online buying, etc.), for that I have my spam-collector, the Hotmail account, which do recieve a lot of these messages.

But then, I would guess that most people have been warned not to use their "real" mail address for the hazards I mentioned, making them as careful with their addresses as I am with mine. This would contradict my mesures beeing that effective when others still seem to get massive amounts of spam?

Am I just incredibly lucky with my two "real" email addresses?

If you took the same precautions I did, how do you think you got into the spam-generals addressbook?

--

--

"I'm surfin the dead zone
In the twilight, unknown"
Re:Kudos to SA. by MeanMF · 2003-02-09 10:18 · Score: 3, Interesting

But how do people get on the spam-lists to begin with? I mean, I have one email address for work and one private. Neither one of these gets more than one spam/month. Ever.

If you email address is simple (e.g. first initial+last name+some number) and your domain name is that of a public ISP, then there's an excellent chance that the spammers will find you regardless of whether or not you ever use the address. Email addresses at work tend to be safer because spammers usually don't bother guessing at addresses in domains with so few valid mailboxes.
Re:Kudos to SA. by domninus.DDR · 2003-02-09 10:29 · Score: 5, Interesting

Ive tested something similar to this. Make a hotmail account with jibberish (rand(), 8 char isalnum() strings is what I used) for the name and see how long it takes to get spam. Out of ten tries my average was about 3 days.
Re:Kudos to SA. by bubblegoose · 2003-02-09 10:41 · Score: 5, Funny

I felt the same way you did until about 6 months ago. I went two years without Spam. Then a coworker thought he would fill out one of those forms on a web page to have the site send me a link to the page. You know the "send link to a friend" that shows up on some pages. Some joke site I think.

From that point on the crap has hitting my mailbox, about 10 per day.

I still haven't figured out how to thank him for that damn link that started it all.

--
I hope that someday we will be able to put away our fears and prejudices and just laugh at people. - Jack Handey
Re:Kudos to SA. by jesser · 2003-02-09 10:52 · Score: 4, Insightful

The (obvious) reason for this is that I never use these addresses "in public" (web forms, online buying, etc.), for that I have my spam-collector, the Hotmail account, which do recieve a lot of these messages.

One of the major costs of spam is that people are afraid to make their addresses available, making it much harder to contact people. I think it's sad that many geeks have become so used to spam that they think anyone who posts their e-mail address on a web page is stupid. Some geeks even go as far as to blame friends for spam they get when a friend isn't as careful with the geek's address.

--
The shareholder is always right.
Re:Kudos to SA. by jafiwam · 2003-02-09 11:48 · Score: 4, Informative

Heh. I assume you are honestly asking and not bragging about how little SPAM you get to make me jealous...

Here are the vectors for getting on lists that I know of;

- using a valid email address in newsgroups
- using a valid email address on a web page
- using a valid email address in form properties in a web page
- using a valid email address on a mailing list or web-forum
- using a valid email address for domain registration contacts
- using a valid email address to sign a web page up for a search spider
- having an email address that can be "brute forced" (i.e. almost all of them)
- your pal puts an email address in an "e-vite" or "e-greeting"
- getting a virus that spreads via email

And above all, being naive about the workings of the Internet, when only a few weeks of ignorance will permenently get the address out there "in the wild". Just about everybody is this at one at one time or another.

Some people cannot avoid having email addresses hung out there on the Internet, so getting on the lists is more or less inevitable if you are doing business or communicating on the Internet in any meaningful way. Since I cannot ignore what comes in the boxes I run, I MUST sort through whatever arrives. That makes SPAM a big issue for me.

Your usage of your email addresses is probably typical (not on web pages and so on..) but you are probably fortunate to both be clueful about it and not dealing with your email address publicly available out of necessity.
Re:Kudos to SA. by daveq · 2003-02-09 12:35 · Score: 3, Insightful

Of course there are also those wonderful friends who send a bulk-ish email that doesn't hide the addresses of the thirty recipients. One of them is bound to be an account at freemail.com.

Not only does your spams-per-hour count begin to rise, but you have to suffer the geek's frustration: How could you have a friend so mind-numbingly ignorant of technical manners?

Every time I set up a new email address ("Okay, this one will be spam-free. Really.") spammers find a way to get it, whatever I may do to prevent them. It only takes one leak.
Re:Kudos to SA. by qengho · 2003-02-09 13:01 · Score: 4, Insightful

send link to a friend
A couple of months ago I got fed up with the ridiculous amount of spam I was getting at my primary address. I sent a note to the people I give a crap about, telling them that my primary address would henceforth be a new account I had created in my own domain.

