Slashdot Mirror
Paul Graham: Filters that Fight Back
Mortimer.CA writes "Paul Graham is back with another article about combating spam. It's entitled Filters that Fight Back: 'One intriguing idea is to literally fight back: to make filters disable spammers' servers by automatically following all the links in each incoming email. We may be driven to this in order to achieve accurate filtering anyway. Why wait?' One danger is someone doing a DDoS by sending fake spam."
And now thanks to links posted to Slashdot, Paul Graham is being DDoS'd =)
Vonal Declosion
this idea is just as bad as "email tax". remember: WHEN YOU GAZE INTO THE ABYSS, THE ABYSS ALSO GAZES INTO YOU? I prefer SPEWS even if they get occasional bad press.
In response to the comment: "One danger is someone doing a DDoS by sending fake spam"
From the article notes: "[5] The best way to protect against abuse might be to have the central authority whitelist every site by default, and then, by whatever protocol, take certain sites off. Because you can look at the sites before taking them off the whitelist, there is little danger of people abusing this system to attack an innocent site."
Why do I h8 apple?
If I load an image or a link from spam, it's possible that a spammer could be validating my e-mail address for future sale, or perhaps increased spamming since he knows someone is actually reading the message. For example, http://server.foo/image.gif?id=ab0a98df12j3 could be unique to the spam that was sent to me. If any user-agent accesses that URL, the spammer knows that my e-mail is active and I'm reading his junk. I don't know if they actually do this in practice, but I'm wont to load HTML messages because of it.
"I'll say it again for the logic-impaired." -- Larry Wall.
In the situation where the spammer gets paid by hit, the spammer would be rich overnight. But, then the customer might see somthing a little fishy, then start asking questions.
Fight Spammers!
The interesting thing is how the courts would end up viewing auto-clicks vs manual clicks. I'd bet that if a user set up a filter then it would be effectively view as the user doing the clicking...
The next site to slashdot will be ready soon, but subscribers can beat the rush and start slashdotting it early!
/.ing moves from the web, right into your own mailbox! All the fun of crushing someone elses website without all of the work of clicking those tiresome links.
Note to self: Move web site off of modded GameBoy running apache.
Which means : 1. receiver of the spam will waste even more bandwidth 2. spammer may verify accounts by posting links like http://bla.com/bla.php?stupid@email.com 3. Already said : DDoS attacks initiated via spam
a deliberate denial of service attack is illegal whether the victim is an innocent website or an evil spammer. There is no internet equivalent of lawful self defence.
If a spammed website is brought down by a method such as this, it wouldn't altogether surprise me if they sued the maker of the software responsible. Matters would be complicated if, as they might, they deny responsibility for the original spam e-mail.
(This is the case in the UK, I'd guess the position will be similar in the US but IANAAL (I Am Not An American Lawyer))
On the other hand, the "scan the spamvertised website for its content" sounds a great technical approach.
I think everyone would agree with me that there is no 'fake' spam.
Seems a bit retarded to at least double the bandwidth drain from spam. Its bad enough as it is. This is *not* a viable solution, unless the spammers happened to be one hop away...
I like the idea, anything that drives up the cost of sending spam above the value derived from spamming is a good thing. I'd also like to see some automated poisoning of things like mortgage solicitations. This type of spam is really intended to simply get your name, address and phone number which are then sold to mortgage brokers for further solicitation. The mortgage brokers pay $10-50 for these lists of name, if the lists were filled with automated junk information the value to the mortgage brokers would quickly drop to zero and this type of spam would drop to zero.
Whitelists already exist to a degree - if the email is in razor, and you've marked it as spam, then it's been checked as a human, using a trust network, to be spam. Simply follow links if the spam is also in razor...
Score:-1, Funny
... bounce the connections through proxies and attach fake return paths. I guess this would punish people who don't (don't know how to) close their proxies to the outside world.
I suppose you would burn the amateur spammers that run cots spam software off their AOL connections.
I have to admit looping fetch/wget in a few cases where I was repeatedly and persistently spammed by some sites. They did invite me to visit, after all, and the spam didn't ask me to limit my browsing to 1 hit. I've daydreamed a few times about a distributed "spam spider" where thousands of people run a client which sits in the background, fetching spamvertised websites. The client would retrieve a fresh list of sites to visit every hour or so.
The only hole in the idea is finding a trusted, centralized moderator (or moderators) to control the list of spamvertised sites. The RBL model has shown repeatedly that the individuals in charge of such lists will occasionally use them to further a personal vendetta of some sort. But with the right person at the helm, someone who receives a lot of spam and can identify real spam from joe-jobs, it might just be possible to maintain a rolling database of sites promoted in spam.
--
Rate Naked People! at Fuck Meter! (Not work-safe)
the exploits.. I mean, couldn't this have potentially bad side effects if a new exploit comes out?
Might be some legal problems disabling their server. But who really cares ?Not the gov. Not me.
"We should try to ensure that this is only done to suspected spams"
I am not sure that is 100% possible. In light of that reality, this might just punish any server, not necessarily attached directly to the spammer. For example, if I wanted to shutdown a site, couldn't I spam a million inboxes with that site's address?
I could see this solution, when mismanaged, merely creating lots of extra, meaningless traffic as well.
I am all for doing something to inconvenience spam, but it seems that the most effective solutions always come at a direct cost to everyone. For example, I have read about adding a small CPU penalty calculation for every email sent. This new solution isnt quite as distributed - it adds traffic to networks and places loads on servers, but its still a penalty.
I guess the real challenge is finding a way to penalize the spammers and no one else. Good thoughts, and honestly if my client supported a "punish mode," I think I would be tempted to use it with the same careless sense I apply delete.
I recently switched from a keyword-based spam filter to a bayesian filter. However, there exists several bayesian filter projects and the choice of which to use is not obvious. Therefore, I decided to do an actual test and write up my findings in a review so others can benefit as well. Read it and find out how to win the War on spam.
How about using the bayesian algorithms we have today and apply them to the referred web pages? I'm sure they would have plenty of good material for the filters to detect.. Plus this would propably be more effective with spam that effectively is only an url.
Secondly, I don't call this any kind of DDoS, even though it might seem such to spammers (is slashdotting a DDoS?). If anyone sends me a mail with an url, chances are they _want_ me to check it out. If my system fetches the pages and stores them to a cache, I'm doing exactly what the sender wants. (Mailing lists may be a problem though.)
Thirdly, does it really hurt you to let spammers know that your address is valid? Chances are the address will receive spam nevertheless..
There are other fringe benefits...the overhead encrypting to a large number of keys would certainly slow a spammer's throughput down. Also, this would encourage the use of widespread secure email.
The "disabling" of their servers isn't thru any malicious act but the simple result of many people having set up their computers to automatically explore the website of any URL's sent to them in an email. As the article points out, one of the dangers would be the use of this in a malicious denial of service attack engineered by sending out a spam message which includes URLs on the targeted system. For example, sending out a penis enlargement spam that includes a Microsoft URL.
