Trustic Anti-Spam Service To Close

An anonymous reader writes "I recently received an email from the anti-spam service Trustic saying: "We have decided to close the Trustic service. We have determined that the system as it currently is designed will not achieve the level of accuracy that we require, and an inaccurate system is worse than no system."" We covered Trustic's anti-spam service, which billed itself as "a community-based block list that prevents untrusted servers from sending spam", as recently as a couple of weeks ago.

Comments

On blocking spam

[Anonymous Coward]

Say what you want about statistical anti-spam methods implemented server-side or locally, but they work. Either SpamAssassin or SpamPal do their job at above average level.

Re:On blocking spam

[OMEGA Power]

Either SpamAssassin or SpamPal do their job at above average level.

Agreed, I've been using SpamAssassin and would say it averages about 2 missed spams per 1,000 messages and almost no flase positives (I don't have a exact number but I would estimate about 1 in 20,000)

Re:On blocking spam

[Saiai Hakutyoutani]

Agreed. I use mozilla's built-in spam filter, and even though I get from 80-100 spam every day, I seem to see one of them in my inbox less than once a week.

I also believe it's been over two months since I got a false positive.

Re:On blocking spam

[Aidtopia]

People here rave about SpamAssassin, but I had such great results. My email-provider runs SpamAssassin on the server with a threshold of 6. To be conservative, they only mark suspected messages rather than tossing them. It only catches about half of my 70-100 daily spam messages, and I've had more than a handful of false positives. In fact, I've been getting so few legit messages recently that I suspect many of them are being lumped in with the spam.

So tell me, what's the trick to getting SpamAssassin to perform as well as it does for others?

Re:On blocking spam

[Czmyt]

One trick is to use all of its features. Use its auto-whitelist feature, use its bayes filtering, use its blocklist recommendations (sign-up for spamcop.net and/or mail-abuse.org if possible), and use the collaborative spam message databases (Razor2, DCC, etc.), in addition to SpamAssassin's built-in pattern-based rules.

I use SpamAssassin for one of my clients who lives and dies by e-mail, and it is pretty effective for them. There is an ISP who I deal with sometimes and they also use SpamAssassin. They must not have it tweaked because their scores are much lower than the scores that my client's SpamAssassin installation assigns to the same messages, so there is a lot of variation depending on how you configure its optional components.

In order for the bayes filtering to work well, SpamAssassin needs to have a database of a few thousand messages. I am not sure how well this would work for a large ISP where their customers have such a wide range of non-spam messages, and I'm not sure that the bayes filtering scales very well to large system-wide SpamAssassin installations.

Re:On blocking spam

[mumblestheclown]

Shortsighted, shortsighted, shortsighted.

Statistical anti-spam methods work NOW because they are at the bleeding edge of the spam game. Only a few of us have bayesian filters going, and so the spammers haven't caught up.

Meanwhile, when the spammers catch on, that is to say, once enough ISPs or individuals install bayesian filters that they notice that their spam isn't getting through, they'll compensate, just like they have with EVERY other anti-spam "technology" out there. In fact, I suspect it's already happening - my SpamBayes Outlook add-in is catching less now than ever before. It still does a good job, yet, but false positives are up as are uncaught spam--all this despite 100,000+ "training" spams (I get about 700-1000 spams a day). Why? Spammers catch on. Email looks more innocuous. There are more clever tricks.

I suggest, therefore, that statistical methods are EXACTLY THE WRONG SOLUTION in the long run, therefore, because their net effect is that SPAM will look more like regular email, thus disrupting email service in the long run even more. Yes, it makes sense for an individual on the bleeding edge like you or me to run statistical stuff, but the ultimate answer to SPAM is:

Law, litigation, jail, and accountability.

that's it. it works in other countries, and it could work in yours and mine too. yes, there's that sticky problem that the internet is global, but fortunately there is no government in the world that is ideologically "pro spam." At best, there are ignorant governments that can be manipulated into stupid net tricks as tuvalu and turkmenistan were with their country suffixes, but that's a temporary thing.

SENSIBLE REGULATION OF THE NET TODAY, PLEASE.

not big brother, not slashdot-esque slippery-slope arguments of how once a government gets their hand on anything they can't stop, just reasonable law enforcement and law. if you show a stranger's 7 year old a picture of a man sucking off a donkey in almost any city in the world, you will go to jail. Yet on the internet this happens daily and nobody is punished OR EVEN SOUGHT.

Re:On blocking spam

[Hentai]

The problem with the law is that then you have to define what you mean by 'spam', legally. Then you're right back to the same statistical problems, and the "winners" figure out how to spam without actually violating the laws, just like they're currently figuring out how to spam without tripping off the filters.

Re:On blocking spam

[the-build-chicken]

SENSIBLE REGULATION OF THE NET TODAY, PLEASE.

I remember reading once that responsibility is the flip side of freedom...when you ask someone to take care of something (e.g. regulation), you give up the responsibility, and therefor have no right to complain about the loss of freedom. Because we are only free to the level that we are willing to take personal repsonsibility for our lives and the society we live in.

Re:On blocking spam

[goodie3shoes]

I have a better idea. Simply pass all of your email through a third-world country, where someone that's paid $1.00 an hour will filter it for you. Sadly, with all the outsourcing going on, no too far-fetched.

Re:On blocking spam

[Anonymous Coward]

The system I use works at 100% :-) www.cruelmail.com

Re:On blocking spam

[MS]

You don't need to define 'spam' *.

In the EU, privacy laws protect people's privacy by forbidding to use personal information (e-mail address included) about persons which didn't give explicit written consent to do so, or which do not already have a business-relationship with you. The privacy-laws were not written to protect against spam, but they work perfectly in stopping spam.

If only those other countries outside Europe would also enact similar laws, spammers would all be fined into oblivion and the Internet would be a better place. But as long as countries like the US spit on peoples privacy, there's no hope.

ms
--
*) there's a simple definition of spam (= unsolicited and bulk), I agree with: http://www.spamhaus.org/definition.html

Re:On blocking spam

[dimss]

Yes, they work 99.9% of time. But sometimes useful messages are marked as spam. For example, all messages from my uncle are marked as SPAM because he uses older MUA. I know I can tune my Spamassassin this time but this is hack not solution.

Another nice example was Kaspersky Antivirus for Linux. It detected "virus" in attached .tar.bz2 containing 1M of zeroes...

IMO, spam protection and antivirus systems are much worse than spam and virii themselves.

Re:On blocking spam

[AntiOrganic]

if you show a stranger's 7 year old a picture of a man sucking off a donkey in almost any city in the world, you will go to jail.

Not to sound like a troll here, but how would your 7-year-old's email address get on the Internet in the first place without him/her violating the Children's Online Privacy Protection Act (COPPA)?

I think you made some very valid points, though.

Re:On blocking spam

[jbrw]

Because the COPPA doesn't apply in almost city in the world?

Re:On blocking spam

[grahamm]

The address does not have to have already gotten onto the internet in order for it to receive spam. Spammers use dictionary attacks etc to send to 'random' users at a domain, and if one of these happens to be that of a 7-year-old ......

Re:On blocking spam

[Arker]

I wouldn't be opposed to a simple amendment clarifying that the junk fax law in the US applies to Spam (it seems to me it does anyway, but I understand the courts are for some reason reticent to apply it.) But I fear, with good reason, that any legislation that is realistically going to be passed is going to be something very different. It will not only have the slippery slope type provisions you mention, and set a very bad precedent for the future in that respect, but it will also excempt lots of so-called 'legitimate' spammers, those that have enough money to buy a couple of legislators. At present, we can still do our best to minimise the effectiveness of those spammers, through filtering, blacklisting, etc. Yes, it's not perfect, but if you think it's bad now you just wait until they have a law saying that they're ok and you can't interfere with them.

I don't see any realistic chance of the US congress, or the legislatures in most other countries, passing any reasonable anti-spam law. I do see a very large chance of them passing the kind of monstrosity I outline above, however. So I'm damn sure not going to make it even more likely by calling for legislative action on it.

Re:On blocking spam

[Ed Avis]

The answer is to *make it cost* to send a message. For as long as sending thousands of messages costs next to nothing, spammers will continue to do it.

There are two reasonable ways to make it cost money to send messages. One is to charge a tiny postage fee (say one cent, or even 0.1 cents) for each message you read. The other is to demand 'payment' in terms of CPU cycles, by getting the spammer to compute something before constructing a valid message.

Jail for spammers is one way to 'make it cost', but it would be tricky to implement, since every country in the world would need to adopt antispam laws and enforce them. I think you underestimate just how difficult this would be to arrange, and how long it would take. But requring 'payment' before reading a message can be done end-to-end, without requiring intervention by ISP or government.

Re:On blocking spam

[ibbey]

I remember reading once that responsibility is the flip side of freedom...when you ask someone to take care of something (e.g. regulation), you give up the responsibility, and therefor have no right to complain about the loss of freedom. Because we are only free to the level that we are willing to take personal repsonsibility for our lives and the society we live in.

And how does this theory relate to spam?

Your quote is accurate when it comes to consensual issues (drugs, prostituition, gambling, etc.), however is completely inappropriate when dealing with something that is directed at a non-consenting individual. Spam, by definition, is unsolicited, therefore regulating it will in no way restrict my rights as an individual.

(an argument could be made that regulating spam would restrict my freedom-of-speech. I strongly disagree. Spam is by definition commercial speech, and I do not believe that commercial speech should be granted the same protections as non-commercial speech.)

Re:On blocking spam

[the-build-chicken]

yeah, some truth there...but you're not regulating spam, you're regulating a communication medium to restrict spam.

This is really too bad.

[MrLint]

This appeared to be really one of the few spam handling i have seen in a long time with a lot of potential. Im hoping that it will comeback in a different form someday.

Bad Philosophy

[FortKnox]

inaccurate system is worse than no system

I think any blocking is better than no blocking. The only 'bad' thing is false-positives. If you lower your blocking to prevernt false-positives, you still have a service that is desired even if you don't catch them all...

Re:Bad Philosophy

[diospadre]

It's possible that by lowering the blocking that Trustic's service would block less spam than other services. Couple this with another possibility, them being unable to justify the resources to fix/improve the service to the level of quality they want, and their best bet is to make available their work to others and axe it.

Re:Bad Philosophy

[Anonymous Coward]

I think any blocking is better than no blocking.

Then block all mail from odd-numbered IP addresses. A full half of all spam comes from those addresses!

