FTC Chief Bashes Anti-Spam Bills

teutonic_leech writes "According to an MSNBC report FTC chairman Tim Muris has indicated that the antispam laws being considered by Congress 'just won't work and may even be counterproductive - some of the proposed laws could be harmful, or at best useless.' He further concluded that 'In the end, legislation cannot do much to solve the spam problem, because it can only make a limited contribution to the crucial problems of anonymity and cost shifting.'" Other spam bits: an anti-spam service has a funny interview with one of their users, and reader der.hans submits a story and some pretty pictures discussing the quantity of Sobig.f virus emails.

Comments

bash?

[selfabuse]

My boss, Bill, bashes spammers. No really, he does. We're one of the first ISPs to sue spammers. Check last months (2months ago? don't remember) Time magazine. Awwwh yeah.

Re:bash?

[selfabuse]

Troll?! I wasn't trolling! Here's the link!!

Re:bash?

[letxa2000]

That's a good idea.

New laws to outlaw spam are, as the FTC director said, probably useless. Most of the spam being sent is fraudulent or deceptive in some way--or porn spam that is also being sent to minors. Spammers aren't bothered violating current laws, why does anyone think they won't ignore new anti-spam laws?

Re:bash?

[selfabuse]

and here's the text of the article, for those of you that don't have time subscriptions Jun. 16, 2003 Cable-TV descramblers! FDA-approved diet pills! Viagra without a prescription! Instant access to XXX movies! Dramatically enhanced orgasms! If you have ever received e-mails advertising products and services like these -- some quite within the law, some clearly outside it -- chances are they came from a guy like Howard Carmack, professional spammer. Using three computers and working out of his mother's home in Buffalo, N.Y., Carmack sent an impressive 857,500,000 unsolicited e-mails in one year, something that is perfectly legal in New York State. But Carmack crossed the line, according to EarthLink, his Internet service provider, when he set up 343 accounts using stolen credit-card numbers to send these e-mails. EarthLink took notice and began a year-long cat-and-mouse game to discover Carmack's true identity. "My name's not on anything," he boasted at one point, according to investigators, when they reached him on his uncle's cell phone. "You'll never catch me." Fingered by his upstairs neighbor and a former employer, Carmack went to ground. A private detective was hired to stake out his mother's house. Carmack was finally caught running from his car to the front door and was served with a complaint. Now out on bail, he has been found liable in a $16.4 million civil lawsuit by EarthLink. Charges of criminal fraud filed by state attorney general Eliot Spitzer are still pending. "There are many more like Carmack," Spitzer warns. "This sends a message that we are pursuing them." Spitzer, a man who knows how to put himself in the spotlight, was the avenging angel of Wall Street last year. Now he is on a cybercrusade against spam. And no wonder. In the space of a year, according to research firm IDC, the number of uninvited entries into U.S. In boxes has shot up 85%, to a total of 4.9 trillion. Driven by cheap technology and the promise of easy profit, spammers have gone from pests to an invasive species of parasite that threatens to clog the inner workings of the Internet. For the first time last month, according to MessageLabs, more than half the emails received by U.S. businesses were unsolicited. The time we spend deleting or defeating spam costs an estimated $8.9 billion a year in lost productivity. Sensing an enemy as unpopular as al-Qaeda, lawmakers are pondering a plethora of solutions -- some of which, spam watchers say, could end up doing more harm than good. Why do spammers flood the Internet with ads nobody wants to read? Because some people do read them, and a tiny fraction actually respond -- which in the world of direct marketing is like money in the e-bank. Take former spammer Scott Hirsch of Boca Raton, Fla., who sold his e-mail marketing business last year for $135 million and retired at the age of 37. Florida is home to more spammers than any other state, and Hirsch -- who started his first bulk e-mail list way back in 1996--likes to take credit for helping make Boca Raton "the spam capital of the world." Hirsch filled his mailing lists with the e-mail addresses of people who had "opted in" by checking (or forgetting to deselect) one of those ubiquitous boxes on website order forms. "When people want to receive [e-mail]," he explains, "you get a much higher return." But for an increasing number of Hirsch's imitators, spamming is a numbers game that rewards excess. "The more times they deliver the message, the more money they make," says Charles Curran, general counsel for America Online, which last week filed lawsuits against more than 100 spammers. "They all want to get as close to infinity as possible." This is getting easier all the time, as high-speed Internet access gets cheaper and computer processor power continues to double every 16 months. Meanwhile, the software tools for spamming continue to improve. Web crawlers harvest e-mail addresses en masse from chat rooms and newsgroups. Dictionary-attack programs string together words or names in multiple languages, random numbers, an "@" and

Re:bash?

[Frymaster]

i get this depressing feeling that the "war on spam" is going to suffer from the same problems as the "war on drugs" - excessive concentration on the supply side.

i find it interesting that whenever something good happens economically, the "power of the market" (demand) gets all the credit, but when the government wants to stop something deemed bad, they blame the pushers or the spammers (supply side).

the war on drugs has been a flop - why would they (the government) try the same techniques in a war on spam?

Re:bash?

[schon]

Spammers aren't bothered violating current laws, why does anyone think they won't ignore new anti-spam laws?

The thing is, if you ask spammers, they'll tell you that they're not violating any laws..

That's why we need a clear message that what they are doing is wrong - they need to be shown, without any doubt, that they are indeed breaking the law.

Re:bash?

[letxa2000]

Hmmm, that's a thought.

But if all we're doing is sending a message to spammers that YES, you're doing something illegal, then an anti-spam law that says something "The practice of spamming is considered theft of services and is illegal" would be sufficient. I would not be opposed to a 1-liner like that.

Problem is, laws are never 1-liners. It's going to get padded, definitions of spams are going to be added, consequences of certain types of spamming will be added, etc. And all the sudden you have one of these useless, burdensome laws that do more harm than good since it probably (unintentionally) opens loopholes that, again, the spammers will exploit to say "No, I'm not doing anything illegal. According to the law..."

Plus, I actually think the spammers know what they're doing is illegal. Even the ones that say they aren't. They know they're stealing the services of other mail servers. They're just playing dumb to justify why what they're doing is ok, but that doesn't mean they really believe it. It's their justification. Pasing the above 1-liner would make it impossible for them to play dumb, but again, I think they'd just find the loopholes.

Re:bash?

[4of12]

excessive concentration on the supply side.

You're quite right.

There has to be a concentration on the demand side of the equation.

Clients of the spammers need to feel it in the pocketbook for a solution to really work.

Unfortunately, a 98% effective boycott of the spamhaus clients by recipients of spam won't do much, considering that response rates are less than 1% already. Rather than attack the spammers directly, the clients should be made to pay big time if they've employed a spammer for advertising.

I don't trust Michael Powell. After caving in to media interests and allowing further consolidation in the face of absolutely zero public support for such measures (and widespread opposition once the results of his hearings became known), his current position on spammers seems to be an attempt to position future policy to insure that there is no possible anonymity on the Internet. I dislike that solution to that problem because whistleblowers, politic dissidents in repressive regimes, etc. would be silenced alongside the despicable spammers.

BTW, along the same lines of supply and demand, there's a recent article about current and former law enforcement officials that want a different approach to the "war on drugs" than what's been not working for the last number of decades.

Re:bash?

[Brian Kendig]

They need to be shown, without any doubt, that they are indeed breaking the law.

And then they'll stop, just like all those people who used to download music, right?

Legal action can help curb spammers, *if* it's pursued aggressively -- but technology still has a lot more it can do. For example:

- Why do mail servers accept email whose sender address is invalid (malformed) or gives a domain which isn't resolvable?

- Why do mail servers accept email which is sent in violation of the SMTP protocol -- for example, 'spam blasters' which dump a whole lot of commands on the receiving server then disconnect without waiting for a response?

- Why don't mail servers automatically check services such as Razor? If an incoming message happens to have the same checksum as a message which has been reported to Razor several thousand times within the past half-hour, why accept the message for delivery?

- Why don't mail servers have a built-in 'tarpit' feature? In other words: if there's an incoming message, and if system resources aren't tight, the mail server could sit on it for sixty seconds before accepting it. If the sender disconnects before sixty seconds, the mail will be rejected. This obeys the SMTP protocol, and it will be unnoticed by anyone except people who want to blast tens of thousands of emails in one shot -- suddenly it becomes more time-consuming to spam, and the spammer can be stopped before he can get very far.

Re:bash?

[jqh1]

forgive the plug, but if the anonymity of the supply side is a problem, mainly because of the lack of anonymity of the demand side (asymmetrical anonymity!) - enhancing the anonymity of the demand side should help, no?

Use disposable email addresses: spamgourmet (my service), sneakemail, jetable.org.

The trouble is, Ma and Pa aol user don't "get" these services (especially mine -- even tech rag reviewers have a hard time sometimes :)) -- I think the next step is to make them more accessible. We're working to make spamgourmet more easily deployable, including a proposed PHP Nuke front end to go with your own installation...

Thinking out loud -- does any of the legislation cover what website operators are allowed to do with the email addresses they collect? Dangerous territory, I know, because anything like that would greatly increase the cost of operating a small website (compliance/legal costs, for one thing), but I believe analogous legislation is underway in California regarding the personal information collected by banks and related entities.

Re:bash?

[autechre]

Michael Powell is the chairman of the FCC, not the FTC. And oh, how I wish it weren't so (William Kennard, the former chairman, was all in favor of low-power FM and local content.)

Re:bash?

[aardvarkjoe]

Are these features already available in existing mail servers? If they aren't, perhaps some of us coders ought to get started adding them to the open source servers. (I'd love to help, though admittedly I don't know the first thing about SMTP.) If they are, we really ought to start trying to get them enabled as the defaults.

Re:bash?

[Jodka]

"I don't trust Michael Powell."

You didn't read the article. This has nothing to do with Michael Powell. The article regards comments made by Tim Muris, chairman of the Federal Trade Commision. Michael Powell is chairman of the Federal Communications Commision.

After caving in to media interests and allowing further consolidation

That is a strange article to site in support of your belief that government should regulate broadcast communcations, which makes me think that you did not read it either. If you had, maybe you would have noticed the excerpts of congressional testimony. Democrats Byron Dorgan and Barbara Boxer site their own concern about the growing popularity of conservative political ideas in radio and TV broadcasting as justification for government regulation. It gives a good sense of their horror that the free speech permitted by under-regulation will allow conservative ideas to become even more popular. Boxer specifically uses the Fox News reference to France and Germany as the "Axis of Weasels" as an example of an undesirable political statement. Regardless of how the the public conceives of this issue of goverment regulation of communication, on the political level is not really about media consolidation, it is about censorship and free speech.

Re:bash?

[Anonymous Coward]

I am actually kind of impressed that someone would sue based on buying a penis-enlargment kit that didn't work; having your name entered into the legal record alongside that complaint (and victory, meaning the claim was substantiated) takes some guts. One can only hope his dissatisfaction with the spammer started before buying the kit. ;)

Re:bash?

[maw]

- Why don't mail servers automatically check services such as Razor?

I don't expect I'll ever use razor again; its database claims legitimate mail is spam.

I think this is due to some misguided people deciding to submit mail which spamassassin decides is spam without manually checking first.

Unfortunately, once you've blown it, it's too late, and razor has been blown.

Yeah, I am very false-positive-phobic when it comes to spam checking. It's why I don't use spamassassin either. To some people it doesn't matter, which is fine, but I consider it more important as a part of my job as sysadmin to provide reliable service than to provide a pleasant service. So I make spamassassin available to my users (most of them use it, even if I do not), but don't enforce it.

Re:bash?

[bensagenius]

MOD PARENT UP!!! First conservative I've seen on slashdot! Must encourage his continued involvement!

Re:bash?

[daecabhir]

I know it is off-topic but regarding the drug war tangemt, I find it funny that similar arguments about crime reduction and the right to carry firearms have been made, but the general public hasn't bought into that either. And I go agree that making regulating drugs as opposed to outlawing them makes more sense - when the profit incentive goes away, organized crime goes elsewhere. Think about how different things would be in Colombia if the so-called drug lords could be legitimate businessmen?

spam is becoming a problem like pollution

[stonebeat.org]

spam is becoming a problem like pollution.... we can not get rid of it, so we will just have to live with it :( http://www.xml-dev.com

Re:spam is becoming a problem like pollution

[BWJones]

spam is becoming a problem like pollution.... we can not get rid of it, so we will just have to live with it

No, most spam is distributed by a few known individuals. Make laws against distributing spam with harsh penalties (especially for porn spam that kids can be exposed to) and the problem will go away. After all, after the do not call registry went into effect, we have had almost zero telephone calls in the evening from people looking to sell us stuff.

Re:spam is becoming a problem like pollution

[ihummel]

Ah, but much, if not most, of the spam that gets passed around on the Internet comes from outside our borders and therefore outside the reach of any anti-spam law. I don't think the same is true for telemarketers.

Re:spam is becoming a problem like pollution

[Trigun]

It is more problematic than just stopping the spammers. Any legislation should be based upon these criteria.

1) Spam cannot be routed via spurious methods.
2) Spammers can not blanket-target domains.
3) The companies who emply spammers should be held responsible.
4) The advertising should follow current laws and guidelines, with the consideration that minors may be using the internet. In general, follow the guidelines for movie trailers.
5) Transactions between companies and these 'advertising agencies' must be recorded.
6) Both the spammer and the company which sells the product must be held culpable.

Any deviation from these guidelines will only prove to make the anti-spam legislation exactly what the claims state it is, useless and filled with loopholes.

Re:spam is becoming a problem like pollution

[Crayon Kid]

Make laws against distributing spam with harsh penalties (especially for porn spam that kids can be exposed to) and the problem will go away.

I guess we might as well try anything, including throwing the law at them. On the other hand, I can't help wondering if harsh law and punishments will really eliminate spam. Bad people don't care about the law anyway, isn't that true? Look at the anti-drug laws, now those are draconic and yet there's still drug smuggling going on. If spam offers enough incentive for spammer to keep doing it, they will do so no matter how harsh the penalty, while at the same time they will look for safe havens and ways to hide their real identities more.

Re:spam is becoming a problem like pollution

[GigsVT]

we can not get rid of it, so we will just have to live with it :( http://www.xml-dev.com

He says as he spams a link to his web site in his URL, in the message body, and in his sig.

Re:spam is becoming a problem like pollution

[-brazil-]

Bad analogy. Drug trafficking becomes the more profitable the more it's outlawed because the addicty will pay literally any price. Not so with spam, where the demand is quite limited and will not put up with inflated prices.

Re:spam is becoming a problem like pollution

[UberOogie]

3) The companies who emply spammers should be held responsible.

This will never work, although that is the real source of the problem. The spammers will never outright say in any contract that they are going to do illegal spamming. The company can always claim they never knew what was going to be done outside the "opt-out electronic marketing" promised in the contract. In that sense, they're untouchable.

The only way to move illegally move responsibility to the clients is to somehow make it "terrorist" or "war on drugs" related, because then, as we know, all rules of law go out the window.

Of course, unless they are stupid enough to sign on for anything that clearly says the spammer will do something illegal. Then, hang them.

Mind you, I totally agree with the sentiment of going after the spammer clients, but in practice, it will be next to impossible.

Re:spam is becoming a problem like pollution

[Efreet]

In a drug deal the buyer almost never hates the seller for what he has done, and wants to turn them in, hence its a victimless crime. Spam, on the other hands, has about a hundred victims for every "satisfied" customer, and so the police should get plenty of help.

Re:spam is becoming a problem like pollution

[Crayon Kid]

But you don't know that for sure. Besides, being among the few able to keep on doing something [even if it's against the law] it should be worth something. Some companies are gonna keep paying for spam.

Gee, whouda thunk

[EMDischarge]

Does this surprise anyone? Really? Coming from an administration that is loathe to consider government's proper position in regulatory matters I am not surprised that he said this.

Re:Gee, whouda thunk

[BillFarber]

And if this administration wrote laws to stop spam, the other half of slashdot would be whining about Ashcroft taking away our right to free speech.

You don't like spam? Hit the delete key. Don't make a law about it.

Re:Gee, whouda thunk

[letxa2000]

Oh come on, leave off the traditional "blame the Republican for all our woes" line. It's getting old. RTFA. The reasons the FTC director gave for the anti-spam laws being useless are right on the money.

Re:Gee, whouda thunk

[Anonymous Coward]

Lexta2000 is correct. I also think the parent comment rates a Troll moderation.

Re:Gee, whouda thunk

[usotsuki]

Until you get 150 virus spams in a day (I am not kidding). Then you will no doubt agree...Hitting solves nothing.

-uso.

Re:Gee, whouda thunk

[Yorkshire]

hitting the delete key once a second for 2 hours a day is a little tiresome

Re:Gee, whouda thunk

[RyuuzakiTetsuya]

problem is when you've been gone for a few days and you're hitting delete a few dozen times.

OR you're dealing with a server that's being hammered day in and day out by spam and the only way to deal is to spend money and upgrade the server to support the same amount of legitimate emails.

There's your problem.

Re:Gee, whouda thunk

[ioliver]

Excellent advice that I will pass on to my nine year old daughter. Except that before hitting delete she has to read a header advertising web sites where she can see beastiality and incest, usually described in rather graphic language.

The spam needs to be blocked before it hits the user's inbox.

Ian

Re:Gee, whouda thunk

[BillFarber]

1) Making pornography available to children is a violation of existing laws and therefore punishable already which means additional laws would do little.

2) I certainly hope your nine year old daughter doesn't use the internet without supervision. I have an 8 year old son who doesn't get near a connected computer unless his mother or I are assisting.

Comments..

[mumblestheclown]

• Anti-Spam bills being considered currently inadequate: 100% correct
• Anti-Spam legislation not a primary solution: 100% incorrect.