My hotmail account gets relentlessly spammed even though I _never_ follow any links from spam or let it load any images. Even before Hotmail introduced the "don't load inline images" feature I always disabled javascript + images before opening any suspected spam.
Basically, can it get worse? They never seem to remove inactive accounts anyway.
I have a domain registered which I've owned for three years, and it's still getting spam for accounts related to the previous owner of said domain. My mailer says "no such account" over and over and over again.
Spammers don't care whether the account exists, is inactive, filtered or whatever. They try to spam it anyway.
Belief is the currency of delusion.
This is brilliant. It costs the spammers little bandwidth to send out SMTP messages. But if we start downloading their graphics-rich webpages, and reloading repeatedly, we'll drive their bandwidth through the roof.
The point is not the user's bandwidth, this is really a DDOS, but since the spammer's asked for it (literally, not just figuratively), it's OK.
One danger is someone doing a DDoS by sending fake spam
;)
I'm sorry but spoof's dont usually work to well on me... I'm 2 1337 to be fooled.
Seriously though, if you just take a little more time to look into the header contents of that "penis enlargement" ad, you might find a pretty new IP addy to "play with" *cough* BO2K *cough* or atleast the real route that this spam took to get to you, just follow the yellow brick road back up to Mr. 12 extra inches and... well, you decide your own punishment for 'em
Besides, it's not like you need that ad... do you?
Business \Busi"ness\, n.;
A scam in which all people involved perceive as beneficial...
While the net effect is DDOS-like, we're only doing EXACTLY WHAT THE SPAMMERS WANT! They asked us to visit their webpages, so we did. This is 100% legal, and no court (or jury at least) would see otherwise.
But you've got to watch out for unique tracking images so as not to validate your email address.
This way, very short spams, that consists only of a link and little else, which currently slip through a Baysean filter, will also be detected as spam.
It is easy to prevent the leaking of personal information, so a properly written antispam program will not cause you to receive more spam.
Oh well, what the hell...
According to latest article smap works for big business, which pays $20 dollars per "interested" party for Home Loans for example.
Solution: ruin the market by creating bots to answer spam?
The Bot creates email addresses which when spammed, reply by clicking, then auto-fill the corresponding web site. This would ensure Banks a steady supply of dead end leads at $20 a pop. It won't take long for them go back to cold calls.
AIK
Say some spammer hijacks someones server without them knowing? Then their server will be brought down with this back lash of email. This is targeting the wrong person in that case.
Also, aren't spammers hijacking personal computers as well? I read about viruses used by spammers to open up peoples computers to act as relays.
That means a defensless persons computer will get a ton of email back them.
I like the idea this person has, it just seems like there is too much collateral damage that could happen.
Isn't fake Spam uh...Spam?
Isn't that like saying "I want you to separate the flammable material from the inflammable."
Veritas patesco per quaestio questio. Truth is revealed through questions.
Just finished reading the section of the article that was headed as "Filters that fight back." I think that the biggest issues that keep such an approach from working are fundamental features of the e-mail infrastructure itself: 1) the lack of verification, and 2) the store-and-forward and replicative nature of email itself.
In other systems I am aware of in which active countermeasures may appear (such as firewalls, and tcpwrappers), the adversary can be established with reasonable certainty in most cases; however, because the From and Reply-To addresses can be (and often are) forged and most owners of relaying machines are unaware they are misconfigured, it seems doubtful countermeasures would work at that step. If one uses the URLs, as suggested in the article, it is not guaranteed that the "million" emails sent out will hit the next server along their path at a particular time, so it seems doubtful you can guarantee a massive traffic burst at once. Indeed, what may be seen instead is incremental bursts of traffic at the delivery retry intervals of various mailserver software.
Other questions also arise, such as: 1) how much additional load will a mailserver experience from hitting the links; 2) what additional security issues are introduced in doing so (what if, for instance, the code to do this results in a security vulnerability); 3) how can it be done in such a way that DDOS attacks against innocent victims can be avoided; and 4) how can you get enough people to both upgrade their systems and cooperate in a useful way to do this. Issues 1 and 2 are probably obvious questions to ask-issues 3 and 4, however, I believe suffer from the same weaknesses as some of the current BL schemes. Also, some localities have legal codes which prohibit the interruption of legitimate access to a system, and the server in this case definitely has a way to track back to you at that point, which potentially make participants vulnerable to legal or civil actions.
While I admire Mr. Graham and his efforts in the spam-wars, and find it an intriguing idea, I do not think this approach will truly be successful until changes are made to the underpinning email system that may reduce some of the issues mentioned, but hopefully will themselves make an impact on the issue without being too onerous to prevent wide-spread adoption.
Looking for a downside to this plan . . . still looking . . . Nope. I can't see one.
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
I bet the leet Skr1pt K1dd13 would use this feature to slashdot competitors and other noobs...
Have your filter parse the message in real time, as the server is receiving it. Reduce bandwidth allocated to the sender exponentially with the probability of the message being spam, and remember it for future messages. But don't make it too slow or the sender will simply drop the connection. Increase the bandwidth if some amount of time passes without spam being sent. The only problem is getting everybody to do it.
An interesting side effect of this strategy would be that it would be harder to track comissions based on per-click (instead of per-sale) for the sites employing spammers, thus limiting their income to people who buy (which can gernerally be a better comission anyway, but not offered by all these seedy companies).
The only problem I can see with this...is it would be really easy for anybody to send out a DDOS attack now.
Just get some spam software, throw your friends server name in the email, and everybodies computer helps out in taking it down.
Sure it sounds ok, but i'm sure there are ways around this, staggering types of emails that are sent etc.
John's PopFile software works almost perfect right now, granted it's a client side application, and this is looking to take care of the problem....
GeekWares - Buy and Download Today!
You saw that piece on MSNBC about how spammers are lead agencies doing the dirty work of big business? In the story they replied to spam and suddenly got calls from 'reputable financial institutions.' The "lead agencies" get something like $12 for each lead from these big companies, and 0.1% of spammees do reply (d'oh). If you flooded their URL/forms/whatever with bogus enquires they wouldn't see da wheet for da chaff! Suddenly those spam addresses would get expense if they couldnt get a single response.
Such an attack on Nutters.org forced me to stop doing my own hosting on a DSL line, since it got utterly swamped and cost way too much in bandwidth. Amusingly, it has forced me into using a much cheaper and higher bandwidth service -- one where such attacks are no longer my problem. The rules of the game have changed for me, though: I no longer consider it viable to host a website on a low-bandwidth leaf node like a single DSL, even where normal usage would make it seem acceptable, since it makes you a sitting duck for this kind of attack. I still can't imagine why anyone would want to target Nutters.org; being small and unworthy of attack doesn't seem to be a good defense anymore.
proof, n. A demonstration that a conclusion is implied by certain premises and axioms.
