Slashdot Mirror
MailBlocks sues Earthlink over Anti-Spam Tech
goombah99 writes "Mailblocks is suing Earthlink , claiming patents on Challenge-Response as a means of blocking spam. Slashdot recently discussed Earthlink's plans to implement a challenge-response email system. The next day mailblocks filed suit to defend their turf in the $118 million dollar anti-spam solutions market. MSNBC has a complete discussion."
Years ago... 1997 to be exact.
Mailblocks has no right on that patent.
...and this ladies and gentlement is why the spammers win.
That MSNBC has a complete discussion makes me so happy! MSN.. hello?
"...founded in July 2002 by Phil Goldman, a former Microsoft vice president..."
Have they patented the idea of challenge/response email authentication? Geez
"Mailblocks is suing Earthlink , claiming patents on Challenge-Response"
If Earthlink responds to this legal challenge, they'd be in violation of this Mailblocks patent? A nice merry-go-round.
I think I'll patent these as well, just in case:
1. Pleading guilty.
2. Pleading innocent.
and so on...
If you keep throwing chairs, one day you'll break windows....
I could be a mile long by now! You'll pay Mailblocks, YOU WILL PAY!
Because all the "good guys" are stabbing each other in the back trying to be the one that fixes this problem.
I say we need to send the One (a large man with a nail bat) to the Source (the companies that PAY the spammers) and let him Disseminate the Code (splatter their heads against the wall).
Yeah, I saw Reloaded three times since last Wednesday... so sue me. =P
This is my sig. Its pathetic.
From this number, would I be wrong in assuming that there are many people besides spammers themselves who have no problem at all with spam remaining legislation-free? I had no idea anti-spam was such a lucrative business, and I suspect many others hadn't either.
If I could make this sig kill you, I would.
Don't you just love software patents.
Europeans, contact your MEP now or else we will have this stupidity as well. The vote is next month and it looks most likely to give the go ahead on allowing software patents in Europe.
I have contacted my MEP and am trying to set up a personal meeting with him. Please do the same. There aren't many of us doing this kind of thing.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
Didn't Jeff Bezos {amazon.com} invent that? I'm pretty sure he holds the patent for it...
All hail the "new" dark ages...where instead of guilds and religion repressing knowledge and progress, we have "intellectual property rights"!!!
Good news is, in about 1000 years will have another
"new" industrial age and be able to move on...
From the article: "Mailblocks developed and owns patents for Challenge/Response"
They will sue me as soon as they find out that I dial in to my ISP using the CHAP protocol.
RedShirt
Microsft spel chekar vor sail, worgs grate !!!
Wouldn't it be interesting if the "privately-funded" Mailblocks were to win and then refuse to license their patent to anyone? Or maybe offer to license it, but for exorbitant license fees. Then, 20 years from now, we'd find out that their private funding came from companies with an interest in Direct Marketing? Or that Mailblocks itself exists as a marketing tool, to collect email addresses and sell them?
One of the very real uses of patents is to prevent people from using the technology.
So am I paranoid enough yet?
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
I know that challenge response has been around longer than thatPRIOR ART.
And challenging Earthlink is a bit foolish. All Earthlink needs to do is come up with the hundreds of thousands of examples of Challenge-Response systems in use as early as 1995 in order to verify an actual person was on the other side.
Food not Bombs is a nice platitude but it breaks down when you notice that the Bombees are usually well fed
Majordomo, Mailman, elzlm...almost all mailing list software sends you a confirmation email, requiring your reply(nowadays via a URL with an embedded authentication string, or via email simply by replying.) Kinda seems like prior art, since I'm guessing "Mailblocks" hasn't even been around as long as majordomo, which dates back into the Dark Ages.
However, in all honesty, this is probably one of the few cases where everyone wins- for many of the reasons folks cited in the comments on the last article that mentioned Earthlink's move... challenge-reply is a VERY half-baked idea, and anything that supresses the market for that software(ie, patent) is a darn good thing in my book.
I'm a mailing list manager, and if Earthlink does manage to get out of this one and fire up the challenge-response business, I'm damn tempted to simply block every earthlink user, possibly at the mailer level, because the users simply aren't smart enough to handle whitelisting the mailing list(s). Hell, most of the hotmail/yahoo mail users can't even keep their mailboxes under quota. We're talking rocket science compared to keeping your mail folder clean...
Please help metamoderate.
Gee... I use a a Sendmail AntiSpam list. It works.
I was going to write a filter that would do a
lookup on the incoming emailaddress, If I don't
find them I refuse the email. That's not patentable. And it should not be.
Does the phenomen need any more explenation ?
The patent/ip mob is on the move again..
Quote: "Mailblocks, Inc. is a new class of Web-based email service for consumers founded in July 2002 by Phil Goldman, a former Microsoft vice president and a founder of WebTV."
Why can't it be that the penis enlarger companies are the ones that are suing each other into bankruptcy over patent infringement?
The Hon. Judge VanDelay ruled against me, so as it turns out, I cleaned myself out pretty good!
Besides, TMDA works, while Mailblocks doesn't. I grabbed a Mailblocks account while I could get a good username, and found that Mailblocks doesn't send out the challenge: it just discards my test messages as spam after 14 (?) days.
UM SPIKE ISN'T Dead.
Food not Bombs is a nice platitude but it breaks down when you notice that the Bombees are usually well fed
So if no one elese but Mailblocks can implement a decent anti-spam response due to patents. then mailblocks has a perfect protection racket. start spamming everyone to sell....anti-spam software.
Some drink at the fountain of knowledge. Others just gargle.
"hello?"
"Hi is this Joe Smith of 104 spammark rd.?"
"May i ask who is calling?"
"No, you may not, we've patented the process where you ask who your talking to then decide wethere you want to continue communication, we can license that technology to you though for the special low price of $1 per use."
Comment removed based on user account deletion
I block all challenge-response systems at the MTA level, because they're fscking annoying because their users always use them on mailing lists.
Thanks to this article, I know about Mailblocks. I will go dig up their MXes now. Thanks, goombah99.
Oh, come on. This solution is so obvious even my mother thought of it. She had never even heard that anyone was actually doing it, and not long ago she emailed me asking me if I could set it up for her. She had the whole idea down, and was certain it was something that she had just come up with.
Using state-of-the-art technology, an assemblage of talented, passionate and experienced individuals unlike slashdot's crew of moron editors
:)
Am I the only one to notice that...? Somehow I doubt that's in the original. Clever and amusing, however
Place sig here.
we'll let the creator sort it out for US.
no need to brIEf va lairIE, as he already has the nearly useless PostBlock(tm) devise, 'working' full bullast.
howsonever, the evile nature of these whoreabull greed/fear based payper liesense stock markup FraUD LIEforms, makes many of US think that hangin' is way too good for the Godless slymebawls, & that we would be better served buy having them receive the citation of the dead rat.
I have been using the excellent utility ASK (Active Spam Killer). This uses the challenge response technique. It's blocked 670 SPAM messages in the last 10 days. It's been around for a while. I thought that an idea had to be "non-obvious" to be patentable. Lots of people comming up with an idea thats not obvious.
challenge-reply is a VERY half-baked idea.
How so?
It seems like a great solution to me (coupled with a whitelist).
I'd put all my friends on the whitelist. When anyone not on that list emails me for the first time, they get an automated message back telling them how to respond. If they do this, the message gets through and they go on my whitelist. If not, they have already been informed that their message will not reach me.
How is this half-baked!?
Life is too short to proofread.
Challenge-Response is the fundamental security mechanism for TCP, the reliable communication protocol used for everything from the web to SMTP itself. During the three way handshake between client and server, each sends the other a randomly generated 32 bit number, and each refuses to communicate unless that number is successfully returned intact. If either the client or the server fakes its identity, it will fail to receive the required value -- one of four billion -- and will thus be unable to complete the handshake.
:-)
At least, that's the thinking. Perfect security this ain't, but please -- the spec for TCP came out in 1981. TCP's security technique entirely encapsulates challenge-response systems for SMTP -- the same mitigation of false addresses through an inability to respond, the same caching of credentials once a response is received (you can think of a "trusted address" as a permanently open socket, with all the management headaches that implies!), etc.
In short, this is nothing new. But of course, we already knew that
Yours Truly,
Dan "I Do Way Too Much Stuff With TCP" Kaminsky
DoxPara Research
http://www.doxpara.com
> Hell, most of the hotmail/yahoo mail users can't even keep their mailboxes under quota.
Well, when Hotmail hands out your email address, and your mailbox ends up being bombarded with spam, and Hotmail's spam "filters" catch about 13 of the 400 spam messages in your Inbox, emptying your mailbox every other day just to make room for more spam ends up being a pointless exercise.
At least Yahoo mail seems to be an improvement over Hotmail. Over 3 years on the same account and not one spam message.
I can't believe these patents are being granted so freely. There is NO WAY the patent office could have overlooked examples of the challenge/response method for restricting email delivery. Honestly I can't think of a specific example at the moment. But I doubt it would take long to find it in use prior to the patent application. These patents are ridiculous.
Of course, this is something of a stupid way to block spam anyways. How does it let legit mailing lists that you sign up for through? How does it let emails for orders you placed through online shopping through?
This proves, anyone against useage of anti-spam obviously has a perfected interest in pro-spam technology.
:D
Next story: United States LLC takes away everyone's rights, puts them in a small box, so the terrorists can't take our rights away.
Story after the next: The Constitution of the 13 united States of America DID NOT need to be ammendmended; anyone that thinks all men are created equal WITH EXCEPTION TO NEGROES AND WOMEN, simply needs an attitude change and statutory rights are actualy granted privileges that may be revoked. In short, Civil Rights need not be around whilst people think they are equal. In a time where near everyone owned a negro slave, the believed (religion) that negroes are only to be owned. I say blah, that is evil and I consider every man my equal and not my adversary.
Next story after next story after next story: CowboyNeal gets married...discloses bacelor party via the opensource phylosophy!
-1 offtopic
-1 shit-brained
-1 possible homersexual
...since I'm guessing "Mailblocks" hasn't even been around as long as majordomo, which dates back into the Dark Ages.
Lord EndUser: Hail, good knight! As you are traveling, send word to the neighboring lands of our bounteous faire, which is nigh upon us!
Sir Michael The Patient: 550 Relaying denied
Lord EndUser: Curse thee, Major Domo!
Spam filtering companies are proliferating at a rate almost akin to the growth of spam itself, and not all of them are going to survive.
Remember when there was a similar growth in companies delivering anti-virus solutions? Remember when several of them were caught propogating viruses?
