Spam Meeting Wrap-up

wendigo2002 writes "Get used to that daily flood of e-mail come-ons, Viagra offers and lucrative enticements to invest in Nigerian pyramid schemes. Internet gurus, software designers and lawyers today ended a three-day Federal Trade Commission discussion on combating spam by concluding neither technology nor laws are yet capable of completely dealing with the plague."

Comments

Perhaps

[Gonoff]

they might work better if they got spammed every day? If we can persuade these guys to get hotmail addresses, they might understand better...

Re:Perhaps

[Uber Banker]

The summary said "neither technology nor laws are yet capable of completely dealing with the plague".

The fact they discussed it means they recognise a problem. Technology or laws not yet capable of meeting it mean they now recognise a deficiency -- a deficiency needs a solution.

I hope they can divert resources to creating this solution. They need to throw rosources, legal and technological, and *WE* need to keep them aware (or indeed, make them more aware), so it doesn't slip down the government's priority list.

As for your hotmail address, I suggest you ditch hotmail. I did five years ago, and that was not soon enough.

Re:Perhaps

[neuroticia]

Who needs hotmail? I get plently of penis enlargement advertising, complete with pictures, at my work email address. Makes me a very popular girl.

They just need to use the freaking internet, and participate in normal venues of conversation. and have a non .gov email address. And within a few months they'll know how much of a negative thing spam is. Especially if they have to use regular dialup.

-Sara

Re:Perhaps

[waynemcdougall]

I set up a Hotmail account specifically to test if spammers would harvest email addresses from a SMTP response :
551 User not local; please try

So far no takers. And after 2 months no spam at all. A 14 character alphanumeric address

what the fuck?

[larry bagina]

I can't post anonymously anymore?

Re:what the fuck?

[Anonymous Coward]

I didnt need to log out.
maybe it has to do with what we do here on /.

Meeting results will be emailed out

[Anonymous Coward]

To over 40 million email addresses. If you don't wish to continue recieving these emails, you can follow the link at the bottom to unsubscribe.

:Boots!

[Anonymous Coward]

Yay for meetings to determine that which you already know.

They needed three days to figure this out?

[Meat Blaster]

The technology obviously hasn't caught up because my mailbox is full. The laws can't because the First Amendment is crystal clear on the issue (and all the spam from overseas makes our laws irrelevant). The future is Bayesian.

Re:They needed three days to figure this out?

[Salgak1]

The issue of spam is not an issue of free speech, its' an issue of theft of service and of fraud. And the answer is a total re-write of the SMTP specification and standard to allow accountability and traceability of email messages

Re:They needed three days to figure this out?

[Cybrr]

What's wrong with viewing the full headers and sending a mail to abuse@lastvaliddomain.com?

Re:They needed three days to figure this out?

[neuroticia]

Nothing. Unless lastvaliddomain.com is actually owned by the spammer, in which case they get a live email address to play with. Spammers love live email addresses. Unless you forge your headers so they can't tell where it's coming from.

-Sara

Re:They needed three days to figure this out?

[Cybrr]

But the DNS registrar data should contain valid data as well, and I don't mail to fishy domains.

Re:They needed three days to figure this out?

[Anonymous Coward]

the first amendment does not make the issue of forcing the reciever to be harrased and pay for the harrasing a "crystal clear issue"

the first amendment has been continually refined by the courts to hold up the spirit and reasonableness of society.

and companies have never had full free speech, why should they have it when spamming?

free speech applies to you and me, but not fully to xyz company

Re:They needed three days to figure this out?

[mcgroarty]

What's wrong with viewing the full headers and sending a mail to abuse@lastvaliddomain.com?

What's wrong is that many major ISPs do zero about spammers, and the ones who do will usually end up zapping the guy with the open proxy or the poorly secured CGI mailback form, not the guys who actually cause the problems.

Re:They needed three days to figure this out?

[jaa]

For the time being:

POPFile Bayesian filtering (works on multiple OSes)

Postfix w/experimental reject_unverified_sender

reject_unverified_sender works like this:

1. mail arrives from sender@example.com for victim@localdomain.com
2. Before allowing the dialog to progress past RCPT FROM, postfix attempts to send mail to sender@example.com. The mail connection is never completed -- just the MAIL FROM and RCPT TO are attempted, so sender@example.com never receives any email as a result of this probe. (postmaster might note a log entry for NULL connection...whatever).
3. If example.com's mail server says "sender@example.com: no such user," the incoming mail connection in #1 is refused.
4. If example.com's mail server accepts mail for sender@example.com, the mail connection for #1 is allowed to proceed.
5. If example.com's mail server takes too long to respond, the mail connection for #1 is given a 450 (try again) response. By the time the sender's server tries again, the attempt to verify sender@example.com's address should have succeeded, and will be cached by postfix.

Add sbl.spamhaus.org and list.dsbl.org RBLs (very, very low false positives), and watch the spam disappear.

Re:They needed three days to figure this out?

[blake182]

And the answer is a total re-write of the SMTP specification and standard to allow accountability and traceability of email messages

I agree -- a completely backward compatible re-write of the SMTP specification, and getting people to deploy it is exactly what's needed.

You see the problem with that statement, of course, don't you? Making it backward compatible and getting it deployed tend to be "the hard part". We already have transport-level authentication and privacy (through TLS), as well as application-level authentication and privacy (through S/MIME and OpenPGP). So how do you deploy those mechanisms in such a way that maintains compatibility, scales, and gets adopted by organizations?

Short answers are fine, but there are people who have been examining these issues for years without significant progress. Partially because it's a hard problem, but partially because it's not clear that someone's willing to spend money on it.

Re:They needed three days to figure this out?

[Cybrr]

It seems to work for me. And if they query the wrong person, they can solve the relay problem and both be thankful.

Re:They needed three days to figure this out?

[AndroidCat]

The future is Bayesian.

Umm, no. While Bayesian filtering will do an excellent job of keeping your email box clear, it won't stop the spam. You were never a possible customer of theirs. All their spam to you was a waste in the first place, filtering won't change that. The small fraction of a percent of the spammed who actually bought stuff from spam are [total vocabulary failure] unlikely to use Bayesian filtering or to train it properly. So the spammers will keep spamming to reach those people -- and crank it up for good measure!

And filtering doesn't make that spam to you disappear. It still has to reach your personal filters (since Bayesian filtering doesn't really work globally). Up to that point, it still has to pass through the Internet usually through abused relays and proxies, and hit your ISP. (Hit is an understatement when the spammers flood every box they know of on an ISP at the same time.)

Filters will keep your box clear, but not stop the spammers. The only way to do that is to hit them either financially or loss of connectivity. Educating the morons who buy from spammers in unlikely to happen in this universe. Loss of connectivity? Make it uneconomic for ISPs to offer services to spammers. Blocklists are a controversial approach, but spam-fighters are always willing to listen to any new suggestions. (Note: eCash sender pays and rewriting SMTP are not new.)

Re:They needed three days to figure this out?

[neuroticia]

usually end up zapping the guy with the open proxy or the poorly secured CGI mailback form, not the guys who actually cause the problems.

Err. They may not be the ones who are spamming, but they're the ones responsible for the tool the spammer is using. Just like the guys who are the admins of the virus-infected Windows computers that like to pollute everyone's logs. They're not the virus authors, but they're responsible for patching their systems. The ISP should take them off-line temporarily and require that they clean up their act.

-Sara

Re:They needed three days to figure this out?

[FyRE666]

The messages can always be traced back to a source via the headers. The technology is there, but the political will to sue the asses off the miserable scum is not. The scumbags posting from DSL lines can be traced right back to their phone numbers since their ISP will (hopefully) know the account using the IP address, and presumably also the phone number used to dial in.

If the RIAA can subpeona customer details for P2P filesharing, surely the government agencies can smoke out these spamming shitballs. For off-shore spam havens, just have ALL ISPs block them. Prevent known spammers from registering new netblocks, or being involved with a company that does this. Change the law so the Ralsky's and other assorted human waste laughing in our faces as they get rich pushing filth into the 'net face prosecution and HUGE fines every time they go online.

Either that, or we could just all chip in and hire a few hit-men to get rid of the source of the problems the old fashioned way ;-)

Re:They needed three days to figure this out?

[Electrum]

Spammers love live email addresses.

No, spammers love live addresses of people who will buy things. Spammers do not want to mail people who will cause problems for them.

Unless you forge your headers so they can't tell where it's coming from.

Forged headers being an issue is a myth. It is trivial to determine which headers are forged.

Re:They needed three days to figure this out?

[slamb]

reject_unverified_sender works like this:

1. mail arrives from sender@example.com for victim@localdomain.com
2. Before allowing the dialog to progress past RCPT FROM, postfix attempts to send mail to sender@example.com. The mail connection is never completed -- just the MAIL FROM and RCPT TO are attempted, so sender@example.com never receives any email as a result of this probe. (postmaster might note a log entry for NULL connection...whatever).
3. ...

Ugh, I hope it doesn't work like that. It would cause horrible loop problems - imagine that the sender is also using this patch. The recipient server would open a connection to the sender to verify the address. The sender would open a connection to the recipient to verify it, since at the point the verification happens it's unable to distinguish actual mail sending from this verification. So it's an endless loop between the two, consuming more and more CPU time and bandwidth for a Postfix shouting match.

If your description is accurate, this patch should never be used.

Re:They needed three days to figure this out?

[greenrd]

It would cause horrible loop problems - imagine that the sender is also using this patch.

I'm not familiar with SMTP, but if RCPT TO comes before RCPT FROM, there is no such loop. Think about it logically.

Re:They needed three days to figure this out?

[Hoser McMoose]

The source can almost never be traved via the headers. Look at spam some day, and try to find the source of it, you'll end up either that it's going through an open proxy, an open-relay, or it's just plain old forged so much that there is no possible way to figure out where it came from.

The Received headers in legitimate e-mail may be used to trace the source because legitimate e-mail doesn't try to hide this information, however when it comes to spam, people go to GREAT lengths to hide where the message is coming from.

Re:They needed three days to figure this out?

[neuroticia]

And how will people cause problems for them? Spam isn't exactly illegal just yet. Besides, next time around they just have to send the spam from somewhere else, and how are you going to know it's them? By giving them a valid email address, you're adding yourself to their list, or promoting your value on the list. They don't care if you actually buy anything--you're just making their list more valuable because you're "live". The spammers aren't usually the businessmen with a product to sell--their product is your email address--the more email addresses their clients mail goes out to, the more money they make.

As for forged headers... Of course it's trivial to determine which headers are forged. The point isn't to trick the spammer into thinking that you're complaining from a valid address that is different from your real address. It's to mask your real address so it doesn't get added to a list.

-Sara

Re:They needed three days to figure this out?

[FyRE666]

Well forging headers is only effective before you send the mail to a machine that's not under your control. So in ANY mail, you can trace the hops back until you hit an invalid domain or a discrepancy that indicates forgery. This is almost certainly the point at which the spam was injected.

If it's an open relay, then the "admin" there had better be keeping good logs, as this would be the only way to prove THEY hadn't injected the spam. Sorry, but you have to be ruthless to cure this apathy.

There's *always* a path back unless the spammer is calling from a stolen/pay-as-you-go mobile phone to a stolen account on some ISP. But then, how much throughput would they get?

Re:They needed three days to figure this out?

[Electrum]

And how will people cause problems for them? Spam isn't exactly illegal just yet.

Send out a bunch of spam and see how long you can keep your net connection. Or send a bunch of spam through proxies advertising your website and see how long it stays up. Now, do the same thing, only this time mailing a remove list (a list of addresses that have asked to be removed or have complained in the past). You will see get into a lot more trouble.

The spammers aren't usually the businessmen with a product to sell--their product is your email address--the more email addresses their clients mail goes out to, the more money they make.