I thought the primary complaint against spam was that it uses too much bandwidth. Wouldn't this proposal waste even MORE bandwidth per spam?
- Multiplies bandwidth exponentially, automatically. Big corporations, especially, would be hacked off by this, and it has the added downside of slowing whole sections of the net (imagine what happens when a college dorm gets hit and 800 little bots go check out the site 57 times...).
- Accidental DDoS on good sites - yes, Victoria, spam can be spoofed VERY convincingly.
- Accidental DDoS on good sites (2) - if you've ever maintained a mailing list of more than 20 people, you know that, eventually, some idiot complains he/she got spammed, even if they double-opted in. I've been accused of spamming when I was quoted 2/3 of the way into someone else's (double opt-in) message! I know great sites that are blacklisted, out of human stupidity, alone.
- Accidental DDoS on good hosts - imagine the impact on any shared host, or even some virtual hosts, when one bad client mails 5 million spams - before they could react, they could be taken offline!
- Bad programmers (gasp!) - yes, those exist, and some of these filters could really go haywire and start thrashing all sorts of sites.
- Lawyers - IANAL, but I shudder to think what happens the first time Microsoft or Big Blue sues some programmer, because an abused copy of their software took them down for an hour! (What is the M$ site worth, per hour? Too much, for sure.) Granted, the suit should go the other way, but that's another topic.
- Abuse of ISPs - you'd be amazed how many ISPs will pull the plug on paying accounts for even innocent behavior (like sending 1,000 messages on a DSL account in under an hour, even if it's a business and all the messages are unique). This could get a lot of folks kicked offline.
There are probably others... My thought is this - build a really good, Bayesian, SBPH filter like CRM114, and incorporate a "grab questionable sites" option for the "spams of the future," then filter that page as though it were spam. That'll get us all up into the 99.9% range (the noise), and spammers will eventually either (a) go out of business, or (b) only be able to get their messages to the few people that think they're worthwhile, anyway.My $.02.
-Ed
Web Design & Software Development
A similar approach would be to get thousands of real people to respond to their spam and pretend to be interested and then lead them along with a few messages asking questions and then they always decide that they're not interested. A spammer or company would have to have the time and personnel to handle large numbers of phony customers in order to deal with the few that are really willing to send them money.
It's an effective distributed denial of service attack that would make a spammer's world a nightmare.
"It is easy to prevent the leaking of personal information, so a properly written antispam program will not cause you to receive more spam. "
How? Not every ID has to look like an ID to your regexp....
<a href=http://hermanab.spammer.com>Feh Fiddle</a>
Nice observation! Yes, it will cause a breakdown in their revenue model. :D
Has anyone considered what this will really do? It'll have next to no impact on spammers.
However, lots and lots of legitimate opt-in mailing lists are following best practices by requiring a closed-loop opt-in with a magic cookie to prevent forged signups.
How do they work? Well, usually you follow a URL containing a magic cookie in a challenge email to confirm you want to sign up for the mailing list. Oops.
(For added brokenness, combine this with the other flawed anti-spam fad-du-jour, challenge/response).
Why not just have the filter reply to the sending address with it's own randomly generated addy and auto drop those messages that use fake addresses that bounce? This could be done within seconds in most cases. The only issues here would be storage of the spam and how long you wait. It could be done by "keeping the spammer on the line" during the SMTP transfer also causing the transmission of spam to be delayed.
Could it work?
I've seen a few posts about the possibility of collateral damage--deliberately targetting someone else's server as the target of an auto-DDOS. Someone also mentioned hijacking a server, and then bringing it down.
The thing is, it's no easier to do it with this proposed system than anything that's currently available. In this case you have to download (buy?!) a copy of spamming software, get a list, and then run a DDOS that's actually traceable back to you. Good plan? Not by my thinking.
Now the nice thing about this is that it will end up costing an inordinate amount of money for the spammer, take down their servers, and really piss off their ISP. (Watch the pink contracts dissappear!) This is a fairly drastic measure that might actually get rid of many spammers for good.
Basically, it's either this or a crowbar to the head.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
This is a great idea, but you need to do it on the server, not (just) on the client.
How's about as a plugin to SpamAssassin? Scan the icoming email as usual. If it's determined that it's unlikely to be legit, pass it on to the URL scanner. Auto-whitelist hotmail.com and other common URL taglines etc. Follow each of the other URLs in the message.
Optional: If, after scanning the URLs, the pages linked to are determined not to contain spam, pass the message back to SpamAssassin flagged as clean and for delivery to the intended recipient.
And remember kids: Never trust a computer you can actually lift.
You, sir, did not read the article.
It sounds foolish, but you can just not get spam in the first place. I personally have three email accounts. The first is only for personal / work email. The next is for newsletters and memberships and the last is for junk. By separating them and being careful, you can get rid of spam by not getting it in the first place.
My first two accounts never get spam. The other one gets some, but I don't use it for anything, so its not an issue
of dealing with spammers and other nefarious miscreants has its merits.
I am not talking tar and feathers or lynch mob scenarios (the merits of which cannot be denied though). I am in favour of the high-tech "put the spammers address and personal info on Slashdot" old fashioned way. It seems to work best as the targetted spammer was really steamed...
From excellent karma to terible karma with a single +5 funny post...
We've already seen viruses doing the rounds which act as open proxies for spammers and/or reverse proxies to hide the spammer's real websites. If these intermediate reverse proxies act as caching proxies, then the spammer is insulated from bandwidth costs by offloading them onto unwitting third parties. Steal enough bandwidth from enough innocent third parties, and you have your own private Akamai of sorts -- somewhat DDoS-proof. The spammer's URLs can change constantly thanks to the whack-a-mole dynamics of the reverse proxies, so the only workable approach will be to scan every incoming URL, thus leaving the system open to abuse as a DDoS tool. That is, unless this whole "whitelist" approach somehow manages to keep up with a white mark for every known-good site on the 'net. I don't see how that would work in practice.
proof, n. A demonstration that a conclusion is implied by certain premises and axioms.
Bayesian Filters are cool but I don't see how anyone can thoughtfully choose between them. From my searching on Google, there has been no comparative accuracy testing of Bayesian Filters at all and I refuse to believe that they are all equally effective in identifying spam.
So with no information to guide their choice how can people effectively decide between Bogofilter, CRM114, DSpam, SpamBayes, POPFile, and other Bayesian Filters.
When my newsletter (confirmed Opt-in for the NANAE people who may be reading) goes out every Tuesday and 8,000 people open it, how am I supposed to deal with these filters DDoSing my site? For that matter, how do I deal with these filters attacking my site when some other newsletter links to it? What do I do when I piss off Ronnie Scelson and he links to every individual page on my site and spams 100,000,000 people with them?
Links are more likely to be found in legitimate email than in spam. We're going to whitelist every single existing domain on Earth, and then remove the bad ones? Do you have any idea how large that list would be and how long it would take to download it to compare with the domains found linked in an email?
Let's say this idea becomes used widely. It will be used as a weapon by the spammers themselves.