The only 'bad' thing is false-positives.

Oops!

If you lower your blocking to prevernt false-positives, you still have a service that is desired even if you don't catch them all...

Ah, change it to only block prime-numbered IP addresses. Much fewer false-positives, and you are still blocking some spam.

Seriously, I'm really impressed that Trustic had the ethics to back off when they determined that the system didn't work. I hope they'll be back with a better system.

Re:Bad Philosophy

[kmak]

I agree.

This reminds me of a story:
A guy was speeding along many others along a highway. He was later pulled over by a policeman. The guy cracked, "But everyone was speeding, why did you get me?" The police then asked, "Have you ever gone fishing?" "Sure.." "Have you ever caught them all?"

Re:Bad Philosophy

[timeOday]

I'm annoyed with spam-blocking lists because my range of IPs has been blacklisted, even though I'm totally innocent. The blacklists know they have to block lots of non-spamming addresses, they don't seem to mind. But I guess ultimately those who use the lists are to blame rather than the lists themselves.

Re:Bad Philosophy

[dissy]

> I'm annoyed with spam-blocking lists because my range of IPs has been
> blacklisted, even though I'm totally innocent.

You are giving money to an ISP that is spam friendly.
You are directly at fault for them being in business still.
You are not at all innocent.

Change ISPs. Tell your current ISP why you are changing.
Give your money to an ISP that actually cares about the spam problem, and isnt itself the spam problem.

The blame falls not just on the spammers, but the people that keep spammers in business.

Re:Bad Philosophy

[Kaa]

You are giving money to an ISP that is spam friendly.
You are directly at fault for them being in business still.
You are not at all innocent

Riiiight.

You are smoking a joint, so you support terrorism, correct? "Directly at fault" I would say...

So, dissy, tell me, do you take upon yourself all the sins of corporations the products of which you use?

Re:Bad Philosophy

[Czmyt]

Dropping your ISP is not an option when they are the only affordable high-speed Internet provider in the area. I'm guessing that the people at AOL Time Warner/Roadrunner care more about ridding their network of spammers than they care about losing a few customers who don't want to be associated with the same netblock as bunch of spammers who have already moved on. I think lists like SPEWS Level 2 give blocklists a bad name.

Re:Bad Philosophy

[Frymaster]

these are the ways we can stop spam:

1. at the source: make it unprofitable for the spam to be sent in the first place. this can be done by either:
   1. fines or other state sanctions.
   2. lack of market.
   1. is faster in the short term - but as long as spam is profitable, there will be those willing to risk sanctions. 2. takes longer and is a bit pie-in-the-sky, but eliminating the market is the only permanent solution.
2. at the tansmissionn level: get rid of those relays! if it is technically too difficult to send spam, the amount will drop accordingly.
3. at the recipient level: this is where filtering fits. really this is just a subset of 1.1 - removing the market. if no one sees the spam because of the filter, they won't buy and spam becomes unprofitable.

looking at this analysis, it seems that 3. is the best option because it helps acheive a lack of market and profitiablity which is the only permananent solution...

however, an imperfect filtering system defeats this formula. consider: if a filtering system can be bypassed with some effort on behalf of the spammer then those spammers who have the kung fu to get their mail through acheive a distinct competitive advantage over their competitors. if there are 10 spammers sending you 10 messages a week, you have 100 spams. that's a lot of "noise". if you filter these spams but one spammer can get through the filter, you are only getting 10 spams. that's "good" but - and this is a big but - that spammer now has way less competition. the signal to noise ratio goes way up for that one spammer and his/her individual messages become more effective because there are no competitors in the inbox!

the result is that imperfect filtering may put nine spammers out of business, but the one remaining will make a killing. eventually that one spammer will pick up the other nine's contracts and, boom, you're back to 100 spams. new spam agencies will rise to the new level to cash in on this profitable venture and the cycle starts all over again.

and that's bad.

Re:Bad Philosophy

[daeviltwin]

I do support Columbian death squads. So I only buy pot from Columbia.

Re:Bad Philosophy

[sjames]

Change ISPs

If only it were all that simple. Some blacklists make an honest effort, others are far too broad. In cases I have seen, people have found themselves on a blacklist because:

1. A long time ago, in a galaxy far away, a spammer used the block, but got terminated the same day
2. ISP has strict no spam policy, but has had several spammers come onboard (and get quickly terminated), they're more than willing, and quite strict, but it's like playing whack-a-mole.
3. A dialup bank exists in the same class C, or did at one time
4. Someone not connected with the company once exploited a hole in a colo machine on the same class C and got some spam out. The hole is closed or the customer is gone, but the blacklist remains.
5. A server in the same class C runs a mailing list. Some dummy signed up for it, confirmed it, then forgot all about it. Sure enough, the first mail that came out of it in a month was reported as spam.
6. The list is one of the new breed of shakedowns and someone on the class C didn't choose to pay the 'consulting fee' to 'verify that the relay is closed' after the 'spam' was reported.
7. The list maintainer is pissed off at someone in the same class C for completely unrelated reasons

I WISH that blacklists were all well run and free of politics and other non-spam issues with good criteria for inclusion, but many simply aren't.

Re:Bad Philosophy

[Anonymous Coward]

The list is one of the new breed of shakedowns and someone on the class C didn't choose to pay the 'consulting fee' to 'verify that the relay is closed' after the 'spam' was reported.

Lemme guess, blars?

If it's a shakedown list, don't worry about it, as neither will competent admins.

Re:Bad Philosophy

[Threni]

"The blacklists know they have to block lots of non-spamming addresses, they don't seem to mind."

Blacklists don't mind, being simply a list, and not having a mind. People choose to implement the lists of their own free will. If you don't like that, write to them to try to change their mind, or use another ISP which doesn't implement the blacklists, if you can. But don't take it out on the poor lists - they never done nothing.

Re:Bad Philosophy

[Tackhead]

> I'm guessing that the people at AOL Time Warner/Roadrunner care more about ridding their network of spammers than they care about losing a few customers who don't want to be associated with the same netblock as bunch of spammers who have already moved on.

I think we'll have to agree to disagree here.

You see, judging from the metric fuckloads of spam coming from 24.0.0.0/8, I'd guess that AOL-TW cares more about the pubic hair on Ted Turner's soap bar than ridding their network of (clueless residential broadband lusers with open proxies abused by) spammers.

Granted that still puts them ahead of 4.0.0.0/8 (now Verizon DSL) and 12.0.0.0/8 (all of AT&T) and the sewer that Comcast calls an ISP.

Re:Bad Philosophy

[Czmyt]

I don't really know what they do, if anything, about the clueless residential broadband lusers who have open proxies that are being abused by spammers. I know that they scan their business broadband customers looking for open relays, though I don't know what they do with that information.

But we're not really talking about legitimate customers whose resources are being abused by spammers, because I don't know of any major list that blocks netblocks because of open relays or open proxies in the vicinity. We're talking about actual spammers using addresses on their network, and those addresses being blocked because they're used by spammers, and the entire netblock being blocked in a political protest against the ISP for it's having hosted spammers, inadvertently or not. If you blocked the netblocks of all ISPs who do not have an aggressive policy of prohibiting their customers from exposing exploitable resources like open proxies, open relays, spam-relaying virus-infected PCs, or other spammer-friendly resources, then that would block way too much e-mail for most users. I agree that AOL Time Warner/Roadrunner should do something about all these problems that their customers cause, and so should Verizon DSL, AT&T/Comcast, and everybody else. I wish that I knew how to get them to do that. Blocking the e-mail of my business associates and my client's associates is not good for business!

Re:Bad Philosophy

[vanyel]

In an end user system, you're right, but I've got a friend whose business is regularly put in jeopardy by spews because they take a shotgun approach and screw any collateral damage and hell no we won't be held accountable for our mistakes.

They're putting a number of legitimate people between a rock and a hard place because it's very expensive to change providers when you're providing high-bandwidth connectivity, but at risk of losing customers who can't send the email they need to because their customers are signing up to anonymous blacklists with no accountability.

Needless to say, it's very frustrating for them.

Re:Bad Philosophy

[Anonymous Coward]

And how many times must we say that SPEWS blocks no one.

The isp/webhost/enduser hwo manages his own server is the one that ultimately decides on what to block.

You are not an innocent bystander if you continue to pay an ISP who care nothing about their contribution to a world wide problem. You decide to deal with an ISP who cares more about their spammers than you, then dont blame us if we refuse to want traffic coming for your ISP.

Its not a "shot-gun" approach. ITs getting ISP's to take responsibility over their networks. Getting them to realize that favoring Spammers over non-spammers is not good business sense.

You are not innocent. You live in a slum; you give money to a slum lord, and you want to complain when the pizza guy doesn't want to deliver to you anymore?

I was "blocked' constantly because I was with interland. I moved after i realize what a scummy, spam harboring business they were and ARE still today. I was losing more busines by staying in business with interland.

Its not bad philosophy. ITs about me protecting what is rightfully mine. A webserver free from spam.

You want ot pay a scummy isp, then that's your problem. Dont go blaming your bad decisions on the rest of the world.

Re:Bad Philosophy

[Anonymous Coward]

And some blacklists don't listen either. SPEWS, for example, provides no way for dialogue about an entry in the list. Oh sure, the FAQ says you can beg at NANAE for a flaming, but there isn't a way to discuss if a listing is appropriate. Spews in effect says "we are always right."

Re:Bad Philosophy

[Lemmy Caution]

But spam-catching should be less like fishing and more like, erm, Pokemon.

Re:Bad Philosophy

[Anonymous Coward]

That is bullcrap since Spews listens to no one, and let alone listens to anything posted in NANAE

You first need to understand what is at the heart of the problem; YOUR spam loving/supporthing/harboring/criminal/ ISP you pay money to every month/year/day.

The FAQ states nothing about "begging" in NANAE (which is obvious you have a comprehension disablitly) ONLY THE CESSATION OF spam will cause a network/ip/block to be deslisted. And ISP's do get delisted; one was delisted within 2 hours of posting to NANAE and proof that the spammer was gone.

So what's hard to understand?
Your isp harbors spammers. The use you as human shields so they can keep the spammers. You want to go on an keep on paying these criminals? That's your choice.

Spews doesn't have to listen to anyone. They get spam, they report it like any of us do; if the isp who its being reported to does nothing, they get listed; if they continue to ignore further spam complaints about the same individual/site/spam source; their blocks get bigger on the list to the point we hope, it gets their freaking attention that they have a problem. If the attention has to be gotten by their clueless users then so be it, but it aint no skin off my back if they are blacklisted. I do no business with spammers and spamming networks.