Legislation is the ONLY way to get rid of spam. Effective legislation and prosecution, that is. The "they will all go offshore" excuse is BS. Sure, some might, but many won't. And then, the country that harbors the offshore spammer is squeezed just as korea was (do you see any korean spam any more? well, yes, but nowhere like the torrents we all received a year ago).

Spam is a social problem, not a technological one. Social problems can only be solved by social contracts or laws. Technological solutions fail. Even bayesian filters, those much heralded bleeding edge anti-spam flavor of the moment, are being beaten regularly--my SpamBayes filter catches still a good deal, but more and more slip through despie over 150,000 'training' emails as the spammers get smarter. And, bayesian filters (even at the ISP level) don't begin to address the crucial problem of bandwidth use.

Legislate Now. Not big brother, not slippery-slope BS about john ashcroft in your inbox - just reasonable, progressive legislation to eliminate the spam epidemic.

Re:Comments..

[swordboy]

Legislation is the ONLY way to get rid of spam.

???

How does a US law stop spam from other countries? You can't get *all* other countries to adopt US policy.

The solution lies in the protocol. I never get spam via instant messenger. Why not add offline storage capabilities to an IM style of communication? In this respect, people can send me instant messages when I'm online, and send me stored messages when I'm offline.

If someone wants to be added to my "list of accepted communications", then they need to know a PIN in order for the request to even make it to me.

Problem solved.

I'm actually baffled why an enterprising individual hasn't implemented this as of yet. While you've certainly got the problem of getting people to move to the new solution, it wouldn't be *that* difficult for most services like Hotmail to switch. In order for this to work, we'd need:

1) Open standard for all to use (i.e. - IM interoperability)
2) Free of charge / bundled with ISP service

Since #1 will require legislation, I would have to agree with your argument.

Re:Comments..

[HowlinMad]

I never get spam via instant messenger

I have, I leave my IM up all the time, I;ll come home and have a few IM from some lonely sorority babes that have a free cam, and I should come chat with them.

Why not add offline storage capabilities to an IM style of communication? In this respect, people can send me instant messages when I'm online, and send me stored messages when I'm offline.

Many IM protocols use this. Yahoo does. ICQ does. Jabber can.

Problem solved.

I'm actually baffled why an enterprising individual hasn't implemented this as of yet. While you've certainly got the problem of getting people to move to the new solution, it wouldn't be *that* difficult for most services like Hotmail to switch. In order for this to work, we'd need:

1) Open standard for all to use (i.e. - IM interoperability)
2) Free of charge / bundled with ISP service


Ahh how idealistic, now lets come back to the real world. There have been some implementations like you suggested. They were not accpeted mainstream, and servies like Hotmail won't just switchover, they want to be the ones dictating.

Re:Comments..

[letxa2000]

Legislation is the ONLY way to get rid of spam.

Absolutely incorrect.

The "they will all go offshore" excuse is BS. Sure, some might, but many won't.

You probably have it backwards. Many will go offshore, but some won't.

Plus, it might not be necessary. There is so much spam and spammers are constantly dodging bullets to keep themselves anonymous I'm not sure if it'd really be necessary to go overseas. There are not enough resources to track down spammers that are covering their tracks unless some "public bounty" is authorized that gives the *public* an incentive to track them down themselves. Even then I think you'll find many of the shadier spammers will just use stolen credit cards and/or free ISP trials to send their spam. The trail is going to get awfully cold for a civilian trying to track down a spammer when you run into stolen credit card numbers or need to find the phone number that dialed into the ISP at a given date/time.

Spam is a social problem, not a technological one. Social problems can only be solved by social contracts or laws.

Spam is NOT a social problem any more than junk snail mail is a social problem. It takes advantage of available technology to serve a business purpose and as long as the technology is available to take advantage of, it will continue. The problem is that in the case of email the technology makes spam free.

The solution is make spamming not free (with lawsuits based on existing laws) or make the technology harder to abuse (with filters, etc.). New laws are completely unnecessary and, as the FTC director said, most would be counterproductive.

Technological solutions fail. Even bayesian filters, those much heralded bleeding edge anti-spam flavor of the moment, are being beaten regularly--my SpamBayes filter catches still a good deal, but more and more slip through despie over 150,000 'training' emails as the spammers get smarter.

Then get a better Bayesian filter. With just 3000 good and 10,000 bad emails my Bayesian filter is running at 99.8%. 5 spams have gone through my Bayesian filter so far this month out of 2415 spams--2 were in a foreign language and the other 3 were on-topic enough that they got by and might have even been something I was interested in. My Bayesian filter accuracy has been going up constantly for the last 4 months.

I'm willing to do deal with 1 spam in my inbox every 3 or 4 days to avoid federal legislation that will probably be less than perfect and certainly will not eliminate 99.8% of the spam.

And, bayesian filters (even at the ISP level) don't begin to address the crucial problem of bandwidth use.

Overnight, no. But if more and more people and ISPs implemented Bayesian less spam would be seen my users--including the dumb ones that respond to spam. In time the motivation to spam will decrease and that will decrease the bandwidth problem.

Legislation is NOT the answer.

Re:Comments..

[Otter]

How does a US law stop spam from other countries? You can't get *all* other countries to adopt US policy.

Read what he said -- there's nothing about getting *all* countries to stop spam. If adequate laws were passed regulating spammers (and more importantly, the businesses they advertise) in the G7 countries and a few others, that would make the problem much more tractable for anyone who can live without mail from China or Russia.

Re:Comments..

[Anonymous Coward]

Legislation is the ONLY way to get rid of beer. Effective legislation and prosecution, that is. The "they will all go to speakeasies" excuse is BS. Sure, some might, but many won't. And then, the speakeasy that harbors the lush is squeezed just as Moe's Tavern was (do you see any Moe's patrons any more? well, yes, but nowhere like the torrents we all received a year ago).

Consuming alcohol is a social problem, not a technological one. Social problems can only be solved by social contracts or laws. Technological solutions fail.

Legislate Now. Not big brother, not slippery-slope BS about john ashcroft in your wine cellar - just reasonable, progressive legislation to eliminate the alcohol epidemic.

Right, well..

Social problems never have and never will be solved through law. You cannot legislate morality.

Re:Comments..

[drlock]

One big questions is, "How do you enforce what has been legislated?"

Who will be responsible for finding and persecuting spammers? Current agencies (ie. police, District Attorney, etc.) are already busy enough with more important issues.

My guess is that most spammers are already breaking some laws (truth in advertising, anti-scam laws, etc.). If no one is enforcing the existing laws who will enforce new laws?

For example, sending unsolicited faxes is illegal, and has been for a long time, but lots of people still do it. Why? because no one is enforcing the law.

Re:Comments..

[CrowScape]

As long as that legislation is at the State level only, sure, otherwise it's not permitted under the Constitution. What part of "Congress shall make no law... abridging the freedom of speech, or of the press" do people not understand? If your State wishes to pass anti-spam legislation, that's one thing as the 1st Amendment doesn't shackle the states in anyway whatsoever specifically for such purposes. But national anti-spam legislation and the whole "Do Not Call" list are just plain unconstitutional, no matter how much I hate spam and telemarketing. And no, the 14th amendment does NOT extend the 1st amendment to the States, as the 1st amendment doesn't grant anyone any right such as the 4th Amendment grants the right to be free from unreasonable searches and seizures. The 14th starts off "The right of the people to be..." rather than "Congress shall..." as in the 1st. The 1st amendment's only purpose is to directly limit Congress's power. Because no one likes spammers it's okay to ignore the Constitution apparently. That's fine, it's nothing new. Our Constitution has been being ignored for a long time now. It's sole purpose now is just to give our government the appearance of propriety while the federal government (particularly the judicial branch) does whatever the hell it wants. Just remember, one day, it WILL bite you in the ass.

Re:Comments..

[tlacicer]

Did anyone else say what? to this comment? First of all let me say the only thing I see wrong with spam is that it chews up huge amounts of bandwidth and in appropriate material finds its way into the email boxes of minors.

As an adult spam does not bother me, and if I had young children, I would be monitoring their computer access, its called parenting, people should try it sometime instead of sitting the kids down in front of the TV or the computer.

I do not believe we need MORE legislation especially legislation written by people who are complete clueless when it comes to all things technical.

And if you think spammers will not move off shores think again, they will. Have you ever seen how much money is involved with that business? The cost of the hardware that they use? The amount of emails that they actually send? It would astound you. There are hardware based solutions strictly for spamming that can send untraceable emails at the rate of 10,000 emails per second. They can scan the Internet an automatically find open relays, they know what common mail servers incoming limits are, they rotate IPs automatically, everything soup to nuts.

This problem is definitely a technological one.

Open relays need to be found and shut down and blocked. Mis-configured mail servers and emails should be blocked and dropped.

I respect your opinion but I happen to know a little but about this and I could not disagree more.

We have enough laws, and we have too many useless ones a that. Spammers use advancements in technology to further businesses, why shouldn't we? That same statement applies to the music and movie industry as well.

Re:Comments..

[WhiteLudaFan]

Man... I wish lonely sorority babes would IM me... :)

Re:Comments..

[Darth_Burrito]

Legislation is the ONLY way to get rid of spam.

I have a problem with anti-spam legislation. The solution to spam is to rearchitect the email system to integrate authentication, approved contact lists, and overall security. Everywhere spam of any sort prospers (snail mail, telephones, windows messenger, etc), it is because these kind of controls are not in place. Take icq and aim for example. In the past two or three years I have never seen a single unwanted junk message.

A legislative solution *might* reduce the amount of spam, but it won't come close to fixing the problem. Also, our legislators, good intentioned or not, do not have a very good track record of when it comes to technology related legislation. Finally, it is already going to be hard to convince the world to re-engineer the email system. Despite the fact that spam and other problems are intrinsic to the system, people will use the illegality of spam to avoid addressing the core problems. It becomes more of a problem for law enforcement and less of a problem for the IT community.

I believe in legislation, but only as an absolute last resort. There are already far too many laws.

Re:Comments..

[kevinz]

Legislation is the ONLY way to get rid of spam. Effective legislation and prosecution, that is. The "they will all go offshore" excuse is BS. Sure, some might, but many won't. And then, the country that harbors the offshore spammer is squeezed just as korea was (do you see any korean spam any more? well, yes, but nowhere like the torrents we all received a year ago).

So the spammers move their relays to another location, while they still cash the checks in Florida and Louisiana. How does that help? Even if we grant your Korea example, and I am not sure that I am willing to do that, we still have a number of other countries available to spammers with many targets for relay abuse. The number of third world countries that will improve their connection to the rest of the world without thinking about security is huge. Further, let's pretend that you are a small ISP in one of these thrid world contries. A spammer offers you the equivilent of 3 years profit to host a relay. What are you going to do? Even better, tech savvy spammers will respond to any law by increasing their reliance on virus spread residential gateways. Sobig could be the tip of the iceberg.

Spam is a social problem

No, spam is an identity problem. As long as you can get into my inbox without allowing me to know who you are I will get spam. By moving caller ID to email we can verify that the email was sent by a known sender. I've found that by requiring that senders authenticate the identity and agree to my terms of service that my spam problem is totally gone. No change to the law. No training a spam filter. No dealing with the few that slip through the filter. The only problem I have is those few people who don't know how to reply to an email, and there aren't many of those.

Re:Comments..

[Kjella]

Legislation is the ONLY way to get rid of spam. Effective legislation and prosecution, that is.

There are already laws. But we're nowhere near a technically feasible way to gather evidence to prosecute, or even blacklist. Let's say Joe Q. Average gets a SPAM. How does he deal with it or report it? Something that doesn't take more of his time than to hit 'delete', and would lead to something effective?

In case you haven't noticed, in the MS blaster fallout there's kazillions of "You've been sending virus email" when in fact the sender is spoofed. I've gotten those earlier myself. I'd be happy for a system that made me sure that mail "from" joe@hotmail.com actually came from the user joe at hotmail. Right now, that's not the case at all.

Kjella

Re:Comments..

[bigpat]

"Legislate Now. Not big brother, not slippery-slope BS about john ashcroft in your inbox - just reasonable, progressive legislation to eliminate the spam epidemic."

If John Ashcroft is in my Inbox, then my spam filter is even more useless than I thought.

Re:Comments..

[schon]

You probably have it backwards. Many will go offshore, but some won't.

I think you have it backwards. Spammers are sociopaths. They have turned to spamming as an alternative to other types of fraud.

Would you move to another country - turning your back on your family and friends, just so that you could continue harrassing innocent people? I doubt most spammers would either.

Spam is NOT a social problem any more than junk snail mail is a social problem.

Spam most definitely is a social problem - most spammers are (by any definition) sociopaths.

It takes advantage of available technology to serve a business purpose and as long as the technology is available to take advantage of

And the technology will always exist - or are you advocating the dismantling of email? That's why it's a social problem. Because there are sociopaths that take advantage of it.

make the technology harder to abuse (with filters, etc.).

Huh? How do filters make the technology "harder to abuse"? It's just as easy to abuse, and (more importantly) you're still paying for it (yes, you do pay for all the spam you filter, whether you like to admit it or not.)

Then get a better Bayesian filter.

A "better filter" will only help you to avoid the problem, it doesn't make the problem go away.

5 spams have gone through my Bayesian filter so far this month out of 2415 spams

Oh. My. God. You consider that you pay for 2420 pieces of email that you don't want a good thing?!?!?!

Re:Comments..

[kolbeinn]

but more and more slip through despie over 150,000 'training' emails as the spammers get smarter.

I suspect that many of these 150,000 training emails are getting old (or you receive an unholy amount of spam) and as you said spammers are changing their tactics. So it might help if you deleted the oldest samples as they are no longer a representative sample of spam, making the decision rule generated by SpamBayes inaccurate. Of course SpamBayes might place more weight on newer samples....

Re:Comments..

[jimfrost]

Generally speaking I agree with your commentary, although we do need legislation if only to give a lever that individuals can use when tracking these people down.

Right now if you want to track down a spammer you're pretty much SOL because you can't get a subpoena to extract identity information out of the ISP. You claim that it wouldn't help because they'll use stolen credit cards and whatnot; that may be true, however I was involved in a tracking operation where we tracked the guy to his office telephone because the ISP logged incoming telephone numbers in conjunction with call time and ID. It didn't matter if the ISP had his real identity, the phone company did.

This was a harassment case and obtaining a subpeona was no problem; had it been a spammer it would have been impossible. Giving us a legal foundation for tracking these people is the first step.

The important thing, for me, is not to outlaw spam outright; there are too many gotchas in doing that. We need legislation that normalizes it. Mandates things like no graphic sexual content in the mail message, no anonymity, and mandated opt-out capability. Moreover, the latter could be used to add a tax to spammers; create an opt-out database that they have to pay to access, for instance.

If such legislation is enacted I'm sure we'll see some operations move offshore, but the thing to remember is that an offshore operation raises the costs of doing this substantially. Anything you can do to raise the cost of doing business, even slightly, is going to help dramatically in the case of the really bad spammers. The profit margin on a lot of those spams has to be razor thin.

In the end, though, I think we're going to need technological solutions -- primarily an authentication mechanism for mailers. If all we do is require an authenticatable signature to SMTP traffic (eg signed "from" line) we will vastly decrease their ability to operate anonymously. For that to work all that needs to happen is a few large ISPs buy in on it and start denying unsigned traffic. You'll get a cascade of migration because if you don't migrate you lose a lot of connectivity. Moreover, the infrastructure to do this already exists, it was developed for browsers, all we have to do is leverage it with a small extension to SMTP.

What's clear at this point is that what doesn't work is ignoring the problem. I'm seeing SPAM increase at the rate of something like 25% per month on my personal account. At that rate even with sophisticated filtering technologies -- my filter system is exceeding 97% accuracy -- the 3% that get through will start to be a real burden in less than 18 months (to say nothing of the cost of the traffic that's being automatically dumped in terms of my DSL bandwidth).

I don't expect that legislation will be 100% effective, but if it takes out a few spammers and blunts the growth rate overall then it will be dramatically effective.

Re:Comments..

[untaken_name]

Spam is a social problem, not a technological one. Social problems can only be solved by social contracts or laws.

Yes, as can be seen by our solutions to the 'social problems' of drugs, gays, discrimination, and poor people. All those laws we have to eliminate the above sure worked really well. Laws are for punishing lawbreakers, not preventing crime. Responsible, moral people have no need for laws, because they wouldn't behave in an immoral manner anyway. Education does more than legislation ever will, provided it's done in a responsible manner. (which, I am quite aware, is rarely the case these days) As an example relating to spam (last-ditch attempt at getting back on topic), if people were well enough educated about what spam is, why it is bad, and why they shouldn't respond, eventually people would stop giving their money to spammers/businesses who use spammers. That would stop spam with no legislation required. Unfortunately, education requires not only a good teacher, but also students willing to learn.
Please note: I am not against drugs, gays, or poor people, and I am not against 'discrimination' per se, although I am against unfounded discrimination. However, there have been and continue to be laws against all of the above.

Just Say No to unenforcible/unneccessary legislation.

Re:Comments..

[Anonymous Coward]

Would you move to another country - turning your back on your family and friends, just so that you could continue harrassing innocent people? I doubt most spammers would either.

First of all, I already get a lot of spam that apparently does not originate in the US. Second, they wouldn't necessarily have to move to another country. They would just have to outsource their spamming to another country. If serious anti-spam laws get passed here, I can certainly see such services springing up all over the place.

Re:Comments..

[letxa2000]

I think you have it backwards. Spammers are sociopaths.

I think you are using the definition of "sociopath" very liberally if you think that all--or even most--spammers are sociopaths. I hate spammers as much as the next guy, but sociopaths? The definition of sociopath is "One who is affected with a personality disorder marked by antisocial behavior." Spammers are insensitive and thieves, but I don't think that most of them suffer from a personality disorder.