1.) Pay-per-click links sent in mass mailings. Spammer gets paid for every link clicked. I'm sure some of the advertisers will get wise, but there will be plenty who just sign the checks without looking deeper.
2.) Ronnie Scelson or Alan Ralsky get pissed at someone who owns a web site (SPEWS perhaps), and send the address to several hundred million people.
For the ISP sysadmins reading, you think it's bad when 20,000 spams land on your mail server? How are you going to like it when each of those 20,000 spams produce 3 or 4 (or 30 or 40) HTTP requests?
Sorry, bad idea. I can't see how the idea of "attack filters" does anything but discredit the whole idea, especially after thousands of perfectly innocent web sites are knocked offline by the sort of malicious software being advocating, or when spammers inevitably abuse it.
Only on
I agree: http is a bit too complex for a ping-back. The spammer could be validating which e-mails got received; the spammer could be selling ads and getting paid by the click.
How about something simpler:extract the IP address from the box and just blast N simple packets at it, where N=1000 or so. Ignore all the crap in the e-mail except for the host address.
I see two more problems. First, you don't want te fight-back filter to take down ftp.gnu.org because of a legitimate message from gcc-announce. And second, the filter network is a DDOS waiting to happen, no matter what you do.
Any program that does something this dangerous automatically, even to people that deserve it, is a BAD idea.
This is the sort of thing that needs human supervision because bugs, user input, and solar flares may cause the program to act differently than you think it should. Any sysadmin who's made programs that would affect thousands of users automatically knows this. There will be a percentage - no matter how small - that the program will affect negatively, and that tiny percentage will be very, very pissed off.
You should be exceptionally careful about where you point your Massive Hose of Death because after all, to err is human, but to really fuck things up requires a recursive algorithm working at 2 billion cycles per second.
It's also ocurred to me that you'd be hurting yourself just as bad bandwidth wise anyway. We all complain about how much of our mail is spam, and how much bandwidth it wastes, but to DDOS them would waste hundreds of times more, not only for you but every provider that carries the traffic.
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
I think a better idea is to use
Exim SpamAssassin at SMTP time
This method don't use your bandwidth downloading urls,
and slow down the spammers connection.
I would like to see what happen when
the mayor distributions start shipping
with something like this as the default option.
Messages conforming to abusive practice would cause the server to send an OAP message back to the spamming provider... so a million outgoing messages would result in a million INCOMING messages on the specified abuse protocol port.. in effect you DOS yourself.
meh
Didn't he invent Hines ketchup too?
Hines 57.
I suspect that a thorough analysis of the proposed scheme would conclude that it could not work if it were widely adopted. It's silly to create a system in which a relatively small, expected but undesired input triggers a relatively large burden on network resources.
Oh, wait... that's called a distributed denial of service attack. Someone already thought it up!
Warning: This signature may offend some viewers.
Why should someone make lish a whitelist?
The idea isn't to bring down or overload the hosts sending or relaying the spam. The idea is to hit the spamvertised website, the one being promoted inside the email message. There are two advantages to this:
1) The spamvertised site may suffer a Slashdot-like effect, making it unreachable to potential suckers clicking through on the spam
2) The spammer, or whoever's hosting them, is going to see his or her bandwidth bill jump
It's a dual-pronged approach, with both prongs aimed directly at the spammers' wallets. First you try to make them lose some orders, then you try to drive up their hosting costs. Sales go down while expenses go up. At some point, the break-even point is driven below the line of diminishing returns, and the cost of spamming rises from practically zero to something prohibitive.
No. The primary problem with spam is that it is assault on the user's attenton.
Telemarketing calls don't cost the recipient an money, but they are a similar assault on my attention.
It's about human attention, not machine resources.
I'm all for the idea, and as a matter of fact, I suggested it a couple of months ago.
If individual spam victims start repetitively downloading the spammers website, this could bring the spammer to change the way he sends spam from the current big bang technique to a small continuous trickle technique. The spammer would send a single spam over several weeks, in stead of a few hours. He would parallelize the process.
I see two possible counter-attacks to this :
Feel the rage !
One small problem: For the miniscule amount of legitimate mass mailings, almost all contain a working "click here to remove me" link.
...Fighting abuse with more abuse probably will not solve anything, and could also get you in trouble with your own ISP, if a spammer hits you hard enough to cause the fake E-mail addresses they put into their spam enough problems.
This is a bad idea, IMO. Stick with blocklisting. Once things get to the point where the spammers are all on what amounts to an intranet, and they're doing nothing but spamming each other, they'll get the idea.
Bruce Lane, KC7GR,
Blue Feather Technologies
The spammer can simply parcel out each individual type of spam over a period of time. So, instead of:
Day 1: Send spam A to 1 million addresses
Day 2: Send spam B to 1 million addresses
Day 3: Send spam C to 1 million addresses
They would
Day 1: Send spam A to 333,333 addresses, send spam B to 333,333 addresses, send spam C to 333,333 addresses
Day 2: Repeat
Day 3: Repeat
Obviously, they would draw this out over more than 3 days, but you get the idea.
If it can be claimed that Spam is slowly killing the Internet, here's a way to speed up the process. Clog the backbone and every choke point with junk packets from all the servers in the world trying to crush each other.
We'd better all start raising pigeons.
I think what is allowing spam, pornography, stupid internet pop-up ads that say my computer isnt optimized, even though I am running linux :). Its us, the IT people who run the internet and they are comming onto our turf.
And so the Slashdot Effect could be put to good use. Good idea! Only one problem. How do you gather those images?
I like the idea of whacking the spammers' bandwidth, but I'm not really keen on validating the email address the bastards have reached.
So, why not follow the links, but change the parameter values? It's all something which we'd do programmatically anyway, so subtle variations in the value portion would still incur the expense of processing the input, even if it fails. Keep the path component of the URL, and the parameter names used, so it gets as far as possible before blowing chunks.
It's not just DDOS that is the problem (in fact DDOS is actually the main feature). A naive implementation would pass along the GET data. So you could use this method to anonymously submit form data. Want to stuff an online ballot? Send out a spam linking to http://whatever/poll.foo?bar. Depending on how poorly written the sites are, you could even use this to do more sophisticated things, like sign up for 10,000 accounts at a certain website.
Yup. Someone was posting about something called "FormFucker" which puts bogus, but seemingly real information in forms. So there is a tool out there to do that already.
Note, that this type of activity is just as legal as the RIAA or MadonnaWhore putting out fake MP3s.
[I work with banks as clients, and they sure are dumb about technology stuff most of the time, but they figure out when something hurts them financially pretty darned quick. I'd estimate the mortgage lead business would go away in less than 6 months if what the parent poster was proposing was actually implemented on a widespread basis.]
Of course, I doubt the leads pay as much as $20 a pop.... a few cents maybe....
