Slashdot Mirror


Spam Meeting Wrap-up

wendigo2002 writes "Get used to that daily flood of e-mail come-ons, Viagra offers and lucrative enticements to invest in Nigerian pyramid schemes. Internet gurus, software designers and lawyers today ended a three-day Federal Trade Commission discussion on combating spam by concluding neither technology nor laws are yet capable of completely dealing with the plague."

16 of 188 comments (clear)

  1. They needed three days to figure this out? by Meat+Blaster · · Score: 1, Insightful

    The technology obviously hasn't caught up because my mailbox is full. The laws can't because the First Amendment is crystal clear on the issue (and all the spam from overseas makes our laws irrelevant). The future is Bayesian.

    1. Re:They needed three days to figure this out? by Salgak1 · · Score: 4, Insightful

      The issue of spam is not an issue of free speech, its' an issue of theft of service and of fraud. And the answer is a total re-write of the SMTP specification and standard to allow accountability and traceability of email messages

    2. Re:They needed three days to figure this out? by neuroticia · · Score: 2, Insightful

      Nothing. Unless lastvaliddomain.com is actually owned by the spammer, in which case they get a live email address to play with. Spammers love live email addresses. Unless you forge your headers so they can't tell where it's coming from.

      -Sara

    3. Re:They needed three days to figure this out? by blake182 · · Score: 3, Insightful
      And the answer is a total re-write of the SMTP specification and standard to allow accountability and traceability of email messages

      I agree -- a completely backward compatible re-write of the SMTP specification, and getting people to deploy it is exactly what's needed.

      You see the problem with that statement, of course, don't you? Making it backward compatible and getting it deployed tend to be "the hard part". We already have transport-level authentication and privacy (through TLS), as well as application-level authentication and privacy (through S/MIME and OpenPGP). So how do you deploy those mechanisms in such a way that maintains compatibility, scales, and gets adopted by organizations?

      Short answers are fine, but there are people who have been examining these issues for years without significant progress. Partially because it's a hard problem, but partially because it's not clear that someone's willing to spend money on it.

  2. Way to go! by arvindn · · Score: 4, Insightful
    Rep. Zoe Lofgren, D-Calif., said this week she would seek federal legislation offering rewards for individuals who help track down spammers.

    Lets see more of those! I hope the reward applies irrespective of whether you bring in the spammers dead or alive :-)

  3. Re:Perhaps by Uber+Banker · · Score: 5, Insightful

    The summary said "neither technology nor laws are yet capable of completely dealing with the plague".

    The fact they discussed it means they recognise a problem. Technology or laws not yet capable of meeting it mean they now recognise a deficiency -- a deficiency needs a solution.

    I hope they can divert resources to creating this solution. They need to throw rosources, legal and technological, and *WE* need to keep them aware (or indeed, make them more aware), so it doesn't slip down the government's priority list.

    As for your hotmail address, I suggest you ditch hotmail. I did five years ago, and that was not soon enough.

  4. scary by Trailer+Trash · · Score: 4, Insightful

    ``We are now importing more spam from the United States,'' he joked. ``We are actually learning what American culture is through spam.''

    Hopefully you know that it's not an entirely accurate view of American culture...

  5. Soon To Be Bottled Up In Committee! by Procyon114 · · Score: 2, Insightful
    I love the fact that Congress has neglected to pass ONE law to deal with spam to this day...

    ...but it has managed to enact numerous laws addressing modern technology's other "scourge," copyright infringement.

    It seems that folks in DC can get things done...when they want to.

  6. Answer the question that lawmakers want by clovis · · Score: 5, Insightful

    Nothing will be done until someone answers the question that lawmakers always ask:

    What's in it for me?

    No matter what you present to a politician, no matter how good the cause or important the problem, laws get introduced and passed for only one reason, and that reason is that someone was able to answer that question.
    Sure, it's possible that the answer was "you'll advance your career if you save mankind with this bill", but that almost never happens. There's always a payoff somewhere, and what I can't figure out is a way to tell a Congressman what's the benefit to him for putting in the effort to fix the spam problem. And getting a bill passed is a hell of a lot of work.