Personally, I think this is a myth. Most of the spam I get appears to be coming from the people who's site it is advertising. Besides, people sending out spam for a fee don't want to get their clients into trouble, any more than people sending out spam for themselves want to get into trouble. If you get someone's website terminated by mailing a bunch of angry people, they aren't going to pay you again.

You need to disregard this about spam coming from countries in Asia or other countries where they don't care about spam. They will mail anyone just because they can.

The point isn't to trick the spammer into thinking that you're complaining from a valid address that is different from your real address. It's to mask your real address so it doesn't get added to a list.

No reputable provider is going to accept anonymous abuse reports. Otherwise, if I didn't like you, I could send lots of fake abuse reports to your upstream.

Re:They needed three days to figure this out?

[slamb]

I'm not familiar with SMTP, but if RCPT TO comes before RCPT FROM, there is no such loop. Think about it logically.

I am familiar with SMTP, and I did think about it logically. The sequence is HELO, MAIL FROM (there is no RCPT FROM; you don't send from a recipient; think about it logically), and then RCPT TO.

Please see RFC 821, which describes this sequence. There are examples.

For future reference, when you say things like "think about it logically", make damn sure you are and the person who you are saying it to isn't. Because seeing people secure in their stupidity really pisses me off.

Re:They needed three days to figure this out?

[Anonymous Coward]

The MAIL FROM address of the probe is "" (a la, a bounce message), so no loop occurs.

I also don't accept mail from sites that don't accept bounces, so this kills two birds with one stone.

Regards.

Re:They needed three days to figure this out?

[Anonymous Coward]

make that "<>"

preview be damned.

Re:They needed three days to figure this out?

[Anonymous Coward]

So you really think that the authors of Postfix, a highly regarded MTA, would make such a glaring error?

Sheesh. Pompous ass.

The address used to probe the sending host is exempted from sender address verification. Many use postmaster or <> since both need to be accepted without verification/blocking anyway, per RFC.

Re:They needed three days to figure this out?

[slamb]

The MAIL FROM address of the probe is "<>" (a la, a bounce message), so no loop occurs.

Ahh, that makes sense. I might give it a try, then. I also noticed earlier (when trying to figure out how they solved this problem, if they did) that it caches verifications. That's good; hopefully most of my legitimate mail won't result in extra hits then, as it tends to be from the same people.

Re:They needed three days to figure this out?

[slamb]

So you really think that the authors of Postfix, a highly regarded MTA, would make such a glaring error?

I assumed no such thing. I had expected the problem was in the description, and it was. I suppose what he said was technically correct, but he omitted an important point by not mentioning the "MAIL FROM" address used by the probe.

Sheesh. Pompous ass.

I don't care for your tone. If you had read my message at all carefully, you would have noticed that used qualifiers like "if your description is accurate"; it was not. Please take a little more care before you hurl insults at people.

Re:They needed three days to figure this out?

[Senior Frac]

I agree -- a completely backward compatible re-write of the SMTP specification, and getting people to deploy it is exactly what's needed.

And just how is a rewrite of SMTP going to tell whether the incoming mail is spam or not? The real problem is that it's an authentication issue. Unless there's some "trusted authority" to say "this is spammer" or "this is not spammer", you're right back where you started. Who decides?

We already have trusted authorities. DNSbl blacklists, or filters, or Brightmail, or whatever. How is changing to a new protocol going to change it? It's not.

You, and people like you, have a complete misunderstanding of the problem.

This is all well and good...

[Bearded Pear Shaped]

But what will this mean for my tiny, tiny penis????

I mean come on people!! Let's not lose sight of my tiny penis.

Nothing? well..

[Kelerain]

Public executions always sounded effective to me.

Re:Nothing? well..

[Anonymous Coward]

Hell, a single, well-placed cruise missle does wonders for solving such problems.

FTC Chair: Sir, we have a dire crisis building up in Michigan?

Prez: What kind of crisis?

FTC: Somebody's planning a spam attack on the White House.

Prez (on phone): Rummy? I wanna order a couple Tomahawks to go.

Maybe not completely...

[spiney75]

...but SpamAssassin in combination with Razor and Distributed Checksum Clearinghouse works quite well on most mail servers I've seen.

Washington Post coverage

[Kappelmeister]

The Washington Post takes a slightly more sensationalist take on the "bare knuckle," "historic" forum.

Re:Washington Post coverage

[pontifier]

It was even better in person, mark was sitting right behind me when he started grilling allen...funny stuff. On the whole though, the people there were the most interesting I have ever met.

They were all experts, and they were are all realy concerned that spam could ruin the internet. there were storys of people getting fed up with spam, and canceling their internet access. I think we will all see some very clever things coming down the pipe from the people that were there.

The discusions covered SMS spam and junk faxes as well. There were representatives from all over the world telling about their experiences with spam. Japan is seeing progress, though the penalties for sending spam can be as high as 2 years in prison, and a 25 million dollar fine.

The Marketers represented there made realy good arguments about the legitimacy of some email marketers. They realy did seem to be against spam, and were responsible in their practices. Email marketing is here to stay, but I think it will get a lot less annoying.

You know . . .

[DrMrLordX]

I wish all those who convene to discuss law-enforcement and/or regulatory initiatives were so honest about their future prospects for success. Can you imagine what the DEA would be like if someone back in the 50s or 60s had actually gotten together and said "you know, guys, we'll never stop the flow of drugs into the country, and it's only going to get worse". On the other hand, that might have made the problem worse.

I still couldn't fault them for being honest, though.

Re:You know . . .

[Anonymous Coward]

I've never believed that war on drugs was about stopping drugs. It's about getting the kind of people that use the drugs. The war on drugs is an us agains them kind of attack. I see it as political war more than one about ethics.

Way to go!

[arvindn]

Rep. Zoe Lofgren, D-Calif., said this week she would seek federal legislation offering rewards for individuals who help track down spammers.

Lets see more of those! I hope the reward applies irrespective of whether you bring in the spammers dead or alive :-)

Re:Way to go!

[mr_death]

Rep. Zoe Lofgren, D-Calif., said this week she would seek federal legislation offering rewards for individuals who help track down spammers.

Lets see more of those! I hope the reward applies irrespective of whether you bring in the spammers dead or alive :-)

Oh please, please, please, let me pistol whip, kneecap, hang, draw, and quarter them. I promise to bring them in (somewhat) alive.

OK, I'll have to wait on quartering them. Then, let us burn them at the stake.

John (who had 30+ emails in my spam trap today.)

Not capable of completely dealing with the plague?

[AlistairGroves]

Fair enough if they don't think it can be completely eliminated, but it would be nice if the article would mention a few tools like http://spamassassin.org

scary

[Trailer Trash]

``We are now importing more spam from the United States,'' he joked. ``We are actually learning what American culture is through spam.''

Hopefully you know that it's not an entirely accurate view of American culture...

Re:scary

[flamingdog]

You mean we don't all have tiny Johnsons, drive mini-RC cars, and video tape our neighbors in the shower with the world's smallest digital camera?

Re:scary

[realdpk]

American culture isn't about exploiting just about everything for profit? I'd say it's pretty accurate myself.

Re:scary

[sean23007]

Yeah, instead they should watch primtime US TV. That would give them a realistic picture...

Re:scary

[stesch]

Hopefully you know that it's not an entirely accurate view of American culture...

The rest we learn by reading "Stupid White Men" and watching "Bowling for Columbine"

Whats next?

[Anonymous Coward]

p2p spamming (black lists will be futile, unless you wan't to blacklist the entire planet)
advanced intelligent randomization (harder to track, as each spam is unique)
rouge java/activex objects (we hide an applet in our spam page, so you send us more spam).
Selling rouge software that opens up relays and disables firewalls.
SMTP Tunnelling
Setting up pop/smtp servers designed to delete the messages source completly (worse than forge headers.

And worse.

Re:Whats next?

[metamatic]

Rouge software? Spammers selling cosmetics now?

Re:fp

[Cybrr]

That was #5869911, become a subscriber. :P

BUSH administration will always choose marketers!

[zymano]

What do you guys expect.

One little campaign contribution can be the difference.

Bush = Harken oil = Enron = creative accounting, creative stock options = quick millionaire = buy texas rangers = if you try doing the same , you go to JAIL.

Federal law

[Klaruz]

We need a federal law with some that lets you go after:

1: The spammer themselves provided you can find them.
AND/OR
2: The entity in the US that the spam was sent on behalf of. If they're trying to sell you something, or scam you, even if they didn't send the mail, they're the root cause.

and

3: You should be able to opt-out of any entity you directly do business with. Opt-in for any of their parters. If I buy something from Amazon I can opt out of recieving their mail. Their partners can not send mail unless I specificly ask for it. If the company gets bought, the opt-in does not transfer, except for one email informing me of that.

4: Here's the gray area; there needs to be some sort of failsafe. So for example, if I hate slashdot and I spam a million people telling them to buy a slashdot subscription. If the people who get the mail can't find me because I sent the mail from an open AP and bounced it off a server in Korea, slashdot gets screwed.

Disclaimer:
I am not a spam expert (I do know a bit)
I am not a lawyer
I am not a lawmaker

Take with salt. Flame on.

Re:Federal law

[Klaruz]

That should read, "with some teeth," or "with huge fangs."

must use preview
must use preview
must use preview

Re:Federal law

[Doctor Hu]

... that lets you go after:
...
AND/OR
2: The entity in the US that the spam was sent on behalf of. If they're trying to sell you something, or scam you, even if they didn't send the mail, they're the root cause. ...

From the nature of the 'products' and 'services' that cause much of the annoyance, I'd hazard a guess that the peddlers involved take as much care to hide their true identity and location as do spammers - indeed, I'm sure that the spammers are perfectly well aware of their prevalent client community's need for discretion and security and are perfectly happy to cooperate in the matter. IOW, it might be just a little difficult to find where that no-prescription Viagra actually came from without an extensive and expensive investigation.

Something tells me that the matter will start getting fixed only when there are enough objections to the content of much of this dreck for the politicians to decide that Something Must Be Done. Then Mssrs Bush and Rumsfeld can start issuing warnings to certain east asian countries to clease giving safe haven to open email relays and other Weapons of Mass Distraction.

RFC-821 Re-Write Will Make It Manageable

[zentec]

Back when the Internet was a nicer place, it made sense to allow anyone to send anyone mail through any system. Now that Internet access is much more common and the propensity of abuse on open systems, it's time to either bury RFC-821 or make it significantly more modern.

No, the deluge of unsolicited garbage will continue regardless of what is done legislatively and with technology. I'm glad to see that people are finally waking-up to the fact that more laws won't fix the spam problem. But technology can be used to make it harder for spammers to hide in their anonymous cloak.

The processing of sending email needs an overhaul that gives system administrators the ability to determine the source of incoming mail and impart a "trust" level of the message. Messages coming from systems that have a high trust are tagged in the headers while those coming from systems that seem dubious or lack any sort of real credentials are tagged accordingly.

No, it won't stop spam, but it'll allow people to simply deny access to systems and users that are a continued problem, forge credentials or email addresses.

Re:RFC-821 Re-Write Will Make It Manageable

[sdscbryan]

I agree with some of your statements and feel that a change in the technology is definitely required if we're ever going to twart UBE.

Here's my proposed RFE to email delivery: Make it possible to only recieve email from a list of email addresses.

Kinda like the way that Instant Messangers work, where you can recieve messages only from people on your contacts list. And if people want to send you email you can authorize their address and add them to your contact list. This way spammers would have to ask for your permission first to recieve email and they would be rejected, without ever getting their message to innocent users. Surely the implementation of something like this would relatively straight forward. I know that processing email will take longer with this feature, but once spammers give up there will be less email to process all together. And you could make it so that certain domains are automatically accepted for company nets, etc. Of course I wouldn't blanketly accept from AOL, yahoo, hotmail, etc... ;o)

What do you think?? Changes in the email standards are slow, I know... uggh. Gotta start somewhere though...