I explicitly begged them not to give the new address to "those stupid send this cool page to a friend" sites. Set up filters in my email client to segregate the old address, and so far, so good, although my Mom gave the new address to an e-greeting card site. Fortunately, the site in question doesn't harvest addresses, and I (respectfully but frantically) pointed out to her that e-cards fall into the "stupid" category, and told her how to make up a disposable address for greeting cards, using my domain name.

Having to go to these lengths to to keep my inbox clear of spam makes me homicidal.
Re:Kudos to SA. by cicho · 2003-02-09 15:43 · Score: 5, Insightful

The parent is not "insightful" - it's shallow. If you're going to be so protective of your email address, you might as well ditch it altogether.

I work as a freelancer. My website hosts my CV, as do several online databases, where companies go to look for people of my profession. The CV of course includes not one, but several of my email addresses, because, in the long run, this translates directly into payable work.

I write software for fun (not profit). I even do email support, so my email address is again right there in plain html, and displayed by every software archive site I've ever uploaded my stuff to.

But this is the point of having an email address in the first place, isn't it? I could be as protective of it as the parent suggests, except by doing so I would lose much more than I am losing now (in terms of time and net-related costs). But to me, it's not only a matter of give and take: I refuse, on principle, to obfuscate my email address; I refuse to give in to spammers. When people start to hide their email contact information en masse, then spammers have won and email has become usleess.

--
"Only the small secrets need to be protected. The big ones are kept secret by public incredulity." - Marshall McLuhan

At last by Mourgos · 2003-02-09 09:24 · Score: 5, Interesting

now that it has been advertised in NYTmag, more people will become aware that spam is something they can actually stop. Can't wait for the new tricks spammers will use to disable anti-spam programs.

Re:At last by qengho · 2003-02-09 13:25 · Score: 4, Informative

Can't wait for the new tricks spammers will use to disable anti-spam programs.

Wait no more. I got a spam today that purported to be an apology for how the sender got my address, something like "so sorry, but these stupid porn sites like [link] must have sent me a virus. I can't believe my kids are visiting sites like [another link] even though I never go to sites like [yet another link], blah blah blah."

I have to admire the creativity of spammers even as I wish for Bad Things to happen to them.
Re:At last by H310iSe · 2003-02-09 17:21 · Score: 3, Interesting

Ugh, not spam cops - those guys, I think, have become a little unhinged in their anti-spam hatred and have developed some kind of a demigod complex as a result. I helped run a mailing list generated from submissions to a website - they sent out mailings to people who opted-in for various sex clubs (I know, but sex does not automatically equal spam). We never hid who we were, where we were sending from, we told everyone why they got our mail (because they signed up at the website) and had a valid reply-to address as well as an unsubscribe feature.

Someone sent an email from us to spamcops saying we were spamming - I checked our logs and in one day one person sent us 4 unsubscribe requests - they never got another email but I wonder if it wasn't them. Anyway, we were totally shut down with no warning, two different sites (one hosted the website the other hosting the email program) yanked off the internet when spamcops complained to our ISP.

This is downright stupid. One, anonymous complaint (never did find out who did it so we couldn't very well remove them from our list!) and all our websites, over a dozen, art galleries, political sites, stores, and some 'adult dance club' sites (you do what you can to make clients now...) all went down. No warning. And no apologies from our ISP or spamcops when we pointed out they pulled our service with absolutely NO research, no attempt to contact us, no evidence whatsoever other than a sole complaint which could have been posted by anyone (um, competitors to the adult club jump to mind).

My ISP (Speakeasy) eventually got someone in touch with us who really did nothing more than empathize with how angry we were and promised to try and not do it again. That's it. There's a movement afoot to try and reign in this sort of insane overkill, one story here and an a nascent organization against overzealous antispammers is here.

For the record, we did not have confirmation on our opt-in list so theoretically someone could have signed up another (say a priest or something) for our mailing lists. We never got more than a couple new registrations a day so there was no systematic abuse, still, we fixed this and added confirmation (using mailermailer.com, I'm very impressed with them so far) after the complaint (no need to knock us off the web to get our attention, a simple email would have done) and, as I said, we had valid contact info if they had only bothered to ask...

Anyone else been a 'victim' of crazy blacklist providers?

--
closed minded is as closed minded does

I've gotten rid of 90% of spam by trmj · 2003-02-09 09:24 · Score: 3, Funny

By simply filtering out all e-mails that have the word "Nigeria" in them.