Given how little it costs to Spam - especially if you're willing to accept a response rate of ZERO - I wonder how long it will be before some of these companies start hiring people to send out spam; spam tailored so that the anti-spam company has patented the most feasible defense!
Help make virtual black mail legal.
The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
This exactly what's wrong with corporate America (a.k.a. the "legal system") Rather than willingly share technology and ideas, people hoarde whatever they can in the hopes of becoming the next overnight Joe Millionaire. The problem is, the success of the one in no way benefits the many. In fact, the contrary is true- this sort of crap hurts the industry more than anything. Meanwhile consumers are complaining to their providors, threatening to take their business elsewhere, crippling an already painful market. If people weren't so damn selfish, and freely shared concepts and ideas (e.g. Open Source), without the need to excessively profit, imagine where technology would be.
The first thing I thought of when I read this was "How are mail list posts handled?" The first message from your underwater basket weaving list comes in, Mailblocks sends out it's challenge, it's sent to the entire mail list but the actual user never sees the challenge because Mailblocks won't let posts from the mail list through.
And I thought the people who have vacation responders on their email accounts were bad. Talk about a vicious circle.
d a v e
"Hmmm...upgrades."
Kind of interested if thier is a solution for this already.
What happens if I have one of theses CR set up and a friend has another one we are not on each others lists. I send him mail, which gets me a piece of mail asking for a responce, since my system does not know the address it then replys, and so on......
I presume with the same product they watch thier know thier own responces so they can put a stop to this.
Kill spam with tech patents -- patent on sending email in bulk, patent on the "click here to remove me", patent on email header forgery, and of course patent on screwing with the subject field to get by most spam filters. Obviously, you have to actually *find* the spammers to sue them. Oh well.
SPAM solution made easy: 1 spammer, 5 cords of rope, 5 hourses, and fireworks. Be creative.
I understand the need for companies to protect their intellectual property, what I don't understand is how you can classify such a simple, dare I say obvious, spam prevention scheme as "intellectual." It's scary to see such a huge legal throw-down over code that any programmer worth his weight in thumb-tacks could write in 30 minutes using VBScript. And really, if your entire company is based on something so trivial that little Johnny 12 year-old could reproduce it during recess and still have time to play 4-squares and get in a round of hoops, then it's time to close shop and start flipping burgers because you aren't going to last in the business world. Take heart MailBlocks; Micky D's is always hiring, and the little Johnnys of the world will always want fries with that.
Brits can find out who your MEP is by entering your postcode here. Set aside any personal feeling you may have on the EU, ranting against it is more like to do harm than good.
Some ideas point to raise.
Point out you are a IT professional and you are writing in that capacity as well as a voter.
US companies have been allowed to accumulate large number of software patents for 30 years by a poorly managed US patent system.
European Companies will be forced to pay royalties to US corporations, even ideas they invented, but patented in the US.
European Companies can be prevented from competing in some areas by patents, either by cost or denial of access to certain technology.
Patents prevents fair competition and promote monopolies.
An expansion of the patents system in the EU to cover computer software is extremely damaging to the European IT sector.
Point out that software is about maths and numbers, if you cannot patent algebra B or numbers so why software.
If possible point out a simple example of a patent in your particular field, even better if you can rightly claim it was invented in Europe but patented in the US.
If it was complete, there wouldn't be any comments here, now would there?
CONCEPTS aren't patentable, are they?
The CONCEPT here is that of requiring a human response from a sender of an email before the recipient receives that email.
There are thousands of ways it can be implemented, I would imagine, be it with something written proprietary for a company, or through something open source (procmail recipes like I use?). Am I the next target because I run Procmail with a recipe set that requires a response before I receive an email from someone? Could the person who wrote this recipe set and gives it away free be a target?
The only way I can see Mailblocks even stands a chance to win anything is if it's proven that Earthlink is using something written by Mailblocks without the authority to use it. But that's licensing violation, not patent infringement. I would hope that a patent revocation would arise from this case.
Here's a link to an interesting article that's relatd to this discussion:
Grip2Ed.com
It discusses SpamArrest and some of the snakiness it's pulling when unknowing users respond to their clients mail. Kinda scary.
d a v e
"Hmmm...upgrades."
When users wish to receive email that will be computer-generated, such as confirmations of email purchases or newsletter subscriptions, they can use a special email address to automatically allow those emails to be sent directly to their inbox.
How long before that "special email address" which you're giving out to online retailers shows up on the spammer's list? We all know that online retailers and mailing lists never sell their email databases to spammers, right?
Unix is user friendly, it's just selective about who its friends are.
Looks like they were right, with two exceptions :-)
How so?
Well, try reading the top rated comments in the last Earthlink-does-challenge-reply business slashdot story. A few of the ideas that occured to me(with varying degrees of seriousness/risk/whatever):
Please help metamoderate.
Just my thought here: Many states, maybe all, have made spam a crime.
But they have not been effective in stopping it.
Now, normally, when I am victimized by a crime, I am justified in defending myself. Mailblocks, however, is saying "You can't defend yourself against this crime, because we own the intellectual property for the methods of defense"?!?!
Okay, so whenever a new technology comes out, the mafia just needs to figure out (1) a way to victimize people (2) the best ways to defend against it. Then patent the defenses, and subsequently hit people from both sides.
Our government is coming to a real decision. Either defend IP at let criminals roam free, victimizing all and destroying the economy, or give up IP, and maintain order.
Meanwhile, Ralsky and his friends are going to be down at the patent office in a flash.
Something is rotten in the state of our legal system.
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
Unfortunately, Mailblocks does not cite their patent number and it is not listed under either of the principles' names.
Possible prior art:
Patent Filed December 1998....
US6546416: Method and system for selectively blocking delivery of bulk electronic mail.
Owned by Infoseek.
TMDA on Sourceforge, April 2001
I've seen this system used for the last several years. There are several cgi/pl scripts out there that email processors or mail clients would use to do the same function.
And lastly I'll never let a 3rd party process my email other than my ISP holding it on the servers there.
Recent articles haven't mentions Digiportal or Mail Frontier, so it is possible that they have come to an agreement with Mailblocks.
Full article (dated 4/05/03) from the San Jose Mercury News.
I was wondering if anyone else noticed that. Glad I'm not the only one who thinks this is an obvious gaping hole in the system.
The addresses that it talks about are disposable. Mailblocks.com calls them "trackers". For example - my email address at mailblocks.com is draino@mailblocks.com , but I can add and delete as many trackers as I want. For example a tracker would look like - draino+something1234@mailblocks.com . The only problem with this is that some places are unable to validate a "+" as a valid character for an email address. A great example is Ebay.. I have now lost access to my ebay account because it let me change my email address to that, but it won't let me login. It deciphers the "+" as a blank space..
Mailblocks Inc. ... is pursuing this legal action to ensure its survival, says Mailblocks CEO Phil Goldman.
If I worked for a company whose very survival was based on patenting obvious things and suing other companies for using obvious things, instead of a software company, I would be very sad. I would be sad to find that I'm not competing with TMDA, but PanIP.
When are we going to take those idiots at the Patent Office out and shoot them all?
.. any collection of rational citizens could do a better job than they at rejecting the obvious.
Gods
Actually, I submit a local Hells Angel chapter could do as well.
See? Challenge-response. Worked perfectly.
There is no sig, there is only Zuul.
The "Trackers" are dyanamic and can be turned off. I don't think that challenge response is ready for mainstream use, however if earthlink can get theirs working with the "average" computer user, then perhaps there is hope on the spam front.
I don't think that the dynamic Username+pin@mailblocks.com is as clean as other dynamic solutions for example the method used at cotse.net where the dynamic range is *@username.cotse.net. But that is just MHO. However for only 9.95 per year for mailblocks vs 5.95 monthly for cotse... I like absolute control and "expiring" addresses.
Food not Bombs is a nice platitude but it breaks down when you notice that the Bombees are usually well fed
I have registered the patent for "Any technological solution to anything. Ever." I expect to be really rich, really soon.
This looks like it's becoming another "unholy alliance" like the virus / anti-virus market. It's as if the net had no native problems, so people have had to think up some so they could sell solutions for them. I wouldn't care if there wasn't so much collateral damamge to the net's reputation and so much extra effort on my part for "trash removal" in my corner of the net.
I'm a proud capitalist, but this is sickening. It's like embedding nails in the road to increase sales of tires and towing services. Surely if there were ever a "solutions market" that deserved to be trashed by OSS, this is it.
Go SpamAssasin and Mozilla!!
So now somebody can patent a spam-blocking technique, then bombard you with spam which you can't legally stop because they have patented spam blocking. Then a virus creator will patent virus detection and removal, so you can't legally eliminate their viruses. And they can do the same thing with ad blocking, firewalls, and the list goes on.
The evils brought on society by software patents far outweigh the good brought by the 1% of useful software patents.
---------
There is inferior bacteria on the interior of your posterior.
DDOS against whoever's name happens to be in the From line of a spam
I am very happy with Mailblocks' challenge-response system. Their webmail based system is blazing fast and just plain works well. I can drag and drop emails to different folders, etc. The account is also a regular IMAP account so you can just pop their settings into your regular email client. However, a couple of companies ( namely some online casino and 1-800 Flowers ) managed to get through the challenge-response. I have a hard time believing that someone from 1-800 Flowers waded through all of the bouncebacks and performed the challenge response. It's very possible but not likely.. So that sounds fishy to me. I hope they stick around, I really like the service. Having a really fast/cheap 50MB IMAP account that I can check from anywhere with a web browser is pretty slick.
Freemasons (similar to the Stonecutters in an episode of The Simpsons) have recently licensed the Challenge-Response technology developed by Mailblocks.
"We saw a need for technology allowing our brethren to recognize one another. The use of Challenge-Response in the form of Secret Handshakes (tm) seemed to be a good way to go about it", says an anonymous member of an unidentified lodge.
Some masons did express concerns, however, regarding the potential spread of cooties and other infectuous diseases through the use of this recognition system.
In case anyone hasn't noticed, this is basically what a "bounce" message does. The challenge of figuring out what caused the bounce and how to get around it not only makes you prove that you are human, but that you can think. Bounces caused by DNSBLs make prove that you know how to send email from some place that doesn't send spam or have an open relay/proxy.
SPF support for most open source mail servers can be found at libspf2.
Let me put it this way: be happy that I don't write email harvesting tools and spam sending tools.