Re:RFC-821 Re-Write Will Make It Manageable

[spencerogden]

Why not just implement this on your client? Its not hard if that is what you are after.

Re:RFC-821 Re-Write Will Make It Manageable

[AndroidCat]

How will you make the genetic rejects who buy stuff from spammers implement it? Until then, you're not cutting the spammer's income.

(Riing! "Hello?" "This is the genetic reject anti-defamation league. We want an apology for that insult!")

Re:RFC-821 Re-Write Will Make It Manageable

[kcbrown]

The processing of sending email needs an overhaul that gives system administrators the ability to determine the source of incoming mail and impart a "trust" level of the message.

The fundamental assumption in the current email system is that every sending machine is trusted. That is what has to change. Most of the proposals to change this have been along the line of using certificates and other nonsense like that. But none of that is necessary (nor is the use of certificates desired: it implies a central certificate authority similar to the ones SSL certificates are issued from. Central control over the email system is a government's wet dream, which is exactly why it shouldn't be allowed to happen).

All you have to do is to verify that the machine sending the email is authorized by the owner of the email's domain (which is retrieved from the SMTP "MAIL FROM" command) to send mail on behalf of that domain. That's it. There already exists a mechanism that can be used for this purpose: DNS.

But, you say, spammers will just buy and manage their own domains? Yes, that's correct, they will. But now you have forced them to actually spend money and time managing a domain that, when you see one single spam from it, you (and everyone else) can completely block. New domains might last a day (if that) once domain blacklists are fine-tuned to deal with the problem.

Now the laws of supply and demand come into effect. There are a limited number of domain registrars competing with each other. If the demand for new domains goes up, so does the price. Increase the price and you increase the cost of spamming, and thus reduce the number of spammers out there because you've raised the cost of doing business and made it more difficult to be profitable at it.

But even better than that, the good guys can now whitelist domains and actually get away with it. You could, for instance, whitelist yahoo.com and know that any email you receive that claims to be from yahoo.com really is from yahoo.com, because the system you got the email from was authorized by yahoo.com to send email: you verified it yourself by looking it up in DNS.

So now, lists of "known good" domains will circulate the net. Email from unknown domains can be treated with suspicion or simply blackholed, depending on what the owner of the site wants to do with it. Spammers will try to get onto the "known good" list but cannot do so because they'll be removed automatically when a few independent people receive spam from them.

We could even go so far as to build a "web of trust" around this. And none of it requires the replacement of the current email protocols.

The problem with spam has always been that nobody wants to actually do something real to stop it. The most they're willing to do is implement spam filtering and block a few IP address ranges. Nobody seems to be willing to make any changes whatsoever to the delivery semantics, because to do so would require agreeing upon a standard, which is something nobody (particularly the big players) seems to be willing to do anymore. Heavens knows we can't have cooperation between competing providers on something like this.

And so as a result, you end up with meetings between the players that conclude that "the problem can't be solved currently". Well, yeah, it can't, as long as the players aren't willing to agree upon any kind of real solution, like the one I just described.

Re:RFC-821 Re-Write Will Make It Manageable

[thogard]

The SMTP rewrite is called X.400 and it sucks. Everyone with an email address would have to register with someone that makes a verisign cert pricing look like a good deal.

Re:RFC-821 Re-Write Will Make It Manageable

[greenrd]

You shouldn't force people to use it, because many people want to receive email from strangers. E.g. businesses, email helplines, etc. For that reason it's totally unworkable. Duh.

traceability, or send-risks-paying?

[bcrowell]

the answer is a total re-write of the SMTP specification and standard to allow accountability and traceability of email messages
That's one approach. Another is sender-risks-paying.

It seems to me that the problem with accountability/traceability is that it would probably require people to have a digital identity that pervades the whole internet. Well, how is this going to be implemented? The bearded-hacker community tried to implement a public key infrastructure, but it's been a huge failure, since it's never reached the critical mass where it would become useful to most people. (It's also way too hard to use.) The other well-known proposal is .NET. Do you really want a future where you have to have a .NET identity in order to send e-mail?

And what about those times when you really do need to send anonymous e-mail? What about corporate whistleblowers? Political dissidents?

I prefer the sender-risks-paying idea. There have been a lot of these proposals floating around, and yes, they've been discussed a lot on Slashdot before. No, they will not require your ISP to bill you for e-mail. No, they will not require non-spammers to pay any money at all. No, they need not involve any actual money to change hands (the currency could be based on CPU cycles, for example). There's nothing technically wrong with these proposals. The bearded-hacker community just needs to go ahead and implement one and start using it. Otherwise MS will implement it in a proprietary way (their Pennyblack project), and it will be another brick in the prison that keeps people locked into Windows/Office/Outlook.

Re:traceability, or send-risks-paying?

[Anonymous Coward]

the problem with accountability/traceability is that it would probably require people to have a digital identity that pervades the whole internet

You mean, like your email address? Yeah, I can see how that would be unworkable.

Re:traceability, or send-risks-paying?

[The Cisco Kid]

A complete rewrite of SMTP isnt gonna happen in this lifetime, or on this Internet.

Adding some sort of hideous PKI (that would require individuals to purchase certificates from someone like Verisign, no doubt) isnt the answer either.

One thing, which works fairly well, and works now, is SPEWS (www.spews.org). It makes it VERY unprofitable for an ISP to provide service to a spammer. That includes service that allows them to send, as well has the hosting of websites, domains, email addresses which the spammer can use to sell whatever they are pitching.

Another, would be the addition of some tweaks to popular MTA's (sendmail, postfix, qmail, exim), which would enable them to reject mail that is coming from IP's which are not 'authorized' by the responsible party for a paritular domain to originate mail from their domain, perhaps by way of an extension to DNS whereby the domain operator listed the authorized IP/networks. Now, this would require ISP's to support something like POPb4SMTP and/or SMTP AUTH, and for other ISPs to either stop blocking outbound port 25 or (better) support the MSA port 587, specifically and only for their OWN (properly authenticated) customers to use for submitting mail for delivery. Something like this could help to eliminate most of the forged spam. Spammers would *have* to register their own domains, and would be forced to use their own ISP's relay (and get shutdown by them rather quickly) or have their domain identified as a spam domain rather quickly, (and 'lists of spammer domains', similar to RBL's, could be setup, with far less risk of rejecting legitimate mail)

Re:traceability, or send-risks-paying?

[Zeinfeld]

One thing, which works fairly well, and works now, is SPEWS (www.spews.org).

SPEWS is used but you will find it very hard to find any ISP that admits to it. The problem is that SPEWS is amazingly careless and sloppy.

There are now 400 blacklists and as a result ISPs rarely do very much if they get listed now. They might contact MAPS and get unlisted, but MAPS is not that effective at blocking spammers any more. The ISPs have decided that the sooner everyone is on SPEWS the better, trying to get off the blacklists would cost a fortune.

It was quite noticable at the FTC panel that even the blacklist people could see that there were enormous problems with what they were doing. Their answers were pretty evasive and they kept contradicting themselves. Julian started out by saying his was a 'high collateral damage' list, use it as one input to the filtering decision. Then a few minutes later he says that blacklists are the only way you can filter without having to accept the email and tie up your server - so what is it.

Of course the reason we have irresponsible blacklists like SPEWS is because of the legal tactics of the spammers. E-MarkettingAmerica is not in business to make the world a better place. Their lawyer served two of the blacklist people with writs during the conference and was somewhat emotional during one of the sessions.

Re:traceability, or send-risks-paying?

[The Cisco Kid]

Hrm.. Lemme guess, your ISP is listed on SPEWS becuase they like spammers money too much, and you dont like that SPEWS wont grant you an exception?

There is nothing irresponsible about SPEWS. They list exactly what they say they list. You (and anyone else) can choose to use it, or not. And, like it or not, rejecting mail from IP's addresses that are in SPEWS, *will* reject a *lot* of spam.

Feel free to point me to any *specific* IP address which appears in a SPEWS listing which you feel is 'irresponsible', and I will be happy to tell you why it isnt. Besides, who is SPEWS responsible to? Only to the admins that use it. If those admins didnt like they way SPEWS worked, they wouldnt use it. SPEWS is not, now should it be, responsible to anyone who wants to force anyone else to accept their email.

Only irresponsible ISP's don't care about being listed in any widely used blacklist. Eventually, as their customers become smarter, and realize this, they will slowly lose customers until they go out of business, or until their dropping cashflow forces them to become responsible.

SPEWS is *not* a *quick* fix to the overall spam problem. It is a *long* term idea. on NANAE often mention is made to 'two internets' forming - one that allows spam, and one which doesnt. In reality this will never happen, becuase the 'spam allowed' Internet will eventually become the 'spam only' Internet, and not even spammers want spam, so no one will pay to be connected to that one, so even as it forms it ceases to exist. Sort of like a cancer which is cut off.

Oh, and the reason the emarketers are emotional is becuase they know they are doomed, and they are desperate. The simple fact is, that NO ONE wants to receive unsolicited ads mixed in with what they *do* want to receive, and by definition the emarketers are annoying people.

People who dont like SPEWS generally fall into one or more of:

-Spammers (duh)

-ISP's that have spammers as customers, and dont want to turn them off becuase they care more about making money from the spammers that about the fact that the spammers are stealing resources from other ISP's.

-Customers of those ISP's that dont understand or care that their ISP is greedy and doesnt care about spam.

-Commercial 'anti spam' systems that focus on filtering spam, rather then blocking it or forcing spammers to be shut down (their business model depends on spam continuing to be sent)

You wont find any signifigant number of persons who dont like SPEWS that dont fall into one or more of those categories, either currently or previously. You *will* find LOTS of people who would never allow themselves to fall into one of those categories, who like how SPEWS works very much.

Re:traceability, or send-risks-paying?

[Zeinfeld]

You wont find any signifigant number of persons who dont like SPEWS that dont fall into one or more of those categories, either currently or previously.

There was absolutely nobody at the FTC willing to defend them. The other blacklists were kinda pissed with SPEWS because it is completely out of control.

They were more pissed with the lawyer for the spammers of course and he seemed to be behaving very oddly indeed.

Re:BUSH administration will always choose marketer

[Ktulu_03]

*cough* I know that Clinton didn't take any contributions from Enron , right?

Stop Spam?

[Anonymous Coward]

Why would you stop spam?

I've got a 76" penis, Wireless web cam's in multiple ladies change rooms, and no debt All thanks to Spam!
Keep it coming!

How about...

[evronm]

concluding neither technology nor laws are yet capable of completely dealing with the plague

OK, we all know we can't deal with it completely. How about dealing with it as much as possible?

Much as I hate big government and feel that most laws are bad laws, I would love to see a set of laws in place that would cut my spam in half...

Spam Insurance

[Detritus]

I've always thought that this is a golden opportunity for La Cosa Nostra. They could sell spam protection insurance. Get spammed? Guido will pay the spammer a visit and "explain" how spamming is not conducive to a long and healthy life.

Re:Spam Insurance

[AndroidCat]

You mean, sort of like this incident?

Re:Spam Insurance

[skinfitz]

Anyone know where they are buried? I'd like to go dance on their graves.

Re:Spam Insurance

[hkmwbz]

I have always wondered by so few spammers are paying for their actions. I mean, they are annoying millions of people. One would have thought that with many spammers' locations freely available, with the rage felt by some people over spam, and the psychos we know exist out there, more spammers would have been found decapitated, drowned, tortured to death etc.