--
Work sucked, until it became unemployment, when it became slightly more tolerable. -Tet

Re:I've gotten rid of 90% of spam by Anonymous Coward · 2003-02-09 12:11 · Score: 5, Funny

>URGENT ASSISTANCE - FROM USA
>
>IMMEDIATE ATTENTION NEEDED :
>HIGHLY CONFIDENTIAL
>
>FROM: GEORGE WALKER BUSH
>202.456.1414 / 202.456.1111
>FAX: 202.456.2461
>
>DEAR SIR / MADAM,
>
>I AM GEORGE WALKER BUSH, SON OF THE FORMER PRESIDENT OF THE UNITED STATES
>OF
>AMERICA GEORGE HERBERT WALKER BUSH, AND CURRENTLY SERVING AS PRESIDENT OF
>THE UNITED STATES OF AMERICA. THIS LETTER MIGHT SURPRISE YOU BECAUSE WE
>HAVE NOT MET NEITHER IN PERSON NOR BY CORRESPONDENCE. I CAME TO KNOW OF YOU
>IN MY SEARCH FOR A RELIABLE AND REPUTABLE PERSON TO HANDLE A VERY
>CONFIDENTIAL BUSINESS TRANSACTION, WHICH INVOLVES THE TRANSFER OF A HUGE
>SUM
>OF MONEY TO AN ACCOUNT REQUIRING MAXIMUM CONFIDENCE.
>
>I AM WRITING YOU IN ABSOLUTE CONFIDENCE PRIMARILY TO SEEK YOUR ASSISTANCE
>IN
>ACQUIRING OIL FUNDS THAT ARE PRESENTLY TRAPPED IN THE REPUBLIC OF IRAQ. MY
>PARTNERS AND I SOLICIT YOUR ASSISTANCE IN COMPLETING A TRANSACTION BEGUN BY
>MY FATHER, WHO HAS LONG BEEN ACTIVELY ENGAGED IN THE EXTRACTION OF
>PETROLEUM
>IN THE UNITED STATES OF AMERICA, AND BRAVELY SERVED HIS COUNTRY AS DIRECTOR
>OF THE UNITED STATES CENTRAL INTELLIGENCE AGENCY (CIA).
>
>IN THE DECADE OF THE NINETEEN-EIGHTIES, MY FATHER, THEN VICE-PRESIDENT OF
>THE UNITED STATES OF AMERICA, SOUGHT TO WORK WITH THE GOOD OFFICES OF THE
>RESIDENT OF THE REPUBLIC OF IRAQ TO REGAIN LOST OIL REVENUE SOURCES IN THE
>NEIGHBORING ISLAMIC REPUBLIC OF IRAN. THIS UNSUCCESSFUL VENTURE WAS SOON
>FOLLOWED BY A FALLING-OUT WITH HIS IRAQI PARTNER, WHO SOUGHT TO ACQUIRE
>ADDITIONAL OIL REVENUE SOURCES IN THE NEIGHBORING EMIRATE OF KUWAIT, A
>WHOLLY-OWNED U.S.-BRITISH SUBSIDIARY.
>
>MY FATHER RE-SECURED THE PETROLEUM ASSETS OF KUWAIT IN 1991 AT A COST OF
>SIXTY-ONE BILLION U.S. DOLLARS ($61,000,000,000). OUT OF THAT COST,
>THIRTY-SIX BILLION DOLLARS ($36,000,000,000) WERE SUPPLIED BY HIS PARTNERS
>IN THE KINGDOM OF SAUDI ARABIA AND OTHER PERSIAN GULF MONARCHIES, AND
>SIXTEEN BILLION DOLLARS ($16,000,000,000) BY GERMAN AND JAPANESE PARTNERS.
>BUT MY FATHER'S FORMER IRAQI BUSINESS PARTNER REMAINED IN CONTROL OF THE
>REPUBLIC OF IRAQ AND ITS PETROLEUM
>RESERVES.
>
>MY FAMILY IS CALLING FOR YOUR URGENT ASSISTANCE IN FUNDING THE REMOVAL OF
>THE PRESIDENT OF THE REPUBLIC OF IRAQ AND ACQUIRING THE PETROLEUM ASSETS OF
>HIS COUNTRY, AS COMPENSATION FOR THE COSTS OF REMOVING HIM FROM POWER.
>UNFORTUNATELY, OUR PARTNERS FROM 1991 ARE NOT WILLING TO SHOULDER THE
>BURDEN
>OF THIS NEW VENTURE, WHICH IN ITS UPCOMING PHASE MAY COST THE SUM OF 100
>BILLION TO 200 BILLION DOLLARS ($100,000,000,000 - $200,000,000,000), BOTH
>IN THE INITIAL ACQUISITION AND IN LONG-TERM MANAGEMENT.
>
>WITHOUT THE FUNDS FROM OUR 1991 PARTNERS, WE WOULD NOT BE ABLE TO ACQUIRE
>THE OIL REVENUE TRAPPED WITHIN IRAQ. THAT IS WHY MY FAMILY AND OUR
>COLLEAGUES ARE URGENTLY SEEKING YOUR GRACIOUS ASSISTANCE. OUR
>DISTINGUISHED
>COLLEAGUES IN THIS BUSINESS TRANSACTION INCLUDE THE SITTING VICE-PRESIDENT
>OF THE UNITED STATES OF AMERICA, RICHARD CHENEY, WHO IS AN ORIGINAL PARTNER
>IN THE IRAQ VENTURE AND FORMER HEAD OF THE HALLIBURTON OIL COMPANY, AND
>CONDOLEEZA RICE, WHOSE PROFESSIONAL DEDICATION TO THE VENTURE WAS
>DEMONSTRATED IN THE NAMING OF A CHEVRON OIL TANKER AFTER HER.
>
>I WOULD BESEECH YOU TO TRANSFER A SUM EQUALING TEN TO TWENTY-FIVE PERCENT
>(10-25 %) OF YOUR YEARLY INCOME TO OUR ACCOUNT TO AID IN THIS IMPORTANT
>VENTURE. THE INTERNAL REVENUE SERVICE OF THE UNITED STATES OF AMERICA WILL
>FUNCTION AS OUR TRUSTED INTERMEDIARY. I PROPOSE THAT YOU MAKE THIS
>TRANSFER
>BEFORE THE FIFTEENTH (15TH) OF THE MONTH OF APRIL.
>
>I KNOW THAT A TRANSACTION OF THIS MAGNITUDE WOULD MAKE ANYONE APPREHENSIVE
>AND WORRIED. BUT I AM ASSURING YOU THAT ALL WILL BE WELL AT THE END OF THE
>DAY. A BOLD STEP TAKEN SHALL NOT BE REGRETTED, I ASSURE YOU. PLEASE DO BE
>INFORMED THAT THIS BUSINESS TRANSACTION IS 100% LEGAL. IF YOU DO NOT WISH
>TO CO-OPERATE IN THIS TRANSACTION, PLEASE CONTACT OUR INTERMEDIARY
>REPRESENTATIVES TO FURTHER DISCUSS THE MATTER.
>
>I PRAY THAT YOU UNDERSTAND OUR PLIGHT. MY FAMILY AND OUR COLLEAGUES WILL
>BE
>FOREVER GRATEFUL. PLEASE REPLY IN STRICT CONFIDENCE TO THE CONTACT NUMBERS
>BELOW.
>
>SINCERELY WITH WARM REGARDS,
>
>GEORGE WALKER BUSH