Victoria? I think you mean Virginia. And it's very sexist to condescend to a female like that. It's the equivalent of saying, "yes, you dumb bitch, I AM right, and you're wrong."
testing out my trending skills
After all, this would hurt the clowns who hired the spammers in the first place! That is one thing that people keep missing. They bitch about spammers, but they don't seem to mention the people who actually create the problem by hiring the spammers in the first place. Crushing their servers or at least making their bandwidth costs so bad that they would probably never dig out from the debt would take away incentive to do this kind of thing. But yes, sadly, this would open up a DDOS hole as well. Maybe a better way would be to set up a program which sits in the background and checks a central site for known spam company links and the software would load the URL maybe 3 times each day. If you had enough people do that, it would really hurt these bastards. Probably result in a legal challenge though. But anyway, this at least warrents discussion for now, but a way needs to be found to protect the innocent and make it so that the spammers and their host companies can't find a central site to sue.
--Won't that be grand? Computers and the programs will start thinking and the people will stop. - Dr. Walter Gibbs
This is a very dangerous and stupid idea. It won't be long until black hats figure out a way to exploit this technique and send out a major DDOS attack on someone they don't like.
eTrade SUCKS
Graham did mention users with broadband connections, implying that this would be something that the client would pull down.
In other words, you get a more accurate filter which takes into account more than the message itself -- it also considers the content which the message is trying to put across.
Somebody get that guy an ambulance!
- your filter recognizes the spam and gets URLs from it;
- all such URLs are gathered in the central authority and statistically verified (how many filters have claimed the same site);
- only the most often claimed sites are left in the list, while more rarely claimed sites are considered as claimed by mistake or by the anti-filter attack;
- people willing to help to fight spam download the screensaver aka SETI@HOME, working at your CPU and net idle time;
- the screensaver downloads the fresh list of sites to be fought back along with a centrally generated schedule;
- the filter actually attacks back at the scheduled time points (if it's still the idlle time for client PC), not massively from the individual PC (so it doesn't look suspicious for the individual client *AND* it doesn't create any peak bandwidth problem for the attacker);
- the spammer's web site is
/.ed;
All problems I see resolvable:The main idea of the spam is to send email massively on a very low cost. So if the attack will be also very massive, it will increase their cost of operation and at least some of them will go out of business.
Any attmpts of spammers to go through filters will not work, as you can manually submit the spam claim to (what is its name? NOSPAM@HOME?) the central authority. If the amount of such claims will be big enough, then the claimed sites will be included.
Less is more !
The good idea there is to filter spam based on what it links to. SpamCop already does some of this, and reports the spamvertised site to its ISP or upstream provider. This is reasonably effective. It also identifies black-hat ISPs that host sites referenced in much spam.
i think a more potentially dangerous outcome is that this could become a vehicle for worms to spread;
lots of vulnerabilities have been discovered (in IE, etc) in the past that run arbitrary code when you visit a web page.
so, if we have all these [identical] email clients set to automatically follow links and that there's some kind of known buffer overrun within the html parsing code (or if they use the IE rendering engine and some similar vulnerability has been discovered) then if a malicious link is sent then all of these clients will follow it and get compromised. (witness the paranoia now in most email clients which disable javascript, attachments, etc by default).
at that point, if tons of machines are compromised, they could be turned into open proxies or could turn around and forward the email to everyone in their address book, etc.
yes, this might sound like a farfetched scenario, but i think even if this case didn't happen, the obvious counter for spammers is to distribute the web load over a bunch of compromised open proxies or something or to throw up temporary web pages on random web hosts until they get shut down.
the bottom line is that in the end the pain of this countermeasure will be simply passed onto innocent third parties.
furthermore, it's unlikely that any major mail client will include this feature by default (outlook or eudora) since there's so much room for abuse, and the whole idea relies on a critical mass of users to actually have an effect.
-fren
"Where are we going, and why am I in this handbasket?"
For some ISPs it's no big deal to slam the spammers they host, but for any ISP that unknowingly or unwillingly gives access to a spammer. They should have enough time to shut them down before having their network destroyed.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
I use Pegasus mail, and just nuke all the unwanted headers, allowing only good email to remain on the pop3 server. I can view all the headers, and double clicking on one reveals all the data, so I know where the spam comes from. Then I have Pegasus mark all those for deletion, and then Pegasus does that.
I'm starting to put my email address on web pages with a _remove_this_ in the middle, to confuse the harvesters.
Anyone know of a linux mail application that can do what Pegasus Mail (for windows) does? I need it, as I log in linux as a user account and think that is more secure than windows.
One of the worst sins of the spammer is the theft of bandwidth and other parties resources. The idea of launching a DDOS against a spamvertised site compounds that problem even further.
I have a better idea. Write a program that sends a letter to your local District Attorney, FBI office and the FTC every time you get spam that asks them when they're going to do their job?
Order your penis enlargement pills now at SCO ! They're only 699$. If you bought pills from other companies, you still have to pay because your penis contains SCO patented technology.
It seems like the need for other anti-spam techniques will decrease as these become more popular. Things like ip banning or automated server hacking just hurt more non-spammers.
I installed a free one called K9 (though I donated $20 to the author), and over my last 573 emails (392 spam) it has only made one mistake, making it over 99.8% accurate after its initial training (141 messages). I've only been using it for a few weeks. It's about a 60k download and is very flexible and well behaved. The downside is that it's closed source and built for win32. I don't know if it works under Wine.
The one spam that got through was disguised a typical personal message, except that it was offering a business relationship and contained a personalized image link to determine if I viewed the message.
I tried Mozilla's built in bayesian filter for a few months. It had about 90% accuracy, even though I corrected every single mistake it made. Something's not working there, so probably shouldn't be used to judge the accuracy bayesian filters in general.
I've tried PopFile as well. It seems to have good accuracy, but it's like swatting a fly with a sledgehammer. It's like a full fledged anti-spam server and is best installed on a dedicated server but is not well suited for multi-user environments, and it'd not easy to correct old mistakes or rebuild the word database. It does have the benefit of being cross platform though, and it supports multiple buckets, not just spam and not spam.
- Filter all incoming mail using spam assassin . The rules are reasonably exact. Mail which is declared SPAM doesn't reach my inbox.
- Automatically report spam that exceeds SA score 7.5 to spamcop .
So far, I've only had one problem, and that was a stupid abuse@ department auto-reply which quoted the entire SPAM (thus got re-filtered by Spamassassin, re-submitted to Spamcop, triggered the same auto-reply, etc etc yadda yadda).This procedure could well be extended to filter all URLs out of the spam and auto-wget them.
If anybody wants the spamasassin+spamcop scripts, mail me. It's a hack though (uses maildrop, qmail, perl, etc).
Home Page
I no longer receive spam in my INBOX although I quickly filter through false positives in my SPAM mail folder. How? I put in a rule to move all mail containing "http://" to a SPAM folder. Now all I need is a procmail or similar rule to reply to senders requesting they reformat their email to avoid this substring (I can cut and paste a URL into my browser easily so there's no need to preface with this token). It' simple and it works and I can scan through the SPAM folder when I feel like it and quickly spot false positives. It might not be for all but it's worth considering.