Seriously, why aren't the spammers getting more trouble over the crap they are doing to people's inboxes? They are messing with big dollars here. People are losing valuable time and money...

Why is nothing happening?

Applied to other portions of life

[gerardrj]

I like the "neither technology nor laws are yet capable of completely dealing with the plague."
So they'll just give up completely.

Pehaps we should also apply this to: the "drug war", the "war on terror", welfare/social assistance.
In each case, no amount of technology and no volume of new laws will completely solve the problem. I hearby suggest that we give up on those fronts as well.
Take the billions of dollars that is used for those purposes and cut taxes by the same amount. There's your tax cut funding Mr. Bush!

Dear Maggie me m ouc

[Letter]

SPAM: --------------- Start SpamAssassin results -----------------
SPAM: This mail is probably spam. The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM:
SPAM: Content analysis details: (12.2 hits, 5 required)
SPAM: Hit! (2.4 points) 'Message-Id' was added by a relay (2)
SPAM: Hit! (1.7 points) Sent with 'X-Priority' set to high
SPAM: Hit! (0.5 points) BODY: A WHOLE LINE OF YELLING DETECTED
SPAM: Hit! (2.0 points) Received via a relay in relays.osirusoft.com
SPAM: Hit! (3.0 points) DNSBL: sender is Confirmed Spam Source
SPAM: --------------- End of SpamAssassin results ----------------

Spam Meeting Wrap-up

Posted by michael on Saturday May 03, @03:12PM from the spam-and-eggs-and-spam dept.

wendigo2002 writes "Get used to that daily flood of e-mail come-ons, Viagra offers and lucrative enticements to invest in Nigerian pyramid schemes. Internet gurus, software designers and lawyers today ended a three-day Federal Trade Commission discussion on combating spam by concluding neither technology nor laws are yet capable of completely dealing with the plague."

Spammers should pay us

[hellswraith]

I am sorry, but I have to pay for Internet service. Since I pay for it, I should be able to control what is transmitted on that service. If they want to send me spam, they should have to pay me for using some of my bandwidth. Plain and simple. Before anyone starts to compare it to the regular postal mail, it isn't the same. I don't pay anyone to have a mailbox. I don't pay the mail man to deliever my mail. But those damn credit offer companies DO have to pay to send over postal mail. They pay the people that deliver it. They pay for the paper and envelopes, etc...

Re:Spammers should pay us

[gobbligook]

just like you pay for cable tv. Which is all advertising, and you have no control over what is in the commercials. Or the newspaper. You pay for all the adds in it. Why not in email too?

Because I pay for newspapers should I control what the newspaper writes or prints in adds?

now if your bandwidth is being sucked up and you are paying based on traffic, don't give your email address out, and use multiple ones. One for trusted mail and the other for those stupid online registration forms everyone has to fill out, when they only want to grab one file, or visit once.

The point is, you pay for a service/item, you get everything with that. I pay for a newspaper $1, I am paying for the adds, fliers, and articles. When you pay $20/month for net access, you pay for email, etc. And it is your fault that the spammer got your email in the first place. I have had a hotmail account for over 7 years. Since before microsoft bought them out. It has yet to see junk mail and I get about 10 personal/business messages a day.

And so you know, you do control what is transmitted. It is the recieving you are having issues controling.

Re:Spammers should pay us

[HowlinMad]

I don't pay the mail man to deliever my mail.

Hmmmm, I guess you dont pay taxes. Or ever use the post office. Part off the cost of sending a letter is the cost of receiving it. THe USPS is self sufficent, so money spent there goes towards all aspects, including delivering to your house.

come to thing of it, I use the post office, and they deliver to your house, so by your arguement, you owe me money.

Re:Spammers should pay us

[Anonymous Coward]

just like you pay for cable tv. Which is all advertising, and you have no control over what is in the commercials. Or the newspaper. You pay for all the adds in it. Why not in email too?

Because I pay for newspapers should I control what the newspaper writes or prints in adds?

Except... ads in newspapers and television go to (allegedly) make the service cheaper for you. Advertisers pay the newspaper company to put their ads in. With the money made from that, the newspaper company can sell their paper for less than it cost to make, and still turn a profit. This is why there are FREE newspapers, which are mostly made up of ads.

With email, you are PAYING for your Internet service. When you see an ad on a website, you requested that page, and in order for access to that page, the webmaster has made sold that space to an advertiser. That's fair, otherwise you would have to pay for access to the site. But when someone sends you spam, the money is going to them and a company you DON'T pay anything to... it's not making anything cheaper for you, unlike most traditional advertising mediums.

In general, the idea is that ads make the service cheaper for you. With spam, there is no service being provided to you by the spammer or the company he represents, so it can't possibly help you (unless you need lots of viagra.)

Now there's the argument that someone is selling your email address to make their site (or email service) cheaper for you. The difference comes in who controls the ads.

If Slashdot said "In order to keep this site going for free, we'll need to send you an ad in your email every day," that would be fine. They could then get ads from advertisers, and send the ads as they pleased. But the line would be drawn if Taco SOLD our email addresses. They wouldn't be controlling the ads received, or who had our addresses. Yes, they would probably be paid more for all the addresses, but that is besides the point. We would no longer be able to say "Forget this Slashdot, too many ads, too crappy of content, I don't want to support them by getting their ads any more." If we opted out of receiving emails at Slashdot, the other comapnies would still have our email addresses. You CAN decide not to receive the news paper any more, thus cutting off advertisements. If you didn't go to Slashdot, but kept getting ads they were profitting from, the service would no longer be going to helping you, keeping a site you don't visit free, it would be going into the pockets of Slashdot editors (greedy bastards!)... or going to make someone else's Slashdot experience free. With traditional advertising, the ads are (allegedly) cheapening the service for you... with spam, it is not.

Re:Spammers should pay us

[gobbligook]

I thank you for your commments, they are well thought out and I can see your reasoning there.

I just would like to make one more point. In a round about way spam is making services cheaper (if you do business with that company) since the more customers that will follow up on the spam obviously has an effect on that originating companies bottom line, thus if they make money on products as a result of spam, they increase demand for an item, and over time inventory will increase, thus their products end up being cheaper. So I guess in a round about way spam makes things cheaper for the consumer.

I don't mean to disagree with your points, and infact I am not, but there are benefits to spam, even if it is not as apparent as other advertising. The opting out of spam is a good point. You can stop buying the paper, you can cut off cable. But then sometimes you can't either.

Re:Spammers should pay us

[WCMI92]

BENEFITS to Spam?

Sure. It benefits the Spammer. I can't think of ONE SINGLE benefit to my e-mail inbox having to fight off 50-75 spams a day (fortunately Popfile makes 99+% of them bounce to the deleted items folder).

This is electronic harassment at the very least, Denial of Service at the worst. You see, I've NEVER ONCE bought anything from a spam solicitation, and I NEVER WILL.

Oh, and who benefits from the sale of fradulent products? I can't think of ANYTHING even halfway legit among the spam I get... It's all "D cup in the bottle, 18 inch penis, FAKE university diploma" type stuff.

Re:Spammers should pay us

[WCMI92]

"Hmmmm, I guess you dont pay taxes. Or ever use the post office. Part off the cost of sending a letter is the cost of receiving it. THe USPS is self sufficent, so money spent there goes towards all aspects, including delivering to your house."

Incorrect argument.

The point the poster made should have been that the cost of SENDING JUNK SNAILMAIL is borne by the SENDER. Not the recepient.

Do you think ANYONE could send out a billion junk snail mailings a day with a .5% (or less) response rate and make money?

They can with spam, because the cost of sending is shifted TO THE VICTIM. They don't bear hardly any of it.

Re:Spammers should pay us

[hellswraith]

I understand what you are saying, but your missing one important point. That point is the fact that you know that in order to get the lower cost of your cable tv, or newspaper, that you will see adds. If you didn't see those adds, you would pay a lot more because you would have to pay for the cost that is sucked up by the advertising.

With Internet access, my ISP isn't being supplemented by these spammers in any way, so them spamming me doesn't bring down the rate I pay the ISP. So the comparison is not valid.

Re:Spammers should pay us

[hellswraith]

I just made the same argument. Didn't get a chance to see yours as well. I agree with you 100%.

Re:Spammers should pay us

[hellswraith]

Yes I do pay taxes. Taxes don't drive the post office completely though. They get their money from people sending mail and packages. Sure, they get supplemented from the government, but it isn't even close to the amounts that the other revenue aspects bring in. Plus, the post office is a federal company. When I pay taxes, I expect some of it to go to them.

I use the post office, and I pay to use it. Spammers don't pay my ISP one cent to use it.

People that send snail mail have to pay to send it, period. They pay to get that mail in my box. That is fine by me. I don't pay to have that box. I consider it a nicety, nothing more. If a company wants to spend a shit load of money to send out snail mail, at least they burden the cost of doing so.

So yes, I consider it a correct argument, along with your points at the end of your post.

Re:Spammers should pay us

[dracocat]

You forgot that the more mail being sent makes it cheaper. So the more these bulk mailers are sending the cheaper it is for me to send my stuff! Think about it.. if I am the ONLY person sending a letter it will cost a lot more than if 30 other people sent a letter to the same person the same day!

"neither laws nor technology..."

[ThumbSuck]

This raises couple of endless quotes:

Give me 2,000 good man and three weeks and I will crush them like cockroaches
-Unknown general in 1800's

I am the Law
Judge Dredd

There is no spam in your mailbox. And there never will be
Iraqi Information Minister

Why not make a 'Do not email list'?

[biggestron]

Why wouldn't a nationwide 'do not email' list work?

I would think this is even more feasible and enforceable than the 'do not call' list that people are trying to establish to combat telemarketers.

Pass a law that unsolicited email sent to an address on the list is subject to a fine.

If the spammers are sending out multi-thousands of emails, even a fine of $50 per complaint would soon put spammers out of business. The fine could be split between the 'spamee' and some agency to enforce the spam law. I would think that there are enough unemployed people with the skills to staff such an agency, given the state of the nation's economy.

The spammers have to send contact information if they are trying to sell you something, thus there is an easy way to find who is responsible for the spam.

Re:Why not make a 'Do not email list'?

[Skapare]

In order for such a list to be effective, it would have to be available. If it's available, it would also end up in the hands of foreign spammers whould would use it as a source of higher percentage real working addresses. Of course the simple solution to that is that the list has to be distributed in the form of list of cryptographically strong (unreversable) checksums. To see if the next email address to be spammed is on the list, calculate the checksum of the canonical form of the address (e.g. lower case), and look up the checksum in the list. But even this won't do very well as the foreign spammers, while not having a direct list of all these working addresses, can at least use it to select known working addresses from the lists they do have.

Another issue with a "do not email list" is how to handle things like tagged email addresses (e.g. foo-alpha@example.com and foo-beta@example.com go to the same mail box, where "-" might be "+" on some systems). If the law says that the tags and their separators have to be stripped off before checksumming and lookup, maybe that won't be so much of a problem.

Yet another problem is that many people have vanity domain names where anything on the left when addressed at their domain will be delivered (or forwarded) into their mailbox. Some form of wildcarding is essential, such as "*@example.net". If this isn't done, you can expect people with such domains to try to register every possible address. If there is any cost to the list, these same people will be suing the government for trying to charge them billions of dollars to register. Of course you can bet that "*@aol.com" will then be registered. And just about any business with a domain will do likewise for theirs.

Unless these things are done, the list won't really work.

BTW, these "do not call" lists in various states are for residential phones only. Businesses phones, at least in several states (Texas and California I know for sure), cannot be listed. There might be a move to gut a "do not email" list by placing the same demands on it, too.

Re:Why not make a 'Do not email list'?

[Mustang Matt]

It wouldn't necessarily have to be available.
Instead, the spammers could upload their lists to a server and the server could return addresses not on the "Do not email" list.