Illegal? by waytoomuchcoffee · 2003-02-09 09:27 · Score: 5, Interesting

The conclusion drawn may be oversimplified but nonetheless pragmatic: 1) forged headers should be illegal 2) a specific header entry should identify the email as unsolicited

Why does everyone in the USA assume that everyone else in the world will somehow obey US law when it is made "illegal"?

Re:Illegal? by meringuoid · 2003-02-09 09:45 · Score: 4, Insightful

Why does everyone in the USA assume that everyone else in the world will somehow obey US law when it is made "illegal"?

Because the vast majority of spam is sent by Americans, advertising products sold by other Americans and hoping to sell them to still more Americans. The fact that the spam is sent via open relays in Korea or bulletproof accounts in China, and received in Europe or Australia, is neither here nor there. Ralsky, for instance, lives in America, regardless of where the spam is routed; indeed, _his_ location is very well known nowadays ;-)

--
Real Daleks don't climb stairs - they level the building.
Re:Illegal? by jjo · 2003-02-09 09:49 · Score: 3, Interesting

People don't assume this. What they do assume is that, by and large, people who try to get money from US residents are actually situated in the USA, regardless of where the e-email might have originated. Even those who are not in the USA will mostly use a US agency to get their money. That is their Achilles heel: Follow The Money.

Stop the flow of money from US residents, and you will be effectively making everyone in the world obey US law, with respect to spamming within and into the USA.

MIT's Post Servers... by g_arumilli · 2003-02-09 09:28 · Score: 5, Interesting

now use SpamAssassin. Basically, a set of new headers is attached to the e-mail of the form X-Spam-foo, and if X-Spam-Score is 7.5 or greater (on a scale of 10 I believe), then X-Spam-Flag is yes. It's really useful for sorting out spam quickly, and I haven't gotten a false positive yet...It doesn't get all of the spam, but it gets the vast majority of it...

Re:MIT's Post Servers... by jdreed1024 · 2003-02-09 09:51 · Score: 4, Informative

now use SpamAssassin. Basically, a set of new headers is attached to the e-mail of the form X-Spam-foo, and if X-Spam-Score is 7.5 or greater (on a scale of 10 I believe), then X-Spam-Flag is yes. It's really useful for sorting out spam quickly, and I haven't gotten a false positive yet...It doesn't get all of the spam, but it gets the vast majority of it...
Some more clarification:
-it's not on a scale of 10 - the SA score can go as high as necessary. I got 27 the other day. Your threshold will be configurable (sometime next week) to "high" (3.0), "normal" (7.5), or "low" (12.0), or a custom number. You'll also have custom whitelists and blacklists.