Re:Bad Philosophy

[vanyel]

And how many times must we say that SPEWS blocks no one.

I never said you did. You're just the man behind the curtain allowing clueless people thinking they're helping themselves to put legitimate businesses between a rock and a hard place. Because you refuse to accept any accountability, it's not even possible to correct any mistakes. You just blithely say "we can't be wrong, you're just in the slum. move." Regardless of how expensive that is. Expensive enough that it's entirely possible that a business could be driven out of business because customers leave and they can't afford to switch. Because you can't find out you'll be in spews until it's too late.

You are not innocent. You live in a slum; you give money to a slum lord, and you want to complain when the pizza guy doesn't want to deliver to you anymore?

If it were the slum being blacklisted, that would be one thing, but it's the entire city. The Internet is not a two-level affair: ISPs and End Users --- there are a lot of middle-men.

Personally, I expect that the problem is moot, because pretty soon the entire Internet will be listed, and people won't be able to use it and still communicate with anyone.

But you're right. It's not your fault. It's the fault of all the clueless people using spews in ignorance.

Re:Bad Philosophy

[dissy]

> You are smoking a joint, so you support terrorism, correct? "Directly at fault" I
> would say...

If my dealer was a terrorist, then yea.
But no dealer i know is a terrorist.. They are usually just some dude that likes to smoke to the point they buy in bulk and wanna make a buck on the side.

Maybe higher up dealers have that problem, but I dont know, I never met one.

If i knew a dealer i bought drugs from turned around and bought guns to do war shit with, then no, i would not buy from that person.

You seem to miss the point of direct and indirect in your example.

> So, dissy, tell me, do you take upon yourself all the sins of corporations the
> products of which you use?

Yes.
I have actually purchased windows XP.
I supported MS and all of the evil things they do with my money from that purchase.
Hey, sorry.

I cant think of anything else I have purchased from a company that does direct evil things, or atleast they hide those evil things from me purposly so i dont know and base any choice off of it.

The person in question in the parent post can not claim ignorance, as he was bitching about the fact they were on spamblocks, so its obvious there was a spam issue there at some point.

Also 'evil' is very different person to person.
There are things i do not concider evil that im sure you do, that if you whipped out as examples, i would simply disagree with.

Hey, atleast im honest about the MS thing thou :)

Re:Bad Philosophy

[Anonymous Coward]

Spews listens to no one

Exactly

You first need to understand what is at the heart of the problem; YOUR spam loving/supporthing/harboring/criminal/ ISP you pay money to every month/year/day.

How is my ISP the problem? Of course, just about any ISP has had spammers and will have spammers. The big ISPs are bound to have some idiots. The small ISPs end up getting IP blocks from the big providers who give ajoining IP blocks to other ISPs -- there are bound to be spammers on some of those IP blocks. As far as I know, my ISP is no better or worst than the average ISP.

Your isp harbors spammers. The use you as human shields so they can keep the spammers. You want to go on an keep on paying these criminals?

Hey, aren't you the guy who said "God will roast their stomachs in hell at the hands of SPEWS"?

Spews doesn't have to listen to anyone.

And that is the problem - and why I won't use SPEWS.

Take a chill pill, 'Kay?

Re:Bad Philosophy

[Tackhead]

> I agree that AOL Time Warner/Roadrunner should do something about all these problems that their customers cause, and so should Verizon DSL, AT&T/Comcast, and everybody else. I wish that I knew how to get them to do that.

You and me both. I wish I didn't have to block them (and don't even get me started on South America :) globally, but them's the breaks. Without blocking all traffic from those cesspools, my inbox was unusable.

Fer chrissakes, uu.net (!) did it with their pools of leased dialups back in 1998-99. Why can't the broadband ISPs do likewise?

Re:Bad Philosophy

[Robmonster]

Trustic seem to have the correct attitude. It can be immensly frustrating to get listed incorrectly, wither by inheriting a Bad ip, or in some cases maliciousness of the blacklist runner.

This happened to a business aquantance and was effectivley held to ransom over the blacklist. The list owner charged a fee to remove IP addresses from the list that he maintained. Conflict of interests...?

One can dream!

[borgdows]

I recently received an email from Microsoft saying:
"We have decided to stop distributing Windows. We have determined that the system as it currently is designed will not achieve the level of reliability and security that we require, and an unreliable and insecure system is worse than a non-MS system like Linux or MacOSX."

How does this rate against other filtering?

[Comatose51]

Anyone with experience with this system and the Bayesian filtering know how they rate against each other? Can one conceivably combined the two?

Re:How does this rate against other filtering?

[nadadogg]

He(or she) has a good point here. With enough time and money, we could build a damn nice spam-filter system. The problem here is the time that it would take to integrate the two together, without them fighting overly much. I believe that if AOL and Microsoft were really serious about fighting spam, they could spend a bit of their hard-earned(yeah right) money on this, which could actually gain windows some points in many geeks' eyes. If there was a cheap application to stop this, I'd definitely give it a look, or hell, even as a cheeeeeap fee added to MSN, or for the AOLers(poor guys.)

Just something to think about really, it would curtail some of the hating that goes on directed at the Big Guys(tm)
One can always dream that the powers that be would do something good for all.

Re:How does this rate against other filtering?

[Im-no-orangutan]

Sure you can combine them, as you can see here http://www.trustic.com/help/dns You could set up spam assasin (among others) to use the Trustic DNS block list.

Re:How does this rate against other filtering?

[ilovecheese]

I've been using Bayesian filtering for quite some time, and find it totally effective for spam filtering. I honestly believe, that there is no need for a DNS blackhole, other than just stopping the trivial waste of bandwidth.

Re:How does this rate against other filtering?

[joebok]

The nature of most Baysean filters (POPFile being the one I'm most familiar with) will tend to develop it's own black-list over time. A real black-list would help cut down on the processor and bandwidth that spam wastes - but in my experience black-lists are much harder to maintain than my POPFile corpuses (corpi?).

Why technology alone is not the answer

[Rathian]

Personally I think it would be wonderful if technology alone could create the silver bullet and kill this annoying problem dead. But sadly as quickly as filters evolve, spammers are constantly looking for ways around them. All too often they find ways.

Even Earthlink's vaunted SpamBlocker is not bullet proof, in spite of using it, I still get some spam that slips in through it.

This is one of the reasons why we need some decent laws on the books so we can either force spammers to cease or prosecute the bastards.

Re:Why technology alone is not the answer

[soft_guy]

I have a system that would completely eliminate spam. It would not be based on filtering, would not cause any false positives, and would prevent 99% of what you think of as spam.

It would also have other benefits.

Problem? I couldn't get venture capital funding to build it. I've still got a business partner who is looking for money. If we get money, I'll build it. Unfortunately no one wants to put money into something that would compete with Microsoft's system. (They are working on a stupid, fatally flawed system that is tied only to HotMail.)

Re:Why technology alone is not the answer

[Anonymous Coward]

maybe you could sell a few bridges to get money to build it.

Re:Why technology alone is not the answer

[Hayzeus]

Hmmm. You need to mass-market your idea to the internet public at large. EMail is ideal in this regard. Our database of 500 million guaranteed fresh email addresses is sure to net you internet gold at the speed of electrons!

Re:Why technology alone is not the answer

[arkane1234]

why not make it GPL and write a roadmap for the project.

Then you could start a consulting firm that integrates it into a companies existing infrastructure.

Re:Why technology alone is not the answer

[raju1kabir]

I have a system that would completely eliminate spam. It would not be based on filtering, would not cause any false positives, and would prevent 99% of what you think of as spam.

"What you think of spam"??? Why am I reminded of a B-movie alien who announces to a startled earthling: "We have been monitoring your so-called 'television' transmissions for ten of your Earth years"?

Re:Why technology alone is not the answer

[Arker]

Technology alone isn't the answer.

Getting government involved won't help, however. You're going to kill the good and let the bad live going that road.

Spam can be stopped, with the current technology (with 10-15 year old technology, actually) with a little social and economic help.

Ask yourself, how do spammers make any money out of being pains in the ass?

Mostly by scamming their employers, of course. They tell regular small business folk they'll do 'legitimate marketing' and get them to pay for it before the results of that marketing, a swarm or pissed off people who want the poor folk to die and will certainly never buy from them, appear. Those sources won't last forever, people wise up after getting burned like that.

No, to have a stable source of income. The serious spammers are hooked up with contracts with BIG ISPs. Small ones won't work, because when we find out who they are we threaten them with the black hole and they fold quick.

But there are a handful of really huge providers that threat doesn't work on. It's just not realistic to blackhole someone that provides backbone service, someone that has so many legitimate users you do more harm than good when you cut them off. They know that, so if a spamhaus offers them a sizeable premium they feel safe hosting them. That is the big reason that current efforts like MAPS haven't practically eliminated spam already.

The key is to distribute the infrastructure. If there weren't any companies owning a large enough chunk of the infrastructure to fancy themselves immune to consequences, spammers would never be able to make a reliable profit and they would die out.

Re:Why technology alone is not the answer

[sjames]

Perhaps what we need is REAL silver bullets in spammer's heads.

Re:Why technology alone is not the answer

[letxa2000]

Personally I think it would be wonderful if technology alone could create the silver bullet and kill this annoying problem dead. But sadly as quickly as filters evolve, spammers are constantly looking for ways around them... This is one of the reasons why we need some decent laws on the books so we can either force spammers to cease or prosecute the bastards.

Spam filtering has always been a catch-up game in the past. However, with Bayesian filtering it seems that anti-spammers have deployed a solution proactively rather than reacting to the spammers. And, as of yet, I have yet to see any spam that has implemented any kind of countermeasures to get around Bayesian, and I'm skeptical they will be able to get around it. The few spams that get through to me get through because they happened to to use words very similar to my real email or because it's in a foreign language. No spams have gotten through because the spammer made an effort to get around Bayesian filtering.

Nothing is 100% successful at blocking spam, and I think if 100% is the definition of a "silver bullet" we'll NEVER find it--neither with technology or through legislation. But with current Bayesian filtering catching upwards of 99.5% of spam, that's close enough to a silver bullet for me.

I would personally approve of legislation that makes it clear that theft of services, including the unacceptable use of email services, is actionable. But I don't think legislation that specifically targets spam is going to be useful or enforced, and will probably raise more questions than it answers.