Would you move to another country - turning your back on your family and friends, just so that you could continue harrassing innocent people? I doubt most spammers would either.

If the spammer is making a few hundred thousand per year I don't think a move to Cancun is going to hurt that much. After all, if they are sociopaths are their links to families and friends going to be all that important? They're sociopaths after all. :)

And the technology will always exist - or are you advocating the dismantling of email?

No, I'm advocating that we lock our doors before we ask Congress to do something about people breaking into our houses. We have the technical means to pretty much solve the spam problem and I think we should obviously exploit those technical means before we go crying to Washington for help that, frankly, they probably won't do a very good job at anyway.

How do filters make the technology "harder to abuse"? It's just as easy to abuse, and (more importantly) you're still paying for it

It's harder to abuse if the spammer has a harder time delivering his message to his intended victim. Filters make it less likely that a spammers' message will get through, thus less likely that a dumb idiot will respond to the spammer, that reduces the profits of the spammer which lowers the incentive to spam in the first place. It's not a silver bullet that will solve the spam problem in one day, but Congress isn't going to be able to give us a silver bullet either.

A "better filter" will only help you to avoid the problem, it doesn't make the problem go away.

See above. You're looking for instant gratification. As they say, the spam problem didn't hit us overnight and we won't defeat it overnight. But widely implemented effective spam filters will reduce even further the response rate of spam which will mean less motivation to send it in the first place. So, yes, a better filter will eventually help the problem go away as long as it is widely implemented. And we have the technical means to implement them widely.

Oh. My. God. You consider that you pay for 2420 pieces of email that you don't want a good thing?!?!?!

Those 2420 pieces of spam consumed 11MB of bandwidth. If I go over my bandwidth allocation (which I don't), I pay $2/GB. So if we assume that I'm paying $2/GB those 11MB of spam cost me about two pennies. Now I'm not saying that I think that it's good that I have to pay anything at all, but my time is much more valuable than the bandwidth cost of spam. And people need to understand that. The bandwidth is annoying, but the real cost of spam is in the time that everyone has to spend dealing with it.

So, yes, the fact that in the last 3 weeks I've had to manually delete 5 spams instead of 2420 is a good thing. If we can get rid of spam and save me three or four pennies per month, great, but I'd rather lose a nickle per month in bandwidth than invite the Federal government to start regulating aspects of email.

Re:Comments..

[Jaysyn]

Bzzt! Wrong! Thanks for playing!

I get spam via YM! & MSN (though I won't have to worry about that soon) all the time

Jaysyn

Re:Comments..

[Anonymous Coward]

This just in!! Nearly all social problems, including drugs, hunger, poverty, terrorism, road rage, and.general irritability have been solved through reasonable, progressive legislation.

Next on the list to be solved: racism, classism, greed, and spam.

Re:Comments..

[Anonymous Coward]

How does a US law stop spam from other countries? You can't get *all* other countries to adopt US policy.

If the CIA, FBI, NSA, and every other government agency down to your local dogcatcher can intercept and read your email, why can't spam be stopped at the border? How many "pipes" are coming into the country? Why can't it be filtered before it gets here?

Re:Comments..

[Anonymous Coward]

If adequate laws were passed regulating spammers (and more importantly, the businesses they advertise) in the G7 countries and a few others, that would make the problem much more tractable for anyone who can live without mail from China or Russia.

and everyone would obey just like US obeyed the security council wrt iraq (eye-raq for fox channel types).

Re:Comments..

[bafu]

It makes me sad to see someone who thinks "technological solution" == "filters" get a +5 Insightful, but whatever. If you are a troll, derive whatever personal satisfaction you can from the fact that I am taking your post at face value...

Spam is a social problem, not a technological one.

You are missing the point of the spam problem. The fact that there are people who have no ethical problem engaging in spamming could be seen as a social problem, but their ability to engage in it is a technological problem. Spam exists because of the way our email system is designed, and that system is not some immutable force of nature. Change the system of incentives in that email system and, without changing human nature or the number of scam artists in existence, you will change the amount of spam in the email system. IOW, they currently use it because the technical design of our email system makes it easy for them to engage in their particular form of antisocial behavior. If and when it doesn't, they will not disappear (or, in most cases, give up antisocial behavior in general), they will just stop sending spam through the email system.

So, I agree that filters and so on are not solutions... after all, they only treat the symptoms. That isn't an argument against a technological solution, however. The people who are proposing "technological solutions" to the overall problem are actually talking about changes to the system itself, not filters slapped on top of it.

Re:Comments..

[anthony_dipierro]

Spam is a social problem, not a technological one. Social problems can only be solved by social contracts or laws. Technological solutions fail.

You're right and you're wrong. Yes, spam is a social problem, and the solutions to social problems need to have a legal aspect to them. But they also need to have a technological aspect to them. Email is essentially a peer-to-peer technology. Just look at how much trouble the RIAA is having stopping P2P filesharing. Sure, enforcement of the law seems to be having a bit of an impact, but that enforcement is also very expensive and is IMO never going to stop much of the filesharing.

Legislate Now. Not big brother, not slippery-slope BS about john ashcroft in your inbox - just reasonable, progressive legislation to eliminate the spam epidemic.

Unfortunately I don't think that's currently possible. For legislation and enforcement against spam to work would necessarily involve a big brother solution.

You agree that the current bills are inadequate, yet you urge us to legislate now. What legislation are you urging us to pass? What is this mystery legislative solution which you propose exists?

Re:Comments..

[anthony_dipierro]

It's just as easy to abuse, and (more importantly) you're still paying for it (yes, you do pay for all the spam you filter, whether you like to admit it or not.)

I don't.

Re:Comments..

[anthony_dipierro]

First of all let me say the only thing I see wrong with spam is that it chews up huge amounts of bandwidth and in appropriate material finds its way into the email boxes of minors.

Really? I think you missed the biggest problem with spam. It's annoying to separate from the legitimate email.

Re:Comments..

[tlacicer]

I don't know about you, but I can spot a spam email a mile a way and delete it without every opening it. I also know which of my accounts gets the most amount of spam.

Now yes one of my email accounts is completely unusable, but I mean the account is heywood@jablowme.com, did I really expect this account to be useable .. no I did not.

And you can setup simple enough filtering rules on your client to get rid of most of the spam for you.

Its like seperating your snail mail everyday, only difference is at least you get to mail their reply cards back to them so it costs them money.

Re:Comments..

[scrytch]

Then get a better Bayesian filter.

A "better filter" will only help you to avoid the problem, it doesn't make the problem go away.

At some point, as filters become ubiquitous, spammers are going to realize they could get more exposure by going back to junk faxing. Maybe SMS, but doubtful, since so much of that infrastructure is centralized. Some suckers buy from spam. Few buy stuff out of emails in their spam folder -- go fig.

Fuck if I want one of the most abusive, oppressive, and invasive governments in america's history getting access to more federal laws to whack us with. They'd probably use it to shut down a political campaign that has the bad judgement to pick a spammer to run a regional mail list (see Howard Dean)

Re:Comments..

[anthony_dipierro]

I don't know about you, but I can spot a spam email a mile a way and delete it without every opening it.

Me too, but it's still annoying to delete it without even opening it.

And you can setup simple enough filtering rules on your client to get rid of most of the spam for you.

I've done this too, but it's still annoying.

Its like seperating your snail mail everyday, only difference is at least you get to mail their reply cards back to them so it costs them money.

Well, the other difference is that I know when my snail mail is going to come, and therefore I only check it once a day. Email on the other hand tends to get checked more often, so it's more annoying.

In any case, the annoyance of getting spam far outweighs the $0.000000001 in bandwidth costs. That's my point.

Anti-Spam laws are the only way to go

[Marxist Commentary]

As long as there is profit to be made, there will be an enterprising capitalist there to take advantage. Especially in the case of spam, where there is no real barrier to entering. If you get a miniscule response, you can make a huge return on a limited investment.

It's akin to regulation of the traveling snake-oil salesman of the nineteenth century. That sort of charlatan is no longer allowed (by law), and the same could happen with strong (and strongly enforced) spam laws.

Re:Anti-Spam laws are the only way to go

[Frodrick]

As long as there is profit to be made, there will be an enterprising capitalist there to take advantage.

Quite true. Perhaps the best solution lies in stopping the profit. If it were illegal for businesses to use or pay for spam, then the spammers would drop off because there would no longer be a profit to be made (except of course in the scams). Obviously it would still be a seriously uphill battle, but at least there would be a fighting chance that we do not have now.

Unfortunately, most governments are loathe to interfere with business any more than they have to. Even really slimey businesses.

Re:Anti-Spam laws are the only way to go

[dirk]

It's akin to regulation of the traveling snake-oil salesman of the nineteenth century. That sort of charlatan is no longer allowed (by law), and the same could happen with strong (and strongly enforced) spam laws.

While I'm no spam fan, it isn't anything like the charlatans of the nineteenth century. They sold a bogus product that did not do as they said it did. Assuming these spams are for real products, that do as they claim they do, there is no comparison. Obviosuly there are some spammers using fraud to make a profit, but I think it is probably less than half.

Re:Anti-Spam laws are the only way to go

[boatboy]

The illogic of your comment is that it ignores the other side of the coin. As long as there is profit to be made stopping spam, capitalism will find the cheapest, best way to do so- much cheaper and much better than any politician ever could. It also, as this century has proven for marxism, ignores the fact that where there is profit to be made, there will always be an enterprising politician to take advantage.

Your analogy is also incorrect. Snake oil salesmen were frauds. Fraud became illegal, not snake oil. I may buy snake oil (or magnet bracelets or crystals) as long as the seller is honest about what it is. Spammers may be frauds also, but the point is, if they are frauds-or in violation of other existing laws- then they should be prosecuted under those laws. If new laws are needed to clarify what sorts of advertisement are illegal, they should not deal with the technology but rather the core issue (ie. it is illegal to advertise indecent material to minors.)

I have a feeling most /.ers, if they thought about it, would trust technology over a politician any day...

Re:Anti-Spam laws are the only way to go

[Danse]

Obviosuly there are some spammers using fraud to make a profit, but I think it is probably less than half.

So that's what... only several million spammers doing it?

Re:Anti-Spam laws are the only way to go

[Anonymous Coward]

Assuming these spams are for real products, that do as they claim they do, there is no comparison. Obviosuly there are some spammers using fraud to make a profit, but I think it is probably less than half.

So you think less than 50% of the spam in your inbox is advertising bogus products! Are you on acid? I have a real bridge to sell you.

Re:Anti-Spam laws are the only way to go

[anthony_dipierro]

Especially in the case of spam, where there is no real barrier to entering. If you get a miniscule response, you can make a huge return on a limited investment.

I think you underestimate the barriers to entering the spam business. Where are the ISPs which are going to allow one to send spam from their networks? We're talking about a significant investment to actually have a chance of making money before you get shut down.

Wow...

[InfinityWpi]

A government figure who actually admits there's not a whole lot they can do. Nice to see a guy with a little common sense (on this issue, at least) giving voice to his oppinions. Let's face it, he's right. Outlawing spam is -not- goingg to have an yeffect whatsoever. Look at underage drinking, pot use, etc. It's illegal, it still happens, and quite often. The 'spam bills' won't have any effect beyond making people think their senators are tech-minded.

Re:Wow...

[DataCannibal]

Arguing that a law doesn't stop a crime being commited therefore you shouldn't have that law is spurious. Pot use and underage drinking are a lot less than they would be if they weren't illegal.
If that law helps stop one kid getting drunk and killing himself it's worth having. If a spam law stopped just a small percentage of spam it would still save shedloads of money worldwide that is now wasted dealing with spam.

Re:Wow...

[Cyno]

But outlawing it, like everything else, will create additional markets for law enforcement.

Its like make-work-day, for the whole country.

Re:Wow...

[AVGVSTVS]

Well no, you see, drinking, pot smoking, etc. Those things exist due to marketplace demand, whereas spam is the opposite, its a bit like comparing pulling, to pushing. Robbery and such exist despite laws against them, however you cannot seriously suggest we stop prosecuting the offenders. Spammers and the companies that utilize them need to be held accountable for damages they incur.

Re:Wow...

[keester]

It's ignorant to compare spamming to pot use and underage drinking: the former being a business model and the latter being recreational activities. (to most people at least, some people are business like about it)

There's not a whole lot of money to be made in smoking pot or drinking. If spammers are fined for spamming ... guess what? They'll stop doing it, because they are no longer making money. Is that so hard to see?

Someone mentioned that they would just go overseas to do it. Well ... go overseas. That makes it easier to block at least. (i.e., block the email from the spam friendly nations.)

Re:Wow...

[keester]

If that law helps stop one kid getting drunk and killing himself it's worth having.

That's lazy logic. The fact is that perhaps we could save more lives by having different laws. Especially in the case of Marijuana laws. Think of it this way: If the law saved 1 life, but a different law would have saved 10 lives ... I digress.

Re:Wow...

[johny_qst]

I think this sentiment is one of the big problems our current federal and state legislators have with the process of creating effective legislation. The use of legislation as a moral or ethical deterrant is seriously flawed. High school kids will continue getting drunk at parties for the rest of the time this society exists on this rock. The key focus of trying to protect these kids from themselves should be education and awareness of the effects. The smart ones will live responsibly and the rest are darwin awards candidates... to claim that having the laws on the books is a good thing just because it "may" stop someon from using or trying something illegal is foolish. Especially when one of your examples is marijuana legislation that is keeping scores of middle-class americans locked away in prisons living off my tax dollars when they were doing nothing to harm or affect anyone/anything other than their own bodies!

Re:Wow...

[anthony_dipierro]

If a spam law stopped just a small percentage of spam it would still save shedloads of money worldwide that is now wasted dealing with spam.

The problem is that in order for a spam law to stop just a small percentage of spam you would have to spend shedloads of money enforcing the law.

Re:Wow...

[anthony_dipierro]

Well no, you see, drinking, pot smoking, etc. Those things exist due to marketplace demand, whereas spam is the opposite, its a bit like comparing pulling, to pushing.

Obviously there is marketplace demand for spam if someone is buying the products being spamvertised.

Robbery and such exist despite laws against them, however you cannot seriously suggest we stop prosecuting the offenders.

True, however robbery is a much more serious offense than spam.

Spammers and the companies that utilize them need to be held accountable for damages they incur.

For direct damages, they already are, under tort laws. Unfortunately, direct damages amount to something like $0.000001 per spam.

Re:Wow...

[AVGVSTVS]

The market "demand" is entirely different. One is a direct consumption demand, people seek out pot, alcohol, etc., for themselves, because they want it. Spam on the other hand is unsolicited, thats the key. Also, is robbery a more serious offense? If I steal a couple CD's from my local media play, is that more serious than someone whos hundreds of thousands of emails have clogged servers, cost companies money for bandwidth, programmers to filter the spam, overtime to techs to fix stuff? Robbery will result in legal punishment, its time spam did as well.

Re:Wow...

[anthony_dipierro]

One is a direct consumption demand, people seek out pot, alcohol, etc., for themselves, because they want it. Spam on the other hand is unsolicited, thats the key.

You've never been to Washington Square Park in Manhattan, have you? Not all drug sales are solicited.

Also, is robbery a more serious offense?

Generally, yes.

If I steal a couple CD's from my local media play, is that more serious than someone whos hundreds of thousands of emails have clogged servers, cost companies money for bandwidth, programmers to filter the spam, overtime to techs to fix stuff?

I'm not sure what a "local media play" is. But assuming you're talking about physical theft, yes, that is more serious. I don't think you can count the costs from programmers to filter the spam, because it is not a direct damage. And I don't think overtime to techs to fix stuff is going to be an actual cost of spam, because spam generally doesn't break stuff.

Re:Wow...

[AVGVSTVS]

No direct damage? Okay, lets say I own a private road, now, I have poeple coming through my road, with big 18-wheelers, advertising to the community on the other side, without thier consent, or mine, now, that road needs to be maintained, I may have to add additional lanes to handle the traffic, the traffic might get so heavy I need to hire guards to patrol the road to ensure the level of traffic is kept down. That is direct damage, its taking money out of my pocket, in order to maintain the same level of service for the poeple who pay to use the road.

Re:Wow...

[anthony_dipierro]

Okay, lets say I own a private road, now, I have poeple coming through my road, with big 18-wheelers, advertising to the community on the other side, without thier consent, or mine, now, that road needs to be maintained, I may have to add additional lanes to handle the traffic, the traffic might get so heavy I need to hire guards to patrol the road to ensure the level of traffic is kept down. That is direct damage, its taking money out of my pocket, in order to maintain the same level of service for the poeple who pay to use the road.

Yes. You're correct. I never said anything about driving down roads with 18-wheelers. I thought we were talking about spam.

Paying for programmers to filter spam is not a direct damage.

what can be done?

[shakeittotheright]

perhaps the only way to solve spam is to go down the route of scrapping email as well know it and starting a new system from scratch that has solid anti-spam measures built in from the ground up. i believe such systems exist.

Re:what can be done?

[Metasquares]

I agree that that's probably the only way to completely stop spam (And spammers'll probably find a way around that, too), but to do that to the entire internet would take years. I'd compare it to the IPv6 switch.

Re:what can be done?

[HowlinMad]

I do not thinks scrapping will work. It needs to change, but the changes need to be made slowly. You will never get enough people to just drop the old system, never go back and adopt the new one. Instead you need to slowly phase out the old system, by making changes one at a time to the system. This could take a while, but its worth it.

Think of it this way, email is like a huge aircraft carrier. Its much easier for the aircraft carrier to make a long sweeping turn, than it is for it to stop on a dime, turn, and start up again in a new direction.

People will accept small changes much easier than a new radical design. PLus these small changes can be incorporated in the products we use now, slowly shaping them into the solution.

Funny interview?

[Anonymous Coward]

I couldn't bear it!! I read about 6 lines. Who does that guy think he is? I've never heard of him but he seems to love himself!