--
There is no sig, there is only Zuul.
Re:MIT's Post Servers... by Alan · 2003-02-09 11:20 · Score: 3, Funny

IIRC I once got one in the 40s or 50s, some asian teen sex toner catridge html penis enlarging money saving viagra enabled weight lose and interest rate mail of some sort I guess....

Always with the legislation... by Sheetrock · 2003-02-09 09:28 · Score: 4, Interesting

Spam is a technical problem, so why can't we come up with a technical solution? For example, it should be impossible to forge headers, not illegal. Why rely on a legal solution from many of the people who have brought us such brilliant solutions as the DMCA and the CDA in the past when all that's required is what our community has always been good at: sitting down and thinking things out?

--

Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.

Re:Always with the legislation... by TGK · 2003-02-09 09:58 · Score: 5, Interesting

I'd say the best technical solution I've seen to breaking the SPAM system is the use of the internets distributed nature against the spammer.

Consider the following. We all access the internet from a fixed and typicaly small number of physical and virtual locations. Were we to map the internet as a whole, starting from any given location the map would look like an expanding cone.

In short, almost all of the traffic from a given point flows through a very small number of servers and routers at some point close to the source.

Since spam messages are sent by the millions and it is fairly easy to determine what messages are likely to BE spam why not set up a filtering system on the routers that determines the rough content of a message based on both its Spam Precentage and the number of identical messages sent.

I.E. If the router sees 500,000 messages of nearly identical content with a 89% spam rating it blocks all of them. If it sees 44 messages with a 23% spam content it lets them through.

Thoughts anyone? I'm sure this idea has gaping flaws in it... what would have to be chnaged for it to work? What are the critical flaws? Is this a viable model or am I missing something major?

--
Killfile(TGK)
No trees were killed in the creation of this post. However, many electrons were inconvenienced.
Re:Always with the legislation... by KjetilK · 2003-02-09 10:17 · Score: 4, Insightful
Spam is a technical problem,

No, it is not. It is a social and economic problem.
1. Spammers do not have the social intelligence to see that what they are doing is destructive.
2. Spammers, at least some of them, are making money.
That's why you can't come up with a technical solution, because it isn't a technical problem.
Making it impossible to forge headers is not going to solve any of the problems above. It will only make it easier to report spam to ISPs, but it will not pressure them more to whack the spammers.
You can take technical measures to shift the cost onto the spammer, but if you do that, you must consider the side-effects.
Frankly, I think laws are the solution. But given clueless legislators, we have to write the law.
--
Employee of Inrupt, Project Release Manager and Community Manager for Solid

Interesting free speech point by jenkin+sear · 2003-02-09 09:29 · Score: 4, Interesting

Towards the end of the article, Gleick makes a really interesting point- he says that as commercial speech, spam isn't entitled to any particular first amendment protection:

The Supreme Court has made clear that individuals may preserve a threshold of privacy. ''Nothing in the Constitution compels us to listen to or view any unwanted communication, whatever its merit,'' wrote Chief Justice Warren Burger in a 1970 decision. ''We therefore categorically reject the argument that a vendor has a right under the Constitution or otherwise to send unwanted material into the home of another.''

Looks like we have the supremes on our side; if we could just congress to issue some letters of marque and reprisal on the spamhausen, we'd be getting somewhere...

--
What a strange bird is the pelican, his beak can hold more than his belly can.

Techical Solutions Are Required by esme · 2003-02-09 09:29 · Score: 4, Interesting

As much as I'd like to see spammers prosecuted for fraud (and think making various deceptive tactics illegal is a good short-term approach), legal and social approaches are doomed to failure. The number of people you can spam is so vast, that even if only one in a million takes the bait, it's still profitable -- that's a powerful economic imbalance that you don't find anywhere else. And it's going to make people forge headers, spam from overseas, etc. to get around any legal and social roadblocks.

I think that breaking that economic model -- ending the reciever-pays system for email -- is the only way to fix spam. If you had to pay some amount of money -- event 1 cent -- for each message that is delivered, spam would stop being economical. And that's the only thing that's going to make it stop.

-Esme

Re:Techical Solutions Are Required by yakko+nef · 2003-02-09 09:51 · Score: 3, Insightful

This is a horrible idea. I use email on a daily basis just to send myself notes. If I think of something at work I need to do at home, or vice versa, I send an email to myself instead of writing it down. Implementing a system which would require me to pay to talk to myself is bad. I already pay for my internet connection to be active telling me I have to pay an additional fee to use it is stupid.
Re:Techical Solutions Are Required by rthille · 2003-02-09 15:01 · Score: 3, Interesting

There's no reason to involve money (dollars) to stop spam, make them spend CPU cycles instead. Take a look on google for 'hashcash'. Basically, it involves the sender computing a function that takes a long time to figure out, but is very easy for the receiver to verify. So, if i want to send you mail, I spend ~10 cpu seconds, and you verify that I spent the time, and you accept the mail. If I don't compute the function, you sideline/reject the mail. Whitelists can be used to prevent always needing to compute the function. That way I can accept mail from anyone who might be willing to send me mail, if they are willing to spend the CPU cycles. However, since spammers would need to spend 10 seconds per message, they could only send about 1000 messages per day. That wouldn't be economically viable for them...