Re:Why technology alone is not the answer

[soft_guy]

Overruled by business partners.

Re:Why technology alone is not the answer

[iabervon]

Filtering technology alone is not the answer. But an authentication scheme where the sender demonstrates the ability to use the From address would eliminate almost all of the spam that forges that information and make filtering or litigating the rest easy.

The issue is that, while weak recipient authentication was built into SMTP, corresponding sender authentication was not; this means that everyone is always anonymous (except for name tags they write themselves), there is no accountability, and people behave badly. Trying to apply technology at the level of behavior is obviously going to be ineffective.

Solution: add a "XM" DNS record type (MX backward), which specifies the hosts which are expected to send emails with the given return address. If a sending machine doesn't have the right XM, MX, or A record, flag the message as likely spam (if it's not spam, the sender should get the DNS updated or their mail routed better).

Re:Why technology alone is not the answer

[soft_guy]

>>"What you think of spam"??? Why am I reminded of a
>>B-movie alien who announces to a startled earthling:
>>"We have been monitoring your so-called 'television'
>> transmissions for ten of your Earth years"?

When I started really thinking about "what is spam?", turns out there are some iffy cases where it is not entirely clear if a message is spam. The concept of "unwanted email" is somewhat subjective at a certain level. My system prevents unsolicited commercial mass distributed email. Maybe I should have said "What people commonly think of as spam" instead.

Re:Why technology alone is not the answer

[voisine]

What are you talking about? Spam filtering is the investment
fad of the week right now. I work for a spam filtering company.
We have investors beating down our door. It's like 1999 all
over again, except we don't even need the money. Bootstrap
sales baby, it's the only way to go. VC's are blood sucking
vultures.

It takes Balls to admit that you're wrong.

[_Sambo]

These folks had a dream. They tried to make it work. When it became apparent that their solution was not viable, they had the honor to admit to it.

The hope of finding a solution to spam is expressed in the final line of their current site welcome screen:
We remain confident that the problem of spam is a solvable problem. Thank you for your help with this great experiment.

God bless them for trying.

Whitlisting alternative

[Marcus Green]

I have been using an outfit that supplies a whitelisting service (port995.com). The idea being that the first time anyone sends you an email, it gets put into a queue and they get a response asking them to reply. Once they reply they get put on the whitelist, the message goes through and all future messages pass through without further messing.

As only a teeny tiny percentage of spammers supply genuine return addressess or read the responses the upshot in my case seems to be "new spray on no more spam"..

Inevitably some people don't read the first response or cannot be bothered to respond, but I guess those folks didn't want to contact me that badly anyway, so I don't want to read their messages that badly.

Marcus

Re:Whitlisting alternative

[grogglefroth]

The problem wtih this solution is that legitimate mail from new contacts never reaches you - because it was a machine that sent it in the first place. Bill notifications and software registration keys etc would all fall victim to this, as you will often not know ahead of time what to whitelist. The greylisting approach seems *safer* in this regard than the challenge/response systems like port995.

Re:Whitlisting alternative

[Anonymous Coward]

Umm, that idea's been around for awhile, but it doesn't work because when they send an order confirmation, amazon.com ain't gonna respond to your idiotic email asking to be placed on your "whitelist".

Moron.

Re:Whitlisting alternative

[trala]

Now if they would just develop something like this for telemarketing calls...

"Hello. You have reached my house automated answering filter service. Please leave your name and number and a brief message and I will call you back if I feel like it. Once I call you then you will be able to freely call me from this number at any time."

Re:Whitlisting alternative

[trala]

If you had looked at the service, you would have noticed that you can also manually add emails to the list without requiring a reply. So if you just signed up for a new service, then whitelist the email address.

Re:Whitlisting alternative

[jonfelder]

Bzzzzt! Wrong!

Try reading the comment again:

"Bill notifications and software registration keys etc would all fall victim to this, as you will often not know ahead of time what to whitelist."

The problem illustrated here is that often times you don't know what address to whitelist, and hence can't add it ahead of time.

Re:Whitlisting alternative

[Anonymous Coward]

bzzzt, its called wildcards

Re:Whitlisting alternative

[AKnightCowboy]

The problem illustrated here is that often times you don't know what address to whitelist, and hence can't add it ahead of time.

And before someone says "just whitelist their domain", often times messages come from a completely different domain than the one you've signed up on. Personally that pisses me off, but it's a fact of life of outsourcing I suppose.

Re:Whitlisting alternative

[Anonymous Coward]

"Hello. You have reached my house automated answering filter service. Please leave your name and number and a brief message and I will call you back if I feel like it. Once I call you then you will be able to freely call me from this number at any time."

Ameritech/SBC has a service like that called Privacy Manager. Unfortunately though they don't get automatically added to some whitelist. You just give the people you want to talk to a PIN to bypass it and get straight in. Works nicely for avoiding those annoying telemarketers with their out-of-area or private caller CID blocks. I wonder if the national do-not-call list will be as effective as privacy manager is for me. I wouldn't mind saving the $5/month or so.

Re:Whitlisting alternative

[SeattleGameboy]

May be you guys should look at a simpler solution. Most whitelist email provides a "junk mail" folder where you can view all the emails that you do have not whitelisted. If an email comes from a new source, you can always catch it. And it is a LOT easier to catch 1 recognizable email address (or title) from 100 junk then to have your inbox full of junk and good all mixed together.

Re:Whitlisting alternative

[zoloto]

read my reply below

http://slashdot.org/comments.pl?sid=73536&cid=66 09 900

Re:Whitlisting alternative

[Anonymous Coward]

You've got to be joking... Add wildcards to your whitelist? Doesn't that defeat the point of a whitelist; having blanket rules?

Re:Whitlisting alternative

[KMitchell]

The solution to this is tagged addresses. This is what TMDA uses (dunno anything about port995.com).

The basic deal is that you tell amazon.com that your email address is someuser-amazon-cryptochecksum@foo.net instead of someuser@foo.net. Any mail sent to that address gets right through to your mailbox. If Amazon ever starts spamming you, you revoke the address. TMDA has some front-end tools to make generating the addresses (handling the crypto) pretty painless.

Re:Whitlisting alternative

[jonfelder]

Not a bad idea, but it seems like it might be a bit of pain. The question is, is it worth all this effort to block spam? If the blocking methods are just as intrusive as the spam, then what's the point?

Re:Whitlisting alternative

[jonfelder]

Maybe...however part of the problem now is that people get a lot more junk than legitamit messages.

Seems to me that wadding through a junk folder to find messages the spam filter missed, isn't a whole lot better than having the junk sent to you in the first place. You still have to wade through the same amount of junk...doesn't matter if it's one legit message or 100.

Re:Whitlisting alternative

[jonfelder]

Another comment in this thread explained this already...many times the confirmation emails come from different domains then where you ordered from. This is particularly true with people who have other companies manage their online transactions.

Furthermore, as someone else pointed out wildcards in a whitelist seems pretty dumb to me. The whole point is to have each sender verify that their human...wildcards sort of defeats the purpose.

Re:Whitlisting alternative

[SeattleGameboy]

The thing is, with the whitelist vast majority of your legitimate emails come through without any effort (in my case, it has been 99%). Only email that I have to check is from a new e-biz vendor. The way our brain works, it is MUCH easier to find the message header (or address) that you recognize from random text than the otherway around. So even if a legit email is the junk folder, you can find it very quickly. And since vast majority of your email comes through without any problems, you don't have to check the junk folder very often (only when you are expecting something). Try it, you'll see the difference.

Re:Whitlisting alternative

[jonfelder]

What about the situation where you didn't whitelist them because you didn't know the sender? Might be hard to know what to look for in the list. Sometimes you can scan the subjects, sure, but often the subjects aren't very descriptive. Spammers also have a tendency to use subjects like "About your order..."

I personally would be more likely to miss the one legit message in the junk folder...I suppose it's all about which method works best for you. I personally use dnsbls and spamassassin...gets almost all of my spam. Only 1 or 2 a week make it through, with very very rare false positives (maybe 1 out of 1000).

Re:Whitlisting alternative

[KMitchell]

I used to get about 50-100 spams/day. I now don't get ANY spam (using TMDA). It took a fair amount of work to set up but in daily use it's transparent. Any outgoing mail automatically gets added to the whitelist so no one replying to your mail has to know that you're doing any of this.

I used to run a variety of filter-based anti-spam stuff (homegrown and SpamAssassin) and the occasional false-positives kept me constantly checking my "spamtrap" filter. Major PITA.

What I've found since using TMDA is that I've started whitelisting email newsletters/ads that I had previously considered "spamlike" simply because I now have far more bandwidth for email now (human, not network) It's a huge difference to have "1 new message" instead of a hundred (of which 99 are crap)

Re:Whitlisting alternative

[SeattleGameboy]

What about the situation where you didn't whitelist them because you didn't know the sender?

Isn't that a description of spam:)?

Seriously, at least with every e-biz vendors, I have never had a situation where the company's name was not in the address or the header (usually both). I had situations where a friend changed his email address, but their name is there.

Also, most junk mails are quickly recognizable. Either they have a name that you do not recongnize (i.e Betty Bush), or email adress that you know is fake (#$@$#@ejkthw2000@yahoo.com), or the header gives it away (Lengthen your Penis!!!). You eyes and brain can very quickly move past these. You attention caught only when you recognize something. You should really try before dismissing it. Who knows? you may like it.

Re:Whitlisting alternative

[Marcus Green]

Legitmate email from humans who want to contact me does reach me. So long as they click reply and send when they get the challenge. If they don't then I they don't contact me and I can live with that.

As for machine generated email (a very small percentage of my email receipts), I can deal with that through pre or post whitelisting, i.e. if I know the email to start off with I whitelist it, if I don't know where it is coming from I can check the pending queue and look for the machine generated stuff and then whitelist the address. It is a once only chore.

I have gone from 99% junk to something like 0.0xx percent junk.

The thing that really made me go for it was when I realised I had missed an email that was quite important because it was buried within all the viagra/penis extension crap. I was spending 5 to 10 minutes every day to try to find the real stuff, now it is 0 minutes.

For me it has worked extreemly well.It may not be perfect, but I believe it is as close as it is going to get to perfect for my requirements.

Marcus

Re:Whitlisting alternative

[Marcus Green]

Hmm and it seems that it is working very well indeed for me. OK, this is how it works, I am expecting a response from Amazon OK?, I check the queue of emails waiting for a response (you know the stuff, bigger penis, cheap loans, pr0n that type of stuff). Ohh look the response I was expecting from Amazon, click whitelist, don't have to do that with amazon again.