Relative of Katz, perhaps?

Two evils

[ArmenTanzarian]

Going to read an article about anti-spam legislation and being bombarded with pop-up ads

best quote

[RevDobbs]

best quote from the Knowspam.net interview:

Q. What are you doing with all your extra time now that you aren't getting spam?

A. . . . Petting the cat. Not a entendre, by the way. Real cat. . . .

Re:best quote

[geekster]

And what is that? Entendre?

Re:best quote

[Anonymous Coward]

He probably should have said double entendre.

Re:best quote

[Don'tTreadOnMe]

I think he meant "euphemism".

Headline Misleading

[kunsan]

At first glance, it sounds like the FTC cheif has his head up his ass. After reading the article, I realised the man just does not want to pass a lame ass law that makes it HARDER to prosecute spammers. He is looking for a simpler plan to make it EASIER to shut down mass-spammers. Sounds like he needs our help, not our hostility.

JP

Re:Headline Misleading

[letxa2000]

You're asking Slashdot folks to *help* the Bush administration, even when it's right? Let's get back to reality here. The most important think here is to bash Microsoft, then bash Bush, then once that's done any remaining options may or may not be on the table.

Re:Headline Misleading

[Anonymous Coward]

When someone repeatedly screws up, often apparently intentionally, you begin to stop considering their ideas as seriously as you might have. This can apply to an administration as well as an individual.

Re:Headline Misleading

[Anonymous Coward]

Actually, it's possible to acknowledge that what the FTC chairman said is true and still bash Bush and Microsoft.

"A Bush Administration spokesman, in a moment of weakness or insanity, took a break from providing fair trade practice exemptions to Microsoft executives in exchange for campaign contributions to say something that is actually true. Analysts now expect that the earth will soon open up and swallow major portions of North America."

I suspect that if ISPs want something done by this administration that's more to their liking, their performance at filling the campaign troughs will have to improve.

I've already forgotten the exact date for when the national "do not call" list goes into effect. It's sometime in September, I believe. In any event, there are so many loopholes in that particular law that I doubt I'll be able to determine when it has begun to take effect. This is an example of how government does things like this - the regulations are so weak as to be minimally effective at best. "Charities", local newspapers, and any business that can claim a prior business relationship (IOW, I was stupid enough to tell them I bought something of theirs) are still permitted to call. This accounts for the lion's share of my telemarketing calls, as I'm sure it does most peoples'.

As others have pointed out, if the ISPs were truly motivated to stop spam, they would have done it already. They've made what are mostly half-hearted attempts to curb some of the abuse, but they're dependent on subscribers. They don't want to piss off the ones who pay for business-level services. Their attempts at legislation are the ones before Congress now - they are all attempts to make the problem go away without making the ISPs do the work or feel the pain. None would succeed any more than casting a spell or praying for divine intervention.

Challenge/response spam filtering

[Mwongozi]

Is it just me, or is C/R spam filtering, really, intensely, annoying?

If I e-mail someone, and I get one of those "I think you're a spammer, prove you're not" messages back, then fuck it, you're not getting my e-mail. Challenge/response breaks the whole concept of e-mail.

I personally use SpamAssassin to drop mail scoring 5-10 into a crudbox, and 10+ just gets bounced.

I don't get much spam anymore.

Re:Challenge/response spam filtering

[KMitchell]

If you email me and get my "prove you're not a spammer" TMDA autoreply then you've never corresponded with me before (with the email address you're using). Any previous correspondence (to or from) and you won't get the autoresponse.

If you care enough to send email to me, you care enough to "hit reply" one time for a "new address". If I started the "conversation" you shouldn't ever get an autoresponder message.

Challenge/response breaks the whole concept of e-mail.

No. Spamming broke the concept of email years ago. The only question is how to fix things. Based on the hoops you're going through with SA, your email sounds just as broken. Been there, done that. If you don't want to email me, I'll cope somehow.

Re:Challenge/response spam filtering

[Mr_Silver]

personally use SpamAssassin to drop mail scoring 5-10 into a crudbox...

I'm amazed you (and most others) have it so high. For me, anything over 3 gets junked and, if it was any higher, i'd get tonnes of spam in my index.

...and 10+ just gets bounced.

Neat. Excuse my ignorance but would you be so kind so show me how would I go about setting that up?

Thanks.

Re:Challenge/response spam filtering

[Mwongozi]

I have it set high because I get a lot of HTML mail. I don't mind HTML mail at all, I just don't like spam. 5 is an adequate setting.

I use Sieve to sort (and bounce) my e-mail.

Re:Challenge/response spam filtering

[letxa2000]

No. Spamming broke the concept of email years ago. The only question is how to fix things. Based on the hoops you're going through with SA, your email sounds just as broken.

I agree with grandparent, C/R is a lame response to spam. It puts the burden of your spam problem on those legitimate users that may want to mail you. Forgetting the technical problems, that's just rude. I am *not* your spam filter and, like parent, if I receive a C/R response I will just ignore it.

Technically, C/R is also lame. So you're getting, say, 100 spams coming in per day to your C/R system. Most of those are coming from non-existant addresses or addresses that belong to someone NOT involved in the spamming. So your C/R system is faithfully sending challenge messages to those 100 senders. Perhaps half fail because they are undeliverable, the other 50 find their way to innocent parties not involved in sending spam.

So for you to enjoy a spam-free email experience you've annoyed your legitimate senders, some probably decided not to bother (false positives that you don't see), you've attempted to deliver 1 challenge message for every spam you received (increasing spam-related traffic), and have managed to annoy 50 innocent people just because their email address happened to be forged by a spammer. But I guess the important thing is that you weren't bothered by the 0.5% of the spam that might get past a good Bayesian filter.

So... can you explain to me again why C/R is such a good thing?

Re:Challenge/response spam filtering

[Mr_Silver]

I have it set high because I get a lot of HTML mail. I don't mind HTML mail at all, I just don't like spam.

I'm the same too. But if I put it any higher, i end up with loads of spam passing the spamassassin tests (because they rank around the 3.5 - 4.5).

Cheers for the link. Will check it out.

Re:Challenge/response spam filtering

[Yorkshire]

bouncing spam is spamming, I do hope you meant reject otherwise you're just another spammer yourself.

Re:Challenge/response spam filtering

[KMitchell]

I agree with grandparent, C/R is a lame response to spam. It puts the burden of your spam problem on those legitimate users that may want to mail you. Forgetting the technical problems, that's just rude. I am *not* your spam filter and, like parent, if I receive a C/R response I will just ignore it.

Email has changed. One way or another, you're going to have to cope. Some buildings have doormen that "challenge" you before you can go up to an apartment. If that offends you so much that you won't visit an apartment, I guess you didn't care enough to see someone. Same deal. It's a screening process that tries to be as non-invasive as possible.

But I guess the important thing is that you weren't bothered by the 0.5% of the spam that might get past a good Bayesian filter.

So... can you explain to me again why C/R is such a good thing?

You just did a pretty good job, yourself. Add up the hours you spend trying to keep your "good Bayesian filter" hitting at 0.5% over an extended peiod of time, plus the time you spend checking your spambox for false positives and compare that with my "spam free existance" My mail works cleanly with minimal effort on my part and that of those I correspond with.

Re:Challenge/response spam filtering

[Anonymous Coward]

Any previous correspondence (to or from) and you won't get the autoresponse

What about spammers who use *my* address in the from field? I send notes to myself all the time, and a good 15-20% of my spam has my own address in the from field.

Re:Challenge/response spam filtering

[fractalus]

I periodically look at my TMDA pending queue to see if there are messages from people who can't figure out how to respond to a challenge.

There aren't any.

Anyone who bothered enough to find my e-mail address and send me mail has no trouble replying to the confirmation request. It's politely worded and explains the situation very well.

TMDA's challenge-response system keeps 200+ spams a day from my inbox. No, it's not a perfect solution, because it still reaches my mail server, still eats bandwidth, and only deals with the final effects of spam, not the root cause. But if I had 200 junk messages in my mailbox every day, nobody would be able to reach me, because I would stop using e-mail.

This isn't rude. This is telling people you're being deluged and this is an easy way to make their message stand out from the junk.

Re:Challenge/response spam filtering

[letxa2000]

Email has changed. One way or another, you're going to have to cope.

Yes. And technology, such as the Bayesian filter I use, allow me to cope without burdening me or the people emailing me, and without creating more useless email traffic in the form of challenges sent to email addresses that have nothing to do with the person that really sent the message.

Add up the hours you spend trying to keep your "good Bayesian filter" hitting at 0.5% over an extended peiod of time

Hours? You said you used Bayesian before going to challenge/response. Is that really true? All I had to do was click a few "you got that wrong" links when I first started using the filter. Ever since then it pretty much trained itself. Now I don't even know it's there on a daily basis.

Suggesting that I've spent hours on my Bayesian filter to get it working is absurd.

... plus the time you spend checking your spambox for false positives

Compared to your system where you don't even KNOW you had a false positive. In all fairness, the people that don't bother to go through the hassle of validating themselves can be considered a false positive in challenge response. Do you even know how many people didn't go through your C/R process? Do you even know your false positive rate?

... and compare that with my "spam free existance" My mail works cleanly with minimal effort on my part and that of those I correspond with.

That's downright selfish. You ignore the fact that your "spam free existance" is at the cost of creating more spam for all the innocent people who are subject to your challenge requests just because some spammer decided to forge their email as the return address. They didn't contact you and yet you are spamming them with challenge emails.

My spam-free existance (about 7 spams per month) is very tolerable and I don't spew out thousands of useless challenges to innocent people in the process. My spam-free existance doesn't come at the cost of increasing the volume of spam for other innocent parties.

Re:Challenge/response spam filtering

[letxa2000]

I periodically look at my TMDA pending queue to see if there are messages from people who can't figure out how to respond to a challenge. There aren't any.

How do you know? If you are receiving 200+ spams per day and you check your pending queue every 2 weeks, that's 2800 messages. Are you positive that you've never missed a message in the middle of all that spam that was legitimate? If so, how much time does it take you to review those 2800 messages? And is reviewing those 2800 messages any better than checking a Bayesian filter for false positives?

TMDA's challenge-response system keeps 200+ spams a day from my inbox.

You do realize that you are generating 200+ challenge messages for those daily spams, right? You realize that that creates more traffic on the Internet, right? Not only that, you know that spammers often forge real email addresses as the return address for their spams such that many of your hundreds of daily challenge messages are being sent to innocent people who never had any intention to contact you and that, to them, your challenge message is spam, too?

But if I had 200 junk messages in my mailbox every day, nobody would be able to reach me, because I would stop using e-mail.

But if you used Bayesian you'd only get about 1 spam every couple of days and wouldn't be generating useless challenge messages that further burden the email system and fill up the mailboxes of others that simply had their email address forged by a spammer.

This isn't rude.

Tell that to the person that receives 100 challenge responses because a spammer used their email address and happened to hit 100 people that use the C/R system. The only reason C/R isn't being widely criticized is because it's not widely used. If it were to become widely used you'd see more and more people complaining about receiving the challenges, especially challenges that they're only receiving because a spammer used their email address as the return address.

Re:Challenge/response spam filtering

[tombu]

knowspam.net handles this problem. You can make yourself a "bad sender" and then use knowspams SMTP server to send mail to yourself. When you use knowspams SMTP server, it puts a special code in the message that lets knowspam know it is really from you and the message gets through.

Re:Challenge/response spam filtering

[Anonymous Coward]

If I e-mail someone, and I get one of those "I think you're a spammer, prove you're not" messages back, then fuck it, you're not getting my e-mail

Would you beilive that this is actually intended response? Why should I sacrifice my time if you are not willing to sacrifice the momment of your time to ask me something? It is after all, that it is you who is initiating the conversation here.

I don't get much spam anymore.

I don't get ANY spam any more.

Anonymous Cowards Unite

(karmacollectortag)

Re:Challenge/response spam filtering

[whoever57]

I personally use SpamAssassin to drop mail scoring 5-10 into a crudbox, and 10+ just gets bounced.

Bounced? To whom? To the poor unfortunate whose email address has been forged? To the ISP whose domain has been forged?

Why not just drop them into /dev/null ?

Re:Challenge/response spam filtering

[Deven]

This isn't rude.

Tell that to the person that receives 100 challenge responses because a spammer used their email address and happened to hit 100 people that use the C/R system. The only reason C/R isn't being widely criticized is because it's not widely used. If it were to become widely used you'd see more and more people complaining about receiving the challenges, especially challenges that they're only receiving because a spammer used their email address as the return address.

How is that different from getting 100 confirmation emails from 100 mailing lists you've been "subscribed" to without your permission? Such confirmation emails are considered good; what's so bad about challenge/response? It mainly differs in who it is trying to save from unwanted email. The mailing list is trying to protect you by requiring confirmation; the challenge/response recipient is trying to protect himself/herself. Either way, it's generally a minor one-time nuisance. The spam problem, on the other hand, is a growing nightmare.

As for rudeness, I guess that's a judgement for society to make. Challenge/response isn't really much different from people who habitually screen all phone calls through their answering machine, and never answer unless they hear someone they want to talk to. Society seems to have accepted that practice, knowing those people are generally trying to escape the annoyance of telemarketing calls -- why shouldn't society accept challenge/response as a way to escape the annoyance of spam? It's only "rude" if society says so, and as more and more of society is becoming familiar with the nuisance of spam, attempts to defeat it will become increasingly accepted as necessary evils...

Re:Challenge/response spam filtering

[letxa2000]

How is that different from getting 100 confirmation emails from 100 mailing lists you've been "subscribed" to without your permission? Such confirmation emails are considered good; what's so bad about challenge/response?

It's different because a mailing list asking for confirmation does so to protect the person being sent the confirmation from being signed up to the mailing list without their authorization. It's not to protect the mailing list, it's to protect the person that someone is trying to screw by signing them up against their wishes.

It's also different in that I've run an opt-in mailing list with email confirmation on one of my websites for the last 5 years. In that time I have not received a single complaint or report of that opt-in message being used to bomb someone with unwanted confirmation messages. And if it became a problem I would certainly build in a throttle to limit future damage.

Users of challenge/response, such as you, know very well that they're receiving 200+ spams per day. You know full well that each of those spams is generating a challenge message and that many will be undeliverable and the rest will go to innocent third parties, filling up their inbox. THAT'S what's rude and you become part of the spam problem in the eyes of those innocent parties.

If my mailing list was sending 200 undesired confirmation messages to users each day, believe me, I'd fix that. Yet that's the norm for challenge/response.

Challenge/response isn't really much different from people who habitually screen all phone calls through their answering machine, and never answer unless they hear someone they want to talk to.

No, challenge/response is like leaving a message on an answering machine along with your (supposed) phone number. The answering machine then calls the (supposed) phone number and asks if it's really you... but 200 times per day the answering machine bothers people that never called the answering machine to start with just because someone left that phone number.

Interestingly, passively screening calls with an answering machine is closer to a traditional or Bayesian filter than it is to a challenge/response system.

Society seems to have accepted that practice, knowing those people are generally trying to escape the annoyance of telemarketing calls -- why shouldn't society accept challenge/response as a way to escape the annoyance of spam?

Again, using an answering machine to passively filter phone calls is fine. And that is equivalent to using a passive filter, Bayesian or otherwise, to filter email. I'm entirely in favor of that. But if telemarketers started calling and leaving messages and leaving random phone numbers and that same answering machine started calling the number to verify the caller, believe me, you'd see people hopping mad and looking for legislation to ban those machines.

I think you need to take a careful look at what you're suggesting. I personally find C/R offensive as a legitimate user emailing someone else and having to help them with their spam problem. But even more annoying is the hundreds of users that receive C/R messages from users that they never emailed.

That's where it's both rude and technically flawed. You're "solving" the spam problem for one person (you) at the cost of hassle for those sending email to you *AND* the hundreds of people that are hit by the challenges your system creates in response to the spam it receives. As long as email can be forged it's just a flawed concept.

Re:Challenge/response spam filtering

[Deven]

It's not to protect the mailing list, it's to protect the person that someone is trying to screw by signing them up against their wishes.

Yes, I said that the difference was in who it was trying to protect from unwanted mail, but in either case, it's about unwanted mail.

In that time I have not received a single complaint or report of that opt-in message being used to bomb someone with unwanted confirmation messages.

Perhaps because it wouldn't be done by sending 100 subscription requests to your list, but to yours and 100 others. Is the user going to bother to complain to each of 100 lists, or just be glad that they can ignore the messages and not get flooded with mailing-list traffic? Probably the latter.

I've received confirmation requests for bogus subscription requests that I never sent, but I've never complained to the list administrator; it's obviously not their fault, so what would be the point? The fact that you don't receive such complaints is no proof that your confirmation emails haven't been unwanted in someone's mailbox.

Users of challenge/response, such as you, know very well that they're receiving 200+ spams per day. You know full well that each of those spams is generating a challenge message and that many will be undeliverable and the rest will go to innocent third parties, filling up their inbox. THAT'S what's rude and you become part of the spam problem in the eyes of those innocent parties.

Firstly, you're jumping to conclusions. I do not use challenge/response at the moment, although I'm seriously considering it. Unlike you, I freely post my real email address on Slashdot and anywhere else. I don't hide my email address, because I don't believe obfuscation is a viable long-term solution. I'd rather see some sort of technical solution. But of course I receive tons of spam on a daily basis. That's the price I pay for my principles.

While you may not care for it, challenge/response is a legitimate technique which can plausibly make a difference in the "war on spam". We're already hearing of people who are giving up on email and the Internet because of spam -- is that really better for society than the hassle and "rudeness" of challenge/response?

Personally, I think it's more rude to refuse to provide your email address and/or to obfuscate it in obnoxious ways that make it hard to automatically utilize the email address, than to implement challenge/response. Either way, you're placing a burden on the legitimate sender, to figure out your email address or to respond (once) to a challenge message. How is one burden worse than the other?