I've proposed this to the state of Missouri but no go so far.

Re:Why not make a 'Do not email list'?

[Hoser McMoose]

New laws like this aren't really the answer, the real solution is to figure out how to enforce existing laws with respect to spam. Making spam more illegal (by having a law against sending to a "Do Not Send" list) isn't going to help any when most spam already is illegal! Distributing unsolicited pornography to children is against the law in most countries, as is sending beastiality to anyone, not to mention the laws against illegal pyramid schemes and fraudulent scams. Even the fairly tame spam, like selling generic viagra, is in direct violation of existing laws in many countries.

The trick is not new laws, but figuring out how to enforce existing laws with respect to spammers.

Re:Why not make a 'Do not email list'?

[Senior Frac]

Why wouldn't a nationwide 'do not email' list work?

Because I own my mailbox/machine/network and my premptive decision is that marketers don't get to use it without explicit permission (opt-in). The default is "you don't use my network without my permission", not "you can use it unless I tell you not to."

The last step of this medium is owned by me; not the television networks, not radio networks, but me. The consumer pays the majority of the cost for transmission on the internet, they get to say how it's used and decide who's abusing it. They made their decision a long time ago.

new laws will be good for business

[gobbligook]

Look at all the new criminal organizations (spammers) that will be sued and people jailed. I can't wait. Hope new legislation is retroactive to the point the company started spamming. Then for my years of torment, they can get years of jail. YAY! I maybe could sue them and make lots of money for lost time deleting junk. 1 second a message, 100 messages a day, 354 days a year that means, 36,500 seconds a year or 10.14 hours a year. Yes one day worth of work.

Yeehaw

[arakasi]

Motohiro Tsuchiya, a communications professor with the International University of Japan, said Friday that about 80 percent of spam in Japan comes from outside the country and most of it is in English.

``We are now importing more spam from the United States,'' he joked.

Yeah! Finally Japanese importation of at least one U.S. product exceeds their exportation! ;-P

FOR IMMEDIATE RELEASE

[rice_burners_suck]

The Federal Trade Commission (NASDAQ: MSFT) today announced plans to increase the amount of SPAM mail, the digital blueprints for highly desired Internet content, sent annually to over 40 million addresses on the Internet. By leveraging innovative technologies, content providers streamline compelling enterprise solutions. The move is said to foster the development of new information technologies.

"We are excited at the news to increase the amounts of this highly desirable content that we email every day," said Xing Dung Ho Chung, president of some organization in China that sends over 5 billion SPAM emails daily. "Our customers will be very pleased when download times increase proportionally with the desirable noise to undesirable signal ratio as we flood the Internet with our information, preventing undesirable signal from getting through."

Hong Dong Chong Shlong commented, "Our goal is to reduce the Internet into a medium for advertising with no possibility of gaining any other use from it. Our long term plans include government lobbying to illegalize the information that people want while simultaneously forcing people to spend a minimum quota of time reading every word of SPAM and clicking on every full screen advertisement that comes up. Strategic partnerships with computer companies and additional legislation will force the consumer to purchase a new computer each day because the hard drive of yesterday's computer will break down with the wear and tear of yesterday's immeasurable amount of SPAM."

SPAM companies also indicated plans to lobby for laws requiring the consumer to purchase every product and service advertised to them. The long term plan is to give huge multinational corporations an easy method to eternal, perpetually increasing profits with no benefit to the consumer. Humanity, except the shareholders of several enormous conglomerates, will be enslaved forever.

Soon To Be Bottled Up In Committee!

[Procyon114]

I love the fact that Congress has neglected to pass ONE law to deal with spam to this day...

...but it has managed to enact numerous laws addressing modern technology's other "scourge," copyright infringement.

It seems that folks in DC can get things done...when they want to.

SMTP keeps originating IP in the mail header

[Anonymous Coward]

Perhaps you should understand a technology before calling for a rewrite.

Re:SMTP keeps originating IP in the mail header

[AndroidCat]

Actually, it doesn't. You can only be (almost) certain that the last Received line (topmost) in the header is correct. Every Received before that has to be evaluated for correctness. How much do you trust each mail server each hop further away? Spammers frequently add fake Received lines to headers.

And spammers have been switching to open proxies rather than relays. You might track the spam back to the open proxy, but there's no way to trace it past the proxy without internal logs. And since many open proxies are people that don't even know that they're running one, the chance of finding out anything more is slight.

Frequently the best attack on a spammer is from the other end: They almost always want you to contact them. The spam includes a payload of an email drop-box, a web page, a phone number or a physical address.

chicken and egg

[bcrowell]

Sorry about the reply-to-self, but here's one more thought:

The sender-risks-paying concept can be implemented on a small scale. All you need to get started is to run a single mailing list on it -- logically, it would be the mailing list for the people developing the new e-mail system. From there, it can spread to any organization that cares to use it. A corporation or a university can say, "Hey, our people are wasting too much time on spam. For internal use, let's require them to use this new system." If it's technically superior to the old system, gets rid of spam, and is easy to use, then it should just spread until it replaces the old system completely.

The problem with a system based on authenticating the sender's identity is it's a chicken-and-egg situation. An online identity is meaningless if it's just like a disposable Yahoo e-mail account. It has to be pervasive and reliable, and it has to point to the real identity of a real person. Probably only MS could pull this off, because their users are such a large percentage of the computer-using population.

"Theft of service"

[Silverhammer]

Blockquoth the poster:

The issue of spam is not an issue of free speech, its' an issue of theft of service and of fraud.

"Theft of service." Hmm...

How is it that sending spam such a heinous crime while "sharing" MP3s is a service to Mankind?

Re:"Theft of service"

[Salgak1]

Blockquoth Silverhammer:

How is it that sending spam such a heinous crime while "sharing" MP3s is a service to Mankind?

Nary a clue. Not that I ever mentioned filesharing. Good afternoon, Ms. Rosen. . . . mind if we keep the topic on spam ???

Re:"Theft of service"

[PM4RK5]

How is it that sending spam [is] such a heinous crime while "sharing" MP3s is a service to Mankind?

The difference is here:
Sharing MP3s is a voluntary action on behalf of both parties involved - the source and the downloader (whoever they may be).
Spam is involuntarily forced upon the recipient, and it becomes a nuissance.

I'm not saying that sharing MP3s is good, but it is voluntary to both users, where as spam is a pain in the butt that the recieving user is forced to deal with against his or her will.

Re:"Theft of service"

[RedGuard]

In the case of sharing MP3s the person having
something forced on them is the owner of the
copyright who loses the right to dispose of
their (intellectual) property. It's striking that
so many posters on slashdot consider an email
address property that spammers are tresspassing on
but refuse to do the same for pieces of music.

Re:"Theft of service"

[Silverhammer]

Blockquoth the poster:

Nary a clue. Not that I ever mentioned filesharing.

You're right, you didn't, and I wasn't accusing you of it, either. What you mentioned was theft of service...

C'mon, it's not that hard...

Re:"Theft of service"

[Silverhammer]

Thank you for actually getting it. You're my new best friend. ^_^

the solutions are there

[zogger]

--the solutions are there, just very few people want to be the first ones, and it has to come automagically installed out of the box. That's the bulk of the email users and receipients. They use what comes installed. They use mostly microsoft. Microsoft does not ship any email client that filters spam AFAIK. It doesn't ship an easy to use click here to generate a whitelist for receipients, that bounces everything else. There's your basic problem. Once again, those that made the most money by far ship the least common denominator product. When there was an opportunity to put the fear of bankruptcy into them, it failed. Their fine and punishment consisted of getting to advertise more, that was it basically. Spam (and mass viruses) will continue until a default microsoft OS installation is a lot more secure and has filtering qualities to it. That won't happen until they get tens of billions stripped from their corporate coffers, and a host of high level execs get some sort of jail terms, or at a minimum get banned from being "part" of microsoft. If the 800 lb gorilla can't do it, every single other machine on the planet could be filtered, firewalled, etc and it WON'T MATTER to the net in general. It is not all their problem, that's obviously true, but I'll say it's going to be have to be mostly their solution, catch 22 there, doing all that makes them no money, just costs them money, they won't spend it, profits are king.

I'd like to use email more, used to use it a lot. It's not useful enough to me any more to bother with it much. viruses and spam and drivel. 99% of the people I know use microsoft, they will NOT_not_send me html email, they consistently cc multiple recipients, they forward every lame joke and stupid rumor and scam, mostly I get drivel, maybe every 1 out of 20 is a legit email now. Spam and drivel, I give up. I glance at my email once a day, sometimes not even once in three days, it's just not useful any longer. I don'teven maintain any sort of address book. I am reluctant to register for any new forums, or to go back to being on email lists. I have almost completely stopped buying anything off the net. I don't WANT any more email addys.

Basically, just waiting for the mother of all viruses to knock out every microsoft machine on the net, then maybe things will get a tad better. I'm actually rooting for the microsoft killer virus to show up. Sooner the better, get it over with. It's a sucky attitude to have, but I have it now.

I've seen here on slashdot all these advanced schemes and techniques,they all look good,many are over my technological head,but none of them seem outstanding or easy though. The problem everyone at the top levels of these conferences, etc, tippy toes around, it's microsoft brand "stuff" just makes the internet insecure. SPAM is just part of it. It just *does* because of the sheer bulk and bugginess, it's designed just...wrong. Close but no cigar but man has it cost people.

Geeks and techs can make anything work well enough,even microsofts stuff, that ISN'T the problem,people on this forum can deal with it using their favorite methods, the problem is there WON'T be a solution until something is done with the dang borg way of "doing" things.

Re:the solutions are there

[jpkunst]

Microsoft does not ship any email client that filters spam AFAIK.

Outlook Express for Mac OS 9 has a Junk Mail filter.

JP

Not really

[autopr0n]

You don't need an internet-wide identity, just one you share with people you know. A simple signed message would work without a huge totalitarian system set up.

The payment method is idiotic because you're introducing a whole new system into the mix: money. Before, you're dealing with the relationship between two people and their computers. Sender-pays involves getting the ISP, and the banks involved. It's just so complex, and to top it off, you'd still need the same identification system as in simple sender-verification!

Sender-pays is the most idiotic system ever devised for stopping spam.

Spam is dead

[ajs]

Get used to a mailbox full of ... whatever you want, including nothing.

Spam tools are currently at the point tht detection of spam is a near-certainty and the probabilities for false-positives (e.g. good mail getting called spam) are measured in the 0.00n-0.0n% range (that is n in 100,000 to n in 10,000) which can almost always be improved on locally by the user through various means that are anti-spam-tool independant.

SpamAssassin is currently my tool of choice. It's very flexible, can be used with any UNIXish mailer and is just getting frighteningly better over time.

SA's recent addition of Razor2, a Bayesian filter and improved handling DNS blacklists (which SA weights so you can apply them withour worrying about slicing large and useful parts of the Internet out of your field of view) have reduced many concerns that folks had before about active abuse of SA's rule-base in the past. The speed with which this system applies hundreds of tests to a message is also quite stunning, and a major boost to Perl's tacit reputation as a "slow" language.

The biggest problem with SA right now is probably the inability to scale up to the mid-range ISPs and medium-sized business without SERIOUS harware allocation due to the heavyweight neature of its testing. That's my personal mission for SA over the next year or so. My goal is to make SA a reasonable option for anyone that has to process orders of magnitude more mail than your average ISP (e.g. AOL).