A few months later and I am expecting something similar from another online retailer (not amazon cos they have been whitelisted) so I check the queue again. Note how I get to browse list of spam looking for one specific email every month or so rather than search for any relevant email in a sea of junk every single day.

Of course I could just have a spare Yahoo or Hotmail account for the purposes of online commerce, then I would never ever look at the list of queued junk, but I prefer to do it this way.

Marcus.

Re:Whitlisting alternative

[EvilSpock]

By Jove! I think you've just invented the answering machine!

Re:Whitlisting alternative

[Baumi]

That'd only be reasonable if you get a hight enough number of spams.

Up to now, I'm lucky - currently, spam accounts for less than 10% of my incoming mail and most of that comes in via the alternate freemailer account that's victim to brute force spamming every other day. (I don't leave my main mail address at many places across the net.)

It's such a small amount that I could almost ignore it, but instead i use it to train my POPFile installation which is already very good at sorting not only spam, but all kinds of other stuff, as well: Private mail from work related mail - family mail from those of friends, mailing lists, etc.

In any case, requiring all my legitimate contacs to white-list themselves is overkill for my situation.
Jens

Re:Whitlisting alternative

[rizawbone]

I work at a large internet colo facility, and from first hand experience I hate whitelists. About half a dozen times I have worked on a problem for a customer, written a long reply, then gone out for lunch or gone home for the day.

The shift covering me gets an angry call from a cutomer who wants to know why we havent resolved his issue. Now the customer has to wait until I am in the office or at home again to open up my email and click his stupid whitelist link. I dread the 4am phone call where I have to click some jerk's whitelist link.

A well configured spam filtering server and some local filtering will get rid of 95% of spam. Set up once and you're done.

Too many idiots use whitelists, it's a case of throwing the baby out with the bathwater. I don't know why someone has to waste everyone elses time, espcially if thier justification is they don't want thier own time wasted.

It really wasn't very accurate

[sgifford]

I've been doing some research about the accuracy of different spam-blocking solutions, and Trustic had a huge false-positive rate. It misidentified 8% of my personal non-spam mail as spam, including mail from my Mom (it blocked our local cable ISP completely), my aunt (it blocked some AOL MX's), my insurance company (who the hell knows why), security warnings from CERT, and the NANOG mailing list.

It did have a good blocking rate---65%---but using a combination of other RBLs (the most optimal I found was DSBL + SpamHaus + Blitzed) it's possible to block nearly 75% of spam with only a .02% false positive rate (a single mailing list correspondent with an Argentinian ISP that has open relays was blocked).

It really is probably best that they laid this project to rest.

Re:It really wasn't very accurate

[Hayzeus]

65%? Seems low compared to something that scans content, like spamassassin. I get around 90% blocked, with a relatively low (maybe 1% false positive after a week of tweaking on and off).

The biggest problem spam assassin has as far as false positives appears to occur when people attach text from a commercial web page rather than a URL pointer. This invariably causes the email to get identified as spam, particularly if the page text contains any references to commerce.

Re:It really wasn't very accurate

[Czmyt]

I had very similar results when I tried it last Friday. I ran it for about an hour before deciding that what it did block (AOL) was going to cause a lot of false positives.

Re:It really wasn't very accurate

[XSforMe]

Thanks a lot for the tip; after several false positives in the company's SMTP server, I had decided to solely allow bayesian filter to handle the separation. Unfortunately the thing is still in "training" and it lets flow tons of garbage.

RBLing from guys like osirusoft did a great job until i figured that they had practically black listed every single IP in Mexico (and we get like 30% incoming mail from here).

Would you be kind enought to share the figures you arrived to with the rest of us?

Re:It really wasn't very accurate

[sgifford]

Here's a link to the numbers I've got. I'm working on writing more up about my methods, but basically what I did was sort all of my mail from the last 90 days or so into spam and non-spam, then simulated the use of these blacklists on my own personal mail. Also, the PDF file is a bit of a mess; something about Gnumeric's PS output or ps2pdf.

http://www.suspectclass.com/~sgifford/writing/spam .pdf

Re:It really wasn't very accurate

[Indy1]

you can do better then that.

try
relays.osirusoft.org +
bl.spamcop.net +
blackholes.easynet.nl +
dynablock.easynet.nl

and you'll nail 97-99% of the spam upfront and not waste bandwidth accepting their crap

Re:It really wasn't very accurate

[sgifford]

osirusoft was very slow in my tests (sorry, not quantified yet, but the tests took about 3 times longer to finish than other RBLs), had a higher-than-average false positive rate (0.26%), and it lost important messages---from a former boss from whom I needed a letter of recommendation, my insurance company, a prospective consulting client, and my MozillaZine welcome message.

bl.spamcop.net was better, but it still had a false-positive rate of 0.16%, about 8 times higher than others. None of the messages I lost were important, but it still made me a little nervous. By including it in the list I mentioned, I can go from blocking 75% of spam to 80%, and my false positive rate goes from 0.02% to 0.19%.

I didn't try easynet. I'll run my tests on it and see how it does.

Just needed more customers...

[Anonymous Coward]

If they had only had more customers, I'm sure they could have held on longer.

If only they had found a quick, easy, inexpensive way to solicit hundreds of thousands of new customers using the Internet they could have stayed alive!

Re:Just needed more customers...

[eggnet]

Haha. But no.

They did do that via a slashdot article. I think, ultimately, that it just wasn't a good idea.

Re:Just needed more customers...

[spike it]

Talk about being brought down by your own services... ;)

Why technology nor the law is the answer

[mobileskimo]

This is one of the reasons why we need some decent laws on the books so we can either force spammers to cease or prosecute the bastards.

This is one of the reasons why we need to get to the root of the problem so we can neuter parents to preclude them from having these children.

Seriously, there's a problem with attitudes. What the hell happened in their childhood that promotes these people to ignore their conscience and annoy millions of people for the name of $? Once they're in their adulthood, no laws or technology will fix their behavior. Gotta fix it while its fresh in their impressionable minds.

Re:Why technology nor the law is the answer

[Anonymous Coward]

Same thing that causes people to steal music to save themselves $. Greed. Once they're in their adulthood, no laws or technology will fix their behavior. Gotta fix it while its fresh in their impressionable minds.

Re:Why technology nor the law is the answer

[GreyPoopon]

What the hell happened in their childhood that promotes these people to ignore their conscience and annoy millions of people for the name of $?

I agree with you, and I'd really like to know the answer to your question. Unfortunately, here in the United States this attribute seems to be the rule rather than the exception.

Re:Why technology nor the law is the answer

[Anonymous Coward]

Same thing that causes people to steal music to save themselves $.

Stealing music is a very uncommon crime. In fact, it's so easy to obtain music by infringing copyright (i.e., downloding it via P2P) that very few people bother to steal it (i.e., break into a music studio and take the master recording with them).

Re:Why technology nor the law is the answer

[daeviltwin]

That's right. Invading Iraq and killing those damn Iraqi's in the name of cheap oil is one thing, but sending me spam. Those kids cross the line there.

Ironic

[Root Down]

Alas, it could not even filter out their own mass email...

The problem

[Anonymous Coward]

Spammers flooded the system with valid adresses to ruin the system. There was no way to combat this problem.

Re:The problem

[Czmyt]

If that's true that it was ruined by spammers, then that's sad, but it was bound to happen, and the people who designed the system should have spent a little time considering this likelyhood. Perhaps if they had a system where you could assign a trust rating to the people rating the servers, then it might solve this problem of people providing dishonest server ratings. Something like PGP implements for recording trust in keyrings. Or maybe if they ran a system like Razor, DCC, or Pyzor, where users could report actual spam, then you could accumulate information about the servers spewing the spam and start blocking addresses based on that.

Vigilantism.

[Anonymous Coward]

This is why we need vigilantism. Spammers are less likely to risk spamming if it puts their families' lives at risk! And no, I AM NOT KIDDING HERE.

Re:Vigilantism.

[Anonymous Coward]

Well, you should be, since such threats are probably illegal. I, myself, do not condone attacking people.

However, there was some spammer on 20/20 who seemed rather unrepentant, even though he'd apparently been vicitimized in quite a few ways (rocks through window, harassing phone calls, car stolen & destroyed, etc.)

The fact that he wants to *continue* spamming only proves one of the fundamental traits of spammers to me: spammers are stupid. The rest of the story tended to confirm the other trait: spammers lie. (He wouldn't show them an example mailing, claimed he didn't send out the porn or scams--the other spammers did! I highly doubt that he has a clean record, but I'm sure there are some websites that would show the spams linked to him for reference if anyone cared...)

I disagree

[Mothra the III]

If you outlaw spam, only outlaws will have spam

So thats why

[Lemuel]

Trustic wasn't replying to my submissions anymore. Now I know why.

While I did my part to contribute to the Trustic database, I wasn't real sure about their methods. I submitted spam messages as they requested, but I had to tell them which address to consider to be a spam gateway. The addresses above that are marked positive. I always picked the first address outside of rr.com, but for all I know the nearest Roadrunner smtp system is a spam forwarder and I should have flagged it as negative. Pooling lots of people's ignorance won't necessarily provide good information.

Re:So thats why

[elvey]

I don't think it's a problem that the RR smtp system was rated good (positive) by you, an RR customer who sends and receives email via said system. That would cause trustic to weigh the value of blocking that legitimate traffic sent using it against any spam that was sent using it, in deciding whether to blacklist it. Sounds pretty good to me. I'm looking forward to the son-of-trustic. (Yes, sending and receiving could be via systems on different IPs) Integration with a system like SpamCop would help.
--

Why not Whitelist?

[SeattleGameboy]

I don't understand why everyone is so worked up about SPAM filters. There is a simple way to handle SPAM - use whitelist.

I have been using a whitelist email for over a year and I can honestly say SPAM's don't bother me at all. It takes literally 4 to 5 seconds to look over 40 to 50 unapproved senders' message headers (enough for once a day). It is a LOT easier to sort out names you recognize from a sea of junk then the other way around. And when you get an email in the Inbox, you know it is somebody from you know and relevant to you.

Who needs a filter?

Re:Why not Whitelist?

[stratjakt]

Theres an easier way.

Use a hotmail/hushmail address to sign up for slashdot and other web forums and porno sites.

I get maybe a half dozen spams per year on my real account, and a couple hundred people and businesses have the address.

