Slashdot Mirror
Are People Using TMDA to Kill Spam?
NewtonsLaw writes "With spam becoming an increasingly frustrating part of life in the Net, I have to ask why more ISPs aren't implementing systems such as the excellent Open Source Tagged Mail Delivery Agent (TMDA) strategy? Using this system would mean that only those spammers who used bonafide email addresses in their headers would get through -- and means virtually all the penis enlargement, weight-loss and other scams would be blocked. Even the those habbitual "brand name" spammers (like Real, PayPal, etc) could still be blocked by adding them to the blacklist. With TMDA, email to and from regular correspondents is passed transparently and there's no risk of genuine messages being accidentally discarded by over-active filters. If enough ISPs at least offered TMDA as an option to their users, the effectiveness of spamming could be shattered almost overnight -- oh, wouldn't that be lovely?"
but tmda allows *senders* to deal with "false positives." and they only need to do it once per address (in a sane tmda config).
at least *READ* about it before you dismiss it out of hand.
US Citizen living abroad? Register to vote!
the spammer would have to know of an address the recipient has whitelisted.
I use Friend/Foe + mod-point modifiers as a karma/reputation system.
Because they're a terrible solution. All you wind up doing is pissing off the poor people whose email address the spammer used in the forged From: line, and not to mention the quagmire that is making these things play nicely with mailing lists.
.com>
But, I think John Levine does a much more eloquent job of explaining why C-R systems are not the answer:
Date: 11 May 2003 21:41:35 -0400
Message-ID: <Pine.BSI.4.40.0305111408240.28246-100000@tom.iecc
From: "John R Levine" <johnl@iecc.com>
To: "Declan McCullagh" <declan@well.com>
Subject: Re: FC: MailFrontier.net, poor anti-spamware, and future of mailing lists
In-Reply-To: <5.2.1.1.0.20030511122149.00b1a710@mail.well.co m >
> My reluctant conclusion is that C-R systems with flawed implementations
> have the potential to end legitimate mailing lists as we know them today.
No, it's worse than that. The collateral damage from widely used C/R
systems, even with implementations that avoid the stupid bugs, will
destroy usable e-mail.
Challenge systems have effects a lot like spam. In both cases, if only a
few people use them they're annoying because they unfairly offload the
perpetrator's costs on other people, but in small quantities it's not a
big hassle to deal with. As the amount of each goes up, the hassle factor
rapidly escalates and it becomes harder and harder for everyone else to
use e-mail at all.
A relatively easy to solve problem with challenge systems is that most of
them are written by dimwits who don't understand the way that e-mail
really works. In 1983 the 4.3BSD Berkeley Unix "vacation" program
correctly dealt with mail from lists and other mechanical sources, yet 20
years later I still see out-of-office replies from Lotus Notes and MS
Exchange to list mail every day. (Is there really nobody at IBM or
Microsoft who used 4.3BSD or knows the rules of thumb to recognize
non-personal but legit mail?) Challenge systems have the same bugs, and
list managers are now routinely kicking people off lists whose broken
challenge systems spam out stupid challenges to everyone who posts to the
list, and ignoring challenges to signup confirmation messages. These
particular problems are soluble; the few challenge systems used by
experienced mail users like Brad and Dan Bernstein avoid them.
But the real damage from challenge systems will come when spammers start
attacking them. Challenge systems all have user whitelists so that each
correspondent only gets one challenge, then mail goes through directly. So
spammers will start trying to send spam with forged sender addresses that
are on the recipients' whitelists. That's not so hard, sign up for a
mailing list, scrape addresses from the list traffic, then send NxN copies
of spam, to each list address from each list address. Similarly with
addresses scraped in groups from web pages, usenet groups, and anywhere
else scrapage happens.
So what will the effect of this be? You won't be able to trust that mail
from your friends is actually from your friends, since an increasing
fraction will be spam leaking through your challenge system. What will
people do? Given the basic principle of challenge systems, which is that
it's someone else's job to solve your spam problem, people will dump their
whitelists and start challenging every message. At this point, it's
possible to automate much of the work, most challenge systems are
scriptable, so that for example I have a few lines in my mail sorting
filters that catch the per-message challenges from submissions to Dan
Bernstein's mailing lists and automatically send confirmations. But of
course, if I can send responses from scripts, spammers can and will too,
so challenge systems will increasingly include "prove you're human"
features like showing you a picture and asking you how many kittens are in
There are better methods. Message analysis (ala SpamAssassin), spam clearing houses (ala Razor), RBLs, bayesian filters, and sender address verification. I use all five at my site, and my users are happy.
Plus, can you imagine a potential client of your company e-mailing for information, only be sent a TDMA message? I'd bet money that person would either not no what to do, or just ignore the message and think you never got back to them.