--
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/

The real way to get rid of spam by KevinIsOwn · 2003-02-09 09:32 · Score: 3, Interesting

Sure all these programs help, but think about what creates spam in the first place.

There are clearly people out there willing to buy the things offered in spam. Obviously not that many, but enough to make a profit. I think that there should be more of an effort to target these people and tell them not to buy stuff from spam!

There is only so much a program can do to stop spam. As we've seen numerous programs have been made, Spam Assasin being one of the best (I use it), but the spam just keeps coming

Until there is no incentive to send spam in the first place people will do it despite any laws against it.

evolution users by asv108 · 2003-02-09 09:33 · Score: 4, Informative

The one big feature missing for me in evolution is a spam filter. Fortunately, spamassassin works great even if you have to run it locally. Here are some instructions for evolution users who need to run it locally or are lucky enough to have spamassassin installed on their mail server.

Re:SpamAssasin in large corporate use? by Webratta · 2003-02-09 09:41 · Score: 4, Interesting

I don't work for a large corporation, but a state-wide ISP. I asked my boss, the chief technical officer of the company, why we weren't using Spam Assassin. He replied that while it is a very neat program and does a great job of filtering spam, the performance just isn't quite there yet. He's of the mindset that it needs some tweaking still before it can be a competitor to commercial products like what Brightmail offers.

Personally, I'd like to see more companies using SpamAssassin just to prove that it can stack up against other products, because I think it can work well if it's configured properly and you use spamd. I use it on my mail server at home and at last check it catches 98.2% of all spam message sent to my machine, and I haven't had any false positives since I set up my whitelists.

--
Beef! Beef! Beef!

Chaos Theory anyone? by bstadil · 2003-02-09 09:46 · Score: 3, Informative

James Gleick, is more technically educated

The uneducated guy that send this story in, need to know that was instrumental in taking Chaos theory from an obscure science in Santa Fe into something that almost every scientific discipline benefits from. Incl CS. .

--
Help fight continental drift.

Re:illegal by fmaxwell · 2003-02-09 09:50 · Score: 4, Informative

illegal is great in theory, but there is no possible way to enforce that on a world wide basis.

It's impossible to enforce almost any laws with 100% effectiveness, but that does mean that we should ignore the problem. If some sleazeball in Florida hires a firm in Korea to spam me, put his ass in jail.

white lists are the only way to stop spam.

I'm amazed by this user-hostile suggestion every time I hear it. Suppose you post your resumé on Monster.com. Who are you going to whitelist? Suppose your friend changes ISPs and then tries to e-mail you his new address? It won't be whitelisted, so it will bounce. Suppose to fill out a tech support request form. You don't know the address of the person that will contact you (or even if they will be the same domain as the web site).

Another cool anti-spam tool by yiingineer · 2003-02-09 09:57 · Score: 5, Interesting

I've been using Cloudmark's SpamNet for the past few months and it's been working quite well.

The smart thing that SpamNet does, is that it relies on its users to determine if something is spam or not. If some email lands in your inbox and a few hundred SpamNet members have proclaimed it spam, it most likely is, and it gets immediatly filtered out. This has the net effect of a few user's needing to filter out a few message ocassionally, while the vast majority of messages are filtered out for all users. Although SpamAssassin seems quite good, it's still based upon filtering rules and spammers are constantly tweaking their emails to try to get around them. Since people are still better at determining what's spam and what's not, I find that its accuracy is generally better.

SpamNet isn't perfect though, as far as I know, it only works with Outlook on Windows and doesn't have a Unix, Linux or Mac version. It also sometimes filters out valid bulk mailings, but overall, I would definitely recommend it.

Re:SpamAssasin in large corporate use? by winnetou · 2003-02-09 09:59 · Score: 3, Interesting

I was wondering how many large corporation are using SpamAssasin. And if not, why not?

Reasons for not using SpamAssassin are the CPU and bandwidth costs. Refusing e-mail from known spam sources is cheaper and (more importantly) does not give away information about which addresses are valid.

After checking the source IP address against lists such as Wirehub, Osirusoft (despite its name not only a list of open relays) and/or some other lists, almost no spam will be accepted.