Re:Why not Whitelist?

[SeattleGameboy]

Isn't that same as creating a whitelist but using two separate email address to do it? I used to do the same, but I just got tired of switching back and forth since I made many purchases on-line. Now, I just give out my email address without thiking about it twice and I still spend very little time dealing with junkmail.

Re:Why not Whitelist?

[Anonymous Coward]

That's a great idea, except that some people have had their real email accounts for over 8 years. Back in 1996/7 not many people knew or cared about spam, and would attach their real email addresses to their posts (say, on usenet). Now, all a spammer needs to do is query Google or somesuch and voila, instant list!

I guess it's just time to get rid of that old email now that the rules have changed.

But, yes, that's a great idea and one I have started doing myself. I only wish someone had suggested it a while back.

Market For Spammers

[heli0]

How about we set up a market for spammers, modeled after the Iowa Electronic Markets. Except instead of buying futures in political candidates, you buy futures in a spammer dying. If people stand to make millions from a certain spammer biting the dust then the market forces will apply themselves naturally.

Re:Market For Spammers

[Anonymous Coward]

That idea (paying predictors of bad people's deaths) has been fleshed out before, in much greater detail, as Assassination Politics But it's extreme. Practical permanent solutions

Not the whole truth...

[Anonymous Coward]

I recently received an email from the anti-spam service Trustic saying: "We have decided to close the Trustic service. We have determined that the system as it currently is designed will not achieve the level of accuracy that we require, and an inaccurate system is worse than no system."

He forgot to add that the rest of the letter read

"... so instead, we are offering you a true ONE-TIME OPPORTUNITY! You too can get a credit card, COMPLETELY FREE OF CHARGE! Call 1-800-TRUSTIC NOW!"

statistical filters avoid blocklist pitaflls

[bigberk]

Statistical filters (like those that run at the user level, not side-wide) can very effectively filter spam for users without the fear of collateral damage that goes hand-in-hand with blocklists. Although locking IPs and netblocks definitely saves bandwidth, it can result in loss of legitimate mail.

Statistical filters such as Bayesian filters have the advantage of considering all mail, then filtering out spam based on content. In my testing on over 5000 emails over several months, I have only had 5 "false positives" (all non-English, BTW) and a total filter effectiveness of over 97%

If you have access to a shell account on your mail system, or you run your mail server you really must check out spamprobe and optionally the webfilt interface. spamprobe is a fast Bayesian mail filter that is invoked by procmail, and webfilt is an interface that aids reclassification. Both are free.

Re:statistical filters avoid blocklist pitaflls

[Anonymous Coward]

You were very lucky, I find that the baysean filtering has a miss rate of about 1 in 20 on BOTH sides. So 5 out of every 100 legitimate mails are tagged as spam and 5 spams get through.

I agree with the site maintainer. An innaccurate filter is worse than no filter at all. The filter that ditches "unwanted" email has to be 100% accurate. Not 97% not 90%. 100%! (When is 97% not good enough? Imagine of only 97% of plane flights reached their destinations, 97% of all packages got through the mail, etc...)

If that 3% of misdirected/overlooked mail contains that one very important piece of e-mail, your MORE screwed than you were before...

whitelist servers

[zoloto]

what we need is white list servers, where only those who are in your contacts list (Addressbook) can be let through to your inbox. A standard Comma Seperated Value (.cvs) document with just addresses at the least will do just fine leaving the server to do the filtering to /dev/null.

When a user sends out to a new address it's automatically added to the white.lst this can also work for domains...

Another idea... have special filtering options available so if you fill out a form on a webpage, you can add a special filter in the subject ie: subject:[special filter](in a subject.lst)so it'll get through.

even better, throw in gpg/pgp for the heck of it.

anyways, jsut my 0.02c

They just gave up too early.

[freeze128]

Maybe their solution WAS viable, but they would rather not be just a half-assed anti-spam service.

Maybe all the mediocre hardware manufacturers should give up too. "Who needs another low-cost motherboard?"
Or maybe Red Hat and Mandrake should just give up because Debian is obviously better?
Maybe Yahoo and AltaVista should shut down their seach engines because we already have Google.
It would be sad if this was a trend in today's economy. Companies just give up because they think they can't make money.....

SpamAssassin

[aclarke]

Agreed. SpamAssassin with the Bayes filtering turned on (and properly trained) is a wonderful thing. It is amazingly accurate and the other good thing is that it's not obnoxiously intrusive like IP blacklists.

Of course, it's not exactly a trivial install for your typical Windows/Outlook user, but the fetchmail/procmail/spamassassin/IMAP combo I have running now is hard to beat for a well oraganized email system.

Because customers tend to dislike it

[jobugeek]

Tell me how I am going to look at the hundreds of senders a day and verify they are OK to let through? I can't. Therefore, something needs to be there to filter it. Are filters tons better? No, but they atleast keep some of the crap out.

Re:Because customers tend to dislike it

[SeattleGameboy]

I do that everyday and it is surprisingly easy. Here is my personal experience. The first month was bit confusing since my Address list didn't cover EVERYONE who regularly sends me email. So, going through the SPAM folder was a pain, but after that, 99% of my legitimate email comes through without any problems. Only new email I get is from new vendors. But when I order something on-line, I know to expect an e-mail from them so I just look for their email in the SPAM folder. Trust me, human pattern recognition capability is VERY VERY good. I can pick out the single email that I want from 100 email headers within 5 to 10 seconds. You do that three or four times a week and that is enough to make sure that you receive every email you want. The key is that you just move on if you do not recognize either the address or the header and most spams have very similar headers. Try it for a month. See how it is. I personally love it.

Trustic is good

[Anonymous Coward]

Trustic is a good service, The author is trying to save the world and his giving up when he feels he cannot.

I didn't think his service was all that bad, it just needs some shaping up.

1) Pos query was a bad idea, since all emails are trusted by default and were overriding negative trust on real spam which results in way too many false positives.

A good solution would to create multi trust levels with a no status default query.

Example:

I enable trustic query on my mail server, then i login, i see all the mail servers that tried emailing me, now i look at which ones spammed me based on complaints or un-expected email i receive and set a blocking bit with the reason I think i should block this mail server with proof of an email.

Then set a 3-day wait period on this mail server
to see if it becomes a legit repetitive offender and then, if it received a lot of attention, and the reason's are valid, the operators block it from ever coming through.

Right now their pretty weak but if they had a good attentive user base, they could poke mad holes in spam.

Offtopic. Don't Care. Will Crush.

[mobileskimo]

What the hell happened in their childhood that promotes these people to ignore their conscience and annoy millions of people for the name of $?

• Same thing that causes people to steal music to save themselves $. Greed.

Greed is that thing that happened in their childhood that promotes these people to ignore their conscience? Please explain.

If you're gonna make an offtopic response to make a remote analogy, in order to push your opinion about music sharing, atleast make the analogy work right.

If you want to go offtopic, you picked the wrong guy to start a debate. Greed is what causes executives in the music industry to blame music sharing as the ill of their demise, instead of the profit making crime organizations that burn CDs and sell on the blackmarket that actually steal potential sales, as this article points out. Since the evil music sharers are much easier to serve court papers than a rogue black market businessman, they can point the finger at these students that wreck so much havoc, and save their jobs when the board of directors ask why their revenues have slumped in this wonderful economy, inlight of such a great outlook for their industry.

Representatives such as RIAA and MPAA like to use the term "steal" and "theft" to promote the scarlet letter labeling of "criminals" like the students they've prosecuted. They are masters of advertising afterall, they know how to make an impression on the less informed public.

They had a vision...

[Anonymous Coward]

They had a vision...

(who here can post the rest of this classic?)

NOT FUNNY

[Anonymous Coward]

I am not fucking joking here.

Poisoned well problem

[obtuse]

Wow! That's the most interesting thing in the article, if true.

It's also a problem that will recur in any public cooperative effort. SETI@home has to essentially double their work because they know that it is possible that a large percentage of their results are crap. The problem is guaranteed to be worse if someone profits by poisoning.

The only answer I know of is validation. As I understand it, SETI@home ensures that any dataset is processed by at least two different nodes. I assume one problem with Trustic was that there's no time for validation. By the time you've validated that an address is evil, the parasite has moved on.

I'd love to hear what makes Trustic unfixable. It sounds like Trustic's "trust network" model (weighs contributions from trusted members more) didn't work, but the difference between not working and insurmountable is interesting.

I MADE THAT UP

[Anonymous Coward]

And you idiots modded it to (Score:5, Insightful)! What a bunch of dumb fucks.

Mozilla's Bayesian

[siskbc]

65%? Seems low compared to something that scans content, like spamassassin. I get around 90% blocked, with a relatively low (maybe 1% false positive after a week of tweaking on and off).

I'll take Mozilla's filter over that. By now, I have over 98% spam tagging rate, and I've only ever had 1 false positive, and it was an autorespond from a company (hardly counts). It has seen about 1500 spams or so.

What we need is a massive spam repository to train those Bayes filters.

Re:Mozilla's Bayesian

[CleverFox]

I will be making my 75,000 spam 75,000 nonspam database available as a download for Mozilla Bayesian soon.

Re:Mozilla's Bayesian

[siskbc]

I will be making my 75,000 spam 75,000 nonspam database available as a download for Mozilla Bayesian soon.

Excellent! My first question is how you actually get a 1:1 ratio of spam:non-spam?

Re:Mozilla's Bayesian

[CleverFox]

Actually I have the database ready as a 15 meg bzipped csv file right now. I just need to find someone who can convert it to the mozilla .dat format and host it.

This is built from mail at my corporation which is probably close to 65% nonspam. However, this corpus is built from outside sources as well and then I have pieced together months of spam and nonspam messages as suits me. It is all very complicated.

This is a very clean corpus. The spam is 100% spam and the ham is over 99% ham. There may be a very occasional spam that made it into the ham, but for a database of mail this large, it is hard to be perfect.

Re:Mozilla's Bayesian

[siskbc]

Actually I have the database ready as a 15 meg bzipped csv file right now. I just need to find someone who can convert it to the mozilla .dat format and host it.

You should talk to the guys at Mozdev - I can't believe they wouldn't be interested. I think the mail filter should come with a "starter kit" of signatures that are used until the user builds up a decent library. And 15,000 is a lot - I've got probably 1/10 that. It should make for an interesting project.

Can be a server operators nightmare...