    I say: "There's these people who make money by sending a deluge of annoying fradulent emails
    that ..." All the politician hears is "There's these people who make money" and wonders "How can I get some of it?"

    If every spam victim donated a dollar to support congressmen (IE, campaign funding) to do something about spam, then it'll get done. I for one am ready to help.
    Just put your name at the bottom of the list, and send $5 to the person at the top of the list. Now send the list to five of your friends and soon, real soon, we'll have enough money to buy a whole session of Congress. This is completely legitimate, a lawyer looked it over, but you mustn't break the chain.

  7. To stop spam? Two words. by MsWillow · · Score: 4, Insightful

    White list.

    If the *only* way for email to arrive in my mailbox was if it came from (or at least purported to come from) somebody on my list, I'd never see spam again. No need to bounce it, just delete it from the mail server, sight (and site :) ) unseen. Eventually, if everybody started doing this, spammers would see zero revenue, and the tide of spam would disappear.

    Anybody know of a Linux email app that does this all, deleting spam at the server but downloading wanted email? I'm all ears.

    --

    Lemon curry?
  8. Hello, McFly! by Faust7 · · Score: 2, Insightful

    neither technology nor laws are yet capable of completely dealing with the plague.

    Um, of course they're not. If they were, the problem wouldn't exist.

    That's why we develop new ones.

  9. Spam, You guys just do not get it! by ratfynk · · Score: 2, Insightful


    Unfortunately there is money to be made sending spam.
    ISPs make money from spam. Some internet users, like those using Aol, MSN, and other tricked out ISPs,
    have not got the brains to read anthing in depth anyway so they need to have flash, groovy pics, colored text etc to have the computer work.


    These types of users GO to the URLs that pop up in spam and could'nt use a real email program if they knew what it was in the first place. The only thing they do with the computer is use IE or AOL to tell them where and what to veiw on the net.


    The problem with spam is the same problem with paper flyers and junk mail, unfortunately they work!

    --
    OH THE SHAME I fell off the wagon and use sigs again!
  10. Re:traceability, or send-risks-paying? by Anonymous Coward · · Score: 1, Insightful

    the problem with accountability/traceability is that it would probably require people to have a digital identity that pervades the whole internet

    You mean, like your email address? Yeah, I can see how that would be unworkable.

  11. RFC-821 Re-Write is Not Needed by minas-beede · · Score: 3, Insightful

    OK, it's time to start thinking in a different mode - what's been done so far isn't working well enough. Look at the facts: almost all relay email sent through open relays because they are open relays is spam. I mean something like 99.9999% of it - almost all. Most of the rest is spammer relay tests. Quality people don't looking for open relays through which to send their email. Spammers do that. Take advantage of that knowledge. If only spammers use that pathway MINE that pathway. It's figurative mines, not real ones: prohibitions against deadtraps don't apply.

    Instead of continuing the three-years-long moan about all those clods who run open relays (I was once one of them myself) why not quit moaning and DO SOMETHING? Spammers send relay tests. DO SOMETHING that screws the spammer because of that. Report relay attempts to his ISP, accept and deliver the tests and send the spam to /dev/null - ACT. Make up your own way of dealing with them, but make it hurt them in some way, however small. Get any number at all doing something with the tests and those that merely accept the tests and ignore them will help strike fear in the spammers hearts (the operator who does nothing knows he does nothing. The spammer has to worry that the operator does more.)

