Spam Lawsuit Clearinghouses?

cloudscout asks: "Spam is getting worse. Despite complex filtering and DNSBL systems the volume of unsolicited eMail continues to climb. The only promise so far has been an increasing number of laws designed to impede the spammers while others are using existing laws to tackle the problem. So when are we going to see this legal process become a commodity? There are already countless lawyers around the country who will accept a set price to fix traffic tickets, handle divorces and get the IRS off your back. When will we see attorneys who are willing to sue the spammers on your behalf for a reasonable, fixed fee?"

Comments

I dunno...

[NanoGator]

I'd rather deal with SPAM by making it technically harder to send out messages like that. I guess I'm just a little paranoid that one day I'll send out a message and find myself in court.

Why should I pay them?

[gmhowell]

Wouldn't a contingency system work better? Why should I pay the lawyer a set fee when the recovery will likely be greater than that? Why not have it so that I get 10-40% of the recovery, and let the lawyer take the rest?

I see a few problems: first, is there any case law to make this a matter of filling out the correct boilerplate and dropping it off with a judge? Second, how does one collect from out of the country spammers?

It's way too early to do this kind of stuff. Divorces and traffic tickets have been around for quite a while, and the kinks have been worked out of the systems.

Re:Why should I pay them?

[PD]

I'd even have it set so that the lawyer gets 100%. All I want is for the spam to stop. If a lawyer can successfully sue a spammer on behalf of a client, I'd consider that money WELL earned, and the lawyer would deserve all of it. I'm not anti-lawyer. There's quite a lot of really great ones out there, good people. When they work hard and do a good thing, it's a good thing for them to make money at it.

Why a fee?

[clambake]

I'd be happy to just let the lawyers have whatever damages they can get from the spammers. They could set up a database and an email address and I could forward all my spamassassin tagged email to them and they could handle them on my behalf. I wouldn't pay them anything, and they would get to collect on whatever damages they can get, but I'd still be getting something out of the deal (less spam). Everybody wins! Even the spammers, no doubt, who will then begin spamming each other with, "Are you tired to getting sued for spamming others? Use SekretSpam, only $19.95!"

SekretSpam

[Anonymous Coward]

Too funny.

Wouldn't it be the other way around?

[Yuan-Lung]

There are already countless lawyers around the country who will accept a set price to fix traffic tickets, handle divorces and get the IRS off your back.

Concidering how the general ethics level is in that perticular community, and much like the theme running in your analogy... there would probably be lawyer getting the spammers off spam suits, rather then to help condemning them.

Why does filtering work for me?

[mlinksva]

I've heard and read many people (including mail engineers at Y!Mail or Hotmail) claim that spam filtering doesn't work, can't work, the spammers will always be one step ahead, etc.

Why does filtering work for me? I have several old domains with published email addresses. I probably get 1000 spams a day. SpamAssassin catches 99.8% of it, and AFAICT the only false positives I've ever had were messages discussing HGH cranks.

So, why does filtering work for me when it is supposedly futile?

Re:Why does filtering work for me?

[josepha48]

NOt everyone is using spamassassin. The problem is that ISP's need to install it and then set it up. They don't, so we get spam. I get LOTS of spam each day and about 75% of it gets filtered through my mozilla filters. I'm now working at a different approach.

I now have a new folder call it inbox_xxx. If someone is in my address book it gets into this email folder. If it gets to one of my mailing lists or other filters it gets in the proper folders. Otherwise it now stays in my inbox, where it is considered hostile spam and gets nuked!

I just started this approach and think it could work. I don't get mail from people I don't know so I hope this works. Still testing.

Re:Why does filtering work for me?

[mlinksva]

I know not everyone uses SpamAssassin. I'm really wondering why many people, including some who ought to know, claim that filtering can't work. Have they really just not tried SpamAssassin, or do they know something I don't?

Re:Why does filtering work for me?

[Steve B]

I've heard and read many people (including mail engineers at Y!Mail or Hotmail) claim that spam filtering doesn't work, can't work, the spammers will always be one step ahead, etc.

I still think that the key is to apply the existing computer-cracking laws against the various methods the spammers use to stay "one step ahead". Why is coming up with new variations on how to spell "viagra" any different from shoveling a dictionary into a password prompt, when the objective in both cases is to get into a computer despite a system that was put there to keep you the hell out?

Re:Why does filtering work for me?

[linuxwrangler]

Probably because you don't have screaming customers. It's one thing to filter mail for you or a small group of understanding people. It's quite another to deal with a large customer base.

One batch wants all the newsletters from {fill in favorite hobby/group} but that mass mailer is blacklisted because they got an unscrubbed list from an unrelated client.

Meanwhile the small business person is afraid that they really might miss the "BIG $1,000,000 ORDER!!!"

A friend of mine is researching anti-spam for her company. Of course the PHBs require no false positives, quarantine everything evil for review, customize on a per user basis, etc. Outsourcing this to an ASP will probably cost them $15k+/year.