Gee whiz. I guess no one writing a filterbot program to follow links would do anything like say check the followed link for the very email address it was performing the filtering function for. Programmers writing anti-spam programs are so dumb they'd never think to do anything so glaringly self-obvious like that. That'd take someone like oh maybe a genuine certifiable genius physicist-rocket-scientist-recombinant-DNA-enginee r-type-person to figure out. Someone who can merely write a Bayesian filter would never think to do it.
They don't seem to slip past on my end (POPFile).
Besides tagging messages as spam for having enough spam-keywords, it also (seems?) to tag incoming messages as "not spam" based on words that only appear in personal communications - when the messages come in. I think some of the other spam-killers also will nab messages which only contain a link, or a minimal amount of non-content.
POPFile has cracked the 98% classification accuracy mark on my system and is continuing to increase.
I never see spam anymore - it has ceased to be a problem for me (at least so far).
N.
"Nothing strengthens authority so much as silence." - Charles de Gaulle
As the article points out, one of the dangers would be the use of this in a malicious denial of service attack engineered by sending out a spam message which includes URLs on the targeted system. For example, sending out a penis enlargement spam that includes a Microsoft URL.
Hey, now that might be a long term plus. While the spammers won't have much legal recourse for everyone loading the links they send, using this system to DDOS someone probably would not be viewed lightly in the eyes of the law. Where the effect of this program might cause some network problems, that's not it's goal - using spam to DDOS someone has no real defense.
Good judgment comes from experience, and a lot of that comes from bad judgment.
An article by Paul Graham, and he doesn't mention the word Lisp even once? Must not be a terribly good one :)
I've been using a slightly altered method for years, and been talking about it in mailing lists, various groups, etc, but no one seems to pay attention, even though it works really really well-
/24s (class-c's) and route them to the bitbucket. No more spam from that entire net, ever. I have over 29000 class-c's blocked right now.
take your spam, filter through it for all domains and IPs, and dump them into two sorted lists. one for domains, one for IPs.
the IPs get routed to the bitbucket, and the domains get added to your own personal RBL-type list. Or you can do the RBL type thing with both, whatever turns your crank.
what I do is take the IPs, make them
yes, I heard all the whiners complain about blocking legit addresses/domains. That's what a whitelist precheck is for. and duplicates are easily eliminated when the lists are kept sorted.
and to make sure legit addresses dont stay blocked, if someone complains they get added to a "do not block" list, but only individual IPs usually ever end up there. That is, you may miss one piece of mail to one user, but never again.
for over 2 years now I've been doing this, and it works well, in conjunction with bayesian filters.
and I've seen every possible method talked about for eons, and the topic keeps coming up again, the same old crap retried over and over again. You do this at the ISP, like I have, and it works wonders.
bayesian is good, filters are good, but this method is much better. and the RBL type lists of your own domains/IPs are at least 10 times faster than the route to bitbucket method, and only affect mail, not ftp, web, etc...
try it, you'll like it, and your spam will eventually drop to almost nothing.
Personally there should be a place where ISPs and others share these lists. But no one does that. and that is a shame, because it'd be an incredible resource. Someone needs to setup a site to do this, I was going to but no one seemed to care...
That would be exciting... legitimate newsletters with a "click here to unsubscribe" would be really out of luck when mail servers automatically unsubscribed everyone...
Send out "white hat" spam, which for all intents and purposes looks like real (ie "black hat") spam. Except clicking on the link takes you to any number of webpages that basically say "are you so f***ing stupid you actually believe pills can make your penis/breasts/whatever larger?"
Adjust content to suit type of spam. Include disgusting images if the type of spam you're emulating is adult-oriented (pr0n, enlargements, etc), something else entirely if you're "selling" mortgages or similarly benign wares (ie no goatse.cx-type images if you're "selling".
And to cap it off, if viewers are so enraged at what they see, the page will have a feedback link. The link will either be a known spammer's email so they receive their venting instead of their money, or link to yet another anti-spam site.
Geeks and filters will automatically block this stuff out, so there's no harm done to us, aside from having to filter out even more spam.
But with any luck, if enough of these anti-spam spams get sent out that people start associating spam messages with informative, insulting or disgusting websites, they'll learn to stop clicking on those damn links, stop buying their bullshit products, the spam model becomes unprofitable, and spam is reduced to a saner level or eliminated entirely.
Legal implications? No better and no worse than black hat spammers.
Comments?
I've been saying this for ages! If only a few thousand people would start "visiting" spamvertised sites over and over again we could cause serious damage to their "business model". If the scum had to pay for several hundred gigs of bandwidth with no sales every time they ran out a batch of spam they might think twice next time (probably not, seeing as they're brainless scum themselves, but still we can hope).
Code, Hardware, stuff like that.
testing out my trending skills
The only real hole in this that I can think of is that a spammer could "discourage" the use of this by including a buried link to a large file that each client would then have to download, such as a trailer off of Apple's Quicktime site. If you're running this on any sort of centralized server, this would probably kill your own bandwidth, as you're suddenly downloading a multi-megabyte file multiple times, but Akamai's network probably wouldn't even sweat it.
This could be counteracted by the whitelisting function that Graham mentions, however.
More and more spam got through the Spamassassin filter I used. This weekend I installed the Active Spam Killer (see a-s-k) and uninstalled the Spamassassin. I believe that the filter approach used by the Spamassassin and friends is a fight one cannot win in the end.
Let's say I have an email autoloader. I often receive lots of wonderful links from my amusing coworkers. Instead of following all those links manually, I simply drag the emails into my new autoloader tool, and it preloads all the links for me. Sometimes I get around to checking the contents, and sometimes not, but they're always there if I need them.
My email autoloader is even scriptable -- it can select emails to autoload by quite a complicated set of rules, instead of my having to manually select them each time. I then don't even have to read "Hey! Check out this funny flash site!" -- the email is automatically deleted, and the site is preloaded for my convenience.
Now isn't that nice and convenient (and legal)?
If you wrote up a web page about it, then submit a story, then you'd probably get more attention that your idea deserves.
testing out my trending skills
I use SpamProbe, which has about 99.5% accuracy. For instance, I received 174 spams today, 1 legit message and 1 spam slipped past the filter to my inbox - a picture spam - my mail server has a HTML trap which disables picture tags, so what I get is a blank e-mail.
The reason Spamprobe is better than most other filters, is because it counts not only single words, but also word pairs. To make up for the tremendous increase in computational load, it uses BerkleyDB as a backend.
On the first count, you're right, it's Virginia. Oops. On the second, don't you know the reference? We're not talking about the entire female half of the species, here, but a little girl! (in the original context, of course, which is the only context that counts). Find something better to do...
Web Design & Software Development
Let's see here..