As for adding to the flow of email by sending challenge messages to return addresses that are likely to be bogus, that's an unfortunate consequence, but the spammers are causing the problem by forging bogus return addresses in the first place -- so blame the source. Also, they generally spam tons of bogus target addresses, causing plenty of automatic undeliverable bounce messages.

Which brings us to filling people's inboxes with unwanted challenge messages -- this implies that a spammer forged a real email address (a "joe job") and that poor user is now getting unwanted challenge messages. This sucks, but they'll also be getting tons of unwanted bounce messages from all the bogus target addresses attempted. Again, blame the source of the problem, not innocent users who are trying to protect themselves.

Users are between a rock and a hard place here. Polite society depends on a certain level of self-restraint; when rudeness and antisocial behavior become too rampant, polite behavior becomes ineffective and rudeness begets rudeness and antisocial behavior begets antisocial behavior. Spamming is an entirely rude and antisocial behavior, and it forces people into rude and antisocial behavior in self-defense. (Like challenge/response, obfuscating email addresses, blackhole lists, etc.)

Until society as a whole de

Re:Challenge/response spam filtering

[Slack3r78]

No, it's not a perfect solution, because it still reaches my mail server, still eats bandwidth, and only deals with the final effects of spam, not the root cause.

And there you have why I don't think C/R is a good idea. You're increasing the total amount of bandwidth dedicated to spam, and in essence, worsening one of the biggest problems with spam. True, it only challenges unknown addresses, but think about it - when you receive email from an unknown address, it is FAR more likely that it's going to be from a spammer using a one-off address than it is someone you actually want correspondence with. So you end up wasting a hugely disproportionate amount of bandwidth on spammers, effectively compounding the problem. Just some food for thought.

Re:Challenge/response spam filtering

[letxa2000]

I was on vacation for a week, hence my delay in responding. Your message was quite long and certainly expresses your view on the issue, but I mostly just want to respond to your response of my primary objection to the challenge/response approach (even though you call it a red herring, even though it most definitely isn't).

As for adding to the flow of email by sending challenge messages to return addresses that are likely to be bogus, that's an unfortunate consequence, but the spammers are causing the problem by forging bogus return addresses in the first place -- so blame the source.

That's where I disagree with you. You are increasing someone's spam problem in an effort to reduce your own. You're increasing network traffic just to avoid spam yourself. That's just selfish. It also doesn't solve spam on a global basis since it's actually increasing spam and email traffic--you just don't see it yourself.

The three options you mentioned are:

1. Spammer uses real email address. Unlikely. But if it happens then the spammer is just treated as a legitimate sender, no big deal.

2. Spammer forges a bogus email address. At the very least spammers now use valid domains since so many email servers reject email that doesn't have a valid sending domain. So even if the email address itself is invalid, the domain is valid--so your challenge/response system is going to connect to the victim email server and attempt to send a challenge/response. That consumes bandwidth and CPU time both on your server and, worse, for the victim server.

3. Spammer forges someone's email address. This is the worst case. It consumes your CPU and bandwidth, the victim server CPU and bandwidth, and spams the innocent victim.

The vast majority of spammers fall into #2 or #3 so, unfortunately, your challenge/response system at a minimum increases email traffic and at worst spams innocent victims.

To blame the spammers for a flawed anti-spam technique is to completely nuke Israel and the Palestinians and then blame them because they made such a mess to start with that the only solution was to glass 'em. No, I think the world would blame Bush for that, not the Palestinians.

Or, on a smaller scale, it's to install a security system on your house that shoots anyone that touches your house without providing a code beforehand. Yes, you'll succeed at not getting robbed but you'll also problably take out a few girls selling Girl Scout cookies. Should we blame the robbers because your security system shot the Girl Scout?

Challenge/responese targets innocent victims because it assumes the return address is correct. We all know that that's not the case yet challenge/response chooses to shrug it off and say "Blame the spammers." No, I blame the spammers for spam. But I blame the users of C/R for ignoring reality and the increase in traffic and spam that THEY create.

Fact is, there are anti-spam solutions (Bayesian filters, primarily) that are so effective that there is no reason to resort to an archaeic anti-spam solution such as C/R that increases mail traffic on the network and increases spam for others just so YOU can avoid spam.

Technology legislation cuts both ways

[Anonymous Coward]

Listen guys. You can't have laws saying "It's OK to be anonymous and post anything you want anywhere and threaten to do anything to anybody and download anything you want and it's all free and nobody can touch you; but spamming is bad. Then you go to jail." Trying to limit everybody else's actions while giving yourself complete freedom is known as "fascism".

Re:Technology legislation cuts both ways

[0123456]

Exactly. The only way to eliminate spam is to force everyone to include real-world indentification data in every single email and Internet posting. Do you really want your SSN on every post you make to Slashdot and the natalie-portman-fantasies mailing list ready for future employers and partners to find?

The price you'll pay for anti-spam laws is the complete end to anonymity on the Net: personally I think that's a pretty lousy trade compared to local filters and ready use of the delete key.

Re:Technology legislation cuts both ways

[kilfarsnar]

But dude!! Natalie Portman is hot! Wait... She's the one from the Fact of Life, right?

Re:Technology legislation cuts both ways

[Anonymous Coward]

You're a fucking idiot. There's no other way around it.

You completely missed the point here. The FTC regulates what COMPANIES DO TO PEOPLE. Spam is from COMPANIES. IT IS A COMMERCIAL APPLICATION.

PEOPLE deserve protection - including anonymity & privacy - in fact, it SAYS SO IN THE FUCKING CONSTITUTION you stupid flame bait.

COMPANIES are an illusion, that neither deserve or want anonymity - they want you to know about them.

SPAM is a big fucking mess that turned email from a valuable tool of communication into a place where I can get revulsed by disgusting porno ads.

YOU are a big fucking idiot IF YOU CANNOT SEE THE DIFFERENCE BETWEEN WHAT INDIVIDUALS AND COMPANIES deserve in the way of privacy.

Re:Technology legislation cuts both ways

[jpop32]

The only way to eliminate spam is to force everyone to include real-world indentification data in every single email and Internet posting.

Wrong, wrong, wrong... I say leave the spammers alone.

Spam is always, as a rule, originated by a bussiness trying to get you to buy something. In order for you to buy something from them, they inevitably have to include a way of contact in the spam.

That's all the information you need. Find a company that paid for the spamming, fine them more than they possibly stand to earn by spamming. That way you directly remove the reason for spamming. Therefore, no bussiness, legitimate or snake-oil will have the incentive to employ spammers.

Returned mail: Service fr_cking unavailable!!!

[Anonymous Coward]

Since they are taking the time to scan email for viruses, you would think they would take a second to check the validity of the "from" address. Or at least not send bounces to domains which have diff ips than the sender.

Now I get piles of bounces from people with viruses.
Great.
Hard to filter since I want to see bounces from my own mail.

Re:Returned mail: Service fr_cking unavailable!!!

[Anonymous Coward]

Yeah, the bounce messages are awful. I'm getting more of those now than copies of the virus. And I can't just ignore them since I've already had legitimate email of mine bounce since the recipient's mail quota was maxed due to this damn virus.

Always funny

[cubicledrone]

How people spend so much time complaining about spam (unauthorized use of bandwidth) yet have no trouble at all making unauthorized use of someone else's data (file trading).

There shouldn't be much problem with a spam policy provided the proper definition of spam is included: bulk, unsolicited, commercial e-mail.

Defining spam as "any e-mail I don't want" is probably part of the problem with having a working anti-spam policy. It is also an incorrect definition of spam.

It also makes it impossible for people to do business, since it will be impossible for people to introduce themselves through e-mail.

Re:Always funny

[garcia]

using someone else's data is beneficial to you, getting spam in your mailbox is nothing but an annoyance.

Re:Always funny

[letxa2000]

It also makes it impossible for people to do business, since it will be impossible for people to introduce themselves through e-mail.

Unless it's personal, one-to-one conversation from a friend of mine recommending some company for something my friend knows I'm interested in, I don't *WANT* to be introduced to any company via email. If I'm interested in a company's product, I'll go Google and find it. Then we can have an email exchange if necessary. But I positively never want to receive a "cold call" via email.

My email address is there to serve ME, not to serve others in their efforts to get-rich-quick at the cost of my time.

Re:Always funny

[Anonymous Coward]

Even when you say "bulk, unsolicited, commercial e-mail" you will have problems. What threshhold of traffic constitutes "bulk"? What level of ignoring warnings constitutes "consent" to receive? Is spam for a non-profit organization "commercial"?

But forget all that for a moment - these guys wouldn't do what they do if it weren't paying off. And I think there we have the key as to why you can't get rid of the problem, through legislative or any other means.

Re:Always funny

[cubicledrone]

I don't *WANT* to be introduced to any company via email. If I'm interested in a company's product, I'll go Google and find it. Then we can have an email exchange if necessary. But I positively never want to receive a "cold call" via email.

You're assuming that all unsolicited e-mail is advertising a product. It isn't.

A policy of "no e-mail unless you are old friends" will make business-to-business communication impossible, and bring the economy to a complete stop.

What if someone wanted to invest in your company? Would you delete that e-mail too because you don't know the person? Got to have both sides of the coin, or there won't be any coins.

Re:Always funny

[Hayzeus]

It also makes it impossible for people to do business, since it will be impossible for people to introduce themselves through e-mail.

I agree completely. So please allow me to introduce myself to you. I am Thomas N'Gemba, formerly of the Ministry of Finance of Nigeria. I and my associates have recently discovered aporximately USD$10,000,000.00 in unsecured funds...

Re:Always funny

[letxa2000]

You're assuming that all unsolicited e-mail is advertising a product. It isn't.

I'm interested in one-on-one conversation via email. If I didn't sign up for a mailing group I don't want mass-generated emails being sent to me. Period.

A policy of "no e-mail unless you are old friends" will make business-to-business communication impossible, and bring the economy to a complete stop.

You're probably right, but I didn't advocate a policy of "no e-mail unless you are old friends." What I do advocate is absolutely no unsolicited mass mailing without the receiver's express double opt-in consent.

What if someone wanted to invest in your company? Would you delete that e-mail too because you don't know the person?

No, because that isn't spam. That's a single person taking the time to email me and initiate communication. That's a valid use of email. If that same person sent an email supposedly wanting to invest in my company and also sent the same mail to thousands of other companies in an automated fashion, yes, I would want that email deleted.

The difference is humans communicating with humans. Email should be used by one human communicating with another. If it's going to a computer mass mailing me impersonally along with thousands or millions of others then I only want to receive that if I expressly indicated I wanted a computer emailing me.

A human sitting down and writing me an email--even unsolicited--is completely different than a human pressing the "Go" button and dumping his load on thousands or millions of email addresses while he watches The Partridge Family on TV.

Re:Always funny

[lrucker]

How people spend so much time complaining about spam (unauthorized use of bandwidth) yet have no trouble at all making unauthorized use of someone else's data (file trading).

The overlap between those two sets is probably smaller than you think - everyone I know hates spam, while I doubt I know many file traders.

Defining spam as "any e-mail I don't want" is probably part of the problem with having a working anti-spam policy. It is also an incorrect definition of spam.

Who does that? Most people define spam as unsolicited bulk email. Whether it's commercial or not really doesn't matter, the important part is that it's unsolicited.

It also makes it impossible for people to do business, since it will be impossible for people to introduce themselves through e-mail.

Whoa. So before email, it was "impossible for people to do business"?. Funny, all the companies I deal with online manage just fine without spamming me.

Re:Always funny

[cubicledrone]

Whoa. So before email, it was "impossible for people to do business"?

Red herring. That's not what I said or meant.

Yeah right

[Anonymous Coward]

I think spammers should be registered (like the mutants) and regulated... But this guy is nuts just by dismissing the problem saying that laws will not work. I expect from my leader solutions not just complains...

The graphs

[McAddress]

Big deal, I can all of my CPU power if I really wanted, its called using Windows.

No

[w.p.richardson]

Legislation is not the only way to go.

Consider this article. Spam can be largely solved via technical means. If none of it gets through, then the incentive to spam in the first place is removed. Laws don't stop crime, they won't stop spam either.

Re:No

[schon]

Legislation is not the only way to go.

I disagree. It's the best way to go.

Consider this article. Spam can be largely solved via technical means.

I read the article - it won't stop spam. The author says that the confimation is a step that spammers "do not and will not take" - how does he come to that conclusion, exactly? What's to stop a spammer from setting up an autoresponder to get past it? - Oh yeah, and say goodbye to legitimate anonymous email, too.

If none of it gets through, then the incentive to spam in the first place is removed.

You're talking about this as if its the first time anyone has tried a technological method to stop spam.. There have been LOTS of other methods tried, and what has the result been? Spammers adjusting their methods to get around them, not spammers quitting.

I think that it's been proven that technological solutions have no effect on spam, except to make email less useful.

Laws don't stop crime, they won't stop spam either.

Laws don't stop crime, but they do reduce the amount of it. Laws may not stop spam, but they will surely go a long way to reducing it.

To paraphrase you;

"If you throw spammers in jail, then the incentive to spam in the first place is removed."

Re:No

[jafuser]

Unfortunately we are conditioning an evolutionary system which is slowly forming better and better spammers as time goes on.

I have a feeling that if/when a particular spammer quits, there becomes more incentive for the remaining spammers to get even more aggressive because they will then have a greater share of the idiot pie to feed from.

I don't think there is any "magic bullet" solution to this problem. It's probably going to be with us for a long time.

I understand it, even though I don't like it.

[mark-t]

From the article:

"Proposals in both the House and the Senate require us to prove knowledge to bring an action against a seller that hires a spammer," Murin said.
Proving such awareness could be nearly impossible, he hinted.

It may suck, but it's right on the money... how can you possibly prove that the seller ever advocated the spamming? The *most* they could expect from a seller is for them to pull the spammer's account (if the spam was done as some sort of referral program), but often even that's not possible.

Re:I understand it, even though I don't like it.

[Anonymous Coward]

As I've said before on Slashdot:

If the spammers keep records of their customers, use that to prosecute their customers.

If the spammers don't keep any accounts, prosecute them for tax evasion!

Re:I understand it, even though I don't like it.

[mark-t]

Following that line of reasoning, all I would have to do is acquire a means of anonymously spamming, advertise my primary competitor's business with it, and sit back and watch them get prosecuted for spamming.

It's exactly this scenario that the people that rejected this law wer concerned about.

What the government CAN do....

[weave]

What the government can do and should do is pass a law that says the matter should be handled by the private sector, and affirm a mail system owner's right to decide what gets delivered, and also word it so third party services like spamcop are legal so they don't have to be threatened with legal actions.

Put an end forever to these bogus claims by spammers that their free speech is being interfered with, that businesses have to pay to provide means to deliver their crap, and that to do otherwise is to interfere with their business and all of their other bogus claims.

Re:What the government CAN do....

[oolon]

The thing I never got about this whole "free speech thing" (Ha I am English anyway, we have no "rights"), sure I respect your right to stay what you want and think what you like. What i don't understand is why I have to listen to it! You have the right to say what you like, not force everyone to listen to what your saying. Is the right to freespeech of someone else greater than my right to privacy?

James

Re:What the government CAN do....

[kilfarsnar]

Good point James. Often, in the USA, we confuse the right to free speech with the right to be listened to (which we don't have).

Re:What the government CAN do....

[anthony_dipierro]

affirm a mail system owner's right to decide what gets delivered

What exactly does that mean? If I send an email to an old college roomate seeing what he's up to can he sue me if he didn't want that email? What if I accidently send the email to someone else with the same name?

Spamming needs to be treated like trespassing. Unless there is some sort of "no trespassing" sign which you are intentionally ignoring you can only be sued for actual damages (in other words, something like $0.000001 per email).

Re:What the government CAN do....

[weave]

It means that if I, as an admin of a mail site, choose to employ a spam filter for whatever reason, a spammer can't sue me if his spam doesn't get through.

If a customer doesn't want the ISP filtering spam out, most ISPs allow filters to be turned off. If not, they can go to another ISP.

As for businesses, they should be free to decide what kind of email gets delivered to their employees.

Re:What the government CAN do....

[anthony_dipierro]

It means that if I, as an admin of a mail site, choose to employ a spam filter for whatever reason, a spammer can't sue me if his spam doesn't get through.

Are you implying that isn't already obviously the case? Are you implying that a spammer has tried to sue for such a thing?

How does this help the problem of spam?

Re:What the government CAN do....

[weave]

Yes, spammers sue at the drop of a hat. Do some google searches on spamcop and lawsuit for example.

Re:What the government CAN do....

[anthony_dipierro]

Spamcop was not sued for employing a filter system.

crucial problems of anonymity? Clue bat!

[twitter]

What crap! Anonymity is a crucial part of free speech. Atempts to eliminate it from email are about as unAmerican as unique CPU numbers or bar-code tatoos. They are also technically unnecessary. IP numbers do not have to reveal a user's identity to be blocked. Laws that attempt to elimiante spam by making it technically imposible are about as sensible as making murder technically imposible by outlawing privacy and pointy metal objects. I'm sick of such stupid shit.

The solution is to outlaw spam outright. Spammers will be caught the same way murders and and crackers are cautht today. It does not require a fundamental loss of privacy or anonymity on the web. Spamming will be reduced to a tollerable level the same way speed limit laws reduce traffic deaths. Spamming and the "cost shifting" involved are simply wrong and it's right to make laws against things that are wrong regardless of how well they work.

Passing Laws

[aking137]

Spam is a big problem, but I think we should be really careful about pushing our lawmakers to pass laws that are that specific to computers. Whenever someone suggests introducing a law that could possibly invade someone's privacy, we're up in arms about it and claim that such problems should be solved a different way - that the lawmakers should stay away from what they don't understand, and that we could solve them by technical means, or by interpreting more general, existing laws to apply to computers.