/. discussion page, it contained circa 100 email addresses. 90% of those were obfuscated in some way or another. After 20 minutes of perl, I could defeat 75% of the obfuscation methods. And yes, there was a case of a valid email address that got "deobfuscated" and therefore rendered useless. How would I go about this? Spam the emails in the database, check the bounces. Deobfuscate the bounces, reinsert in database. After a couple of rounds, mark the address dead.
One day I asked me "can I defeat the email obfuscation many people use?" I downloaded one
Spam sending tools? Defeating the challenge-response systems in use is almost trivial. You get a cookie, you send the cookie back. The only trick is _finding_ the cookie. For some of the systems, it's trivial, since they have been designed with ease of use in mind: just quoting the whole thing and sending it back does the trick.
You really need authenticated email to defeat SPAM once and for all: it's getting to the point where I will accept only email which is cryptographically signed by signatures that I have signed myself or in the general case, by signatures which can be traced to me. People who don't have such signatures can receive temporary certificates, but they have to _sign_ the dammed thing. Eventually it will evolve into accepting IPSec connections from machines that are trusted. Mailing lists? I don't care about email in mailing lists. I care about my inbox.
- Does it surprise anyone that the CEO of the company bringing legal action is a former Microsoft exec? It's clear that Mailblocks is more interested in making money than in fighting SPAM. I can't say I blame them for that, but it's a shame that they're attempting to supress useful technology in order to eliminate competition. In fact, the MSNBC article alludes to several other similar lawsuits brought about by the same firm. Survival via settlement, just like the article said.
- Limiting SPAM using challenge/response would be far more effective on the whole as a draft RFC that any MTA (or add-on) could implement, rather than a closed system that even individual developers can't duplicate for fear of a lawsuit.
- Opinion alert: The problem of SPAM is far more important than the problem of keeping one startup in business. Those on the anti-SPAM side of the "war" argue about how to define SPAM, how to combat it when it occurs, and sue each other over who thought of it first. (I personally discovered long ago that if you let a group of technical folks argue the technical merits of a solution until the end of time, they will.) Thus, the spamming minority continues to win, because they don't have anything to fight about -- they just keep pounding out those weight loss and penis enlargement ads. Sue the damn spammers, not other spam-fighters.
- Challenge/response isn't exactly new or exciting, even as applied to e-mail. How about PGP? It already provides the ability to authoritatively assert the identity of a sender and recipient. The only missing link is what to do with a rejected or non-PGP signed message. Couldn't generating a keypair be made as simple as the ch/resp method Mailblocks uses? The implications of trust levels as implemented in PGP are profoundly interesting too. Generating an initial whitelist becomes far more useful once you can say, 'I trust all my senders, and all my mother's senders, and all of Uncle Joe's senders...' IANAP*, but it seems like an idea that would work!
* - I Am Not A ProgrammerThat being said, it is every ISP's job to do whatever they can to block whatever spam that might hit their users. I certainly don't pay my isp to let spam pass through. To put it another way, I don't pay my DSL provider for crappy service, outages, and ping fluctuations. Same thing here only theres a company that sees a big name like Sprint but only sees $$$.
Uhm...
> From: your@friend.addy
> Subject: Hey there
>
> You've been spammed! Ha! Ha! Ha!
no, really. It works that way.
- increased load on mail servers
The load increase is manageable. Challenge response would only need to happen a small percentage of the time for valid email. For spam, yes up to 1 email would be sent per spam recieved. I think the internet can handle that. It's not like there are going to be large attachments or anything.- everyone's challenge-response system will be different and incompatible
That's the whole point of the challenge response system. The idea is that the message can only get though if an actual person is willing to sit there and read how to make it get through. If if isn't worth this unknown sender's time to figure out how to make the email get through, they're probably just wasting my time anyways.The other idea would be to make the response be the results of a computationally expensive task. With a new RFC, the format for this could be standardized, and it could all be made totally invisible to the user. Since CPU power costs money, it would still be effective at reducing spam.
- businesses won't be able to send legitimate automated email(shipping notifications, confirmations, etc.) because everyone will be using different challenge-response systems. You think the average earthlink user is going to be smart enough to even REALIZE they need to whitelist a business, much less what address?
First off, they can just whitelist the whole domain of the business. Hey, the could even tell it to auto-whitelist any email addresses in that domain from which they recieve email in the next 2 hours. Second, yes I do think people will be able to maintain a whitelist. Using a whitelist would be voluntary, so if you can't use it, you don't have to. Once they get fed up with the amount of spam they're getting, it will provide them with enough incetive to learn. Most people can learn how to do simple things with their computer, they typically just don't see it as worth their time to do so. Beside you could make the whole "it's hard to use" argument about the WWW itself. People just eventually decided if was worth learning to use.- Loops when dealing with any of the dozens upon dozens of mailing list software, autoresponders, and legitimate automated email systems.
Other that implementing some basic sanity checking, these would be flaws on their end of the system. The should be no message I can send an automated mail system to make it go apeshit. All the challenge response software would need to do is ignore replies the weren't even attempting to respond correctly. This could be done for N hours after recieving the first message from a source.The only really big problem I can see is what happens if someone sends out spam with your email address. It seems like a potential DOS-style attack. It seems that there's an obvious solution to this: Add a standard string to be include in all response requests.
This way your mail software can check to see if you've sent mail to that address, and ignore it if you haven't.
I looked at the comments in that story, but it still don't see why this idea is half baked. One of us must be missing something.
Life is too short to proofread.
Call me crazy but I'll ask anyway. Since everyone is so gung-ho about how evil software patents are,
imagine for a moment that software patents were abolished. Do you think companies and people would continue to innovate software? Or do you think software development would stop? What would be the consequences to industry? Would the economy collapse due to a severe outage of software companies (The entire world has a huge stake in it, anyone know the numbers and percentages? percentage of GDPs?) ? What about the Hardware Manufacturing companies? How would they be impacted? Inquiring minds want to know.
"Last one in is a rotten goblin!" - Kepp
-
Load on mail servers should go down, as it is less overhead to
look up if sender S is on recipient R's white
list already than it is to run 75 content filter
algorithms and compute the score, etc. And you can
do it before you actually accept the body of the email.
-
Your second point and your third point don't play together well -- if they're all different, it makes it much harder for spammers to reply to them.
- If spammers figure out how to reply to them, they at least have to start using reply addresses that work to the first order; a first step to other forms of remediation.
The later points are fixable:- When you make your first order with the company they send you your email confirmation,
and they have to have a person reply to the
responder that first time. From then on they can email you. A person is generally involved with the order anyway, so it isn't that much overhead.
- You make a whitelist reply have headers like any other delivery error report. People have been sending bounce e-mails for decades, and
RFCs describe how to avoid bounce-bounces.
Of course, to work at all the system has to work in a symmetric situation -- you must automatically whitelist folks to whom you send e-mail, otherwise you can't receive their auto-responder query...The thing to do is bring up issues in designs like this that might be a problem, and try to solve them; not to say "It's a bad idea because I can think of 20 potential problems".
- "History shows again and again how nature points out the folly of men" -- Blue Oyster Cult, 'Godzilla'
So, a patent can tell a company to stop doing something even if they develop it themselves?
:)
I'm curious.
If you patent A, then I come up with A on my own time, for use in my own company, you can still tell me to stop using it?
I mean, I guess Earthlink is advertising that they're going to be using a challenge/response system, but they're not selling it, are they? I don't understand how the patent system even applies here.
Someone help, my head hurts.
# increased load on mail servers
.001%. Most challenges will bounce.
No, decreased load on mail servers. Spam comes in. A challenge is sent and it bounces (due to the spammer having forged an address). The spam is discarded, saving space on the server. If the server is smart, it will automatically discard all bulk e-mail purporting to be from that address. The user retrieves their e-mail and that traffic does not included the discarded spam. Spammers, recognizing the futility of sending spam to challenge-response mail servers, will stop spamming that domain.
# everyone's challenge-response system will be different and incompatible
Since a human being has to follow the simple instructions in the message, that is not a problem. You don't want something that is easily scripted anyway.
# spammers will figure out how to reply to them
Only if the spammers give a legit return address. And how many of them do? Probably less than
# businesses won't be able to send legitimate automated email(shipping notifications, confirmations, etc.) because everyone will be using different challenge-response systems. You think the average earthlink user is going to be smart enough to even REALIZE they need to whitelist a business, much less what address?
That's a legitimate concern, but one which can be addressed by ISPs creating whitelists of trusted businesses. The businesses, in order to be able to continue getting legitimate e-mail through, will not spam and risk being removed from the list.
# Loops when dealing with any of the dozens upon dozens of mailing list software, autoresponders, and legitimate automated email systems.
That's a very legitimate concern. One way to deal with it is to send one challenge per sender/recipient. In other words, mailing list A sends e-mail to you. A challenge is sent. No response is received. Mailing list A continues to send e-mail to you. Because they are not whitelisted and because they did not reply to the original challenge, the e-mail is discarded/refused.
Challenge-response is a very good way to deal with spam, though I am sure that there will be some setbacks here and there. Overall, I think that it's a very reasonable idea.
I am writing a project called "honeymail" ( http://lucifer.intercosmos.net/index.php?display=h oneymail )
I am now thinking maybe I should look into a few of the laws before I get to release 0.1
anime+manga together at last.. in real time.
Yes. Patent's are agnostic about whether they were developed independently or not. The only thing that matters is who filed first.
I'm sorry. This is a definite prior-art by truly me.
We all gain, and MailBlock loses.
http://www.angel.net/~nic/spam-x/ (with revision history dating back to 2001.
The only thing that it doesn't address is the potential for a spammer to bulk-mail accept-list confirmations prior to or as part of their mass-mailings.
So maybe use a digest of the headers to ID the original message, recover the e-mail address from it, and add it to the whitelist?
Internet Explorer was unable to link to the Web page you requested. The page might use standard HTML or CSS.
Well, there have to be hundreds of ex-MS VPs. They had to end up somewhere. (Hell, there's probably hundreds of current MS VPs.)
One line blog. I hear that they're called Twitters now.
the internet might NOT be able to handle that. (but i do think the challenge/response system has potential...)
from http://www.gallup.com/poll/releases/pr030520.asp: The basic facts are staggering. Internet service provider Earthlink estimates that 40% of the e-mail that comes through its system is spam. Brightmail, a spam prevention company, says that 45% of e-mail sent is spam. AOL claims that 70% to 80% of its incoming e-mail is spam. Jupiter Research reports that the average e-mail inbox gets 42 spam messages a day. USA Today quotes an estimate that more than 2 trillion pieces of spam are expected to be sent over the Internet this year. That's trillion with a "t."