[Sim9]

For small server operators, getting falsely listed in a central blacklist can be a long and painful process. Inheriting a 'bad' IP address (one that was previously used for spamming, and is now recycled to a new owner) or getting banned as part of a range for the datacenter hosting you essentially blocks you permanently. Few people running these are concerned about false-positives, as everyone that tries to get themselves unlisted /must/ be a spammer. Perhaps this isn't true of the majority, but I've had horrible experiences with at least a minority.

Mod me down if you must, but if there's going to be a central blacklist, there should be checks and balances to its system.

Re:Can be a server operators nightmare...

[Indy1]

simple solution, dont use hosting services that support spammers, like XO, C&W, any of the bell companies, burst, verio, etc. Check www.spamhaus.org/sbl to see if the hosting service your thinking about using is a known spam haus or not. Companies with lots of listings should be avoided.

Re:Can be a server operators nightmare...

[Anonymous Coward]

That's nice in theory.

However the company that I work for has been listed several times, and we have not once sent a spam message. The problem was caused by forged ips in the headers, and bad mail servers at AOL/yahoo that accepted emails with this level of forged headers.

It's about time blacklist operators realised that their systems are not perfect, and being willing to communicate with a blacklisted site. Of course the worst ones, or those that also use the same black list and don't provide an alternative method of contact.

Re:Can be a server operators nightmare...

[pqdave]

The checks and balances are that if the list is too aggressive and arbitrary, few will use it. If there were some sort of official process to prevent a blacklist entry the spammers and their ISP's would learn to use the process to their advantage. The point of most blacklists isn't to block individual spam, it is to pressure the big guys into doing the right thing.
In your case, you should find a spam-free host for outgoing mail, if not for all connectivity.

Re:Can be a server operators nightmare...

[Anonymous Coward]

"It's about time blacklist operators realised that their systems are not perfect, and being willing to communicate with a blacklisted site. Of course the worst ones, or those that also use the same black list and don't provide an alternative method of contact."

That was one of the nice features of Trustic, accountability and a means of appeal. RBLs run by anonymous zealot hobbiests are a bad idea. Hopefully someone will actually succeed where Trustic failed, because they had the right idea.

The problem with Trustic

[waynemcdougall]

The problem faced by Trustic was a lack of positive recommendations. People were quick to complain about spam, but slow to make any positive recommendations.

The effect of this was that large mail servers (eg cable gateways, etc) which let through a very small percentage of spam but s detectable quantity, would get a host of negative recommendations and the server would become untrusted.

I don't think this was an unsolvable problem - it requires dealing with trust, and positive versus negative recommendations, and volume assessments. But it should be possible to come up with a function that would give meaningful responses even in an inherent;y untrustworthy system of recommendations, and disproportionately few positive recommendations.

For one thing an inappropriate listing of untrusted would provoke a host of positive recommendations.

And of course you could/should whitelist your Mum's cable based SMTP server anyway.

There are people who want to pick up the Trustic idea (or keep Trustic going if possible), and I wish them every success and will support any such efforts.

I think there is a place for cooperative based recommendations estabishing a trust network. It will just take time and thought to determine how to balance the positive and negative recommendations.

What I particularly like about Trustic is that I can make recommendations based on IP address alone - if a mail server tries to send email to clearwater@codeworks.gen.nz I KNOW it is sending spam - I could reject the recipient, and report the IP without incurring the time and bandwidth of accepting the mail message.

Try Spambayes

[Nik4]

My experience with the Bayesian filtering based Spambayes is extremely good. It is very transparent so that you can see how it is classifying.

Unless you use Outlook, you would need to use the pop3proxy.py application.

Read to understand how it works. Too dense for me - but it does work!

Re:Try Spambayes

[N7DR]

My experience with the Bayesian filtering based Spambayes is extremely good. It is very transparent so that you can see how it is classifying.

Or try popmail. Or Mozilla Mail. Or almost anything else with bayesian filtering. I had stability problems with spambayes so I use popmail on some systems and Moz mail on others. Popmail in particular verges in the magical (for me, anyway). The real message here, though, is: if you see more than about one spam per week, try bayesian filtering.

Innocent victim of anti-spam systems

[Cogneato]

Over the past few months I have been through a lot fighting anti-spam ip lists, primarily relays.osirusoft.com and spews. For all those saying that false-positives are rare or not that much harm compared to the need to stop spam, I think if you were in my shoes, you would feel differently.

The whole thing started when a spammer signed up for service at the hosting company that I have been with for several years. I have a server there with many of my clients websites on it (I am a web designer). So, the spammer purchased service at the same host as me, and happened to fall within the same IP block as I did. He was soon discovered and shut down, but the damage had already been done... spews and relays.osirusoft.com both put the ENTIRE ip block in their system.

Think about it this way: what can the host really do? The spammers come in, pay the setup fees, get one good night of spamming in, and then move on.

It took me several days to track down why some of my emails were not going through and who I had to contact to get removed from these lists. relays.osirusoft.com had some tools that is supposed to re-check, but it did no good... as far as I know, the thing doesn't even work.

In reading through these two websites, the self-righteous bastards that put together these lists really don't take any responsibility for their actions. They are quick to add entire IP blocks and take weeks to remove them even after the host has contacted them to inform them that the spammer has been shut down. These anti-spam lists apply fault to the host or to the isp implementing the list, but never to themselves, while at the same time preacing the wonders of the services they provide. If they don't want to take responsibility, then they should print more warnings about the mass amounts of false-positives that actually happen.

In addition to the anti-spam lists, the isps really need stop relying on these lists as the first defense to stopping spam. I had a chance to talk to one of them that a client of mine was going through and they told me that there was no way they could add me as a trusted ip because the anti-spam list comes in front of the exceptions list as a first line of defense. Even after we finally got removed from the anti-spam lists, many ISPs did not update their copies of the lists for weeks afterwards, causing more blocked emails even after we were off the list.

So, after hours and hours of frustration, fielding support calls, yelling, long distance phone calls, writing emails, reading page after page of self-righteous dribble, and trying desparately to explain that I just happened to have an IP address that was a coupled dozen numbers off of that of a spammer, as far as I am concerned, the more anti-spam lists that die, the better the place the world will be.

I hate spam. I cuss every fifth time I have to delete one (making that about 20 or 30 nasty words a day)... but the people who have really cost me the most time, money, and headaches are the anti-spam lists. Good riddance.

Re:Innocent victim of anti-spam systems

[Anonymous Coward]

The whole thing started when a spammer signed up for service at the hosting company that I have been with for several years. I have a server there with many of my clients websites on it (I am a web designer). So, the spammer purchased service at the same host as me, and happened to fall within the same IP block as I did. He was soon discovered and shut down, but the damage had already been done... spews and relays.osirusoft.com both put the ENTIRE ip block in their system.

Unless its a well known spammer that can be found on such lists like ROKSO ( http://www.spamhaus.org ) I doubt that it was that "immediate" as you make it out to be.

Soon as in relation to what length of time? Soon for me is 24 hours after the first complaint about "spammer" comes into abuse@

In order to even get on the spews list, the spammer must have been there a lot longer "spamming" and your ISP that you hold dearly ignored those complaints that came in. From the looks of most of spews listings, many of the networks and spammers who are listed, are those that have been spamming at least for month or more without any action on the part of the ISP to stop the abuse.

So you might wanna curb that "death sentence" troll that is so commonly used here about how blacklists are bad because "it hurst me as well" and look at the big picture.

The spammer happened to be in your ip block? How long was he there? Must've been quite a while in order to get listed.

Osirusoft is a list of open relays, so did said spammer leave an open relay? Why didn't your ISP act on reports about having insecure webserver on their property?

Without giving up much about your specific situation, we can hardly see your "side" when there are more against you than there is for you.

And iF YOUR ISP was dumb enough to sign up a known spamming vermin, they have deserved to be blacklisted for making a stupid business decision like that.

Think about it this way: what can the host really do? The spammers come in, pay the setup fees, get one good night of spamming in, and then move on.

If they get onto blacklists, the spammers were there a LOT longer than just the "whack a mole" spammer we see. What can isp's do? ACT ON compalints that fall into their abuse@ . Dont ignore them, and dont combat with hostility or give "spammers" time to move. 24 hours is more than enough time to act on a complaint.

Why do many of the isp out there do not land on blocklists? Maybe they know how to run their Isp in an ethical manner and actually respond to abuse complaints.

It took me several days to track down why some of my emails were not going through and who I had to contact to get removed from these lists. relays.osirusoft.com had some tools that is supposed to re-check, but it did no good... as far as I know, the thing doesn't even work.

See now you're mudding the details of your blockage. You said you were listed at Spews? Well that's easy enough to figure out. What is your IP address? Plug that in and it will pull up the record for yoru spam loving isp. the listing is in chronological order and usually starts with the single ip involved in spamming. Follow it and you get the big picture.

In reading through these two websites, the self-righteous bastards that put together these lists really don't take any responsibility for their actions.

AWW poor baby. Just because the other kids dont want to play with you, you dont havta go crying to mama.

What responsibility do they need to take. They just list ips/spam sources from what they receive . Its up to Joe Schmoe ISP to judge the list and then use it to his /her / its discretion.

You should direct your ire to the irresponsibility of your ISP for getting your ip block listed in the first place.

They are quick to add entire IP blocks and take weeks to remove them even after the host has contacted them to inform them that th

Re:Innocent victim of anti-spam systems

[Cogneato]

I just spent a few minutes writing up a response to you and then realized that you don't deserve it. It is easy to flame when you are not even willing to show your face. It is much more difficult to have a informed discussion about how the system itself is broken and costing innocent people money.

We go on everyday talking about how spammers cost the american companies so much money per day. So why are we willing to accept a solution that costs other companies, including small businesses like mine, so much time and money? In the end, Blocklists will not be the answer. They aren't even the best option from those available today.

I know that many system admins out there that may be looking at them as a very tempting answer to your problem (a problem I very much understand), but I beg you, please take a second look at other solutions before you place your trust in these lists. For as frustrating as spam is, these lists burn your fellow geeks, like me.

Re:Innocent victim of anti-spam systems

[RipCurl808]

Why not just post your answer. There was nothing to flame in that, but if you found one, you obviously are trying to place your anger in the wrong direction. I've read over your ignorant post about how you were hurt; Spammers hurt us more. The ones that dont do business ; or run a website, or do anything. They hurt the average consumer by cloggin our email inboxes with crap we would never buy ( yea im gonna buy viagra from a company hosted in costa rica ) and THEY are the ones who drive up the cost you are so mad about . If your ISP doesn't want to place nice with the rest of the kiddies, they go into the corner with the other bullies. You obviously are not a sysadmin, and it shows in your ignorant post that you have absolutely no clue why blocklists do exist. Go back to 1976 please, your thinking is doutdated by almost a generation.