When we're pushing for anti-spam legislation, we're saying it's suddenly okay to pass laws that specific just because it suits us and we can't see any possible way to lose out. Is this a fair way of doing things? Are we really decided on how far we want laws to extend into computers, and where we draw the line?

Very insighful

[mericet]

I agree wholeheartedly. There are a lot of laws which are not activly enforced, but their existance in the books sets a social standard.

Moreover, a law which is not enforced by itself is useful when the authorities catch them for something else which is hard to prove (in the case of spam, probably fraud, misuse of other people's computers) or have jurisdiction problems. And it helps civil litigation too (I don't know if the US have a civil criminal litigation procedure, but it helps either way).

Re:Very insighful

[fyonn]

a law which is not enforced by itself is useful when the authorities catch them for something else

ooh, no, an unenforced law is a very dangerous thing imho. in general, if a law is unenforced then everyone will feel like they can do it, which leads lots of people to do it with no social stigma, and then the police can crack down on those ppl they don't like who are breaking the law and leave the others.

if everyone breaks a law routinely, why is it there? (this could be applied to filesharing too)

yes, it can be useful in some cases perhaps, but much moe dangerous in others I'd say. afaik in many countries, including the UK, if a law hasn;t been used in a certani period of time, then if anyone is taken to court over it then first the law must pass muster for being on the books in the first place.

dave

Remember Prohibition?

[mblase]

For those who don't: The United States once made alcoholic beverages illegal by amending the Constitution. The very day it went into effect, organized crime took up where legitimate distribution left off. All the enforcement the government could muster did little to impact the real problem of illegal distribution and profit-making. In the end, the amendment was repealed because the cost of enforcing the amendment far outweighed the benefits of having it.

Now, spam certainly isn't in the same category as this, but the same basic problem remains. It has more in common with illegal alcohol than annoying telemarketing. Most of the spam I get isn't legitimate, in the sense that it offers and honors my "opt-out" requests. Heck, most of the spam nowadays I get doesn't even use the English language. Legitimate spam is already either easy to identify and block or easy to opt out of.

Legislation would be fine and good, but it wouldn't begin to solve the problem. "Legitimate" spammers would either be squeezed out of a business (unlikely) or resort to additional sneakery to get their job done. In that sense, while legislation is a nice idea, enforcing it would be impractical if not impossible and therefore probably wouldn't be done at all.

Re:Remember Prohibition?

[NialScorva]

Not exactly a parallel case. Prohibition was in response to a high demand, and the black marketters filled the supply-side of that equation. There is no corresponding demand for spam.

Re:Remember Prohibition?

[Crayon Kid]

Heck, most of the spam nowadays I get doesn't even use the English language.

There's some Murphy's law in this, I'm sure. I'm not English and most of my spam is in English. I wonder how they do it.

Re:Remember Prohibition?

[mblase]

There is no corresponding demand for spam.

Tell that to the spammers.

Automate the challenge/response ...

[tessaiga]

There's no need for a human to get involved. Have a protocol whereby in order to the receiver's machine automatically issues a small, dynamically-generated math problem which requires the sender's computer a few seconds of computing time to solve. The email only gets "authorized" if a correct solution is received. This would have very little impact on a regular user, but a spammer who sends out hundreds of thousands of emails would be facing some pretty prohibitive computational costs.

Re:Automate the challenge/response ...

[iainl]

A few seconds of computing time on what, exactly? My 28MHz Amiga A1200 does a perfectly acceptable job as a Pine station, but I'd really rather not have it solve something the Athlon 2800+ takes 'a few seconds' over every time it sends an email!

Re:Automate the challenge/response ...

[Tarrio]

"This would have very little impact on a regular user, but a spammer who sends out hundreds of thousands of emails" -- or a legitimate mailing list server -- "would be facing some pretty prohibitive computational costs."

Re:Automate the challenge/response ...

[danila]

Don't say it's the only, or the best, or even good solution. It is not. There is a fundamental difference in approaches to spam. One approach is to leave technology as it is and use legislation (old or new) to smack the spammers. Another one is to use technological solutions to make spam impossible. But technological solutions will not work, because in case of spam it is trying to undo the technological progress itself. Face it, e-mail is free. It is free because of the technology and unless you shut down the fibre-optic Internet backbones, it will remain free. Any attempt to change it will fail (you may not believe me, but it will regardless of that).

Another technological solution is to remove anonymous e-mail, but this won't work. Even now you can trace the e-mail almost all the time to the originating ISP and IP address. That is still not enough. Take the [relative] anonymity and you will flush the baby with the water. It won't help you fight spam, but we will lose a bit of our rights (right to free speech requires the right to anonymous speech).

The second distinct approach realises the technological changes and attempts to work out the problem from another angle. Make it possible to fight spammers in courts and charge them for the costs they incure. It worked for the faxes, it should work for e-mail. Currently there is no way in most countries to charge spammers with anything. They are not doing anything illegal (technically) and the policies of their ISPs never involve fines, at most a termination of contract. Make a law that anyone can charge a spammer, who must then disclose the list of intended recepients. If the nature of the offending e-mail is not obvious, ask the recepients. If enough of them say it is spam, the spammer is guilty. Give ISPs the authority to try to resolve the issue without going to court first (if both spammer and the recepient agree). You CAN make a law that will both work and not be very easy to abuse. And almost anything will be better than the present situation.

Re:Automate the challenge/response ...

[iantri]

.. but if it set up with a system that is one-time only (like the current challenge/response systems), the server would be authorized during the subscription process, and extra processing time would not be needed on the server.

Re:Automate the challenge/response ...

[ryanvm]

This is almost a good idea. The problem is it's more complicated than it needs to be. Why not just make the server sending you mail have to wait 5 seconds for EVERY recipient? You get the same effect except it isn't based on the sender's processor speed.

Re:Automate the challenge/response ...

[Anonymous Coward]

-- or a legitimate mailing list server --

Maybe we should remember that Internet isn't only running on ports 80 and 25... What is the problem with auhenticated NNTP server? Mailing list servers were the answer for the lack of NNTP connectivity and storage problems. Considering the price of storage systems today, let's not make a problem out of solution for the problem that doesn't even exist any more.

Anonymous Cowards Unite

(karmacollectortag)

Re:Automate the challenge/response ...

[mikeee]

But you don't know he isn't doing something else while he's waiting; it doesn't much slow the spamming, it just means they need to launch a jillion threads to get the same throughput.

A busy processor, though, is a busy processor.

Re:Automate the challenge/response ...

[ryanvm]

Ahhhhh, I knew my proposition was too simple.

Re:Automate the challenge/response ...

[WuphonsReach]

So what happens when a small ISP has 2000 customers who send 10 e-mails per day, and the ISP only has a single server? Now, the odds that all of those e-mails are going to your mail server are small, but it demonstrates some of the issues if it were widely deployed.

Or, what about the case where an SMTP server can just open up more connections to you? (Which is perfectly normal.)

Or the spammer is using a network of hijacked hosts that each attempt to connect to your SMTP server?

Basically, the 5 second wait suffers from the same deficiencies as that of the "require sender machine to calculate some math problem" solution.

Re:crucial problems of anonymity? Clue bat!

[mark-t]

The solution is to outlaw spam outright. Spammers will be caught...

Oh... and just *HOW* do you propose that we do that? Follow the return address? It's always faked. Contact the seller? You'd be *EXTREMELY* hard pressed to prove that the seller advocated the spam. Heck, maybe the spam was sent by some bloke who works for the competition trying to disrepute these guys. How can you prove otherwise?

Nice in theory, but no go... as long as anonymity is allowed to exist in email, spam will exist. No two ways about it.

2nd best quote

[lupine]

"It may be impossible to prosecute enough spammers to have a serious deterrent effect, let alone stop, or even slow down, the problem." - FTC chairman and republican corporate lapdog Timothy Muris

"You tried your best, and you failed miserably. The lesson is, never try!" - Homer Simpson

Anonymity will be surrendered to fight spam

[FearUncertaintyDoubt]

No spam law that doesn't help investigators find the real sender of the message would be effective he said.

Anonymity is something that I think is one of the things that makes the internet so valuable as a tool to help people fight oppressive governments and corporations. When it is impossible for a spammer to cover his tracks, it will also be equally impossible for a political or corporate dissident to do so as well.

The implication here is that spam can be solved by a technical solution, i.e., one that makes forging identity very very difficult. IPv6 or something like that, perhaps, with additional anti-terrorism/anti-spam identity measures, forcibly implemented (Carnivore anyone?) on ISPs and backbone providers. We'll be so happy to be rid of spam we won't realize what we gave up.

Re:Anonymity will be surrendered to fight spam

[RealityProphet]

Anonymity is something that I think is one of the things that makes the internet so valuable as a tool to help people fight oppressive governments and corporations.

Oh, really? Could you name even one government or corporation where the so-called anonymity that the internet brings to its users has helped in its downfall? The countries with the most oppressive governments on earth do not even have internet access. And, unless I'm very mistaken, the anonymity of the internet had absolutely nothing to do with bringing down Enron or MCI WorldCom.

Re:Anonymity will be surrendered to fight spam

[FearUncertaintyDoubt]

Could you name even one government

China. Anonymous internet access is vital for people struggling against the Chinese government.

or corporation

I'll pick a slashdot favorite. The MPAA. Without anonymity, DeCSS would not have been able to spread to being ubiquitous so quickly. It would have been stopped because you wouldn't have been able to pass it along without being caught.

Keep in mind that anonymity was essential to the intellectual process that led to the founding of the United States. The British would have rounded up people like Thomas Paine, John Jay, James Madison, etc., if they had been debating their ideas under their own names in print.

Re:Anonymity will be surrendered to fight spam

[fermion]

Certain people wish anonymity to vanish from the Internet, and since those are the same people with the power and money, we are seeing the argument framed as one of anonymity.

The reality is in that in most spam the player are not all that anonymous. Disguised often, but not totally unknown. The real issue is one very similar to the filesharing issue(and I am not saying filesharing is equal to spam, or making any judgments of filesharing, just that they share a specific similarity).

With spam we often can know who, at the end of the day, is going to receive our money when we purchase the product. We often know who registered the domain that orders are sent to, the registrar that holds that name, and the ISP that hosts it. We often even know who sent out the spam and the registrar and ISP for that person.

Unfortunately, the way things are structured the only entity we can attack is the person who sent the spam, which is often a very small and mobile target. ISPs are shielded from any action even though they are known to set up lucrative contracts with spammers. Doing anything against a Registrar is hopeless. If we go up against the company actually pushing product, they just claim it was their independent contractor and they are not responsible.

It is really very similar to the drug pushers that put up 'the work at home' signs all over the country. The top level company takes no responsibility for the actions of their contractors, and they will do nothing to police the activity of the people the 'hire'.

So it is not a matter of anonymity, but of responsibility, something that politicians talk about, but never do. They complain how irresponsible the kids are today, but if it them driving drunk, or lying during state of the union addresses, they just want to blame it one someone else. I say before pushing a police state, just try to get a single CEO criminal to go on tv and take responsibility for his incompetence. Down here at the worker level, we do it all the time.

eliminating "super spammers" will help

[peter303]

Spamming is a scale free phenomena- that is, a small fraction, 20 to 200, account for most of the sucessful spam. You'd just need the legal incentive to go after the big ones.

Forget UCE, they need to go after the criminals.

[gristlebud]

I agree that the proposed spam legislation is inadequate to solve the problem, and I commend the FTC for standing up, rather than passing more useless laws and backing an inneffective solution just to be able to say "look what we've done"

However, my problem has lately has not been the tradition UCE spam (Spamassasin does a pretty good job taking care of that); my problem lately has been outright criminal messages reaching my inbox.

Recently, I've been getting more and more messages spoofed as being from Paypal, Citibank, my ISP, etc, saying that my account has been suspended, and I need to verify my password, credit card number, even my mother's maiden name(!) These messages are getting more sophisciated, and appear to have (for example) a paypal.com address for me to click on.

After getting a few of these in a week's time, I checked the headers, and all seemed to come from China. I'm not sophicicated enough to trace them back any farther, but since these are so blatently criminal, I dont think they'd be originating in the US, as the potential for prosecution is so high.

Unfortunately, these messages are the most dangerous, and the hardest to stop (if they truly originate overseas.) I'd like to see some sort of internation cooperation to track and prosecute these degenerates.

So how does one find a spammer anyway?

[einTier]

It seems like these guys lay low so that geeks like us can't find them and harrass them. But, this has always begged the question in my mind, how do their customers find them?

Not that I want to spam mind you, but it seems like they have more than a few customers, and yet, it seems next to impossible to find a point of contact for these people.

Re:So how does one find a spammer anyway?

[gorbachev]

All large volume spammers are well known to the anti-spamming circles. Their information is listed on such resources as ROKSO (Registry Of Known Spam Operations), SPEWS (down due to DDOS by spammers on its nameservers) and Google Groups searches on newsgroups like news.admin.net-abuse.email or news.admin.net-abuse.sightings.

Then there're mainstream companies that have managed to fake legitimacy that target not the fly-by Viagra peddlers, but real businesses, politicians (you may recall the Howard Dean spam debacle from last week) and other legitimate advertisers and pretty much lie about the nature of their business ("we're strictly opt-in" while blatantly spamming to harvested addresses, etc.). These sort of companies buy full page ads on industry magazines. They're all over the place.

The chickenboning scam artists spammers are typically found by word-of-mouth or through "bulker's clubs", i.e. private web based bulleting boards spammers advertise their wares. Most of these clubs have anti-spammers as members though, so they rarely fly under the radar.

Yet another way to find spammers are contract job listing sites and reverse auction job sites (or whatever the hell they're called, where someone who wants a job done will advertise his need, then contractors will bid for it). There's a whole bunch of ethically challenged companies asking for bulletproof hosting and spamming services on them all the time.

Proletariat of the world, unite to kill spammers. Remember to shoot knees first so that they won't run away while you slowly torture them to death

It's easy, practical and sensible to outlaw spam.

[twitter]

Oh... and just *HOW* do you propose that we do that? Follow the return address?

Why do people always ask that question?

You catch spammers by, well, catching them! ISPs and other interested parties can trace IP numbers back to the machine that sent them, no matter how "fake" they are set. That's the same kind of detective work and reliance on witnesses that any normal crime is solved by. ISPs constantly cut off these creeps and they have to keep going from ISP to ISP to get their word out. It would be very sweet indeed for an ISP to be able to report their spammers to the police.

In any case, outlawing spamming will get rid of a large volume of crap. Jackasses who brag about the volume of spam they are able to send from their freaking mansions will be shut down right away. So will lots of other losers who have been investing in equipment to annoy the rest of us. Good riddance. It may not get rid of all of them, but it will get rid of a lot of them.

as long as anonymity is allowed to exist in email, spam will exist

As long as people exist, spam, murder, and all sorts of other foul things will exist. None of it will ever be defeated by any police state but the confines of a police state are more odius than pure anarchy. Laws that follow morals are good things. Laws that "surrender to practicality" they way you would are flawed and hateful.

Hmm

[Dark Lord Seth]

That time travel guy, I think. Did you ever get it? That guy who was looking for aliens who had perfected time travel because he needed to go back and fix something? It was a rambling treatise about the nature of time and him trying to convince the reader he was dead serious about this and there didn't seem to be any other point to the thing. No URL, no offer to increase my penis size, nothing.

Did anyone else receive that one? I thought it was nice! It was so full of bullshit (nor noteworthy amongst spam) and... it had no purpose. Spam is usually aimed at stupid and/or gullible people who are willing to believe anything they receive in their mailbox. Even if someone were to believe this one particular spam message, what would one do? Send Mr Fusion to a set of long/lat coordinates IN THE PAST? Is it some kind of joke?

Re:Hmm

[julesh]

I think it was sent by somebody who hopes that time travellers really do exist and are visiting this time period & have e-mail addresses & will take sympathy on him...

Kind of a long shot, but with the cost of sending spam so low, who knows? :-)

Re:Hmm

[HermDog]

Sorry to keep everybody waiting for their spam. I'm going to try to get that one sent out last month.

Sender Verification for SMTP?

[Adrian Lopez]

I think the SPAM problem could be largely mitigated by altering the SMTP protocol to include cryptographic signatures which are used to authenticate the email address listed in the email's "From" field. The receiving SMTP server contacts the server listed in the From field to obtain a copy of the claimed sender's public key which the receiving server uses to authenticate the sender's true identity. The public key is user-settable so that alternate From addresses may be used as long as the sender is authorized to use that address in From fields.

Re:Sender Verification for SMTP?

[Anonymous Coward]

Wouldnt work. That would require everyone to pay some facist company (like NetSol) money for a certificate.

Re:Sender Verification for SMTP?

[Adrian Lopez]

It would not require certificates. I can easily generate my own public keys using GPG, and I could easily send those keys to each of the servers where I have an email account. No need for crypto certificates at all.

Re:Sender Verification for SMTP?

[lpontiac]

I think the SPAM problem could be largely mitigated by altering the SMTP protocol to include cryptographic signatures which are used to authenticate the email address listed in the email's "From" field.

SMTP doesn't know about the From: field. Or the To: field, for that matter.

Re:Sender Verification for SMTP?

[amcguinn]

So everyone in the world who uses email needs a GPG key, and needs to handshake with their email providers before they can send everything. (Yes Mum, you've generated your key pair, now you need to export the public key, and then supply the private key to your email program for every message. Remember to use a good password!)

And the only result is to prevent email forgery, not the majority of spam (in my experience) which is not forged to be any other user, but just sent on a throwaway account obtained for the purpose?

Re:Sender Verification for SMTP?