It just seems to me that this method will only be effective for a short period of time. Eventually, as this technology becomes more prevelant, the spammers will develop a way to have their mailers expect this challenge/response, and be designed to respond appropriately. Until something better can be devised, I will continue to use three email addresses (hotmail for signing up for various websites, my ISP account for any billing info that requires an email address, and my personal address for friends and family) - Funny how the only spam I get is from in my hotmail box.
Just pay thousands of third world children .002 cents for every email they "authenticate."
Or, with computer vision growing in leaps and bounds this too would eventually be replaced by a computer with a $20 web cam and some nifty software.
Anyone remember the guy who wrote a program to let his computer play Tetris by taking screen grabs?
Apple free since 1990!
In this country, and probably many others, software cannot legally be patented. I am not an expert, but I would guess that this means software patents granted in other countries are not enforceable in the UK - and therefore no offence would be committed using "patent-violating" software here.
Governments should, if they don't already, have the power to annul any patent, and that power should be exercised against abusers of the system.
Meanwhile, if your ISP offers virtual hosting, you can always use disposable addresses. (well - at least until the spam merchants twig onto that). This is my attempt at disposable addressing.
So whose patent does this violate?
Je fume. Tu fumes. Nous fûmes!
Halt, who goes there?
Public executions, first offence, for spammers.
Broadcast immediate, ALL channels, satellite, cable, OTA, AM/FM. ALL channels.
We interrupt this broadcast for another public execution of a spammer and as a bonus execution, three patent lawyers. Please stand by, after the executions you will be returned to your regularly scheduled programming.
Thank you."
That's a legitimate concern, but one which can be addressed by ISPs creating whitelists of trusted businesses.
Think so?
Quick - list all of the businesses that all earthlink subscribers will do business with this year. Don't miss any.
that's good info
I never finished implementing the system (I wrote my dissertation instead) but still have a midsized collection of emails about it.
Challenge/response has got to be "obvious to one versed in the art" -- I can think of at least three other people at Stanford who had the same idea at about the same time.
Challenge-Response authentification routines in place, but not activated, years ago, can you say in 1993? Besides, the CONCEPT of challenge-response is older than dirt! "Halt!!, Who goes there?!" "Able Baker Carley!" "What is the password!?" "Blow Me You Patenting Bastards!" "That was the improper response!" BANG BANG. So some yokel in the patent office let this shit slip through? Naturally, they are public servants.
I hacked together a challenge-response system in Perl without too much trouble about a year ago. Hardly rocket science.
I don't use it any more, though, since I neglected to whitelist a mailing list and got an angry response... it's not worth the hassle. I just use a whitelist, and every so often I manually check if anything has slipped through... works nicely.
$obligatory_hotmail_spamming_rant
I'll bet the patent office wouldn't allow you to patent just plain pleading innocent or guilty.
However I'll bet that they would allow "method for pleading innocent to an internet lawsuit"
subject says it all
There would be a spike of traffic, since every spam would generate a challenge, but that would roll off in reasonable time as spamming became a less attractive marketing tactic.
How hard is "Did you send this? Reply if you sent it." ? Seems like the only variance would be whether you reply, or whether you click a special link. You don't have to be a rocket ship, you know.
I'd like to see how they do that. Short of logging into my hotmail and yahoo accounts and manually replying, they couldn't do it.
For all but the order confirmation and mailing list cases, challenge-response is quite workable. For the latter two cases, I recommend special email accounts. I create an email account for each mailing list I join, and I have another account I use when ordering products online.
.sigs are for post^Hers.
And I suppose spammers won't start parsing the disposable addresses?
"Last one in is a rotten goblin!" - Kepp
Back when I was in the Army I clearly remember learning the "Challenge" and "Response" system. "Halt, what's the password"? If you get the correct response, you let them in, if not, kill them.
Kind of seems like the same thing huh?
The opinions expressed here are not mine, but those of these dang voices in my head.
Innovation was starting to suck anyway.
because I have been enjoined by this Holy Office to abandon the false opinion which maintains that the Sun is the centre
Sadly the spammers already have prior art, and I wouldn't be surprised if they also have these patents hidden away somewhere.
Any UBE supression scheme which generates more mail messages is a perverse idea. After all, we all want receive less irrelevant mail, not more.
(This is basically a rehash of some other idea that's been around a while... I can't quite remember which one.)
John_Chalisque
Since a human being has to follow the simple instructions in the message, that is not a problem. You don't want something that is easily scripted anyway.
And how do you propose this will work with businesses that deal with hundreds or thousands of customers each day? You have to come up with some way to deal with that little problem.
That's a legitimate concern, but one which can be addressed by ISPs creating whitelists of trusted businesses. The businesses, in order to be able to continue getting legitimate e-mail through, will not spam and risk being removed from the list.
And if you have default whitelists, what's to prevent the spammers from forging a whitelisted sender? You could of course build into the new standard that all mail should be GPG/PGP signed, but that's a serious amount of overhead for an automated business server to handle.
I don't think call/response will fly as it's currently designed. I think a system where only servers with certificates are allowed to propagate mail would have a better chance of success.
If a server is found to be propagating spam, it can simply have its license centrally revoked.
You could make it into a system similar to DNS and only allow mail from registered and signed MXes through.
http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PT O2&Sect2=HITOFF&p=1&u=/netahtml/search-bool.html&r =4&f=G&l=50&co1=AND&d=ptxt&s1=5443036&OS=5443036&R S=5443036
T O2&Sect2=HITOFF&p=1&u=/netahtml/search-bool.html&r =1&f=G&l=50&co1=AND&d=ptxt&s1=5443036&OS=5443036&R S=5443036
http://patft.uspto.gov/netacgi/nph-Parser?Sect1=P
The CR patent reminded me of silly patents like this.
Enjoy
SPAM solution made easy: 1 spammer, 5 cords of rope, 5 hourses, and fireworks. Be creative.
Try to order something online, where your confirmation is mailed to you, or be a member of a list, and then get back to us on how well this works.
"Remember, the US is the land of the free, well free as long as you don't wanna be a communist or a list of other stuff."
These are the guys who think it was fine to execute 80,000,000 civilians during the 20th century, and to try to enslave the ones that are left. Good riddance.
"Their entire system is based on greed and the selfisness of becoming as rich as the next guy above you."
Working for what you get is not greed.
Quick - list all of the businesses that all earthlink subscribers will do business with this year. Don't miss any.
I can't. No one can. In the short-term, ISPs will need to create lists with the big guys (amazon.com, walmart.com, ebay.com, etc.). As smaller businesses note that automated e-mail is being rejected, they will have to contact the ISPs to get on the whitelist.
It would be market-driven. ISPs that use challenge-response systems will have to develop good whitelists or customers will leave for ISPs that have better ones. Businesses will not want it to be difficult to communicate with customers and will actively try to get the ISPs to whitelist them.
I expect that companies like TRUSTe will eventually start handling the process of maintaining trusted business lists and the ISPs will use their services.
I have no doubt that, in the short run, there will be some problems. In the bigger scheme of things, I think that these problems will work themselves out.
You are forgetting that spam is quickly becoming the MAJORITY of email being transferred. As you said, 1 challenge/response mail is being sent for every spam received. Challenge/response DOUBLES the number of spam, and since most spam isn't too big it's not impossible that challenge/response would double the VOLUME of traffic attributable to spam.
Whether the Internet can *handle* it isn't the issue. The issue is that you are INCREASING useless traffic instead of reducing it and I don't see where that helps anyone, and certainly not ISPs or backbone providers.
The only really big problem I can see is what happens if someone sends out spam with your email address.
So this great challenge-response solution essentially doubles spam traffic (by generating 1 useless C/R request for each spam received) and has the potential for creating a new way to DDoS an email user.
Sorry, but C/R is really obsolete technology.
Seriously, My company (atqui.com) filed a patent some time ago on challenge/response as a defensive measure. The application was pulled due to a wealth of prior art that we came across. If anyone is looking for information concerning this, let me know and I'll see what I can provide.
No... It's obvious that the spammers are winning because... they have big penisses. We can't do anything because of our tiny little penisses. Spammers have huge, gargantuan penisses. That's why they're winning (Apologies to South Park...)
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I can't. No one can.
:o)
That was pretty much my point.
As smaller businesses note that automated e-mail is being rejected, they will have to contact the ISPs to get on the whitelist.
Or: the customer gets pissed off at the ISP for blocking their email confirmations.
Or: the company doing the emailing sues the ISP for interfering with their business... hmm, maybe you covered that with this:
Businesses will not want it to be difficult to communicate with customers and will actively try to get the ISPs to whitelist them.
Want to see something really ridiculous?? Regardless of what challenge system is used it's hard to get around this one... 6,421,709 "A system and method of filtering junk e-mails. A user is provided with or compiles a list of e-mail addresses or character strings which a user would not wish to receive to produce a first filter. A second filter is provided including names and character strings which the user wishes to receive. Any e-mail addresses or strings contained in the first filter will be automatically eliminated from the user's system"
I wonder what i could patent. "A motorized vehicle designed to carry passangers or cargo" I'll sue the hell out of Ford for violating my patent.
True, patent law makes no explicit distinction about independent invention, but I can see independent invention being used as evidence that the invention was obvious. The USPTO isn't supposed to grant patents on obvious inventions, but...
Will I retire or break 10K?
Seems strange that you can sue someone over blocking spam. If Earthlink is protecting their customers, where does Mailblock even have the right to sue? Is it Mailblock that is spamming people and then forcing them into a corner to use their software to stop it? The conspiracy has just begun ... but the truth is out there. Or maybe not.
Paidstamp Source code has been placed on our GotDotNet Workspace
We do have a wish list for this to be developed and free, in other languages, and have the ui be simpler for first time users. See flowchart if interested in doing it for other languages as it has the basic flow of our initial project.
Hopefully you Open Source community can develop this, before someone else tries to take the idea over and Market it as theirs. Although by me putting this out, I think we have some documentation on prior art.
Anthony Loera
Brainclone Enterprises
No, increased load. Instead of dealing with one spam, you receive the spam, send out a useless C/R email (creating load on a third server), and then get a bounce back again requiring time to deal with on your mail server.
The spam is discarded, saving space on the server.
Disk space is cheap compared to bandwidth and CPU load dealing with all of it.
Spammers, recognizing the futility of sending spam to challenge-response mail servers, will stop spamming that domain.