What is AOL rejecting? Something like 1 billion messages every day and that only represents a fraction of the spam they get. Even a false positive of 1 per thousand rejects means 1,000,000 legit emails rejected every day. They have to be very careful.

It's way easier blaming the spammers than explaining why you rejected the legit message a customer/boss needed.

Then again look at the source...big companies who don't believe the RFCs apply to them anyway (postmaster is a required address that must go to a live person not an autoresponder but just try to reach postmaster at aol/hotmail/yahoo).

Re:Why does filtering work for me?

[josepha48]

I'd say it that they have not tried. Also think about a large corporation like Earthlink. They have their 'spaminator'. I think this is either a partnership or a home grown product (more likely a partnership). I think att.net is the same with a 'different' spaminator. If they just switch it may be breaking a partnership. If the spaminator were to start using spamassassin then elink would probably say wtf and drop them. In this case and I am sure there are others, it baseically breaks down to a business decision. Earthlink does not allow relaying either. I'm kinda pissed at some of these ISP's, like elink, they say I can't spam, but they do not do enough so that I don't get inendated with spam.

Re:Why does filtering work for me?

[Motherfucking Shit]

So, why does filtering work for me when it is supposedly futile?

As others have pointed out, filtering works for you because you're the one implementing your own mail filters. You know what you consider to be wanted and unwanted messages, and you've set up SA with some particular ruleset(s) to match. Unfortunately, this just doesn't work well at the ISP level. There are two reasons, really:

1. Who decides what does and doesn't get filtered? If you put the ISP in charge of this, invariably you're going to wind up with users missing legitimate email (remember, it's up to the user to determine which messages he or she thinks are legitimate). When Jane User loses an email from Mom talking about how things are going - which happens to mention how Dad got a prescription for Viagra - she's going to be ticked.

2. How much computing power is needed? You get 1,000 emails a day. AOL gets billions. And while AOL probably has the cash to invest in a few Gibsons to scan billions of inbound email messages looking for keywords, your average ISP is unlikely to make such an investment. (Interesting now that I think about it; if they're filtering for spam, what else might the world's largest ISP - conveniently situated in the middle of Spookville - be looking for?)

Point 2 becomes an extension of point 1 when you think about the "obvious solution" to the question of who decides what's filtered. That obvious solution, naturally, would be to implement a system where each user gets to set up his or her own filters; similar to what Yahoo mail has done on a rather limited scale. The problem there is yet more processing time. Instead of blindly applying the same filter to all inbound messages, with each message the recipient must be determined and their unique filter rules loaded.

It's not that filtering doesn't work. It does work, but it loses both effectiveness and accuracy when control moves away from the individual recipient. I don't want my ISP filtering my email based upon their idea of what looks spammish, or their idea of which hosts should or shouldn't be sending me email. But my ISP doesn't want to invest in the resources to let each of its users control their own spam filtering. As long as that catch-22 exists, ISPs are either going to filter everything equally or they aren't going to filter at all.

Even if there were a real solution available (aside from shifting the burden of filtering to the end-users), you'd still see the major ISPs suggesting legislation instead of filtration. The reason is that even bit-bucketed spam costs money to receive. AOL filters something on the order of a billion emails a day; assuming an average of 1KB per message, if my calculations are right that comes out to approximately a terabyte of bandwidth per day comprised completely of inbound trash. You can bet they'd rather see spam outlawed than have to sit around and pay for it.

Re:Why does filtering work for me?

[mlinksva]

filtering works for you because you're the one implementing your own mail filters. You know what you consider to be wanted and unwanted messages, and you've set up SA with some particular ruleset(s) to match.

No, actually I've always used SA out of the box:

wget http://www.spamassassin.org/released/Mail-SpamAssa ssin-2.53.tar.gz
tar zxf Mail-SpamAssassin-2.53.tar.gz
cd Mail-*
perl Makefile.PL PREFIX=~
make
make install

First two rules in .procmailrc:

:0fw
| $HOME/bin/spamassassin
:0:

* ^X-Spam-Status: Yes
caughtspam

And it just works. No more spam. This is an ISP shell account.

You and others bring up good points concerning the reasons why large ISPs don't filter and/or make it easy for their users to do so.

However, I'm not sure that

The problem there is yet more processing time.

If spam is really a big problem, then facilitating individual customers' filtering is a selling point. And increase in cpu required is somewhat offset by reduced storage space needed for spam.

If the ISPs won't help, we simply need to get client-side filtering into the hands of as many people, usable, and used as much as possible, reducing the spammers' audience.

While I'm at it, I'm also surprisd that teergrubing isn't widely deployed, AFAIK.

Re:Why does filtering work for me?

[Hyperbolix]

Nobody here seem's to realize how much CPU time spamassassin uses. Can you imagine running spamassassin on a server with 10,000 users? Even on my 1.73Ghz Athlon XP w/ RAID striping, spamassassin still takes considerable CPU time, and I'm only serving five email addresses. It pushes my CPU to 100% for a good second or two each time I get an email, and that just will not scale. The solution is not to reduce the volume of received spam by technical means, as we'll be fighting forever with the spammers. As soon as we upgrade, they will. The solution is to reduce the volume of incoming (not recieved) spam. Lawsuits work. Any way that makes sending spam costly will do the trick. They won't send it if the business model doesn't hold up.