[Adrian Lopez]

SMTP doesn't know about the From and To fields? What do you mean? SMTP requires that users specify a From and To field, and while it might not respond immediately with information about the validity of an email address, it is nevertheless possible for SMTP servers to establish the validity of an email address. My server, for instance, does this:

helo caribe.net
250 OK
mail from: me@caribe.net
250 me@caribe.net OK
rcpt to: nosuchuser@caribe.net
550 is not a valid mailbox

SMTP seems like the natural place to verify the validity of a mailbox, but ultimately it could just as easily be implemented as a separate service.

Re:Sender Verification for SMTP?

[rthille]

When you say 'From' and 'To' Fields, most people would believe you mean the 'From:' and 'To:' headers in the message. In the dialog with your server, the 'mail from: ' addr is usually refered to as the 'envelope sender', and in the 'rcpt to: ' addr is the 'envelope recipient'.

Re:crucial problems of anonymity? Clue bat!

[Anonymous Coward]

Oh... and just *HOW* do you propose that we do that? Follow the return address? It's always faked.

Force the relays they've used to stop relaying spam. They're easy to trace. If they won't, subpoena their SMTP session information to find where the connection came from.

Follow the packets, not user supplied headers.

What is needed is a new email protocol

[mark-t]

But retaining backwards compatibility with SMTP would invariably allow spamming to continue.

An entirely new mail protocol probably still needs to be created though, but what I suggest is that mailservers which support the new protocol have a mechanism whereby, on a user by user basis, any SMTP-protocol mail coming in for users that have turned off SMTP could be rejected as soon as the header is finished. These mailservers would also be configured to automatically add a header for the users who don't reject the mail, maybe something like "X-Protocol: SMTP" so that they can have an idea whether or not they are still getting important stuff that way after the protocol has been around for a bit, and determine whether or not they should simply reject old SMTP from that point forward. Also, if the mailserver admin desires, *ALL* old SMTP protocol mail could be rejected this way, but presumably he wouldn't do that until he was confident that all the individual users were content with such a policy change. This sort of mechanism would give people the ability to slowly migrate to the new protocol, and in the interim, give people who wanted a quick and easy way to classify such emails by a specific email header that option.

Re:What is needed is a new email protocol

[Bo Diddly Squat]

We don't need a new protocol. We need some real action by ISP's to stop the spamming.
They can check the received headers if they're checking for viruses anyway and they can also blacklist other ISP's that don't do anything about spam originating from their networks.
Doing that will take care of most of the spam I get.

Re:What is needed is a new email protocol

[amcguinn]

What would the new protocol give you that SMTP doesn't?

What allows spam isn't SMTP, it's the way SMTP is used: Any ISP will accept email for their customers from just about any ISP, many of whom in turn will allow just about anyone to sign up as a customer and send email, without proving identity or showing any bona fides beyond payment for the service.

How will your new protocol magically stop that happening?

A slight improvement could be brought about by:

• Insisting all messages have a "sender:" which reflects the actual network origin
• ISPs' outgoing servers accept mail only from their own connected customers (happens already), and that the "sender:" matches the customer sending the message.
• ISPs' incoming servers accept mail only if the "sender:" matches the domain of the server that is sending the message

With this in place, you could whitelist reliably on the non-forgeable "sender:" field. It would cause some reconfiguration, and upset some people. It would require no changes to SMTP.

ISP's would then be able to add a new header field to outgoing mail, indicating "This is a bona-fide idenifiable, accountable customer", if it really was (and remove any such header field if the customer is not identifiable). The ISP at the receiving end could remove the header if it does not really trust the sending ISP to keep track of its users. Customers would then have the option of receiveing from only such "reliable" senders, plus a whitelist. Again, this is only extensions to current mailserver functionality, not changes to the protocol. All the software to run this scheme already exists.

(Corporations, universities etc. who do not send or receive mail through ISPs count as ISPs themselves under this scheme.)

Today, the demand for such steps is not there, but it may be within the next few years.

There are a few details to fill in: obviously ISPs would have to provide filtering options to their customers based on the new headers, to save customer bandwidth, but the gist of the system is all there.

Re:What is needed is a new email protocol

[julesh]

These mailservers would also be configured to automatically add a header for the users who don't reject the mail, maybe something like "X-Protocol: SMTP"

Something like:

Received: [...] with smtp [...]

perhaps? Don't forget that our current e-mail system started out in a multi-protocol world, so provisions for dealing with this are already in place.

Re:What is needed is a new email protocol

[WuphonsReach]

>> ISPs' incoming servers accept mail only if the "sender:" matches the domain of the server that is sending the message

Which is exactly what proposals like RMX / SPF and others are attempting to do. Since the DNS system is already used to designate which IPs will accept inbound e-mail for a particular domain - why can't DNS be queried to find out if a given IP is authorized to send e-mail for a particular domain.

Explanation of RMX
SMTP+SPF proposal

As a side-effect of the RMX/SPF style systems that a given e-mail comes from an authenticated IP for the purported domain is that e-mail worms will find it more difficult to spread directly from infected systems straight to target SMTP hosts. Instead, those worms will have to spread by passing through the user's official SMTP server.

Re:What is needed is a new email protocol

[mark-t]

I did not suggest any particular "magical new protocol"... I only suggested that allowances in the protocol be made to allow people to individually progressively move over to the new, non-backwards compatible protocol.

Any protocol that is backwards compatible with SMTP itself will still be subject to spamming from people still using old SMTP and forging the necessary headers. If somebody decides to use old SMTP and forge my proposed 'X-Protocol:' header, it wouldn't be of any benefit because when the message arrives at the destination (where a new server is in place), another 'X-Protocol:' header would get added to the message, correctly identifying the protocol as SMTP anyways.

The stuff I was talking about were changes that could be made to SMTP servers so that end users could easily identify which protocol people were using to send them email in the first place. After a few weeks, they could make an informed decision about the degree to which rejecting SMTP mail from then on would adversely affect them (and they could politely inform any valid contacts that were still using SMTP to switch or to pressure their ISP to switch).

Re:What is needed is a new email protocol

[amcguinn]

I looked at the RMX link - my suggestion would indeed require something like RMX to work at all, although what I described goes a lot further (which may not be a good idea: I propose it on the basis "If you really want to do something...", though personally I'm not sure that the benefits really justify the costs).

I was basically arguing at cross purposes though. A lot of people say "SMTP needs to be replaced/changed" when they really mean "The internet mail infrastructure needs to be changed". My argument that the SMTP protocol does not need modification is barely-relevant pedantry if you accept that "SMTP" is being used as shorthand.

Anti-Spam Services

[Goo.cc]

The interview in the story is from an anti-spam service called knowspam, which works pretty much like Blue Bottle: if you are not on my white list, you have to authenticate yourself to send me an e-mail.

But what happens when two people, both using such a service, decide to send an e-mail for the first time? Couldn't such a setup create a endless loop of authentication requests?

Re:Anti-Spam Services

[Anonymous Coward]

We've heard this before. The solution is simple: people you send to get whitelisted.

Re:Anti-Spam Services

[dr_eaerth]

But what happens when two people, both using such a service, decide to send an e-mail for the first time? Couldn't such a setup create a endless loop of authentication requests?

I think the way it is usually done is that, if you send an email to someone, then replies from that address are automatically accepted. So it goes like...

1) Unknown user 1 sends message to unknown 2.
2) Unknown 2 sends challenge.
3) Challenge is automatically received by unknown 1.

Re:Anti-Spam Services

[Telumehtar]

"what happens when two people, both using such a service, decide to send an e-mail for the first time? Couldn't such a setup create a endless loop of authentication requests?"

I asked this question of Knowspam.net. Thomas Burns immediately replied with the following explanation:

"knowspam.net has an SMTP server you can use to send mail. When you send mail using the knowspam SMTP server, it adds all the recipients to your "good senders" list (meaning their response will pass through without being challenged)."

In addition, only one challenge will be sent every 10 days, so there can't be an infinite loop!

Re:Anti-Spam Services

[whoever57]

"knowspam.net has an SMTP server you can use to send mail. When you send mail using the knowspam SMTP server, it adds all the recipients to your "good senders" list (meaning their response will pass through without being challenged)."

That assumes that the recipient address is not some kind of alias.

It is quite common for people to have multiple addresses that feed into the same account. The system, as described, can't handle this.

Re:Anti-Spam Services

[Telumehtar]

I'm not sure this is necessarily so.

I use a forwarding address, and the To: header in the original email is preserved by the mail forwarding server. So the auto-responder would be able to set the From: address in the auto-reply accordingly.

In other words mail sent to forwading@address.com is delivered to myaccount@myisp.net but the mail header still says To: forwarding@address.com and this is hopefully what the auto-responder would put as the From address in the reply.

Too bad they don't realize this on every issue.

[Maul]

Legislation isn't always the correct tool to fighting something. Whenever we consent to Congress passing more and more laws, we are sure to lose some of our freedoms along the way.

I hate spam as much as the next guy, but it isn't worth letting Congress think up some hair-brained, rights-destroying scheme that probably won't work anyway.

Too bad they don't realize this on most issues out there.

Re:It's easy, practical and sensible to outlaw spa

[mark-t]

You catch spammers by, well, catching them! ISPs and other interested parties can trace IP numbers back to the machine that sent them, no matter how "fake" they are set

Wrong.

This is a critical failing of SMTP. It is impossible to authenticate that the email in question came from any of the IP addresses that might be found in the email.

The guy's right

[amcguinn]

First, in saying some recent bills may be counterproductive, he's only echoing what many anti-spam campaigners have been saying: the bills actually legalise a lot of spam.

Now, a good anti-spam law can contribute by driving spam further into the criminal underworld, but let's face it, it's most of the way there already, and you're not going to cut it down much more in that direction.

The key point is anonymity. If you can send email anonymously, you can send spam, legally or illegally. If you are willing not to receive anonymous email, you can receive zero spam (using whitelisting), or next to zero spam (counting on blacklisting of known spammers by name). Contrary to what some people say, the existing technical SMTP protocols are perfectly adequate for spam-free email: you just need a virtual email network using smtp, to which anonymous users are not admitted. I think it quite likely that MSN, AOL, etc. will be setting this up within the next 12-24 months. They might screw it up by trying to lock out competitors, but it can only be useful if it's reasonably inclusive.

Personally, I want to receive anonymous email, from people who've seen my web sites, or old friends who've looked up my address, or whatever. But to get these emails, I'm bound to get spam as well, legally or illegally, and I'm prepared to live with it.

Re:The guy's right

[Kjella]

Personally, I want to receive anonymous email, from people who've seen my web sites, or old friends who've looked up my address, or whatever. But to get these emails, I'm bound to get spam as well, legally or illegally, and I'm prepared to live with it.

How anonymous do you need? I mean, I'll never know user@free-email-domain.com's real name, he probably didn't sign up for it in the first place, which is enough anonymity for 99,99% of us. But if he is using that email to commit crimes (and SPAM is a crime, at least here) the police can (in theory at least) get court orders and track him. That's how it works and should work.

The problem is that spammers send email that appear to be coming from other places. If I could get the real origin (or at least, the last compromised relay) that would be a very good start. Did joe@hotmail.com really send me this email? A verification of that, doesn't have to be non-anonymous, but just verification that this person is the owner of the email address in question.

Kjella

Re:The guy's right

[amcguinn]

What if he signed up from an internet cafe? What if he signed up from a large company that needs months to go through its logs, or doesn't have secure access internally? What if he signed up from Bangladesh? (Nothing against Bangladesh, it's just somewhere fairly remote and difficult for my local police to deal with).

If he's planning a terrorist bombing, the police can have a go at tracking him down, but at least where I live it's hard enough to get police to spend resources investigating a burglary, never mind what they would see as electronic flyposting.

Cutting out forgery, or at least flagging possibly-forged from definitely-not-forged mail for customer-controlled filtering is worthwhile, and I described more details for that in another comment. Bear in mind that many people use a "From:" address that has no relation to the actual connection they send email from (I do myself), so even that would cause a lot of disruption, for a less than immense gain.

Re:The guy's right

[kindbud]

Contrary to what some people say, the existing technical SMTP protocols are perfectly adequate for spam-free email: you just need a virtual email network using smtp, to which anonymous users are not admitted.

But there is no mechanism in the SMTP protocol to do that. You have to add something on to it. Now it isn't SMTP, it's anonymized SMTP on a virtual network, for which there is no RFC. Your solution is just as ad-hoc as any others.

The key point is anonymity. If you can send email anonymously, you can send spam, legally or illegally.

And you can send non-spam anonymously. Anonymity is worth preserving, even if it means some people can't make as much money as they'd hoped. Let's not throw the baby out with the bnath water. This is the freakin Bush administration's (Homeland security, TIA, etc.) FTC chairman we're talking about here, and he wants to call anonymity the problem, and ignore the fraudulent business activity. Doesn't that make you just a little suspicious?

Re:The guy's right

[jmarkantes]

...driving spam further into the criminal underworld, but let's face it, it's most of the way there already,...

When you hire spammers or buy their products, you're supporting terrorism!

Maybe we should tell Georgie.

Re:The guy's right

[amcguinn]

But there is no mechanism in the SMTP protocol to do that. You have to add something on to it. Now it isn't SMTP, it's anonymized SMTP on a virtual network, for which there is no RFC. Your solution is just as ad-hoc as any others.

SMTP says how two machines exchange email. It doesn't say which machines you should choose to exchange email with. For that matter, it doesn't say what should be in the messages (RFC822 / 2822 is not SMTP, and what I would propose would extend them.)

Anonymity is worth preserving, even if it means some people can't make as much money as they'd hoped. Let's not throw the baby out with the bath water

I agree with you. I did say that receiving spam is a price I am willing to pay for being able to receive email from anyone. But if someone else insists that to send email to them I must either prove my identity to them, or that I must make myself traceable by the (trustable) ISP I am sending through, then that is their right, and it is up to me whether I choose to comply with their demands or choose not to send email to them.

Not really

[jeroenb]

We can avoid spam if we just collectively start using another system for sending eachother messages. Sound difficult to get that off the ground?

Try finding another planet to live on. Then compare :)

Re:crucial problems of anonymity? Clue bat!

[mark-t]

Many of these open relays are overseas. How, exactly, are you going to force their governments to cooperate?

I like Challenge/response spam filtering

[wayne]

I like Challenge/response systems and have recently increased my use of them.

The one I use works like this: During the SMTP session when the email is attempting to be transfered, I run SpamAssassin from exim (my MTA). If the score is high enough, I send an SMTP 5xx rejection code. This causes the sending MTA to generate a challenge message. Because it is the sending MTA that creates this message, it is usually not fooled by forged From: addresses. More over, even if the sending MTA is fooled by a forged From: address, it is likely that the sender is on a blacklist and the domain of the forged sender can deal with it correctly.

Since this challenge is only generated when the email is almost certainly spam, most people will never see it. Most spamware will not be able to deal with the 5xx rejection code and therefore will not generate a challenge message to anyone.

Also, since this challenge message is created by the sender's MTA, it will more likely be in the correct language.

This challenge message, created by the sender's MTA, must be correctly interpreted and the correct action must be taken. This almost always requires a real human to do and moreover, it requires a cluefull human. It works very, very well.

I call this kind of challenge-response system a "bounce".

Re:I like Challenge/response spam filtering

[Dan Ost]

I'm ignorant of how a C/R system would work in real life, so forgive me
if my questions are simplistic or ill-formed.

that said, if you have a C/R system set up and I have a C/R system set up, then
when I email you for the first time and you send a challenge to me, will
my system then send a challenge back to you?

If so, would this cause an infinite regression of challenges or is this loop
somehow thwarted by cleverness in the system?

Also, where is the C/R mechanism implemented (user agent, transfer agent, etc)?
If it's in the user agent, how can it work if I check my mail from multiple
machines? If it's in the transfer agent, how can I, as a user, control it's
behavior?

Re:I like Challenge/response spam filtering

[wayne]

if you have a C/R system set up and I have a C/R system set up, then when I email you for the first time and you send a challenge to me, will my system then send a challenge back to you?

With the "bounce" challenge-response system that I use, no it wouldn't. Bounces create a null return-path, thus preventing double bounces. Other challenge-response systems are not so well designed.

Re:I like Challenge/response spam filtering

[tombu]

With knowspam, if you send the email through knowspams SMTP server, the recipient is automatically added to your good senders list.

Re:I like Challenge/response spam filtering

[WuphonsReach]

C/R also suffers when it comes to mail lists... the response is usually that we can just whitelist the mailing list domains.

Except that spammers can forge their domain to match that of a domain that is on the whitelist.

SPAM is a multi-facted issue... one of the first facets that I hope gets taken care of before we all grow old is that the IETF approves one of the RMX / SMTP+SPF style proposals and eliminates "joe jobs" and forged domains.

Yeah, well they bashed the anti telemarketer laws.

[Anonymous Coward]

FTC: "No No, anti telemarketing laws bad. Nobody wants them!"

PEOPLE: "But it would be much easier on the telemarketers if there was a central list they could match against...

FTC: "Hell no."

PEOPLE: "OK.. Hey, it's a year later, and now we've got anti telemarketer laws in a majority of states"

FTC: "You fools! Why don't we just have a centralized list so those poor telemarketers don't have to deal with 50 different state agencies. Here. Use this one..."

PEOPLE: ">Sigh. Thanks I guess. Hey, what about this spam stuff..."

FTC: "Hell No. It's stupid and a waste of our time."

Re:It's easy, practical and sensible to outlaw spa

[jridley]

ISPs and other interested parties can trace IP numbers back to the machine that sent them, no matter how "fake" they are set.

What about infected end user machines that are being used as anonymizing zombies? There are, by all accounts, tens of thousands of them out there. You can bet that they don't keep logs.

Re:eliminating "super spammers" will help

[Anonymous Coward]

Yes, Pareto's Principal applies to UCE too. There's about 150 spammers who are responsible for the majority of the spam.