/dev/null since then it has no defendable purpose other than 'DDoS' which can cause badly informed people to think it's evil per definition and sue. On the other hand if you call it 'advertisement collection tool', make it cache say a day worth of.. and make a sparse system to actually view what's been collected..(like a local cache browser)
:) )
- MODERATION. This is the key thing. Same as with the slashdot effect, you can't blame a 'posse' for sending on URL's for whichever reasons and effectively 'attacking' the site in question. Legit non-spam sites can't really prosecute I don't think, but it's wrong, so we need dependable humans to check each and every link, and/or make a (slashdot type) moderation thing that will review and moderate up real spam links to 'Engage, mr. Sulu' level.
- EASE OF USE. It needs to be easy to install
- LEGAL ISSUES. If you use a 'distributed client' I think it shouldn't send stuff to
Also I don't think spammers can 'sue' us since they sent the email to us (keyword is 'unsollicited') which makes the mail and its contents our property.
The primary problem really is how to get a dependable, defendable list of attack candidates without actually hiring 10 people to sort through all the spam each day. (unless someone rich cares to donate to the cause?
That should tie up their spam servers a bit...
-- The universe began. Life started on a billion worlds...
-- Except on one where stupidity was there first.
Very good points.
A 1x1 gif image is smaller then most server's 404 error msgs.
autopr0n is like, down and stuff.
A lot of spammers actualy will remove you if you click the 'remove' link, since no one ever does. Or so I've heard.
autopr0n is like, down and stuff.
I don't really see the point of doing something if your average slashdotter can see a way past this easily, and can figure out a way to make it do even worse things to the network.
We should be looking for spam solutions that a) don't have a huge obvious negative impact and b) even if exploited still 'help'.
I'm convinced that Bayesian filters, Reverse MX, and sender verification will pretty much kill all spam these days.
autopr0n is like, down and stuff.
Daneil Hartmeier (the guy who started OpenBSD's pf firewall) has an explanation of how this can be used in conjuction with filters such as spamassassin. Using this method, each time you get a spam, the spammer gets blacklisted to be directed to spamd the next time. It's documented at http://www.benzedrine.cx/relaydb.html -
because you can fake the email's origin.
autopr0n is like, down and stuff.
Isn't this what some congressman is trying to get passed for P2P networks? He thinks that it is perfectly acceptable for copyright holders to hack P2P networks and bring down machines that are suspected of having illegally obtained copyrighted material. Now we propose this for spam and suddenly this is a good thing? I know, nobody likes spammers, but that can't be the foundation to allowing people to hack other's systems. If filters were allowed to strike back at spammers, that would give the RIAA and MPAA all the ammo they need to lobby for new laws that allow disabling people's service. As many people have said in other posts, it sets a very slippery slope that will probably have consequences beyond what we initially invision, not just for email, but for anything that someone does over the internet that is "unwanted".
"Oh dear, she's stuck in an infinite loop and he's an idiot" -Prof. Farnsworth (Futurama)
.... the links sent in spams are generally tailored to be able to identify someone following a link to an individual spam that was sent, these "attack back" filters would only serve to verify that the email address the spammer spammed is valid, thereby increasing (incredibly) the amount of spam that address received.
The resulting positive feedback created by automatically telling all spammers that your address is good can only cause more trouble for networks. You'll quickly find that the amount of spam you receive is unmanageable because every spammer on the planet will quickly learn that your email address opens and responds to every piece of spam it receives.
Look around, try to find someone, anyone who pays per click anymore. No one does. Everyone pays by commision because pay-per-click schemes are way to easy to defraud.
autopr0n is like, down and stuff.
"Hash cash" works like this: the recipient forces the sender to burn some configurable amount of CPU time before accepting a message for receipt. The recipient does this by giving the sender a problem which is hard to solve, but easy to verify the solution for.
This fight-back filter sounds similar. The fight-back filter imposes some configurable amount of load on sites extracted from the message. At least, that's what it does when everything works properly.
I'm not an expert at these things, but I like hash cash better. With hash cash, the recipient imposes the cost on the actual machine that's trying to send mail. With a fight-back filter, the recipient visits some other machines which are selected by the spammer and under the control of the spammer. That opens the door for security holes.
The disadvantage of hash cash is that it may require a SMTP protocol change to be effective.
Making spammers pay for each spam they send? Sounds a lot like Daniel Bernstein's Internet Mail 2000 recommendation, except that this idea has far more potential for abuse. As much as I like Paul Graham's innovative ideas, this one is definitely both late on the scene and inferior to IM2000.
Jeremy
Looking for a Python IRC bot?
Well, one way to easily DDOS spammers is to use slashdot as an offensive weapon against spammers. Open a slashdot section called spammers. Each day we could have a list of daily spammers, similar to daily news stories. The effect, the target site gets slashdotted. (Huzzah) In theory, we won't have to worry about targeting an incorrect site as slashdot admins would verify that the target site is infact a spammer site.
"There is no spoon." - The Matrix
Use (and support) the Open Relay Database. These people maintain a free service to blacklist mail from open relays. I can't attest for the service myself, but I've heard good things about it.
Everything helps in fighting the war on spam.
Spam fighting, it seems to me has 2 fronts. What to do when you get on the lists and how did you get there to begin with. Having made numeous web sites thru the years it has become clear to me that these spammers are largely harvesting addys thru mail-to links on web pages. A number of techniques can be utilized to prevent such activity. 2 of my favs are the use of ASCII characters in the actual addy and the use of Javascript to mask the addy. Once you are "in their hooks" there seems little you can do so it seems best to me to not get there in the first place. Best Jeff
A better solution, in my mind, is to design an encrypted access control system for email - such that I give unique public keys to people I want to receive email from. "Public key" is really a misnomer - each person would have a unique public key that is theirs only - my email system would manage users based on the public key they have been assigned. All email to me would be encrypted using these public keys, and decrypted using the private keys I keep on my system.
The beauty of this is twofold:
1. No more unsolicited email - anything that is not properly encrypted with one of my public keys is dropped in the bit bucket.
2. If someone I previously trusted abuses the system - or if their public key is compromised, I can cut them off: simply remove their public key from the list.
The best way to hit the spammers is in the pocketbook; if their spam doesn't get through to an audience, then they get no money - and spamming will simply dry up. A widespread public-private/private key system would make it impossible to get spam into anyone's mailbox.
The drawback is that you will need to establish connections with people in other venues than email - which might not be a bad idea anyway.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
Having a "filter fight back" is a polite way of saying that you have trained attack software.
Software has bugs. If you have trained attack software, it will have bugs. Which means eventually it will attack an innocent site.
Ultimately this is a bad idea for the same reasons that automated home defenses are a bad idea. It's very easy to say that the intruder has earned the automated response, but then you get the nitty gritty issue of whether your automated system can distinquish between a burglar and a fireman.
The same issues apply in identifying Spam. How will your software, which will make mistakes, distinquish between the real source of Spam and a clever header that is making it look like someone else is the source? I don't care how good your algorithm is. It's coded by humans, so it will make mistakes. Unlike a human making a mistake manually, however, it will pounce at very high speeds.