Re:Why does filtering work for me?

[Anonymous Coward]

why does filtering work for me when it is supposedly futile?

Maybe because you're not paying by the byte to receive the spam, so that Spamassasin can filter it for you.

Re:Why does filtering work for me?

[Pembers]

And increase in cpu required is somewhat offset by reduced storage space needed for spam.

This is true, in that better spam filtering will allow the ISP to put off buying bigger disks for a while. But a crucial difference between disk space and CPU cycles is that you can reuse disk, but you can't reuse CPU.

From the ISP's point of view, it may not make much sense to spend, say, 5 microseconds to run a Bayesian filter on a 5K message, and then decide to dump it in /dev/null instead of /var/spool/mail, when half an hour later, the mailbox owner will read the subject line and delete the message anyway. Either way, the ISP has the 5K back, but the 5 microseconds are gone forever.

Of course, the mailbox owner may well take the view that he'd rather have the computer waste 5 microseconds deleting a message than him waste 5 whole seconds doing it himself. This is what angers me most about spam, more than the fact that it's driving up my costs: these bastards are stealing my time, and giving me nothing in return.

If spam is really a big problem, then facilitating individual customers' filtering is a selling point.

Absolutely. I'm getting near the point where I'd pay for something like that. But at the back of my mind is a little voice asking: "Why should you have to pay not to receive crap that has no benefit for you and that you never asked for in the first place?"

If the ISPs won't help, we simply need to get client-side filtering into the hands of as many people, usable, and used as much as possible, reducing the spammers' audience.

Anything that improves the signal-to-noise ratio in peoples' inboxes is good, but I don't believe client-side filtering will make much of a dent in the spammers' market. The whole point of spam is that a spammer can afford to send a million messages and make maybe ten sales. Anybody who hates spam enough to install a client-side filter is probably already one of the 999,990 people who wouldn't have fallen for the scam even if they had read the message. But if the result is that a person's inbox becomes useable again, would they care how it happened?

Re:Why does filtering work for me?

[mlinksva]

You're right, spamassassin does seem to be pretty heavyweight. I hadn't ever bothered timing it on the command line before. It can be run in daemon mode, which would at least eliminate perl startup/script compilation costs.

I suppose on a really busy mail server SA would peg cpu. But I'm guessing most installations have plenty of cpu to spare for SA.

Re:Why does filtering work for me?

[paitre]

Um, no.
Having worked for a reasonably large hosting company (largest in the world based on number of active IP addresses...by domains it's still a pipsqueak, but not insignificant) I can say, with confidence, that SpamAssassin will -not- work in that environment.
Not easily, at least. And yes, deploying it was considered, but the CPU hit (as mentioned) would kill all of the servers (since they were all Web/App/Mail in a box type set ups).

Re:Why does filtering work for me?

[paitre]

IIRC, the postmaster@ at AOL goes to the same group that handles spam for them. It's been a while since I talked with any of those individuals though (I'm out of the anti-spam game. too much stress...seriously).
Basically, postmaster is received, but probably not -replied to- by anyone because of the sheer volume of crap that comes in to those addresses. Having -been- an abuse desk, it gets read, and added to the complaint count for whoever you're complaining about.

'sides, the RFC only requires that it be deliverable. Not read.

Re:Why does filtering work for me?

[mlinksva]

FWIW Pair, a reasonably large hosting company, offers SpamAssassin-based filtering. But a user has to turn it on. Maybe they're counting on most users not using SA. AFAIK their machines are all multirole web/shell/mail (I've had some accounts with them).

Also, if the local box doesn't have cpu to spare, a dedicated cpu farm for SA could be used. I guess your "Not easily" comment covers this. :)

Re:Why does filtering work for me?

[mlinksva]

Of course, the mailbox owner may well take the view that he'd rather have the computer waste 5 microseconds deleting a message than him waste 5 whole seconds doing it himself.

Well, a user can filter on the client side, and there's always cpu to spare on the client. Only downside vs. filtering on the mail server is that you've got to transfer the spam to the client. Which is a problem over modem, but not over DSL or better.

Anybody who hates spam enough to install a client-side filter is probably already one of the 999,990 people who wouldn't have fallen for the scam even if they had read the message.

Yeah. I didn't spell it out, but my point was that we need to get filtering built in and turned on by default in MUAs. Mozilla's "junk" button (as of 1.4a anyway) is a good start, though I don't know if it is prominent enough.

Re:Why does filtering work for me?

[paitre]

Pretty much.
We decided that the only way to effectively roll SA out in their environment would have required setting up a number of different machines for it. For those clients that -really- wanted it, they look the other way.
Basically, with as small as the admin team is, there simply isn't the man power (and to sound egotistical, skill, they've had to hire a couple of folks to replace me since I left). Incidentally: 330 servers is a small fraction of the number of machines said previous employer had 6 months ago.
They've more, now.