IP space is finite and, even better, allocated in ranges. Continued spam from (or spamvertizing a website on) an IP address is a very good indicator for more spam from the IP range.

Go with POPFile. by TDScott · 2003-02-09 10:00 · Score: 4, Informative

SpamAssassin's a great idea, but for the non-technically minded user, POPFile's the best choice. Bayesian filters, learning, kickass UI, and a Windows installer (and Perl for other platforms.)

Re:NO NO NO - for a different reason by JonTurner · 2003-02-09 10:03 · Score: 5, Insightful

>>1) forged headers should be illegal 2) a specific header entry should identify the email as unsolicited

Don't we ever learn from the past? We've all seen the unintended consequences of poorly-crafted legislation (e.g. DMCA), so why run to the shelter of more restrictions which, in the end, will only cause us more problems? Like the criminals trying to scam your mom with the Nigerian-hold-my-money-for-a-day scam are going to suddenly begin obeying the law... yeah, right. Which begs another question: what law, in what jurisdiction? Even if the US were to pass this law and ruthlessly enforce it (domestically), all scammers would simple flood us from offshore servers.

The solution is not legislation, it is the creative use of technology. Build software that "learns" what is spam and what isn't, then evolves to keep up with the changing tactics of the spammers. Something like PopFile

I rarely ever get spam. by cpaluc · 2003-02-09 10:18 · Score: 4, Interesting

Heres how:
1. Spend 10 bucks, buy a domain name (eg xyz.com).
2. Set up a few email aliases to point to your real email. eg:

joe@xyz.com ---> you@hotmail.com

temp123@xyz.com ---> you@hotmail.com

spam123@xyz.com ---> you@hotmail.com 3. Never give out 'joe@xyz.com' to anyone except friends/family.
4. Use the other emails for signing up for things on the web or in usenet.
5. When you get your first spam addressed to 'temporary21@xyz.com', delete the email address (no more spam from that source!).

I find this method works extremely well. By using aliases in this way you effectively hide your real mailbox. Even if your hotmail account starts receiving spam you can just get a new one and point your aliases at it. Also, if you change ISP you don't need to change your email address.

If you use it to forward to a hotmail account it might be better if the hotmail account name isn't a dictionary word or name (ie. use a random string for an account name that the 'bots won't guess.

You're screwed if your 'trusted' address gets out there but if you're careful you'll at least get much more use out of it before needing to kill it.

Re:I rarely ever get spam. by LocalH79 · 2003-02-09 10:39 · Score: 4, Interesting

Spamgourmet does exactly what you propose, and is much more effective.

Internet mail architecture sucks by cdegroot · 2003-02-09 10:28 · Score: 3, Interesting

Change to something like IM2000 (http://cr.yp.to/im2000.html), spam vanishes in a poof. Keep around with the current broken system, and we'll have ever more draconian laws in ever more futile attempts to suppress it.

Re:I get four a week. by Sarcazmo · 2003-02-09 10:32 · Score: 3, Informative

If you just want a fake email address that is "valid", use whatever@example.com

example.com is an official internet blackhole, sanctioned by RFC. It is what everyone is supposed to use in books, demonstrations, etc, similar to 555-XXXX phone numbers on TV.

Re:I get four a week. by Junta · 2003-02-09 10:36 · Score: 3, Informative

Better strategy.... But requires having control of your own mail server...

I run my own mail server. I have Postfix configured to forward username-@the.server to username@the.server by default. So, for example, I registered with amazon username-amazon, and it gets to me. If this email is ever put on a list, I'll complain to amazon, and then create a .forward-amazon and have it put mail in /dev/null. Alternatively you could use procmail or maildrop in the dot-forward file to perform per-extension filtering or bounce messages to explain why the mail will never be read, in case legitimate mail tries to come into that box, perhaps with a random, unique extension provided for them to try a legitimate box. Not only do you have an effective mechanism for filtering out unwanted mail by source and outdated email, you also have a way to track how your email gets out. It has worked quite well. Last week I got three spams, and blocked that address. Aside from that and a couple of other incidents in the past year (about 8 or 9 spam mails total), the signal to noise ratio in that mailbox is excellent.

--
XML is like violence. If it doesn't solve the problem, use more.

Bad idea by Goonie · 2003-02-09 10:38 · Score: 3, Interesting

This is near-impossible, technically. By the time the traffic flows through the "core routers", it's just a bunch of IP packets which the system doesn't even try to interpret at a higher level. Reconstructing the messages, running spamassassin on them, and selectively blocking them would put an insane CPU load on the routers. They would effectively be acting as mail relays, not routers.

There are also philosophical problems with such a scheme which others can explain...

--

Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)

the Author's version of the article by gleick · 2003-02-09 10:50 · Score: 4, Informative

For what it's worth, an ever-so-slightly longer version, lacking a few bits of Times editing, is posted here, at my own site. And may I say how helpful and fascinating the many Slashdot discussions of this subject have been?