    Like, for instance, here's a relay test from today:

    Received: from adsl-65-70-89-125.dsl.tulsok.swbell.net by X.X.X;
    Sat, 3 May 03 12:04 CDT
    Message-Id:
    Date: Sat, 03 May 2003 12:01:44 -1700
    From: 0eik00ha7i95o4@starband.net
    Subject: hello
    To: timsmith777@connectfree.co.UK
    MIME-Version: 1.0
    Content-Type: text/plain; charset="Windows-1252"
    Content-Transfer-Encoding: 7bit
    X-Priority: 3
    X-MSMail-Priority: Normal
    X-Mailer: Microsoft Outlook Express 5.00.3018.1300
    X-MimeOLE: Produced By Microsoft MimeOLE V5.00.3018.1300

    054053046055048046056 057046049050053058097 10011510804505405304505504804505605704504905005304 610011
    510804611611710811 511110704611511909810110810804611 0101116058049049048051058057058089101115

    (I had to beeak up the strings becuase of the Slashdot "lameness" filters.)

    It takes as close to no smarts at all to trap a test like this as is possible. DO IT.

    (By the way, I altered the string in the message-ID: that's where spammers who use this form of test encode the IP tested.) Similarly, they encode where the test originated in the body. It's decimal ascii: "048" encodes "0," etc.

    Don't want to do SMTP trapping? No problem - trap some spammer open proxy abuse. MAybe you'll learn his IP, even (the clown who sent the test above has been using the same IP since at least 11-Mar-2003.)

    I've been telling connectfree.co.uk about these test messages going to the spammer dropboxes in their space. I suggest that they simply divert email to the dropbox address so it goes someplace else. This is SOMETHING they can do that really screws the spammers. Until the spammers figure out the email is being diverted they discover no open relays if the email through those open relays to the dropbox doesn't get delivered.

    Isn't it about time people though about what to do to stop these spammers? Is it so terribly hard to divert email to a known spammer dropbox address someplace else? Does that not conform to the TOS? CHANGE the TOS - quit waiting for someone else to solve spam and act. Worried about the US DOJ saying this is a crime? Hey, we're talking about a .co.uk location - US law doesn't reach that far. DO IT.

    Read my post again. See anything that says action must wait for a change in the SMTP protocol? NO. See anything that says the little guy with a DSL or cable connection can't take part? NO. ISPs could do even better - think about what the ISP with hundreds of abused open proxies could do if it intercepted the proxy connections made by the spammers.

    This does nothing to stop direct spam. There blocklists work like a charm. This does an awful lot to sop abuse-path spam (non-direct spam.) DO IT.

    Or continue to moan. One path has better results - see if you can tell which.

  12. whitelists mean the spammers have won. by Schlemphfer · · Score: 3, Insightful
    Eventually, if everybody started doing this, spammers would see zero revenue, and the tide of spam would disappear.

    The trouble is that comparatively few people are savvy enough to switch to whitelist email systems. And it only takes a small percentage of internet users who don't block spam, and who order occasionally from spam, to keep the spam problem a growing nightmare for the rest of us. I think it's unrealistic to suggest that whitelists can solve the spam problem, since there's no way to argue they'll be adopted widely enough to keep huge amounts of spam from reaching people.

    And another thing. I want random people to be able to contact me, for whatever reason. What I don't want is to be contacted by automated email systems for purposes of marketing. In my mind, whitelists prevent the latter, but they also prevent or seriously inconvenience the former. And to me, that's unacceptable. I presonally rely on Mozilla filters, which rid me of about 97% of my spam, while allowing the email of random people who need to contact me to (usually) get through.

    --
    I'm generally "Interesting," "Insightful," and even "Funny" here. What the hell happens to me at parties?
  13. Re:Spam Insurance by hkmwbz · · Score: 2, Insightful
    I have always wondered by so few spammers are paying for their actions. I mean, they are annoying millions of people. One would have thought that with many spammers' locations freely available, with the rage felt by some people over spam, and the psychos we know exist out there, more spammers would have been found decapitated, drowned, tortured to death etc.

    Seriously, why aren't the spammers getting more trouble over the crap they are doing to people's inboxes? They are messing with big dollars here. People are losing valuable time and money...

    Why is nothing happening?

    --
    Clever signature text goes here.