When the upcoming 2.54 comes out, I HIGHLY recommend checking it out. You can install SA on most UNIX-like systems, as long as they have Perl installed by typing (as root)

perl -MCPAN -e shell

following the configuration process if you have not done so for Perl before, and then typing

install Mail::SpamAssassin

After that it's just a matter of how you want to configure your MTA to talk to SA. I recommend using SA in "spamd" mode with sendmail and procmail. If you already use sendmail with procmail delivery, you just have to change your .procmailrc by adding rules to invoke SA, and there are good examples of that on the SA site. You can also use qmail (officially qmail doesn't support this kind of thing, but if you use the standard set of patches that most every has to apply, it's reported to work fine) and postfix (though postfix has some complexity when it comes to setting up any kind of uni-directional filtering).

Good luck!

Re:Spam is dead

[ajs]

Ooops, in the beginning of that message, I meant "anti-spam too dependent"... sorry if I implied there's an anti-spam-tool universal config file, though IMHO, there should be....

Re:Spam is dead

[realdpk]

Regarding CPAN, doing that, will it try to install perl 5.8.1 like it's been trying whenever I attempt to install anything?

CPAN is worthless to most folks (IMO) as long as that "feature" is in place, but if it's not necessary for SA, that'd be great.

Re:Spam is dead

[Anonymous Coward]

Spam tools are currently at the point tht detection of spam is a near-certainty and the probabilities for false-positives (e.g. good mail getting called spam) are measured in the 0.00n-0.0n% range (that is n in 100,000 to n in 10,000) which can almost always be improved on locally by the user through various means that are anti-spam-tool independant.

Aaron, How are you getting such high accuracy when The Register reports current spam programs cannot be certified because they are too unreliable?

See Anti-spam packages 'too unreliable' to certify

Best Regards,

Mike Monett

Re:Spam is dead

[samhalliday]

5.8.1??? i thought the latest stable was 5.8.0

Re:Spam is dead

[thogard]

Has anyone tried a Bayesian filter with an Soundex like system? I'm thinking it would help take care of some of thouse misspelled subject lines.

Re:Spam is dead

[greenrd]

The speed with which this system applies hundreds of tests to a message is also quite stunning, and a major boost to Perl's tacit reputation as a "slow" language.

I think not. lists.indymedia.org was using it, and it induced an almost complete system meltdown with emails taking over 5 days to deliver in some cases. They had to uninstall it and get some new hardware.

Then again, perhaps it was misconfigured or mis-installed so that it was invoked in an inefficient way - that's a possibility I suppose.

Re:Spam is dead

[ajs]

Actually, you don't want to do that. If someone says "sluts", then it's a fair indicator of spam, and that word will be weighted appropriately by Bayes. However, if they say "5LUTS", it's MUCH MORE likely to be spam!

Obfuscation in most cases is self-defeating, and only people who thinkg that avoiding this or than specific rule is going to help them bother.

Re:Spam is dead

[ajs]

It was probably a fair number of versions ago. SA now has a daemon-mode called "spamd", since it turns out that most of the startup cost is in parsing the configuration (e.g. all of the rules), and compiling the Perl, of course.

Once you have spamd in use, you cut your CPU usage amazingly (made it usable for my company), and your memory access patterns are much more reasonable for the OS to deal with. Memory is still used liberally, but that will probably change when later versions of Perl start doing CoW more automatically, since a lot of SA's memory usage is simply read-only copies of parts of the message.

Re:Spam is dead

[ajs]

You're running an ancient version of Perl. This is in all the FAQs, but just do:

perl -MCPAN -e shell
install CPAN
reload cpan
install Bundle::CPAN
reload cpan
[insert whatever you wanted to do here]

Re:Spam is dead

[ajs]

The Register is a rag. Can we please stop quoting from it for anything important?

For simple, Bayes-only systems Paul Ghram has seen false positive rates around 0.03%, and SpamAssassin sees only slightly more than that on it's large database of mail, much of which is often in the database because it's pathologically spam-like.

Systems like Razor2, Bayes and blacklists make the system even more accurate, though often not in ways that are easy for a benchmark to detect (you need to leave SA running long enough for bayes to get trained by the rest of SA; Razor2 is time-sensitive and blacklists change in quality over time).

Re:Spam is dead

[realdpk]

Yeah, but since they've had a poor history of backwards compatibility, I can't afford to upgrade (customers have scripts which depend on perl, if they broke, they'd be out thousands, potentially more.)

Btw, I checked the FAQ for CPAN, I don't see anything about install Bundle::CPAN ?

Re:Spam is dead

[ajs]

You missed the point... YOU DO NOT HAVE TO UPGRADE PERL.... follow the instructions I gave. That will correctly upgrade just the relevant libraries.

However... WHAT poor history of backwards compatibility?! You mean the fact that 10% of the programs in the world broke when perl when from major version 4 or major version 5 over 10 years ago? Or did I miss some compatibility breakage in the last 10 years?

Compatibility is a major point of pride for Perl, and unless you're relying on unintentional subtelties in the language (read, bugs), I haven't heard about a break in such compatibility. My programs that use the Perl internals from C from 8 years ago don't compile cleanly, but the ONLY reason that's true is that the *C* compiler won't take my broken semi-ANSI C anymore, other than that it works like a charm!

Re:Spam is dead

[ajs]

5.8.1 exists in a pre-release state. It will be the first maintenance release of Perl 5.8. 5.9.0 is also in a pre-release state.

B.S.!!!!

[Anonymous Coward]

No way to combat it? This isn't like illegal drugs sold in a secretive black market. In order for SPAM to work it must send you to a place to buy a product, thereby always giving you someone to arrest. If its across international boundaries we'll extradite or put an import tariff on the country for not allowing it.

I suspect the latter is why they shot it down. You would have to hurt trade with 3rd world despots not willing to extradite offenders in order to stop our mother from getting graphic beastiality pics in her email.

Evil Man

Answer the question that lawmakers want

[clovis]

Nothing will be done until someone answers the question that lawmakers always ask:

What's in it for me?

No matter what you present to a politician, no matter how good the cause or important the problem, laws get introduced and passed for only one reason, and that reason is that someone was able to answer that question.
Sure, it's possible that the answer was "you'll advance your career if you save mankind with this bill", but that almost never happens. There's always a payoff somewhere, and what I can't figure out is a way to tell a Congressman what's the benefit to him for putting in the effort to fix the spam problem. And getting a bill passed is a hell of a lot of work.

I say: "There's these people who make money by sending a deluge of annoying fradulent emails
that ..." All the politician hears is "There's these people who make money" and wonders "How can I get some of it?"

If every spam victim donated a dollar to support congressmen (IE, campaign funding) to do something about spam, then it'll get done. I for one am ready to help.
Just put your name at the bottom of the list, and send $5 to the person at the top of the list. Now send the list to five of your friends and soon, real soon, we'll have enough money to buy a whole session of Congress. This is completely legitimate, a lawyer looked it over, but you mustn't break the chain.

Re:Answer the question that lawmakers want

[Anonymous Coward]

Ah come on ! Which retarded monkey modded this as Insightful ? It's a bloody joke !

Re:Answer the question that lawmakers want

[smithwis]

Mod the parent up as funny or insightful or whatever;-)

Re:Answer the question that lawmakers want

[Tokerat]

If every spam victim donated a dollar to support congressmen (IE, campaign funding) to do something about spam, then it'll get done. I for one am ready to help.
Just put your name at the bottom of the list, and send $5 to the person at the top of the list. Now send the list to five of your friends and soon, real soon, we'll have enough money to buy a whole session of Congress. This is completely legitimate, a lawyer looked it over, but you mustn't break the chain.

Yes, and Instant Message this around, too, because AOL, Yahoo, and MSN are keeping track of how many times this message is sent, and if 1 million people send it to 5 of their friends, they will keep free Instant Messaging. Otherwise, prepare to feel your wallet lighten!!!11

Re:Answer the question that lawmakers want

[greenrd]

Sure, it's possible that the answer was "you'll advance your career if you save mankind with this bill", but that almost never happens.

Spam doesn't just affect geeks. Don't you think that being able to claim truthfully that you were the sponsor of a bill that substantially reduced spam and saw many spammers fined/jailed would win a few votes?

Why do you need to do a rewrite?

[autopr0n]

What you're talking about seems like nothing more then a simple modification of the Black Hole system. which doesn't work at all.

I suppose a 'source trust rank' along with other analysis like baysian filters and other techniques might be slightly more effective, but spammers can simply use these tools to 'check' to see if their messages get through as well.

Re:Why do you need to do a rewrite?

[zentec]

A black hole? In a way, I guess you are correct, but it's a black hole that's configured by the receiving system. Any blame for missed messages lies solely upon the shoulders of the receiving system.

All I'd really want is a way to accurately determine the true originator of the mail I'm receiving. With that established, I can filter based upon who and am willing and unwilling to accept mail.

Re:Why do you need to do a rewrite?

[greenrd]

In a way, I guess you are correct, but it's a black hole that's configured by the receiving system.

Who the fuck do you think configures existing blackholes? The US government? Aliens? No, it's individual site administrators. They may choose to run with an unaltered public blacklist, but that's not inherent in the blacklist paradigm.

I don't get that much spam...

[flamingdog]

You know, it's really not that big of a problem for me...

I use Yahoo! mail, and they really do a great job of filtering spam. They have an option by every email to report it as spam, have it investigated, and then blacklisted if appropriate (delivered to spam folder, not deleted, just in case it's important in some way)

In addition to their spam filters, you can create your own and they work pretty decent, too. I get about 100 spam mails a day, about 95 are filtered to my trashcan or spam folder, and only about 5 get through...I can deal with that.

I don't see how spam makes any money any more...oh well.

Re:I don't get that much spam...

[gl4ss]

me neither.. i guess having .adsl in the address cuts off most of it.

i even have my email on a page available through crawling..

how much spam i get? about 0.05 per week, i don't call useless mail i get because i subscribed to something spam though.

as for the what's the stuff they're selling through spam.. man, i was reading old spidermans just today and it's unbelieviable what they advertise there.."buy this book and be a super athlete in few weeks"

Re:I don't get that much spam...

[kallisti777]

I also use Yahoo mail, and I also get about 100 spam emails each and every day. The filters do an excellent job, but I still have to spend a couple of minutes double checking, reporting, and deleting the stuff.

Considering the millions of people that use free web-based email, maybe we should think of it as a bigger problem.

it's really simple....

[Heem]

Spam would stop if nobody bought anything from spammers. SOMEBODY out there must be buying the generic viagra and paying for memberships at hoochiemamma's webcam site. Likely it's nobody that reads or at least is an active participant in sites like this, but THAT's the message that needs to get out. "Don't want spam? Don't buy any of these things". Spammers need money to send spam email. If we don't buy their product they either go out of business or learn that they are losing money by sending spam.

Now, I want and can think of many uses for some X-10 hardware - But I won't buy it because of spam. I have a dog that takes heartworm prevention pills - but i'll pay the extra price to get it from the vet instead of getting from the cheaper online dealer, who, spammed me.

The message needs to get out: "If you spam me, I won't buy your product, even if I do want it."

Re:it's really simple....

[AndroidCat]

It's called The Boulder Pledge, by Roger Ebert.

Re:it's really simple....

[Senior Frac]

Spam would stop if nobody bought anything from spammers.

True. However, the spammers cost-shift their advertising costs onto the end user. Since they can steal from the consumer they have the ability to reduce their costs so much that a previously unrealized business model becomes possible.

Their entire business model is based on that one sucker out of 1 million who buys. There's no way you're going to get the word out to everyone in sufficient quantity to even come close to making a dent in the spammer's income. No... calls for a "spammer boycott" feel really good, but are a waste of effort better spent in other endeavors.

Spam

[DaLiNKz]

I have two different issues with spam:

One, my email address that i use for almost everything for the past 4 years only recieves 1 or 2 spam a day. The address i used for 3 months recieves 100-150 spams a day, it is impossible to use that address for anything..