A new breed of email is on the horizon by mcrbids · 2003-02-09 10:52 · Score: 4, Interesting

If we can pull it off.

With Bind 9, we finally have a decent, working implementation of DNSSEC. This will allow for a new breed of secure, verified websites and email, and (Finally!) makes a RBL actually mean something.

How's that you ask?

Well, one of the biggest problems with SPAM is the forged header, open relay issue. It's a complicated issue, and one that doesn't have an obvious, "in your face" kind of answer.

DNS is designed to tell you where to go, and SSL/Certs make sure that you got there. Why aren't they joined together? The fact that you are the DNS server for a domain makes it clear and obvious that you are an authoritative designator for where you are supposed to go - why have this wholy separate and dis-jointed SSL/Cert that can't even be made to work consistently?

If an ISP can issue DNS-SEC certs with impunity, we might actually see a reason to have encrypted and ISP certified email.

And suddenly, the ISP is back in charge again, able to validate every email going out as coming from one of it's customers. Revoke the cert and their email becomes unreadable.

Now, we have an email system with a powerful mechanism built in that is:

1) Standards compliant
2) Easy to implement
3) Clearly laid out
4) Cheap
5) secure
6) private - using the ISP's cert to identify yourself doesn't mean that the ISP can read your email! (like they can now - the command is "mail -u _username_")

What's not to argue with? The issue of locking down an open relay becomes a non-issue - an ISP could simply identify an "s-mail" server (secure mail) that will only relay for those holding a valid cert at that ISP.

Roaming wouldn't be an issue, nor would open relays or forged headers.

A brave new world? Yep. One I'd like to live in? Yep. One that's coming? We can only hope...

--
I have no problem with your religion until you decide it's reason to deprive others of the truth.

Re:illegal by fmaxwell · 2003-02-09 10:53 · Score: 3, Insightful

1) use a "throw-away" email address when including them in your resume.

Most people can't even deal with a single address.

2) develop a more friendly "white list" system that makes it easy for you to "open it up" for your potentual employers. So when I send mail out to someone important, I'm just one click away from adding them to my "white list".

Listen Miss Cleo, you have no way of knowing who will respond to your resumé. It might be a company that you send it to. It might be someone at that company working from home. It might be someone at another division that you did not know about. If your resumé was posted on a web site, it might be anyone responding.

Come on guys, I thought /.ers were nerds and knew how to write programs.

My mail server and e-mail processing software implement filtering that would probably make your head spin. Despite having dozens of e-mail accounts and three different domains, I probably see less the one percent of the spam that's sent to my domains. I have autoresponders for retired addresses, auto-complaints for mail from Brazil (to mail-abuse@nic.br), and I use multiple blacklists. Some of my e-mail addresses accept blind copies from untrusted senders and some do not.

But the spam problem needs to be solved for everyone, not just computer geeks that hang out on Slashdot. When the risk of fines and jail time make it unattractive, then we will have really solved the problem.

Where spam really comes from by Cbs228 · 2003-02-09 11:10 · Score: 3, Interesting

Spam isn't a legal problem-- it's a social problem. It is the result uncontrolled avarice, of people wanting to make money at any ethical cost. There will always be these kinds of people who will steal our time (and our bandwidth) regardless of any laws against them. There are also people (Sysadmins of certain Far East networks come to mind) who are willing to look the other way for a few extra dollars.

But most importantly of all, we cannot forget that American consumers are responsible for spam. That's right, spam is OUR fault. It is our fault because no matter how many messages are filtered, and no matter how many websites are closed for spam complaints (or get DDoS'd by rampaging slashdotters), they still make money. They make money because of that infinitesimally small group of consumers who buy stuff from spammers. That small percent is what makes it all worth it to them.

The day that spammers' profit margins drop to nil because consumers refuse to buy from spammers is the day that spam vanishes from our inboxes forever. No laws, no filters, no problems.

Unfortunately, as P.T. Barnum would put it, "There's a sucker born every minute..."

--
At our school, we don't earn a degree when we graduate—we earn pi/180 radians

Technically educated? He founded Pipeline by yelvington · 2003-02-09 11:52 · Score: 3, Informative

"the author, James Gleick, is more technically educated than what we've come to expect from the big press."

Maybe because after many years as a reporter, he founded Pipeline, one of the first big ISPs.

What was the e-mail? by shellac · 2003-02-09 12:20 · Score: 3, Funny

So what was the e-mail with a score of 27?

"Hello, I am a Nigerian prince who is selling XXX-brand diet pills that also have the side effect of enlarging your penis. Also if you forward this email to five other people and tell them to each send you a dollar you can make money fast."

*ducks*

49 of 394 comments (clear)