AOL, MS & Yahoo Unite On Anti-Spam Initiative

dilaudid writes "FT.com has an article about AOL, Yahoo and MS putting aside their differences to combat spam. An AOL VP is quoted as saying "Our customers are telling us it is the number one problem with the internet." Their intended response is "narrowly-defined federal legislation aimed at so-called "king-pin" spammers" who send the bulk of the mails. "

Comments

Re:yeah yeah we don't want to buy more hardware

[leviramsey]

RTFA. The main reason they're pushing for this is because their customers are telling them that the spam is decreasing the value of their offerings.

Spam wouldn't exist without morons

[Stiletto]

If the number one problem with the Internet is spam, then the number two problem is all the idiots who buy products from spammers and keep them in business.

Spam will never stop. Just like junk snail-mail will never stop. The tiny percentage of below-freezing IQ's out there who fall for unsolicited "offers" are ruining it for everyone else.

Re:A valid use for a buttload of cash?

[fredrikj]

I am concerned that when all of this is said and done, only users of a Microsoft OS will not receive spam. ;-)

That makes sense, actually. What if the "solution" would be to only accept and forward messages with a valid DRM certification?

Re:Exceptions

[Otter]

Wait, lemme guess- that "narrowly-defined" definition of "spammer" will not include internet service providers advertising their services, nor companies the ISPs have paid to spam their subscribers?

My primary email account has disappeared under an avalanche of bounces and blocks from some asshole spammer forging my domain name in everything he sends out. I'm job hunting now, and refuse to install some new untested filters that are liable to throw out something important. So I need to wade through hundreds of returned ads for streaming gay porn.

If these companies can put a stop to the total scumbags, they can include a provision that their ads can be sent over the NSA's secret high-speed network. I'll still be grateful to them.

My grandmother got porno spam within 2-3 days of her MSN "internet appliance" getting set up, and it had a very unusual account name(with numbers in it, too)- no dictionary atttack hit this one.

Maybe, but my suspicion is that you underestimate the magnitude of dictionary attacks on common domains like that. Given millions of idiots, all MSN addresses are shallow.

What really needs to be done

[Monoman]

* Use existing laws: I am sure there is more than enough laws already on the books that cover "fraudulant and egregious methods to disguise and misrepresent". We don't need laws specific to spam we should use generic laws that cover communications fraud.

* Go after those that hire spammers too. If I contract someone to perform a service and I know their methods are not legal then I should be held liable too.

* Don't depend on laws to fix everything. Fix the system!

Re:Dumb and Dumber

[dknight]

This works only assuming that all email/websites/etc... are within the US. I know we like to police the world, but even we couldnt pull THAT one off.

Doubting Yahoo's commitment to this ???

[adzoox]

I have had Yahoo mail for almost 9 years now. I was getting about 3-4 messages a day all the way up to 2001 when they started charging for premium services. Then an avalanche of SPAM hit. Now at 300+ a day.

I do realize everyone's SPAM is at insane levels and SPAM has gone up in the last 3 quarters. That said, I have very intelligently and precisely made my 15 free filters and none of them work on Yahoo mail. Middle of last year, I decided to chunk down the money for the premium email account. I used up the free 35 extra filters pretty quick.

It is my opinion that Yahoo allows junk mail, in fact, dumps it heavily on it's customers so that they will buy a premium service.

And if you lie about the headers?

[unfortunateson]

The spammers will claim they all fit in the personal communications requested by the recipient, and are not required to fill in all that rigamarole.

And you're right back where you started from.

No, the solution is to inform people that
a) Your body parts aren't going to get bigger (bellies excluded)
b) You really don't want to trust your finances -- even credit bailouts -- to people who'd SPAM you
c) There are no dignitaries in Nigeria that have millions of dollars they need to launder into the US, and if they did, you'd be arrested
d) There's no need to pay for porn. Go out into the big blue room and you could find someone real. Besides, there's enough free internet porn, just look.

You get SPAM because it works. People buy this crap. If they didn't, the spammers would stop.

Drug War Parallel

[limekiller4]

This is kind of funny, the parallels between the spam wars and the so-called drug wars. I call say this because it is more appropriately labeled "war on some drugs." But that's another rant.

But isn't it interesting that they (meaning AOL et al) are going after the big offenders and not, say, THEMSELVES? After all, they are analagous to the street-level pushers of the spam. The big spammers ("kingpins") are the ones who create the spam and are the nexus for it's origin. The product is then filtered down until it reaches the local ISP of the client/user and finally handed to the target -- the customer.

You might object and say, "the difference between drugs and spam at this level is quite sharp because drug users want the drug. Spam receiptients do not." Well SOMEONE is buying. Spammers don't spam because they think their literature amounts to avant garde exercises in promotional haiku. They spam because someone pays them to. And someone pays them to because someone is buying. In other words, every nickel they spend on spam comes back to them dressed up as a dime. It's as simple as that. The only real difference between the two analogies when you consider it is that spam is less visible because of the inherant privacy and legality of spam. That's all. You still have a product, you still have a buyer and you still have a larger community that must deal with the fallout of that activity.

However, this is the point at which the analogy breaks.

The community normally goes after the street-level dealers and the users. Of course the dealers have little to lose because they're poor to begin with and there will always be someone to deal. Always. And users/buyers are always going to use/buy. So go after the source, right? This makes sense, right?

So why are over half (55%) of all federal prisoners drug offenders?

This would be like Microsoft and AOL suing themselves half to death and prosecuting the recipients of the email when they purchased wares sold by spam. Never mind the fact that buying after seeing a spam isn't illegal. That's not the point. The point is that even if it were, it is an obviously flawed and ineffective model. It just doesn't work.

Technical Pressure

[linuxwrangler]

One thing that the big ISPs could do is exert technical pressure to help deny spammers the ability to hide. I would love to see them reject all mail in which the HELO greeting is not fully qualified and resolvable (as required by the RFCs). Same thing everywhere else a domain appears in an SMTP conversation. This would force a mass cleanup of incorrectly configured mailservers and I would be able once again to include that as a requirement on my server.

Although perhaps exceeding the requirements of the RFCs, they might also consider refusing mail if the HELO/EHLO does not resolve back to the connecting IP.

In addition, they could publish via DNS info records or ?? the IPs of all their outbound mail servers (no MX won't work - that's only for inbound mail). It would be great to be able to bounce all mail "from" someone at yahoo/hotmail/aol/etc. unless the connection came from a mailserver associated with that email address (sure, for some people the mail may have been legitimately relayed before arriving at their site but that has never been the case for my servers).