Now i use two email addresses, one for things like MSN and registering to forums and websites that goto a drop box and then my main address that i only give out to people these days.. its useful, even behind the current spam filters we have on the mail server it gets 8-10 spams a day.

To stop spam? Two words.

[MsWillow]

White list.

If the *only* way for email to arrive in my mailbox was if it came from (or at least purported to come from) somebody on my list, I'd never see spam again. No need to bounce it, just delete it from the mail server, sight (and site :) ) unseen. Eventually, if everybody started doing this, spammers would see zero revenue, and the tide of spam would disappear.

Anybody know of a Linux email app that does this all, deleting spam at the server but downloading wanted email? I'm all ears.

Whitelisting works for me

[NetDanzr]

Disclaimer: I've been using this method for a few months now, but I've heard the term "whitelisting" to describe this method only yesterday on CNN Headline News. I don't take any credit for it.

Anyway, here is how it works: Set up filters for people who you want to get messages from. I personally have several different mailboxes - for family, work, newsletters I subscribed to, etc. Everything else goes by default to the trash. Operating several Web sites, I needed to make sure that strangers can contact me, too, which is shy I set up links to my e-mail to include a standard subject, and I set up a filter to look for those subjects. This way, I'm able to eliminate 99% of spam (the rest is a combination of viruses (virii?) and spams the spoof the sender's address to someone who's on my list. In turn, I lose less than 1% of messages that I'd actually want to receive. Considering that I was getting 50-70 spams per day and only 3-5 real e-mails, the numbers are on my side.

Re:Whitelisting works for me

[rawg]

The problem isn't blocking the spam, or filtering the spam. I have very good luck using Spamassassin. The problem is, that I have to download it in the first place. Why am I forced to download all this SPAM, over 1000 a day, just to delete it.

Also, I have been finding that the "remove" links have be going to "not found" pages lately. So they include a way to be removed, but they do not have a remove system.

There needs to be a way to stop this crap.

Hello, McFly!

[Faust7]

neither technology nor laws are yet capable of completely dealing with the plague.

Um, of course they're not. If they were, the problem wouldn't exist.

That's why we develop new ones.

Spam, You guys just do not get it!

[ratfynk]

Unfortunately there is money to be made sending spam.
ISPs make money from spam. Some internet users, like those using Aol, MSN, and other tricked out ISPs,
have not got the brains to read anthing in depth anyway so they need to have flash, groovy pics, colored text etc to have the computer work.

These types of users GO to the URLs that pop up in spam and could'nt use a real email program if they knew what it was in the first place. The only thing they do with the computer is use IE or AOL to tell them where and what to veiw on the net.

The problem with spam is the same problem with paper flyers and junk mail, unfortunately they work!

Laws alone won't work...

[SpyderFan]

Stiff laws with significant penalties plus technology WILL work.

The laws are necessary because it forces the spammers to modify their messages in such a way that they (the spammers) won't get caught.

Then, programs like Spam Sleuth can easily detect the deception and remove the messages.

Pass the laws, and use technology. The solutions exist already. Receiving spam is a nuisance (bandwidth). Seeing spam is a choice.

spamd

[cdn-programmer]

I think spamd is the way to go. Its in the new release of OpenBSD. Of course - spammers will react very quickly and blackhole any OpenBSD protected site.

But that is great for us - because we don't want to hear from them anyways.

This is just part of the evolution of the net. A new species pops up and slowly takes over.

Eventually uncompetative experiments die out completely.

Just blame Microsoft

[Anonymous Coward]

Ah, the ./ answer to any problem. And it's so simple, no thought required. What would we do with them?

This is crazy!

[Anonymous Coward]

Hacking has been illegal and stereotypically 'bad' since like, the dawn of time. Did it ever stop them? Attaching a stigma to something by creating laws to 'prevent it' merely makes it more interesting, not less. we *need* a guaranteed technological 'solution' to spam promoted and agreed upon by *ALL* the big-guns, otherwise no amount of 'law' making will make it stop. This is all completely pointless until a technological solution can be provided for all. Learn from our past mistakes! History will prove this true. Whatever solution is found, you need to make it Illegal to not implement it, otherwise it's again pointless.

Spamassassin plugin

[TheFlu]

I've been using Spamassassin along with the Razor and DCC plugins and it works very well, 99% of the spam that enters my Inbox is clearly labeled as such. However, does anyone know of a piece of software that will automatically add the IP address of the mail server that sent the spam to my sendmail access.db reject list? If there isn't such a thing, already, I could probably write one myself, but I don't want to go through the effort if it's already been done.

FRY THEM ALL!

[Anonymous Coward]

But only after they are stoned to death with hard drives full of SPAM!

+1 Troll

Solution

[Anonymous Coward]

Well - I figure the solution for unaddressed junk physical mail is the principal that: "If it ain't addressed to me then it is misdelivered". Since it is a against federal law to destroy mail - the only recourse is to put it back into the Big Red Mail Boxes the post office has so that they can deal with it.

I presume they return it to the senders.

If it is addressed to me and its unsolicited - then just write: "Return to Sender" on the envelope and again - put it in the Big Red Mail Box.

If more people did this - the problem would go away.

Forward Your Spam to the FTC

[edibobb]

Forward your deceptive spam to the FTC at uce@ftc.gov. If we can up the numbers they get from thousands to millions, maybe they'll fix the problem.

http://www.ftc.gov/opa/2002/02/eileenspam1.htm

MOD PARENT UP!

[Vainglorious Coward]

How many times does it have to be said - "re-write SMTP!" is not insightful, it's a failure to understand the problem.

DMA's opt-out response�

[WiredOni]

I am not surprised at the amount of laughter that DMA president H. Robert Wientzen caused by saying that commercial email should be opt-out. It is no wonder people hate the marketers mentality that consumers should be force to see their advertisements.

Pretending for the moment that all the spam problems don't exist and ignoring their redefinition, can you imagine trying to opt-out of billions of email messages? Even if there was rules and they did honor opt-outs, they are still killing the usefulness of email by flooding you with crap that prevents you from getting you real messages.

Then there is the fact that the DMA they probably will not follow the rules or will have lots of holes when they make the rules. One example I can think of will be that they make it so they can just change the names of the "company" or have several "companies" and switch the "company" sending the email so they can re-send you the same emails.

If companies really wanted to be ethical about this and have customers, they would not resort to ticking their potential customers off and they would use confirmed opt-in and not sell their customers personal info (email, phone, street address, etc). It may be harder to get customers, but it is a lot better in the long run if you are get and retain those customers that way then what you might get if you resort to spamming the hell out of them.

it's just data....

[zogger]

.... deal with it. what is the % of computers connected to the internet, well over 90% microsoft based, running microsoft email clients? This is yes/no binary. It appears to be *yes*. Ergo, the solution, that will make the most good in the quickest time and be the best all around is to somehow get ALL those machines to have filters of some sort, and "more secure" features. That isn't bashing, it's just reality. If every single mac, linux, unix whatever machine on the net was 100% totally secure, how much spam and viruses would there still be? Buhzillions still? Be honest, you know it would still be horrendous. it's dealing with 100 million computers running microsoft products that are the problem once you get past the few hundred major spammers. the spammers exist because the microsoft running machines are EASY TARGETS.

It's just data, get over it. Microsoft has billions cash and flocks and fleets of millionaires, they can spend some of that money to make the internet more secure and to help with the spam and virus problem, and they can also do it without turning the internet into microsoftnet. That they choose not to is THEIR decision, not mine. It's up to them to ship more secure products and to include an email client that has filtering and other securing qualities to it. Asking people by the tens of millions to go out and find software and download it and try to make it work is *not* the answer, and this is just SO obvious. YES, it IS mostly their problem. When SPAM and viruses weren't a big deal, swell, who could blame them, the internet was designed for ease of communications PERIOD. That was then, this is now. Now that we know that there are problems associated with that, it's up to them to get on the stick and do the right thing. And not just "more of the same" like they always do, but to make their products better and not smash other peoples products or create two different versions of the internet. They have the opportunity to be righteous, ball is in their court. If it was some other company, then that's what I'd say, because it's mostly -by an overwhelming majority- their machines we are talking about, well, that's the proper noun to use, it's just DATA. There's no "opinion" to it. NO SPAM or virus solution can be attempted without identifying and singling out "microsoft" as the primary place to institute "the fix".

RFC-821 Re-Write is Not Needed

[minas-beede]

OK, it's time to start thinking in a different mode - what's been done so far isn't working well enough. Look at the facts: almost all relay email sent through open relays because they are open relays is spam. I mean something like 99.9999% of it - almost all. Most of the rest is spammer relay tests. Quality people don't looking for open relays through which to send their email. Spammers do that. Take advantage of that knowledge. If only spammers use that pathway MINE that pathway. It's figurative mines, not real ones: prohibitions against deadtraps don't apply.

Instead of continuing the three-years-long moan about all those clods who run open relays (I was once one of them myself) why not quit moaning and DO SOMETHING? Spammers send relay tests. DO SOMETHING that screws the spammer because of that. Report relay attempts to his ISP, accept and deliver the tests and send the spam to /dev/null - ACT. Make up your own way of dealing with them, but make it hurt them in some way, however small. Get any number at all doing something with the tests and those that merely accept the tests and ignore them will help strike fear in the spammers hearts (the operator who does nothing knows he does nothing. The spammer has to worry that the operator does more.)

Like, for instance, here's a relay test from today:

Received: from adsl-65-70-89-125.dsl.tulsok.swbell.net by X.X.X;
Sat, 3 May 03 12:04 CDT
Message-Id:
Date: Sat, 03 May 2003 12:01:44 -1700
From: 0eik00ha7i95o4@starband.net
Subject: hello
To: timsmith777@connectfree.co.UK
MIME-Version: 1.0
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.3018.1300
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.3018.1300

054053046055048046056 057046049050053058097 10011510804505405304505504804505605704504905005304 610011
510804611611710811 511110704611511909810110810804611 0101116058049049048051058057058089101115

(I had to beeak up the strings becuase of the Slashdot "lameness" filters.)

It takes as close to no smarts at all to trap a test like this as is possible. DO IT.

(By the way, I altered the string in the message-ID: that's where spammers who use this form of test encode the IP tested.) Similarly, they encode where the test originated in the body. It's decimal ascii: "048" encodes "0," etc.

Don't want to do SMTP trapping? No problem - trap some spammer open proxy abuse. MAybe you'll learn his IP, even (the clown who sent the test above has been using the same IP since at least 11-Mar-2003.)

I've been telling connectfree.co.uk about these test messages going to the spammer dropboxes in their space. I suggest that they simply divert email to the dropbox address so it goes someplace else. This is SOMETHING they can do that really screws the spammers. Until the spammers figure out the email is being diverted they discover no open relays if the email through those open relays to the dropbox doesn't get delivered.

Isn't it about time people though about what to do to stop these spammers? Is it so terribly hard to divert email to a known spammer dropbox address someplace else? Does that not conform to the TOS? CHANGE the TOS - quit waiting for someone else to solve spam and act. Worried about the US DOJ saying this is a crime? Hey, we're talking about a .co.uk location - US law doesn't reach that far. DO IT.

Read my post again. See anything that says action must wait for a change in the SMTP protocol? NO. See anything that says the little guy with a DSL or cable connection can't take part? NO. ISPs could do even better - think about what the ISP with hundreds of abused open proxies could do if it intercepted the proxy connections made by the spammers.

This does nothing to stop direct spam. There blocklists work like a charm. This does an awful lot to sop abuse-path spam (non-direct spam.) DO IT.

Or continue to moan. One path has better results - see if you can tell which.

Re:RFC-821 Re-Write is Not Needed

[thogard]

Welcome to 2003.... Most spam today isn't from open realys, its from hacked boxes that have had proxies installed.