Either that or a spammer will set up an account at Yahoo, send an email to the targetted user, will receive the challenge, will respond, and then will spam the target using that "From" address--and maybe even pass the "unlocked" Yahoo address to other spams who will send in a ton of spam taking advantage of the fact that it is currently open. The target eventually logs in, downloads a ton of spam and nukes the newly-unlocked Yahoo address... but the spam still made it through.
Or, another possibility... Spammers may deduce commonly unlocked email addresses. Perhaps a full 1% of users have unlocked "Support@microsoft.com" and another 1% have unlocked "list@bigmailist.com." So instead of dealing with the challenge response, spammers will just send the same email to each user with a hundred different "commonly unlocked" email addresses. So you'll get spam with forged email addresses that are often unlocked, and instead of a spammer sending the user the email once he will attempt to send it 100 times.
This second approach is what I think the spammers' response to challenge/response would be. They'd make a good guess at the most commonly whitelisted addresses and just send email to the user from all those addresses in the hope that at least one gets through.
So much worse than doubling spam (by sending a C/R response for each spam), you may have increased it by an order of magnitude by giving spammers an incentive to send the same spam multiple times from different forged addresses hoping that at least one is unlocked...
C/R is an unworkable solution to spam.
I saw an iteresting system, I forgot where though. For registration for an account, there was an image that had text in it, but was ofset, crooked, and had crooked lines through it (IE hard for a machine to OCR the image). The registrant was asked to type in what they saw to register. Simple enough for most people that do have a graphical browser. It doesn't have to be in the email as an image, but in a link somewhere else.
> > challenge-reply is a VERY half-baked idea.
>
> How so? It seems like a great solution to me.
1. You use a challenge-resonse system.
2. I use a challenge-resonse system.
3. You post a message in usenet.
4. I reply (privately) to your posting.
5. Your challenge-response system challenges me.
6. My challenge-response system challenges yours.
7. Your challenge-response system challenges mine.
8. My challenge-response system challenges yours.
9. Your challenge-response system detects a loop and discards
further messages from me without notice.
Marc
http://about.mailblocks.com/challenge.html
...
Those pictures look AWFully like the subway posters advertising Lavalife.com
muhahahah Pit copyrights against patents!!
Mailblocks, Inc. is a new class of Web-based email service for consumers founded in July 2002 by Phil Goldman, a former Microsoft vice president and a founder of WebTV.
That "technology" is a couple of decades old--people used to use awk scripts to do that kind of mail processing. Well, what can you expect from a former Microsoft VP.
Let's hope Earthlink does their background research rather than rolling over for such a ridiculous patent.
Some points.
1) They have a right to try to make money but there is so much prior art in this, it is obvious this lawsuit is designed to delay the inevitable. They are killing good will
2) Somehow I don't see much difference in this lawsuit and lawsuits where spammers try to block their business to protect their own business.
3) I love your product, you are cutting edge and are a showcase for completely blocking spam and you are convenient and worth the $11 a month in my book, but if you piss me off as a customer, I will move to TMDA and never evangelize your product again.
-Nuke the moon
The passwoid is "Ken Sent Me".
Do daemons dream of electric sleep()?
And how do you propose this will work with businesses that deal with hundreds or thousands of customers each day? You have to come up with some way to deal with that little problem.
They call the ISPs and get put on the whitelists. No more challenges.
And if you have default whitelists, what's to prevent the spammers from forging a whitelisted sender?
The whitelist could be IP address list based (e.g., amazon's IP range would be whitelisted rather than Amazon's domain name). Also, the threat of tangling with, say, Amazon.com's attorney's would make most spammers hesitate to forge "customerservice@amazon.com".
I think a system where only servers with certificates are allowed to propagate mail would have a better chance of success.
And then Verisign could charge between $350 and $800 per year for a certificate -- like they do for SSL web server certificates now. Microsoft and Netscape would include only certificate authorities that paid them enough money to be included as "trusted." And mail servers run by individuals, small non-profits, and even some small businesses would disappear.
Who would police the list? Who would be authorized to revoke certificates? How would you handle it when someone forged spam in an effort to get the certificate pulled? How would you handle it when some small group in Ghana wanted to run a mail server? Who would vouch for them and say that the mail from there should be trusted? What happens when the small server in Ghana happens to be something that Ralsky set up, knowing that he could spam for days before being investigated by the certificate authority?
I hope that we never see an all-controlling entity that, in essence, "licenses" mail servers, presumably for a fee. That's way too much power to put in the hands of any organization.
Spamgourmet kind of allows such an idea, by allowing a section of the false e-mail address to be anything, like
name.anythinggoeshere.number@spamgourmet.com
In the case you describe, multiple bypass codes could be used, and whichever one is misused has a good idea of who gave it away.
The same idea I have seen used with normal mail, by either adding a dept or a C/O.
They could just make their spam look more like mailing list messages.
Spammers already disguise their spew as newsletters.
Hotmail solves the problem of discussion lists by letting users whitelist specific addresses as mailing lists, and then (I'd assume) it tweaks the spam filter in response. For instance, it has probably already whitelisted the IP addresses of sourceforge.net, yahoogroups.com, and other popular discussion list service providers.
Will I retire or break 10K?
The company is no longer around (but I'm sure someone still owns the patent), but NetExchange used to do this in the 1997-1998 timeframe. If I recall correctly, they even held a patent (or maybe a patent pending) on the concept. So there is definitely prior art here.
businesses won't be able to send legitimate automated email(shipping notifications, confirmations, etc.) because everyone will be using different challenge-response systems. You think the average earthlink user is going to be smart enough to even REALIZE they need to whitelist a business, much less what address?
There's no need to whiltelist whole domains, etc. The Mailblocks (and Earthlink) impelementation allows you to create alias addresses to give out. You can give them to companies and e-mail coming to those aliases will bypass your whitelist. If you see an alias is being abused or distributed it's a very simple matter to remove it and you'll never see spam coming from them again. They also suggest them for 1 shot e-mails where you need to provide an e-mail to receive registration info, but don't want future e-mail from them.
You get the convenience to receive all your e-mail in one box without the risk of giving out that e-mail address to unkown / untrusted parties. And the ability to cut them off if they get out of hand. Seems like a great idea to me. I hate checking 3 separate e-mail accounts because I don't want to give out my personal address to corporations who might just decided to change their privacy policy and opt you into a bunch of things you don't want without your consent. (a la Yahoo!)
Or: the customer gets pissed off at the ISP for blocking their email confirmations.
-- and the customer leaves, going to an ISP that has a better, more comprehensive whitelist. This will encourage ISPs to actively try to keep their whitelists up to date and comprehensive.
Or: the company doing the emailing sues the ISP for interfering with their business.
On what grounds? Your ISP has no contractual obligation to to some business trying to send you something. They can accept or reject any e-mail that they choose. They could reject all e-mail from SCO just because they are pissed off about the recent lawsuits. They could reject all email from the RIAA because I don't like their lobbying efforts. Unless the RIAA and SCO had contracts with your ISP guaranteeing delivery of their e-mail, your ISP is within their legal rights.
Spamming is, unfortunately, not illegal. Would you feel that a spammer had grounds to sue an ISP that didn't deliver penis enlargement ads sent by the spammer? That's "interfering with their business", disreputable though that business may be.
All valid points, but the thing is that this would only involve the servers themselves. In essence, it could be tied to the DNS system, so that only MXes are allowed to propagate mail with reverse checking to prevent spoofing.
The signing would be part of the domain registration process, providing the registree with a license to propagate mail with their server. If found guilty of spamming, that license could be revoked.
This would of course require fundamental changes in the way the internet is built, but if spam is such an enormous problem (personally I get one or two spams per month without filtering), then maybe it's time for extreme measures?
I suggest searching for "spam" on the USPTO site under current patents. It is depressing. Every conceivable 10 line Perl or awk hack that people have been using for filtering spam has more or less recently been patented.
For example, patent no 6,167,435, applied for in 1998, patents E-mail verification for mailing list subscriptions. I couldn't find the Mailblocks, which would at least have to reference 6,167,435 as prior art, which leads me to believe that it hasn't been published yet. Patent attorneys may be stupid or brazen enough to ignore decades of actual practice, but they wouldn't ignore another patent.
Mailblocks itself is an anachronism--a bubble-era startup with no realistic business proposition, financed, in this case, by the winnings from the founder's previous dotcom. Most likely, Microsoft will buy them out to own the technology for Hotmail. If not, they will keep suing people until somebody does buy them.
While tons of us know of prior art on things like this, I've seen (to my surprise) some patents dating back 10-15 years. Things I think that are obviouos ideas -- well someone else thought of it 15 years ago. I didn't read through every word of the articles, but just because the company is new doesn't mean they didn't buy the patent from someone who filed it ages ago.
The interesting question comes up is how this relatest to SBC's phone number blocking technology, distinctive ring technology and additional password technology (or going through 'voice mail') to reach the recipients voice mail box.
I.e. -- How about a voicemail type maze for emailers -- please return your message with option #1 selected if you want more info on my mental condition,
please select option #2 if you want the P.O. Box to send free money to, please select option #3 to leave a message for my dog or select option #4 to route your message to me.
Now you have an automated email-response exactly like many voice mail systems (well, many voice mail systems are worse). But wasn't there a ruling that simpoly taking a real-world process and using it on the computer wasn't sufficiently unique to qualify for a patent?
We've got to contact our congress critters and let them know that software patents are just plain 99% abused.
Sigh...
-l
I'm sure others out there have prior art to present in this - particularly TMDA.
My own anti-spam system, which will be launched very soon (sorry no link, my dev server couldn't survive a slashdotting), also uses challenge-response. The predecessor of this also used challenge-response, and has been in use for around three years, "publicly" at least in the sense of the many thousands of people and spammers who interacted with it.
Any suggestions how I ought to present this to the patent and/or lawsuit people? Sure it would be helping a competitor, but I feel it's the right thing to do.
This Like That - fun with words!
Sounds like everyone has written something like this at sometime. I've been using MapSoN ( http://mapson.sf.net ) along with Spamassasin for quite some time. MapSoN is a basic challange/response type of system. It's not 100% perfect, but then thats where SpamAssassin steps in.
I'm collecting prior-art for this.
.sig
If anyone has anything they think is relevant, please email a copy to prior-art@spamwolf.com
The relevant stuff (what I consider relevant) is being posted at http://www.spamwolf.com/patents/
The best candidate so far (IMO) is this post to news.admin.net-abuse.usenet on 1996-11-17.
I'd really like something prior to 1996-08-26 though.
I'm looking for anything prior to 1997-08-26 that;
compares the sender's address to a list of accepted senders; (friends list)
-and-
sends a challenge if the sender's address is not contained in the list
-and-
the challenge is designed to be answered by a person and not a machine.