Re:Innocent victim of anti-spam systems

[Cogneato]

I actually went over this issue with my host. It is against their poicilies (as posted on their website) to host for spammers and they shut them down "no questions asked" as soon as they are discovered. Like the other poster said, it is not like the spammer came in and announced that he would be spamming from the server.

I explained my experience in my post. How can a simple description of my experience be ignorant? Don't displace your anger towards spam on me. Like I said, I deal with spam on an everyday basis too.

I don't think you understand that these blocklists do not coordinate with the hosts. They put an entire IP block on a list without even sending out one email to the ISP, and many make this policy clear on their websites. The only way you can tell that you are being blocked is to look at the bounced emails, and by that time it is too late.

They are also much quicker to put an IP block on the list than they are to take one off. SPEWS, for example, complains that they are simply too overworked to remove blocked servers from the list in any reasonable amount of time. If you don't have the time to upkeep such a harmful tool, then why offer the service in the first place? I would not have a problem with these lists if they would take the blocks off in a day or two, but we are talking about not having access to your outgoing emails for weeks.

I mean, if they can put an entire IP block on a list, then why not a single IP address, or a smaller range? The answer is clear -- in the own self-righteous crusade they want to hurt as many people as possible because, like you, they assume that the ISP is fully aware of the spammer when they are clearly not. By hurting many people, you create many complaints... but this is kind of like bombing an entire town of civilians to get them to revolt against their leaders. Perhaps effective, but is it really moral?

When anyone here wants to order a server, I am sure that they expect certain things: fast setup times, not having the server's email crippled, not having spyware installed on the server, being allowed to change their password, and on and on. If these are things the you expect from an ISP, then I wonder how you can expect an ISP to know when a spammer has signed up for the same service that you would order yourself. The best thing I could think of would be some program that would monitor the outgoing mail that is installed outside of the server. Perhaps the blocklists should post some advice about these kinds of programs if they really want to help.

But I don't really think that they want to help at all. They are kings of their hill. They have a crusade. This makes them feel powerful. And to them, that is all that matters.

Personally, I like to go through life harming as few people as possible. If that means I have to delete a few emails by hand, then so be it.

Re:Innocent victim of anti-spam systems

[Anonymous Coward]

I hear ya with regard to spews and osirusoft.com by its association with spews. But I think that was part of the motivation for Trustic, to provide an RBL that was run more responsibly with a clear means of appeal.

I read an article on them, read their terms and emailed as to cost for commercial use. My reply was the letter mentioned in this story. It would be nice if there was an RBL that was not only not a pain to small businesses like yours and mine, but which we could feel safe using ourselves.

I'm currently offering clients TMDA white listing, but it would be so nice just to be able to bounce the spam, confident that it was spam that was being bounced.

I called it

[augustz]

Interesting, see my earlier post about them.
http://slashdot.org/comments.pl?sid=72548&cid=6542 483

Wasn't too impressed, crazy that the O'Reilly people picked them of all folks, looked to me like the author had some connection with the service. Bad form.

Sorry things didn't work out

[jrothlis]

I signed up for Trustic a couple of weeks ago, and fifteen minutes after configuring my mail server to use it, I had bounced a legitimate email. The email in question came through Sneakemail, a service I use to generate disposable email addresses for posting on websites, etc. Well, presumably somebody using Trustic had received SPAM through a Sneakemail address and promptly made a negative recommendation against Sneakemail, which blacklisted the server.

Trustic uses a "karma-like" system where the more recommendations you make, the more your recommendations are worth. I think the problem with that system is that it is very open to abuse and mistakes. And even though I loathe SPAM, I don't hate it enough to want to expose myself to losing legitimate email.

So very sadly I disabled Trustic as an RBL source on my mail server.

I'm sorry things didn't work out.

non-victim of anti-spam systems

[CryBaby]

I don't really see where the "victim" part comes in. Your spammy ISP was blocked, as it should have been. They finally kicked off the spammer when SPEWS turned up the heat by listing a block of ip's. No more spammy - no more listy. Situation resolved. This is exactly how it's supposed to work.

What you fail to realize is that other customers of your ISP probably did not sit around and whine about how unfair blocklists are (probably because they never heard of them) - they called the ISP and complained. As luck would have it, these complaints were directed at the correct party - namely the one who is enabling and profiting from the spammer's activity. The ISP then decided they needed the legit customers' money more than the spam-money.

Also, you begin your rant with a completely unproven and frankly unbelievable premise. You imply that the spammer was "discovered and shut down" before the block was in effect. That's funny because 99.99999% of the time, it's the block that gets finally gets an ISP's attention and results in positive action. Show us the evidence file and your correspondence with your ISP to demonstrate that SPEWS blocked after the fact or, just as importantly, jumped the gun by immediately listing a large block of ip's. Guess what? You can't because the facts contradict your story. Did you even look at the evidence file? It's obvious that you didn't join the newsgroups...

All you really need to understand is that sys admins will continue to use SPEWS and other RBL's because they work. A busy sys admin desperately trying to keep up with spam traffic doesn't care about your opinion.

FYI - I have had my client's servers blocked by SPEWS in the past. The situation proceeded much as yours did. I considered it a success and was impressed that there was a tool which could actually change the behavior of ISP's for the better. The ISP in question (now one of the largest in the U.S.) converted from a spammer haven to a fairly responsible outfit - because they were FORCED TO BY SPEWS.

Re:non-victim of anti-spam systems

[Anonymous Coward]

Paragraph by numbers:

1. That's your theory. However the previous poster said they kicked them first.

2.
a) How exactly is a company supposed to know before hand if someone is going to spam on their service? You tell the story like they intentionally allowed the spammer to join. When all they did was sign up a new client. It's night like people sign up under "Spammer'R'Us" or anything.

b) Why do you feel it is justified for an ISP to incur costs, after the fact because of slow to change/update block lists.

3.
a) 99.9, etc % and _THIS CASE_ are not the same thing. I would personally not put the percentage that high. There are very few ISPs that intentionally allow spammers.

b) It isn't hard to shut down a spammer before being blocked. You just watch the logs for a client sending unsually large numbers of emails and investigate. I would be surprised if most ISPs didn't track the emails per client when they offer such a service. Then how long after being sent does the user report it, days, months...etc.

Actually you know what, it's pointless to go on because you appear to be one of these "self-righteous" individuals. (Hint: Don't ask for facts, then immediately say the facts show "blah". As you only look like a moron)

Re:non-victim of anti-spam systems

[Anonymous Coward]

Paragraph by numbers:

1. That's your theory. However the previous poster said they kicked them first.

And with all things on the net, there are two sides to every story, and the Op on this subject is definitely not seeing both sides. He's claiming that his ISP kicked them prior to listing? Then Why would they be listed? Your "answer" makes no sense.

Spews spamtrap gets spam from xxx.xxx.xxx.xxx domain at XXX ' isp.
Spews sends a complaint to abuse@xxxx .
XXX does nothing.
Spews gets more spam from the same ip . Spews lists the ip address of the origination of hte spam, more complaints are sent
Spews gets more spam from the same ip; spews escalates the block to get the ISP to do something.
ISP continues to ignore; spews escalates again.
ISP decides to move spammer to another IP space because now the original is blocke.d
Spews doesn't play games so it decides to escalate its block by encompassing the new IP blocks the spammer moved to.

What's so "hard" to understand about this simple little concept.

YOU ignore abuse compalints, you pay the price.

Sorry, SPEWS doesn't work on pre-emptive blocking, and by history, has never worked that way, unless the spammer is of the ROKSO Breed who are "list on site" spammers because ISP's shouldn't be doing business with known spammers.

I belive the posters story as much as Ronald McDonald selling porn to children at McDonald's locations. Why not list the Spews case file number? LET us be the judge of why he was CORRECTLY blocked.

2.
a) How exactly is a company supposed to know before hand if someone is going to spam on their service?

Visit newsgruops and sites that deal with spam and spam fighting. A simple google search will bring up several thousand complains on CongentCo, Verio, Level3, Rackspace, UUnet alone. AT&T and Sprint complaints have slowly waned , but the complaints about spam and abuse from their network spaces are still archived. Its called due dilligence. If you are unwilign to research the company you plan to do business with, you pay the price for not researchng thoroughly.

And keep on researching every couple of months to make sure your ISP you do business with is remaining kocher.

SPEWS and OSirusoft and Spamhaus all have look-up availability on their websites; takes all of 30 seconds to each site to check your IP's against their DB's to see if you are part of their "public" blocklist ( for privately used ones, you are up $#!+ creek on that, and will have to deal with those sysadmns personally ).

I moved away from Interland because I was getting my mail blocked. Did I complain to the people blocking me ? No, I complained by canceling my account with them and moving and GAVE my reason that I could not do business with and ISP that is willing and knowingly doing business with spammers. I pay a much higher rate now, but for a spam free/unblocked ip address i'm all for the benefits.

You tell the story like they intentionally allowed the spammer to join. When all they did was sign up a new client. It's night like people sign up under "Spammer'R'Us" or anything.

You make it seem like they listed the spammer on site before spam came out of their netblock.
IF the spamemr in question ( and since we dont have the actualy SPEWS file number, we can only guess ) was on ROKSO, then they deserve to be listed. AND ISP can easily query ROKSO Before commting to any contract with a spammer. The way "isp" handle sign up of new accounts are 90% of the reasons why spammers can get fast hosting. Change the way sign ups are handled, and you can cut the spammers new sites by at least 30%.

His isp didn't do antying on complaints and let the spammer run. That is what happened.

Here's a simple analogy for the "big picture" impaired.

You have two children; your oldest child is invited over to play games with your neighbor's child. Your child destroys their huse and breaks all your neighb

Re:non-victim of anti-spam systems

[Anonymous Coward]

He's claiming that his ISP kicked them prior to listing? Then Why would they be listed?Because people who run anti-spam blacklists are a bunch of incompetent morons. Duh.

Re: defining spam

[Jawn98685]

Rubbish. Spam is well-defined; unsolicited commercial email (or canned pork shoulder and ham, depending on the context). If you send me an email, that I did not ask for, and in the absence of any prior commercial relationship, in an attempt to solicit me, it is spam.