Re:RFC-821 Re-Write is Not Needed

[minas-beede]

"Welcome to 2003.... Most spam today isn't from open realys, its from hacked boxes that have had proxies installed."

Where's your data? I have no doubt some spam comes that way - I've read Michael Tokarev's November, 2002, report in mailing.postfix.users. Absent actual evidence I can't see any reason to assert that hacked boxes are now the principle conduit for spam.

I know spammers still seek open proxies and open relays - these are still valid areas of concern and action.

(http://groups.google.com/groups?selm=aqhj96%2429t p%241%40FreeBSD.csie.NCTU.edu.tw&output=gplain )

Re:RFC-821 Re-Write is Not Needed

[thogard]

I think most of the open proxies were put there and aren't config issues. Too many of them are on the wrong ports. Besides word gets arround way too fast for an open proxy on very strange ports.

This is a recent change since November and the amount of spam I'm getting that fits into the new grouping is about double what the open smtp people were doing.

Of course I only check a few sorces of spam but the logs show the funny proxys are much faster at sending spam than the smtp relays. I'm wonding how long it will be before they start installing smarter software on the proxies.

Re:RFC-821 Re-Write is Not Needed

[minas-beede]

"I'm wonding how long it will be before they start installing smarter software on the proxies."

I think it's pretty damned smart already. I can't recall where but I read a description of Jeem on on of the anti-virus web sites - that is pretty sophisticated already. The downside I hope exists for the spammers is that this brings all the security people into the fight against spam - when the spammers crack into systems (by whatever pathway) they've really crossed a line.

I advocate open relay and open proxy honeypots. The Jeem approach, if the Trojan Horse is sent by an email virus, is rich with honeypot possibilities. Once you know how the cracked proxies work (all the details) you can "phone home" to the master spammer system and tell him your honeypot now has the spam relay installed. Then he trusts it and sends it spam to deliver. The operator of the phony cracked system goes into full ROFL mode.

(It would be interesting to see if the US DOJ would claim anyone doing this was intercepting communications. Very interesting, indeed. How will the DOJ find out someone is even doing this?)

Stop selling lists

[Chatmag]

Make it illegal to sell email lists from one company to another company or individual.

Re:Stop selling lists

[Chatmag]

Thanks to everyone that has sent me unsolicited emails for spam filters. ROFLMAO!

Technology not able to handle it?

[Dimensio]

...Who came up with this? The technology for dealing with spam and spammers has existed for longer than e-mail. It's called 'a gun'.

Kill the spammers, and the spam stops. It's that simple.

Re:To stop spam? Two words.

[corz]

You should check out TMDA. TMDA offers challenge/response based whitelisting so that unknown senders can mail you after an initial confirmation. With a correct TMDA installation legitimate senders will only need to confirm once, after that they are added to the whitelist and future mail passes through automatically.

whitelists mean the spammers have won.

[Schlemphfer]

Eventually, if everybody started doing this, spammers would see zero revenue, and the tide of spam would disappear.

The trouble is that comparatively few people are savvy enough to switch to whitelist email systems. And it only takes a small percentage of internet users who don't block spam, and who order occasionally from spam, to keep the spam problem a growing nightmare for the rest of us. I think it's unrealistic to suggest that whitelists can solve the spam problem, since there's no way to argue they'll be adopted widely enough to keep huge amounts of spam from reaching people.

And another thing. I want random people to be able to contact me, for whatever reason. What I don't want is to be contacted by automated email systems for purposes of marketing. In my mind, whitelists prevent the latter, but they also prevent or seriously inconvenience the former. And to me, that's unacceptable. I presonally rely on Mozilla filters, which rid me of about 97% of my spam, while allowing the email of random people who need to contact me to (usually) get through.

Re:whitelists mean the spammers have won.

[MsWillow]

it's unrealistic to suggest that whitelists can solve the spam problem, since there's no way to argue they'll be adopted widely enough to keep huge amounts of spam from reaching people.

If it came already set-up that way, by default, in Micro$oft's new OS, and AOheLl's new version, you'd catch a fairly large percent immediately, and with that userbase, there would be one hella incentive for other email programs to incorporate these features in their new releases, too.

Now, if you want anybody to be able to email you, might I suggest you use somethin akin to Hotmail or Yahoo.com? Those are, as evidenced by all the spam I get from either, throw-away email addresses, perfect for dealing with random people. These would also work with the various dating systems, where you want email from them, but not necessarily also a ton of spam to wade through daily.

I presonally rely on Mozilla filters, which rid me of about 97% of my spam, while allowing the email of random people who need to contact me to (usually) get through.

I rely on a Bayseian filter program (which seems unable to spot anything thus far), and Mailwasher, a Windows program that somehow holds together under Wine to run, most of the time, if you're lucky. They catch, with much human intervention, all of my spam... but it's the "human intervention" that's bugging me.

I'm a lesbian, an apartment-dweller and not a drug user. I have less than zero desire for Viagra, penis enlargement, septic tank cleaning, illegal peeing teens, hot anal fisting or Valium. Not only do I not want these, I don't even want to *see* them. A whitelist would grant me my wish - and the first time one of my "close friends" spams me because they got a virus would be the end of our friendship. I used up all my tolerance for spam some thirty thousand emails ago. I just want some peace and sanity.

My using a whitelist may not, by itself, end all spam, but it sure would end it *for me*. The rest of you are free to be deluded into thinking that you'll be able to fix it with laws, or filters, or whatever. I know my way will work. Even better, this may well give me incentive enough to learn --C well enough to add this feature to my Linux email program. Wheee, to be spam-free at last! What a joy that would be.

Re:whitelists mean the spammers have won.

[Brock Lee]

And another thing. I want random people to be able to contact me, for whatever reason.

Then they should be willing to pay you a small amount (US$0.35?) for that initial contact, which you could optionally refund, and you could then optionally white-list the sender. Of course the payment would be handled entirely through digital means.

Overseas

[Gonoff]

Most spam is only from overseas if you are not in North America - specifically the USA.

If you guys get rid of what comes from your country, the remaining amount will seem minor (until the spammers move and get a whole country into the RBL...

Charge the advertisers

[Litterbox]

Why not charge the advertisers of whatever product or service that is being pushed? Wouldn't that eventually lead them to reducing the spammers? Is this too logical or just a stupid idea and I somehow missed the point?

Internet Marketing Conference

[Anonymous Coward]

http://www.internetmarketingconference.com

May 12-13-14, 2003 - Palais des Congrès - Montréal, QC, Canada

intentionally bad spam

[drDugan]

has anyone else noticed a stream of spam that appears to be forged in an attempt to get the highest spam scores possible?

Over the last few (2-3) months, I've watched the maximum spamassassin scores for filtered mesages -- rise steadily. it looks like people somewhere are actually trying to create spam that trips as many of the rules as possible. Its actually kind of funny -- scores like 45-55 are not uncommon.

anyone else noticed this?

Re:intentionally bad spam

[silentbozo]

I've seen the exact opposite. For the last couple of months, I've seen an increasing number of spams that have forged features that generate negative scores - negatives scores big enough to outweigh the "spamminess" of the rest of the message.

Fortunately, although annoying, this problem is easy to fix. For any forged feature that gives a negative score (ie, PGP signature, PINE as client, etc.), just go to your user prefs and assign a score of 0 to it.

I've already set the majority of the features that generate negative scores (out of the 12 or so that exist), and at this rate, all will be disabled within the next month or so.

Problem solved. The next thing for me to do is to continue to fine tune the minimum score needed to trip the command to report the mail. I'm already down to 4.2 as the defining line, and I'm prepared to take it down to 4. I'll have to start whitelisting senders soon at this rate...

Re:intentionally bad spam

[thogard]

The reason is that if your aveage spam has a threashold of 10, you will consider 5 as "safe". Now a month later, your finding spam that is over 100, will 5 feel "safe"? The answer is no, so you increase your threashold and see more junk.

Re:TMDA

[ectospasm]

But what about automated responses, like order confirmations from say Amazon? Those systems will never send a response to a challenge, no matter what. And not every user is smart enough to add such systems to their whitlelist manually.

I think whitlelists are a poor solution to the spam problem.

technology not there?

[aggieben]

Of course, they're wrong. All you would have to do is put a mechanism in SMTP that would require the point of origin to have a valid IP and perform some sort of lightweight handshake for confirmation.
Maybe something like this:

1. mta1 @ valid ip (1.1.1.1) -> email -> mta @ valid ip (2.2.2.2)
2. mta2 -> (email_id,email_md5) -> mta1
3. mta1 -> ok -> mta2
4. mta2 delivers email normally

If mta1 is a spammer and they are trying to spoof an ip, then the handshake will fail because either (a) the host at the spoofed ip will reject the connection or (b) the host at the spoofed ip will accept the connection, but will fail the handshake because the email_id or email_md5 aren't in its records.

e.g.:

1. mta1 @ spoofed ip (1.1.1.1) -> email -> mta2
2. mta2 -> (email_id,email_md5) -> host @ 1.1.1.1
3. host -> reject || wtf? -> mta2
4. mta2 drops email and makes a note in the logs

a scheme of this sort would provide some level of accountability for spammers by preventing spoofing. They would be trackable. End of a lot of spam. the extra steps wouldn't require that much more processing power, especially for low-volume servers (e.g., 1000 emails/sec ).

Winners and Losers

[freedomchild]

There seems to be a simple solution to this problem. Why not just go after the people that will be making money off of the spam? It really doesn't matter at the end of the day who sent it. What matters is who will be recieving the money from the spam doing its job.

Spam email has to have a way of the recipient replying the spammers (and the spammers cutomers)
so that it makes economic sense.

If there is a law that prevents spam from being profitable, chances are it won't exist much longer.

Theft of attention, not service

[billstewart]

Yes, Spam does increase network costs, but not much. The real cost is the readers' attention span, which is much more expensive. I get lots of spam, but probably less than a megabyte per day, and I consume a lot more web surfing. Storing the spam doesn't cost anywhere near as storing my real email (at least my work email, which often has MSWord and MSPowerpoint attachments), because spam gets deleted. It's the human effort of filtering and updating filters and trashing obviously spammy subjects that slipped through that's the cost. Machines do the rest... they're cheap.

Re:TMDA

[mdfst13]

TMDA supports this by allowing you to create temporary email addresses and list-specific addresses. For example, say my email address is me@whitelist.com. I sign up for an account at Amazon. Instead of putting in an email address of me@whitelist.com, I put in me-amazon.whitelist.com. Mail sent to this address is automatically passed through. If Amazon sells my email address, I will be able to tell since I will get spam to me-amazon. If so, I can remove this address from my pass through list and complain to Amazon.

Alternately, if I want to put out my email for a reply that will come within a week, TMDA can create an expirable email of the form me-A283653DE@whitelist.com (the A283653DE is an encrypted date/time string). I can then happily send that email out to anyone with the assurance that after a week, messages sent there will bounce.

I agree that this is not an absolute solution to the problem since not everyone will use whitelists. However, it can be a very good solution to the personal problem of trying to manage one's own receipt of spam.

TMDA

[mdfst13]

Check out TMDA.net. Essentially what it does is require people who have never emailed you previously to respond to a challenge email. If you respond to the challenge, you get whitelisted and your email goes through henceforth. This is discussed more lower in the page (look for TMDA).

I don't think that this is *the* answer to spam, but it is an answer that improves the current situation.

Re:TMDA

[AndroidCat]

It will improve the situation, for your mailbox. This is not a bad thing. Few people want to join the Don Quixote Liberation Army. It won't stop the loads of crud jamming ISPs -- end-user filters don't stop that.

There are no answers, just more tools in the toolbox.

shazzam!

[zogger]

--ahh, good to know, I sit and type corrected! Does it work well? Either way, glad to see it!