-- this is not a
I don't think you're all that paranoid. Exactly the same notion came to my mind when I read the intro.
And this raises all sorts of interesting questions.
This would seem to be legal - has something like this been done before (that is patenting something to prevent someone else from using it) ?
Could such a patent be used with a GPL like (or even more inclusive) license? That is, you can't use the technology covered by this patent in a product unless you release any other technology you use in that product under a similar license?
Could the FSF use this kind of manoeuvre effectively?
How about using a patent as a punitive device? Perhaps by licensing a patent cheaply to a competetitor of a competitor.
Grr.....
Sure, let's just forget about advancing the human condition by experimenting.
All ideas are half-baked at some time in their developement.
While I agree with Sturgeon's second law,
I think I'll wait until after Earthlink's actually deployed something before deciding if it's 10% or 90%.
-- this is not a
No, increased load. Instead of dealing with one spam, you receive the spam, send out a useless C/R email (creating load on a third server), and then get a bounce back again requiring time to deal with on your mail server.
.01% sales rate, he won't be making it at .001%
Then you delete all 142,675 copies of the spam, keeping it from being downloaded 142,675 times by your customers. Then spam decreases by 99.9% because spammers know that their messages don't get through. Use some foresight, man! Don't just look at the first 50 transactions. Consider the implications down the road. If spammers know that their messages will be blocked because of challenge/response mechanisms, then they will stop spamming that ISP.
Disk space is cheap compared to bandwidth and CPU load dealing with all of it.
There's a bandwidth and CPU cost for spam that is received. There's cost when it is received. There's cost when the customers retrieve it. There's cost when the e-mail clients retrieve images from the spammers' servers. ISPs like Earthlink recognize that keeping spam out of customers' mailboxes helps them attract more customers, keep the customers they have, and decreases their costs long-term due to the projected reduction in spam.
Either that or a spammer will set up an account at Yahoo, send an email to the targetted user, will receive the challenge, will respond, and then will spam the target using that "From" address--and maybe even pass the "unlocked" Yahoo address to other spams who will send in a ton of spam taking advantage of the fact that it is currently open. The target eventually logs in, downloads a ton of spam and nukes the newly-unlocked Yahoo address... but the spam still made it through.
Or, another possibility... Spammers may deduce commonly unlocked email addresses. Perhaps a full 1% of users have unlocked "Support@microsoft.com" and another 1% have unlocked "list@bigmailist.com." So instead of dealing with the challenge response, spammers will just send the same email to each user with a hundred different "commonly unlocked" email addresses. So you'll get spam with forged email addresses that are often unlocked, and instead of a spammer sending the user the email once he will attempt to send it 100 times.
I run the domain anti-spam.org. I understand how spammers work. I know that spam would be economically infeasible with either of the methods you describe above.
You ignore the fact that the receiving server could easily determine, by IP address, that the mail purporting to come from "support@microsoft.com" or "enlarge_your_penis@yahoo.com" was, instead, coming from an open relay in China. Drop that connection and the problem is gone.
So much worse than doubling spam (by sending a C/R response for each spam), you may have increased it by an order of magnitude by giving spammers an incentive to send the same spam multiple times from different forged addresses hoping that at least one is unlocked...
If you sharply increase the number of times that a spammer has to try to get a message through, you make spam unprofitable. While he may be making money with a
C/R is an unworkable solution to spam.
You are incorrect. It is, in fact, an elegant solution that does not require legislation or a fundamental change to the e-mail infrastructure of the Internet.
In essence, it could be tied to the DNS system, so that only MXes are allowed to propagate mail with reverse checking to prevent spoofing.
Many large organizations use different servers for sending e-mail than receiving it. The SMTP servers that send e-mail for an ISP may not be listed on the MX records at all because they don't handle incoming e-mail for the domain.
If found guilty of spamming, that license could be revoked.
By whom? What worldwide authority would you trust to pass judgement on whether a domain was spamming? Would you trust the registrars?
This would of course require fundamental changes in the way the internet is built
But challenge/response does not require those changes and I expect that it will be very successful. I was advocating it years before the company that's claiming patent rights on it ever existed.
I shure hope this isn't a spoiler, because I haven't seen the movie yet. :\
/. account filter prefs.
Perhaps it is an idea to add a spoilerwarning checkbox and/or dropdown menu of the latest movies to the Post Comment page or moderation system.
And the same to the users
Or is that also a patented filtering technology, perhaps?
Eventually some partially computer literate friend or family memeber will submit your spam free e-mail address to a web site.
My own dear sister just sent me an e-post card for my birthday. You know, the kind where you get an e-mail saying click here for your card.
Anybody got a good procmail Bayesian filter recipe?
Wrong. You should have said:
1. You use a challenge-resonse system.
2. I use a challenge-resonse system.
3. You post a message in usenet.
4. I reply (privately) to your posting.
5. Your challenge-response system challenges me.
6. My challenge-response system let's the challenge through, since sending someone email automatically adds them to your whitelist.
Life is too short to proofread.
Many large organizations use different servers for sending e-mail than receiving it. The SMTP servers that send e-mail for an ISP may not be listed on the MX records at all because they don't handle incoming e-mail for the domain.
Valid point. Basically I'm just mindstorming here, so I like the bubblepopping.
By whom? What worldwide authority would you trust to pass judgement on whether a domain was spamming? Would you trust the registrars?
Enough to give them money for my domains.
But challenge/response does not require those changes and I expect that it will be very successful. I was advocating it years before the company that's claiming patent rights on it ever existed.
And how would automated servers handle the sender verification without being bogged down? Or should my mother have to remember to whitelist companies she deals with before any server generated mail is sent?
vacation(1), Lotus Notes, Exchange, autoresponders, new mail sent to C/R system from someone that goes on vacation and the challenge gets delayed.
I leave you to figure out the implications of infinite loops.
I can throw myself at the ground, and miss.
- MailBlocks is owned by Phil Goldman, the WebTV millionaire .com millionaire, and former employee of Apple, Generial Magic, and knows what patents are worth, so he did a patent search
6 5843.htm
- Phil Goldman is skilled in the art of computing, and so he _obvious_ly thought of using a Challenge/Response system for stopping Spam.
- He's a
- Found patent 6,199,102 (Granted March 2001), and bought it from Christopher Alan Cobb
- Found patent 6,112,227 (Granted August 2000), and bought the owner, Jeffrey Nelson Heiner, who signed over all rights
- Patents are "one of the largest expenses that we (at Mailblocks) have."
- MailBlocks has also sued Spam Arrest (case pending in WA), DigiPortal, and MailFrontier (resolutions unknown)
- MailBlocks actually started suing before releasing a product of their own.
- Goldman regularly responds to penis enlargement spams with his credit card number and a request to have them delivered in a plain brown paper wrapper
- So far, none of them have worked (somebody should tell him creation != enlargement)
Here is an interesting article: http://www.siliconvalley.com/mld/siliconvalley/55
Do daemons dream of electric sleep()?
vigorously enforce our rights to the fullest extent permitted by law
/. IANAL speak. What a boob.
Enforce our rights? The whole thing sounds like
Never underestimate the power of fiber.
You are forgetting that spam is quickly becoming the MAJORITY of email being transferred. As you said, 1 challenge/response mail is being sent for every spam received. Challenge/response DOUBLES the number of spam, and since most spam isn't too big it's not impossible that challenge/response would double the VOLUME of traffic attributable to spam.
The thing is, each of those response messages can have an easily identifible tag in them. This allows and ISP to see that 500 challenges have to been sent to "foo@bar.com". This can automatically set off at ISP-level block of messages from "foo@bar.com" originating from host W.X.Y.Z, since they are obviously sending bulk UCE.
Also "obsolete" is not a proper term to use, at least not with the argument you're making.
Life is too short to proofread.
This is really sad, I can't find any info on Mailbock's patents in any of the articles.
They are;
US 6,199,102 (the Cobb patent) Filed: 1997-08-26
and
US 6,112,227 (the Heiner patent) Filed: 1998-08-06
That the USPTO will grant a patent for ANY idea that exists and has existed for DECADES if you just add "on the internet" to it?
Go figure...
Corporatism != Free Market
You: Then you delete all 142,675 copies of the spam, keeping it from being downloaded 142,675 times by your customers.
That's not a challenge/response system. You're talking about a networked solution to spam where spam identified by one user is used to identify other people's spam. That's fine, but the same system can be implemented with Bayesian or pure filters without having to resort to generating C/R traffic for each spam.
Then spam decreases by 99.9% because spammers know that their messages don't get through... If spammers know that their messages will be blocked because of challenge/response mechanisms, then they will stop spamming that ISP.
On what do you base that assumption? History has shown us that every time we make it harder for spammers to get their garbage to us they respond by mangling their spam, getting around the solution, and sending MORE spam, not by reducing it.
ISPs like Earthlink recognize that keeping spam out of customers' mailboxes helps them attract more customers
Yes, but C/R is not the best way to keep spam out of customers' mailboxes for reasons that I and others have already explained here.
I run the domain anti-spam.org.
Oohh, I didn't realize I was dealing with royalty. Let me cower in my lack of knowledge because I am a commoner that doesn't run anti-spam.org. :)
I know that spam would be economically infeasible with either of the methods you describe above.
You underestimate labor costs for the first one when using teen-labor and/or folks in 3rd-world countries, and I don't understand why you think the second one would be too expensive for a spammer. If they can send a million spam they can send 100 million spam to brute-force their way through commonly-unblocked email addresses.
You ignore the fact that the receiving server could easily determine, by IP address, that the mail purporting to come from "support@microsoft.com" or "enlarge_your_penis@yahoo.com" was, instead, coming from an open relay in China. Drop that connection and the problem is gone.
You ignore the fact that that's NOT challenge/response and not what we're talking about and that same solution (which is not a bad one!) could be applied to Bayesian or traditional filters without the hassle of challenge/response and without generating MORE mail traffic (from C/R requests) in the process.
If you sharply increase the number of times that a spammer has to try to get a message through, you make spam unprofitable. While he may be making money with a .01% sales rate, he won't be making it at .001%
You seem to assume that it costs 100 times more to send 100 million emails than it does to send 1 million. I don't believe that is the case. In fact I KNOW it's not the case.
It is, in fact, an elegant solution that does not require legislation or a fundamental change to the e-mail infrastructure of the Internet.