I am a huge proponent of the death penalty for spammers (this is really a joke, I'd settle for just removing their digits so they can't type.) With that being said I would love to find a way to shutdown spam. Here's how I think it has to be done. 1) Education. Educate your mother who buys from spam emails that even though she's getting a discount (or perceived discount) that she's doing so at the detriment of people's time and wasting bandwidth. Explain why bandwidth is important. Bottom line, don't reply, don't buy, and don't encourage spamming. Education stops the motive, and the loss of motive will stop the crime. I would be interested in seeing the trends in terms of how often people respond to spam and if that level of response degrades per user as those users become more net-savvy and gain more experience. 2) Law enforcement and legistlation. I would prefer it if everyone could sue a spammer. Obviously this has to be more carefully thought out because anyone who uses the cc field in an email might be considered a spammer, but I still think that action should be taken quickly and decisively. Possibly an organized investigative body to discover who spammers really are and then to build up incriminating evidence. Then of course to sue their ass out of existence in class action lawsuits with the money going to pay for more investigative work. Also, a heavy against companies. "We know you are utilizing spammers and we don't appreciate it. You have been blacklisted" or some other various things. But what it all amounts to is : money. Control the money, control the problem. And I feel education and law enforcement are some of the few clear ways to do that. Everyone else has basically mentioned in other posts my problems with the method of DoS'ing spam hosts. N
Reality is a slackware box running on a 386 tucked away in god's sock drawer.
This is something I've been considering since Graham's Bayesian Filter article appeared last autumn.
.... you need to fetch the large images, maybe even the same-site linked pages. On the other hand, few people pay much for banners which do not provide click-through. It won't take many days of a million clicks an hour to convince the remainder to change their policy.
Whether it's Spam Assassin or Bayesian filters, conventional defense mechanisms attempt to prevent spam from getting through. If IBM or AOL succeed, the savings are significant, both in terms of employees'/subscribers' time, network bandwidth, hard drive storage, etc. But for individuals, the effect is purely local. One person stops receiving spam, after the first few.
Unfortunately, there is no effect on the spammers. The majority of people are unprotected, so visit the web site, buuy the product, etc. What do they care whether Paul Graham visits their site or not?
What is needed is to inflict a penalty on the spammer for sending the spam. One ideda which has been passed about is intrroducing a low fee for email. Your first 10,000 messages each month are free, but after that each one costs a penny, nickel, dime. Ordinary users won't be affected, only those attempting to send millions of emails. But what about corporations? Obviously, IBM, GM, AT&T send many emails. So this method stops those who try to send 5000000 messages through a user account, but what about someone who has their own corporation? For that matter, what about AOL? AOL users send more than 10000 messages, between them. Yes,I know, none of us care about AOL, but still.
Now a spam message is an invitation to visit a web site. They WANT you to go to their website. They're not going to make a sale over email, but if you see their pr0n for yourself, you might sign up. So the solution is for everyone to visit their web site. Since you are so interested in their product, you want your software to fetch their website every hour, so you will know quickly when any changes occur. Suddenly, sending spam has a cost: web site bandwidth.
Some people might object to the spammer being paid for 'pay-per-view' banners, but there is a simple defense against that. Just set your software to only fetch same-site images and includes. Of course you want to fetch more than the tiny frameset
The big risk, in my opinion, is people spamming out a URL to mount a DDoS attack, slashdotting someone they don't like. My solution is a combination of Google and Gnutella. Check your peers for copies of the web site. If it is not available, or if your peers cannot agree on the size or checksum of the page, or if a random number returns a wrong value, go check on what Google, Yahoo, Altavista or the Way Back machine have to say about the site. Of course, these sites may not be totally delighted to offer a portion of their bandwidth to protecting the internet, but life is hard. If a couple of these sites disagree on what the page looks like, or the random nunmber is still rolling snake-eyes, visit the page itself. This way, the load on Joe's Shoe Repair is limited to a forgivable level.
Once a page, or a few alternate pages are obtained, the user needs to examine them, to determine whether to co-operate with the email by visiting the web site, every day, every hour, every ten minutes.
If the page obtained from the web site is different from the archived copy, user interaction is required. The possibility remains that we are visiting an innocent web site which has been mis-represented. On the other hand, what about web sites that strive to protect themselves by having insignificant varying components. Banner ads rotate, for example, so not fetching those improves comparability. if included components change, while a major portion remains unchanged, we are still dealing with the same web site. If minor text segments change, but the bulk is constant, we can continue downloading on a regular basis. How about if the site changes grgadually
The point is to simply follow the link, not to parse or render the recieved HTML.
But yes, the idea is daft as many people have already pointed out.
What's your GCNSEQNO?
You don't have IE download the web page. The page is downloaded by a program/script in C, C++, java, Perl, Python, Ruby which does not attempt to interpret the page, but simply scans it for includes and images from the same web site. The program is presented to the user as a rough text/image thumbnail. If it is spam, no need to view it through IE; if it is not spam, no need to view it through IE.
How about something more subtle and less prone to being abused:
Find out on the spammer's site where the order form is and fill it with bogus information
?
This would hit the spammer where it really hurts: they can't afford ignoring the order forms but it will cost them a lot to process them. Hopefully it will make the act of spamming much less interesting financially.
There is a small company that I dislike. What prevents me from hacking their ip address and send shitload of spam in their name?
In my opinion it is posible to have a statistical analasys that would be capable to distinguish it unless you organize a really big attacke. On the other hand, a central (even if it's distributed) autority may help to gather a witness evidence against your unfair anti-competitive practice, which would be rather difficult if such NOSPAM@HOME project would not exist.
automatic or manual retaliation comes back to making justice yourself which is inherently illegal (at least in the us).
What makes it illigal? It is a statistical research project. Volonteers help to gather a statistical database of originally filtered emails. The central (and distributed) authority asks volonteer to help to gather the rest of information, namely the responsivity of a seller's web site, based on a pre-estimated schedule. BTW, the result of stitistical analysis can be peacefully used to consult the seller web site admin how to improve the site responsivity. Most likely the only advise would be so far: "shut your spam down and your site traffic will come back to normal".
I am actually ready to stand out in the court and say: "Well. the targetted company sends their marketing materials with only 5% of chance that the reader wants to read it. We study the responsivity of the targetted site by creating the traffic to the site where only 5% of actual requests are wanted by the business of the site's owners. How our 5% are different from their 5%? If what we do is illegal than what they do is illegal as well. But what we are doing is the non-profit research when only a very small group of people may dislike it, while what they are doing is a for-profit compaign when millions of innocent people dislike it."
Less is more !
which was on /. some days ago? Remember that the whole url thing can be tricked by using JavaScript: just add a link like <a href="#" onClick="swapURL()">spam!</a>. Some JavaScript would change href and take you there when you click it, so you wouldnt easily find a target for retaliation.