As is Bayesian which doesn't require legislation or a fundamental change to the e-mail structure of the Internet, and which DOESN'T worsen bandwidth problems by sending out C/R requests to each spam received, and to which your other anti-spam techniques (networked deleting of identified spam and checking IP address to see if the mail is from who it supposedly is from) can also be applied.
mailblocks advertising the mailblocks service (commerical) in *every* CHALLENGE request it sends merely CAUSES MORE SPAM!
This is exactly why I didn't implement a service such as this many years ago when I came up with the idea. It adds to the problem, not fixes it.
The filing date of the Cobb Patent (US6,199,102) is 1997-08-26.
(You can find a PDF of it
at this site.)
If you *published* prior art before that date,
do let the world know! Let us know where
and when it was published, how it can
be cited, where it can be found.
This is important -- but don't just say
"I did it too" -- give us something that can help
fight it!
I really can't wait till the various "commons" that our society houses collapse on themselves. The IP commons is one of the ones that I think will be first to go....unless the corporate bank accounts and lawyers can somehow manage to delay it ad infinitum. Another contender for First Commons to Collapse is the entertainment industry....lets see if you can figure out why.
Buy Steampunk Clothing Online!
The load increase is manageable. Challenge response would only need to happen a small percentage of the time for valid email. For spam, yes up to 1 email would be sent per spam recieved. I think the internet can handle that. It's not like there are going to be large attachments or anything.
Try a near-doubling of mail load. No, check that, more than doubling, in our case.
Today alone, ONE SPAMMER has added over 200 new fake return addresses and over 180 new proxies to our internal lists. With a challenge/response system, our server would have had to accept all those spam attempts (whatever their size), then generate a challenge to the invalid address, then process the bounce messages from YAHOO, AOL, and HOTMAIL for all the invalid addresses.
Assuming a spam of 10K length, over the time period the "attack" ran, that's the major portion of our T1 bandwidth... As it was, the load was only a few percentage points, because we blocked them via other means.
Challenge/response sounds great, but the spammers have already made it a pending nightmare.
- If the server is smart, it will automatically discard all bulk e-mail purporting to be from that address.
This sounds like a risk for a denial of service attack. Spammer's already forge headers... The poor person who happened to have his email address forged might not only get deluded by tons of challenges... but would have to answer a lot of the challenges just to prevent their address from being black listed. Furthermore I imagine a responible time period would have to be selected before blacklisting... else you would block legitimate senders that didn't answer the challenge immediately. (Say they sent the email and then shutoff their computer for the night, etc...)That's not a challenge/response system. You're talking about a networked solution to spam where spam identified by one user is used to identify other people's spam. That's fine, but the same system can be implemented with Bayesian or pure filters without having to resort to generating C/R traffic for each spam.
;-)
:)=
;-)
Yes, it is C/R. A challenge is issued. The challenge bounces. All e-mail from that sender is deleted. (Maybe you would issue the challenge twice spaced 30 minutes apart in case technical problems that caused the first bounce.) There is nothing stopping the ISP from issuing only a single challenge when one sender delivers mail for hundreds, thousands, or more recipients. A single response could cause all of the mail to be delivered.
On what do you base that assumption?
Economics and need for a valid return address -- the latter of which you will not find on 99.99% of spam.
History has shown us that every time we make it harder for spammers to get their garbage to us they respond by mangling their spam, getting around the solution, and sending MORE spam, not by reducing it.
But what happens when you go from "harder" to basically impossible, which is what C/R does? There has always been fairly simple ways around the earlier forms of spam filtering. C/R has no simple, low-labor, low-bandwidth, low-exposure means to circumvent it.
Yes, but C/R is not the best way to keep spam out of customers' mailboxes for reasons that I and others have already explained here.
So you know more than all of the people at Earthlink who have investigated this problem? You know more than people at MailBlocks? I could believe that, but you couldn't know more than me.
Oohh, I didn't realize I was dealing with royalty. Let me cower in my lack of knowledge because I am a commoner that doesn't run anti-spam.org.
I was only trying to show you that I am someone who has done a lot of investigation into this problem. You may rise.
You underestimate labor costs for the first one when using teen-labor and/or folks in 3rd-world countries
Any time that there is significant labor, no matter how cheap, it slows things down and the spammer is unlikely to be able to spam profitably -- even if he has a whole shop full of people in India creating Yahoo! accounts.
If they can send a million spam they can send 100 million spam to brute-force their way through commonly-unblocked email addresses.
Again, it's pretty easy to tell that "support@microsoft.com" is not going to be sending e-mail through the net.edu.cn domain, so that e-mail could be dropped without ever issuing a challenge.
Bandwidth is both time and money to spammers. Many of them have systems running 24/7 using all of their available bandwidth. While they may be able to cover the costs of their T1 bandwidth to send spam now, they won't cover the costs of the OC3 that they would need to handle the additional volume.
You seem to assume that it costs 100 times more to send 100 million emails than it does to send 1 million. I don't believe that is the case. In fact I KNOW it's not the case.
I agree. And whether it costs five times, ten time, or 50 times as much makes little difference. If the spammer is not rolling in dough now, he will be behind the curve when the costs go up substantially.
As is Bayesian which doesn't require legislation or a fundamental change to the e-mail structure of the Internet
But that costs CPU cycles and is less effective than C/R.
tone
tone
the STATE sues EarthLink !
Enough to give them money for my domains.
;-)
It's one thing to trust them to do data entry. It's another thing entirely to trust them as judge, jury, and executioner for spam violations. GoDaddy is not going to charge $7 a year for domain registration and then launch a multi-day inquiry to determine if you really spammed or if the people claiming you did are just out to get you.
And how would automated servers handle the sender verification without being bogged down? Or should my mother have to remember to whitelist companies she deals with before any server generated mail is sent?
I don't believe that Amazon.com would get 211,376 challenges just because they sent 211,376 e-mails to customers at your ISP. I think that the ISP would issue one challenge. It would be read by the customer service people at Amazon. They would respond. All automated e-mail from Amazon would then be delivered without further challenges. I also believe that ISPs will develop whitelists of trusted senders and that the quality of these lists will be instrumental in keeping customers satisfied.
I really do think that C/R can work and I really want to see if Earthlink can do it right. If they do, I think that the spam problem will start to go away. Other ISPs like Yahoo!, MSN, AOL, etc. will implement it and that will be the end.
Another advantage will be that most AOL users will be completely confused by the challenges sent to them and they will stop sending e-mails to the rest of us.
how does a challenge/response system solve anything? a spambot can answer the challenge just the same as a human would
bite my glorious golden ass.
vacation(1), Lotus Notes, Exchange, autoresponders, new mail sent to C/R system from someone that goes on vacation and the challenge gets delayed.
I leave you to figure out the implications of infinite loops.
Improper responses to the challenge address (e.g. challenge_response@yourISP.com) would be scrapped.
Bob sends e-mail to Tom before going on vacation.
Tom's ISP sends a challenge.
Bob's autoresponder sends an out-of-the-office e-mail.
It's not a proper response, so it is discarded.
No challenge would be issued. No infinite loop.
This sounds like a risk for a denial of service attack. Spammer's already forge headers... The poor person who happened to have his email address forged might not only get deluded by tons of challenges...
;-)
I think that you meant "deluged."
but would have to answer a lot of the challenges just to prevent their address from being black listed.
Good point. But only a bounce would automatically blacklist the user. If he did not answer the challenges and later sent messages, he would be challenged again and could respond appropriately.
Furthermore I imagine a responible time period would have to be selected before blacklisting... else you would block legitimate senders that didn't answer the challenge immediately.
I would not blacklist a user for not responding. I'd hold their e-mail for a week or two and then discard it if no response was received. If they later sent mail to my servers, the servers would again challenge them and if they responded, deliver their message.
I would also have the blacklists expire. If you are blacklisted, you would only remain so for maybe a week to thirty days. If you sent again, you'd get another shot at responding. You don't want a situation where a spammer forges bobsmith2004@yahoo.com, gets it blacklisted, and Bob Smith, who signs up next year, finds himself with an address from which no one will accept e-mail.
Right-o, because belief in the invisible man upstairs and everywhere is going to bring us into a new golden age. Exactly what knowledge does atheism suppress? It doesn't mean you can't read the bible.
Feh indeed.
Black holes are where the Matrix raised SIGFPE
There is no patent. And if there is they are probably going to loose. All they wanted is people to click into their website. And they succeeded greatly. I wish I were them Yigal Irani
I agree that if you implement C/R and the response bounces that you could choose to assume that all the emails from that address should be deleted. But in and of itself C/R is the challenge and the response. What you do with an email deemed to be spam is separate and can be applied to any anti-spam technique, not just C/R. Perhaps when I get a spam that has a 100% Bayesian score I go out and kill all the other "same messages" for everybody else... Does that make the "go out and kill all the same messages for everybody else" part of the Bayesian technique? No, not any more than it's part of the C/R technique. It's just a question of what you do after you've decided you've identified spam.
There is nothing stopping the ISP from issuing only a single challenge when one sender delivers mail for hundreds, thousands, or more recipients. A single response could cause all of the mail to be delivered.
What? Are you suggesting that when one sender (spammer) delivers mail for hundreds or thousands of recipients instead of issuing hundreds or thousands of C/Rs you issue only a few, and if a few are responded to you let the mail through to all hundred or thousand emails? Now THAT would definitely be vulnerable to spammers since they could just answer a few of the C/Rs and be happy knowing that was all it took to get their spam to the other hundreds or thousnads of emails.
Or perhaps I misunderstood you there...
Economics and need for a valid return address -- the latter of which you will not find on 99.99% of spam.
I'd submit the economics are not a problem since you can send more mail for little extra cost. As for a valid return address, it's not hard to open up some accounts at Yahoo that are valid and can receive replies. Sure, they'll get shut down sooner or later but you've already received and answered quite a few C/Rs before that happens--and even once the account is shut down you can send spam with that forged email address without Yahoo's help (unless you implement the other feature you were talking about regarding dumping email based on IP != professed sender's host). Even this feature is not necessarily workable because it IS possible (granted, not so common) that people use Yahoo via POP3 and send email with @yahoo.com addresses that don't necessarily go through Yahoo's outbound server.
There has always been fairly simple ways around the earlier forms of spam filtering. C/R has no simple, low-labor, low-bandwidth, low-exposure means to circumvent it.
If they go for the "send the email 100 times using 100 different commonly-unlocked email addresses" solution then it's still low-labor. Bandwidth has never seemed to be a problem for spammers, neither has level of exposure.
Plus, if they DO find a way around a given C/R system, they'll be able to spam all the people that are protected by that system. With Bayesian there's really no way to get around it since getting around a Bayesian filter requires knowing what the "innocent" words are for a given user, and they're just not going to know it. If they happen to guess a couple that doesn't automatically mean all the users using Bayesian are going to become victims as well.
Plus Bayesian is better in the sense that the spammer doesn't know what he's up against. With C/R, he knows that there is a challenge and he CAN deliver the spam if he wants to take the time. With Bayesian, he has to assume his message got through--there's no indication that it didn't. His response rate just drops through the floor and it's not going to be obvious why, or what the spammer has to do to get response rates back up.
So you know more than all of the people at Earthlink who have investigated this problem? You know more than people at MailBlocks?
I would hope that is not the case. But I've seen article after artcile in the mainstream press abou
This could be done without the hassle of C/R, though. If you see 500 messages coming from a certain IP address then you could just assume that it's all spam. This same technique can be applied to any anti-spam technique without having to implement the C/R portion.
Yes, there are ways to reduce the damage C/R can do and the volume of mail it creates. But, again, why do we need a solution that creates MORE mail and has to have special logic for damage control when that same logic would be applied just as well to other anti-spam techniques that don't require the generation of the C/R requests?
Also "obsolete" is not a proper term to use, at least not with the argument you're making.
When there are easier-to-use anti-spam techniques that achieve an extremely high level of success without adding any hassle to senders and without generating more email traffic in the process, yes, I think a system that requires a sender to go through hoops (even if only once) to get their message delivered and that has the potential of generating quite a bit more mail traffic is obsolete. It is obsolete in the sense that there are simpler, less bandwidth-intensive and more user-friendly ways to achieve the goal of keeping spam out of the inbox.
Mailblocks acquired two patents for challenge-response, which were granted in 2000 and 2001, respectively.
I've been a Spamcop member for at least three years now (oldest spamcop mail I have is Nov 1999). Spamcop has (did have?) a challenge response system back in the early days. Not sure if it's still available (I've set my filtering to always block a long time ago). But I'm sure that Spamcop's challenge response system predates Mailblock's.
-- Spammers: My E-mail server is in California. Consider yourself warned.
What? Are you suggesting that when one sender (spammer) delivers mail for hundreds or thousands of recipients instead of issuing hundreds or thousands of C/Rs you issue only a few, and if a few are responded to you let the mail through to all hundred or thousand emails? Now THAT would definitely be vulnerable to spammers since they could just answer a few of the C/Rs and be happy knowing that was all it took to get their spam to the other hundreds or thousnads of emails.
I really should have been more clear. I meant that they only need to send one challenge if it bounces. After that, the messages can all be considered trash.
I'd submit the economics are not a problem since you can send more mail for little extra cost.
That's something that needs to be quantified. Many spammers are saturating outbound connections already. I know it's not cheap for me to quadruple my bandwidth and I don't think it is for them, either.
I agree that's a good idea--but I again stress that that isn't in itself C/R. That same technique can be applied to any spam filtering technique to make it even better.
Within limits. You can't assume that the sender domain and the address domain will match (as you know) unless it is a major corporation like Microsoft, IBM, etc. That's where one needs some tuned whitelisting.
But from what I understand the bigtime spammers aren't right on the edge, they're buying big houses and earning more money than I am...
They may be getting more money than you or I, but they are not earning it.
Bayesian is extremely effective, doesn't cause a hassle for the sender, requires very little effort on the part of the receiver once it starts getting "tuned", doesn't generate a swarm of C/R requests, and doesn't announce to the spammer what kind of system is in place to block his spam...
But can it be implemented at the ISP level? Every implementation I have seen has been at the client level, partially because it needs to learn what you, personally, consider spam. I may have signed up for a get-out-of-debt list server that delivers messages that you would consider spam. If it's at the ISP level, the accuracy will probably be unacceptable.
If the user must abandon their current e-mail client in order to use Bayesian filtering, then it is not low-hassle. If the user has to install software to perform the Bayesian filtering, it's not low hassle. If the user has to train the Bayesian filtering, it's not low-hassle -- and you will find that most will not do it or understand why they should.
One big problem with Bayesian filtering is that the end-user has to download the entire message and then, and only then, determine if it is spam. Another problem is that spammers will be able to rely on less than 100% client-side participation. There will be a large subset of users who just accept all e-mail, many even welcoming the spam and clicking on the links. If it is blocked by C/R or some other means before getting to the user, the ISP saves bandwidth, CPU cycles, storage, and admin costs.
They patented the obvious ways to defeat their copy protection scheme, right?
I agree. But the point is that I think they have a profit margin high enough that they can take some pretty big hits and still be GETTING enough money to keep spamming.
Me: Bayesian is extremely effective
You: But can it be implemented at the ISP level? Every implementation I have seen has been at the client level, partially because it needs to learn what you, personally, consider spam. I may have signed up for a get-out-of-debt list server that delivers messages that you would consider spam. If it's at the ISP level, the accuracy will probably be unacceptable.
It absolutely can be done at the ISP level. That's where it SHOULD be done. But on a user basis.
Check out the site in my signature. It's a service, but it could just as easily be implemented on any given ISP. The Bayesian filtering takes place at the ISP level so the user doesn't even have to download the spam. Retained emails are visible on a website and if there's a false positive by all means tag it for downloading. If any spam gets through, there's a link in the headers you click on to report that message as spam so the ISP can update your Bayesian corpus.
Bayesian *should* take place at the ISP level, but it should be done on a user-by-user basis since that's the only way Bayesian can work.
If the user must abandon their current e-mail client in order to use Bayesian filtering then it is not low-hassle.
Not necessary. Again, see site below--you just point your POP3 client to the site. Or if the ISP implemented it you wouldn't even have to point your client to another server at all.
If the user has to install software to perform the Bayesian filtering, it's not low hassle.
Again, see site below. Just point your POP3 client at the site and you're done. Nothing to install.
If the user has to train the Bayesian filtering, it's not low-hassle -- and you will find that most will not do it or understand why they should.
This is the one weakness to Bayesian, and I see three solutions that would be great to see implemented: 1) Site below also has traditional filters which will catch 85-90% of spam. With normal filters enabled the Bayesian filter will largely train itself. 2) While a users' Bayesian corpus is small, a generic could be used which represents the best and worst of email. This could help suplement the traditional filters until the user's personal Bayesian corpus grows. 3) There should be an RFC for reporting spam to any given server, defaulting to the POP3 server. It could be as simple as opening the connection, giving a username, password, and message ID#. But there should be a standard way for all email clients to report spam to whatever spam-filtering service or procedure is being utilized.
The training of a Bayesian filter is the ONLY downside, but it only lasts for a little while. I have largely trained my Bayesian filter and even though I've received nearly a thousand spam in the last week, not a single one has gotten by--and no false positives. So an ounce of effort at the beginning with Bayesian can pretty much eliminate the spam problem for any given user.
One big problem with Bayesian filtering is that the end-user has to download the entire message and then, and only then, determine if it is spam.
Again, see below. The site below does the filtering and only good email is downloaded to the client. If an ISP implements it, that's how it should be implemented as well. If a user has to waste time downloading it before any given filter works then the solution is largely useless.
Another problem is that spammers will be able to rely on less than 100% client-side participation.
I doubt *any* given spam solution is going to achieve 100% client-side participation. In fact, to tell you the truth, I'd just assume that everyone NOT use Bayesian. While Bayesian filters remain in t
Kinda like US gun-control ain't it? The government is saying "You have no right to protect yourself from violent crimes, because we don't trust you with guns."Even people who shoot in self-defense tend to be brought up on all sorts of charges that you wouldn't get stuck with if it was your intent to go commit a crime the whole time (way to go Legal System, reward them criminals!).
As a side note, something has been rotten in the sate of our legal system for a very long time now...- I love animals. I try to eat at least one a day.
Try putting in the ASCII equivalent to the plus sign preceded by a percent sign. I only have the space character memorized, so I will use it as an example.
draino%20something1234@mailblocks.com
I can't afford a sig!
And then all the spammers have to do is send mail with headers forged to make it look like it came from "the big guys". They're already doing this, actually.
The whitelist could be IP address list based (e.g., amazon's IP range would be whitelisted rather than Amazon's domain name). Also, the threat of tangling with, say, Amazon.com's attorney's would make most spammers hesitate to forge "customerservice@amazon.com".
IP address based just means they'll forge the headers to show the IP address. Unless you mean you're going to configure your MX to only accept mail from the IPs on your whitelist, which would turn into a supreme pain in the ass.
As for "amazon.com's attorney"... er, something makes me wonder how much you've actually dealt with fighting spam. They've been forging those kinds of headers for years. They couldn't care less (spammers or amazon).
The most important problem with whitelist systems is that the whitelists themselves become a commodity. People who are now selling their internal distribution lists on the sly will start selling their company whitelists as well. Have a business partner you *always* accept mail from? Expect more and more of your spam to look like it's coming from that domain. Spammers are already doing it. On the individual level they're crawling for "good" mail routes into given mail boxes along with the mail addresses for those boxes; e.g., if they find foo@bar.com in a mailing list archive on the web, they'll also note that that person probably accepts mail from that mailing list, and forge their spam to that person accordingly.
Whitelists were routed around by spammers and obsoleted within weeks of becoming a fad. Adaptive content-based filters are the only thing that stand a chance in the long term.
> since sending someone email automatically adds them to your whitelist.
Oh, so you like their products so much that you not only use their mailreader,
but also their newsreader, their sms-to-email gateway, their home surveillance
system with email alarm, and even their internet-enabled fridge.
The brits are so funny.
and smart, stylish, modest, really great infact.
Why did we accept them in the EU,
because we are just great, that's why we are called the Great British!
For instance, it has probably already whitelisted the IP addresses of sourceforge.net, yahoogroups.com, and other popular discussion list service providers.
Then it definitely sucks, 'cause I used to get all kinds of spam from Yahoogroups. Since you can create an account for free, create all the lists you want, add people without confirmation, and then let Yahoo foot the bill for your sending, it's a spammer magnet despite their "we'll delete the abused account that never would have been used again anyway" policy.
The reply comes as a new mail, necessitating another challenge.
On the other hand, maybe this will finally get Microsoft and IBM to fix their crappy clients.
I can throw myself at the ground, and miss.
I was looking for the actual patent #s (Patent 6,112,227 (Heiner) and Patent No. 6,199,102 (Cobb), as per an internet news story.
When I tried to return there via the mailblocks press page, all the links pointed back to mailblocks.
Looks to me like they are trying to hide those patent numbers. But it could just be a bug in their web site.
---