The Problem with "Anti-Spam Legislation"

[rudy_wayne]

I'm all for fighting spam, but so far, there are 3 problems:

First, there seems to be this naive belief among politicians that if they pass an anti-spam law, spammers will actually obey it. The majority of spammers have little regard for the law and their entire business model is based on deception and other activities of questionable legality. Any anti-spam laws will be ignored (and tied up in the courts by legal challenges).

Second, is enforcement. You can write all the laws you want, but they are meaningless if not enforced. If I am deluged by spam that violates an anti-spam law, who do I complain to? Who will investigate my complaint and take appropriate action - all the way through to prosecution? If you think about this for a minute, you quickly realize that *MEANINGFUL* enforcement of anti-spam laws will take a lot of resources -- i.e., it will be very expensive.

And finally, there's the international nature of the internet. Routing spam through a mail server in a foreign country is trivial. The only likely outcome of anti-spam legislation is that spammers will use foreign servers for their e-mail and websites.

Re:The Problem with "Anti-Spam Legislation"

[anthony_dipierro]

The only likely outcome of anti-spam legislation is that spammers will use foreign servers for their e-mail and websites.

That'd be fine with me. I'd happily move to my spam folder all e-mail coming from outside the United States which isn't from someone on my whitelist (which as of now would consist of no one), and wouldn't check my spam folder unless I was specifically expecting an email which I hadn't yet received (signed up for a foreign website or something).

Idle CPU?

[Captain Large Face]

I don't understand all this User, System, Idle nonsense.. I though it went User, System, SETI?

I just don't understand....

[Ogre332]

What the big deal over spam is. For years, everyone got junk [snail] mail in their [snail] mail boxes. People would complain about it occasionally but most just threw it away. Taking care of spam is easy: I use junk mail filters in my email client and have a Hotmail account set up for anything that requires me to "Enter your email address". That way, 99% of the spam goes to the hotmail account, and my filters take care of the rest.

Re:I just don't understand....

[swordgeek]

Here's the big deal.

1) Bulk paper mail subsidises personal letter mail. They pay well for the privilege of sending out stuff that no one reads.
2) Spam recipients pay for the spam they get. Disk space is used, bandwidth consumed, and ISP bills are higher. Not to mention the fact that we now need extra software (more computer resources, more maintenance, more time, more money) to filter this shite out.

YOU ARE PAYING for every spam you receive, as well as every spam you filter. By the time it's left the spammer's computer, the load has been incurred, and the costs go up.

FURTHERMORE, it's easy to tell the difference between paper junk mail and real mail. It's not always as easy (esp. for filters) to distinguish, and as a result you have spam that gets through to you, as well as real mail that gets trapped by your filters. Worse yet, the spammers are exploiting this--they've turned it into a war of escalation, with better crafted spam vs. better filtering. As long as they have free reign, we will be paying higher costs and continue to have the value of email service degraded.

Of course nearly all of the "I don't get it" comments come from spammers, so you probably already know this and are just trying to excuse your behaviour.

Re:I just don't understand....

[Anonymous Coward]

With snail mail, our government has already put legislation in place to curb the solicitations. It --does-- take effort on behalf of the recpient, but most junk snail mail can be stopped. And if not stopped, it can be prosecuted., by law. I have used "stop mailing me or I will charge you for use of my personal property (name and address)" for some time, and it does work effectively.

Most snail mail comes from a known entity, not a forged or spur of the moment bogus address. You --can-- contact the company and say stop, under penalty of law. With most spam, you can't.

Lastly, it's a matter of degrees. Yes, I don't like getting a few pieces of unsolicited junk mail in my snail mail box. But when I get hundreds or thousands of junk email a day, that's just downright ridiculous, especially when there is nothing I can do about it. (i.e. forged address, bogus company name, etc.)

The real question is that posted most often, "how do you find out who the spammer is?"

let them have that.

[twitter]

What about infected end user machines that are being used as anonymizing zombies?

Let them try it. The traffic controling them can be traced back if it's against the law. Once again, difficulty in enforcemant is no reason to give up.

format c:

[Anonymous Coward]

If you format the drives of their servers they can't spam any more.

And don't bother with this, "But that's stooping to their level!" or any other such cries. They are not a legitimate business, they are not advertising any legitimate product or service, they are hiding who they are (which goes with my previous point) and they are costing ISPs and us millions of dollars a year in lost productivity and bandwidth costs.

Sometimes one has to resort to drastic measures to get the results you want.

What's so special about SoBig?

[NecrosisLabs]

There have been other email worms out there before, and I have had some extra traffic because of them, but I have had over 500 SoBig infected emails in the past 24 hours.
The message doesn't appear to be particularly "catchy" and it seems to follow the infection vector of other worms, so why the traffic? Does it cause infected computers to send out messages more often?
Most importantly, when can I punch the person responsible for this?

How to deal with spammers.

[Anonymous Coward]

Track them down (I'm sure there is a way of doing this but I've never learnt how) then, You proceed to whip them to death publicly (preferibly with toilet paper because it takes longer) and that would set the example to other spammers.

The amount of spam should decrease.

Just my 2c.

Correct definition of spam

[gorbachev]

Take out the commercial part.

The definition is, and will always be, despite the efforts of the DMA and other spam friendlies, "unsolicited bulk email".

Not commercial, not porn, not fraudulent, but ALL unsolicited bulk email regardless of content.

Proletariat of the world, unite to kill spammers. Remember to shoot knees first, so that they can't run away while you slowly torture them to death

All or Nothing

[CuppaJoe]

I for one am getting so sick and tired of the attitude that [some piece of legistlation] doesn't do "enough" so we just shouldn't do anything at all. There is no perfect law and no, legistlation will never solve the whole problem. So does that mean we should just say, oh well, poor us, there's nothing we can do about it? Give me a break. You have to start somewhere!

Re: legislating Spam

[KarmaOverDogma]

You are correct, IMO that spam is a social problem. But "social problems" are rarely fixed by mere legislation and prosecution. The last time I checked, various drugs were illegal, too. But this fact does not appear to have stopped the (illegal) drug trade. I *think* there also a whole lot of creative laws vs. market and stock fraud as well. I hear there's even an entire governmental agency to fight this, too.... Yet the Enron's, Worldcoms and Adelphia's execs still get away with it.

I for one wont hold my breath waiting for creative, effective legislation to stop Spam. The use of the three words creative, effective, and legislation together is almost an oxymoron anyway.

Its is more accurate, IMO to label Spam, as both a demand problem, like drugs, and a financial crime, very much like fraud. Spam, therefore couldn't sustain itself but for the combination of two factors:

1) the one out of a million (or whatever the number is) spam recipients who actually buy the spy-cam or p3n1s enlarger.
*and*
2) the usual/customary fact that email in ANY volume/frequency is ALWAYS free.

Problems like this, therefore need to be dealt with both economically (market forces) and by law.

A better solution IMO (and as I have seen numerous times before) is to front load the cost of email on the sender. Charge one (1) penny for each email, period. Bulk email could get a discount to reduce the cost to 1/10th of a cent.

This would be made policy by, you guessed it, legislation. Half of the funds would be kept as profit by the ISP, so they wouldnt kick up a fuss about making yet more money. The other half would go to enforcement of *effective* laws vs. spam, so the ones hacking the system to spam without paying (or the ISP which allows email without payment) could be hunted down. The extra funds collected could even allow for *gasp* innovation in email/SMTP security

Yeah we'd prolly pay an extra buck or two per month, but to seveery curtial spam, I for one would do it.

Treat the disease - fraud - not the symptom

[swb]

Spam is predominantly a marketing method for fraudulent or otherwise illegal business enterprises. Without a source of business, the people performing the spamming will be forced to move on.

You *can* easily catch the people running the businesses behind the spam; they collect money, and the money trail is easily followable. Lean on these people, and you can probably get the spammers if someone decides to make spamming illegal as well.

The key point is to not try to attack spam; it's only a symptom. The real cause is fraudulent business entperprises, and I'm mystified why the FTC or the FBI doesn't make them a higher priority. Even the DMA should back this, since it would make them look more reputable without a direct attack on a business practice they'd *like* to use.

While we're on the topic

[metalhed77]

Let's not forget about the recent clash between SPEWS.org and SomethingAwful.com . The toll the spam war takes on everyday users through organizations such as Spews who are too heavy handed. Treating spam as a war to be won at any cost has allready produced enough casualties.

Re:While we're on the topic

[gorbachev]

somethingawful.com is a bunch of script kiddie wannabes having a temper tantrum, because they can't send their 3|337 emails to their elementary school friends.

Something of note here...their provider, cogentco.com is hosting a HUGE number of, not just your regular spammers, but criminal spammers. They have an infestation of spammers, who are actively scanning for open proxies 24/7 on multiple netblocks. See Mark Ferguson's recent proxypot stats posted on news.admin.net-abuse.email for evidence.

Not only that SBL has 19 separate listings for Cogentco for hosting career spammers (not just first-time or flyby spammers, these guys are the high volume pumpers) The earliest goes back to Jan 2003. That's over half a year of hosting a known, career spammer.

SBL, btw, is one of the most conservative blocklists out there and has a rock solid reputation among both users and the ISPs.

So, in summary, mentioning somethingawful.com as an example of how the "spam war" has gone too far is completely bogus. Cogentco has a huge spam problem and has refused to clean it up. Why should anyone want to accept any IP traffic from them?

Proletariat of the world, unite to kill spammers. Remember to shoot knees first so that they can't run away while you slowly torture them to death.

Re:While we're on the topic

[gorbachev]

"See Mark Ferguson's recent proxypot stats..."

That's actually Ronald Guilmette's recent proxypot stats.

EVERYONE STFU

[Anonymous Coward]

Get with the program and use a mail program that supports bayesian filters (like mozilla mail).
You have to train it with a few hundred e-mails for best results, but if you're complaining about spam you probably get that much anyway.
Bayesian filters work.

They are freely available.

Anyone who complains about spam now is just a whiner.

I for one do not want any more bad legislation being made, as we all know technology legislation has been "wonderful" (DMCA, Net act, patents).

Outlaw Spam

[Anonymous Coward]

If Spam is outlawed, only outlaws will have Spam.

Well Put!

[craic]

Living with it doesn't have to be as painful an experience as you might think, however. The best practice I've yet heard of is where IT departments invoice the spammers for the lost productivity hours suffered as the result of inundated mail servers and mail service outtages suffered through poorly designed network topologies or lack of IT management savvy. It seems to me (imho) that as more and more corporations and personal computers use their computers for productivity and enjoyment the companies providing the unsolicited marketing interruptions into our days should be providing much more incentive (perks, paybacks, chotchkes) for those popups and other web application interfaces. Failing this, it should be legislated ( by the people, for the people ) that the companies responsible for these interruptions be required to accept invoice and process an account payable for each respondent who had, willing or not received said marketing verbage. The appropriate amount would be a calculated percentage based on the fee received by the marketer for the marketing push in direct and proportional relation to the amount of email that the public infrastructure ( the internet, billions and billions served TM ) needed to process. So as not to eliminate spam altogether, this will curtail mass mailings and ensure that marketing continues to be able to thrive, however, under a much more equitable arrangement for the infrastructure as a whole. Responsibility for the payment would be directed through the carrier as service provider to said marketing company, individual, anarcho-syndicalist commune, etc. The carrier, as well paid provider of the network services required to perpetrate such a mass marketing push would be responsible for its impact on the overall network in this scheme and would be required to take responsibility for its networked connections transmissions. This shift in responsibility for packets would balance the likelihood that service providers will continue to provide users with the ability to mass mail, or spam via web apps etc. ( insert your most loathesome client adware product here ). In order to protect carriers from inaccessible funds due to the inability of the marketer to pay, or potentially, other fraudulent marketing scams the carrier would be entitled to and recommended to take out insurance against such scenarios. This will force carriers to be more discerning as to whom they allow to connect to their services, and the appropriate credentials would be required when taking contract for the consumption of network services, thereby providing the government with a way of ultimately penalizing offenders, and protecting the public trust. These countermeasures and balances will curtail inappropriate network usage and promote more vigilance by carriers as to the content they're proliferating. The legislation should be multiply interoperative in various sectors so as to ensure that fairness and credibility be considered throughout. It wouldn't be easy legislation to write, but the fact that legislation is currently tabled gives rise to the possibility that a much more considerate approach could also be tabled, ratified, and maybe even "They signed you bill, now you're a law!" The polluters of our lakes and rivers have also been required to pay for cleanups and/or damages done to people and properties for their accidents or transgressions, it may be high time for netizens to push for a more 'network aware' government and ensure that pollution doesn't get out of hand in our new frontiers.

Sobig.f Stats

[mindriot]

For the Sobig.f statistics, check out the virus stats page of the University of Vienna also.

Re:Yeah, well they bashed the anti telemarketer la

[gorbachev]

The FTC is not blasting the concept of passing an anti-spam law. They're bashing the existing anti-spam bills that are about to become law. They're essentially saying we need better laws.

Sender Verification for SMTP has existed for years

[wayne]

There are several such authentication systems out there that have been around for years, have been formalized via RFCs, have been implemented in the MTAs and MUAs and are mostly unused.

Do a google search on terms such as "SASL", "SMTP AUTH", "GPG", "SMTP TLS", etc.

Before you get your hopes up that "the spam problem could be largely mitigated by altering the SMTP protocal to include cryptographic signatures", you should do some investigation about previous systems that have failed to largely mitigate spam.

You're the one who can't define "spam"

[Len]

I don't care whether spam is advertising a product, or asking for money, or asking for my vote. If it's unsolicited, bulk email then it's spam. Note bulk, not a single email to a single person about a topic that concerns him specifically. I don't see how you could confuse an offer to invest in my company (which couldn't be part of a bulk mailing, right?) with spam.

Re:Sender Verification for SMTP has existed for ye

[Adrian Lopez]

If these systems have failed to mitigate SPAM it's because of a lack of widespread adoption, not because the systems themselves have "failed" to mitigate SPAM. I'm sure they'd be reasonably effective if widely adopted.

Re:It's easy, practical and sensible to outlaw spa

[kilfarsnar]

Laws that follow morals are good things. Laws that "surrender to practicality" they way you would are flawed and hateful.

Whoa there! At risk of going off topic, are you sure you want laws based on morals? I know it's an age old question, but whose morals? Yours? Mine? George W.'s? John Ashcroft's?!? There are a select few things most of us can agree on from a moral standpoint (murder, rape, theft), but the vast majority of morality can have wild variation from person to person. I would much rather have my laws be practical than moral. If a law isn't practical, maybe it shouldn't be a law.

My $.02 on topic: Spam is a nuissance for most people. Stopping a nuissance is not worth giving up freedom for. Anonymity and spam is better than a lack of both. The spam blocker in my mail client (Mac mail) does a decent job.

All the HTML I know I learned on Slashdot

Anonymity.

[Irvu]

I thought it was interesting that both sides in this fight (the FTC Chief Vs. the current Bills) are treating anonymity as a problem. The FTC Chief stated it outright while the existing bills (according to the article) attack the "crime" of sending anonymous e-mail. Depending upon how that is worded that could make any and all remailers, anonymizers and other tools illegal within the U.S.

That scares me greatly.

Is reducing the rate of spam by .01% really worth our right to anonymity?

Off shore

[Dekortage]

Someone suggested that if spammers moved to other countries (where many already are) then the U.S. would somehow "squeeze" those countries to extradite those spammers. That's ludicrous. The U.S. has far greater things to worry about in terms of international politics. If Americans are going to try to influence other countries, let it be for human rights, disarmament, peace, food, medical care, etc. -- not something that is merely an inconvenience associated with a technological advantage.

Seperately: I don't have the reference right now, but I recently read an article where the author suggested that spammers of the future might get around challenge-response by farming out response work to humans in low-wage countries. A penny for ten responses! The spammer would just raise their rates a little to sellers, maybe call it an extra service....

Re:Off shore

[kevinz]

Seperately: I don't have the reference right now, but I recently read an article where the author suggested that spammers of the future might get around challenge-response by farming out response work to humans in low-wage countries. A penny for ten responses! The spammer would just raise their rates a little to sellers, maybe call it an extra service....

There are a number of problems with that thought. First, the spammer would need to maintain a working email address. This is a non-trivial exersize. Two, the spammer would lose their veil of anonymity, meaning that we could track them down. This could lead to number three, civil suits based on violations of an ISPs terms of service. Four, even at 10 responses for a penny the costs would be too high. Spammers send millions of emails hoping to get less than 100 responses. Let's assume that 10% are protected by C/R. 100,0000 / 10 * .01 gets us $100.00 in C/R costs for 10 favorable responses. Let's assume that they can close 10% of the contact and they are paying more that $100 per sale. I couldn't live on that, and I don't think that the average spammer can either.

The bottom line is that to make spam work the spammer needs a one-way channel of communication. C/R enforces two way communications and the economics don't scale up to that for spammers.

Re:Off shore

[Dekortage]

Alright, I agree it is a zillion-to-one long shot, but for the sake of argument... First, the spammer could easily set up a system with disposable addresses that last long enough to handle C/R. Two, they could stay anonymous with disposable addresses and appropriate routing/masking. Three, spammers don't give a shit about ISP terms of service. Four, ten responses for a penny might be ludicrous, but there might be other economies that would work. *shrug* I don't know a lot about people in low-wage countries but even a child can be trained to recognize 3 cats instead of 2 in a picture. -- "It's not the fact that we keep shooting ourselves in the foot that bothers me. It's that we reload so damn quickly." - Anon.

Re:Off shore

[kevinz]

First, the spammer could easily set up a system with disposable addresses that last long enough to handle C/R.

There are services that will provide disposable email, but remember that we are talking about 10,000 responses in my example. Real world spammers use much higher numbers. They might get the first few thousand challenges, but the rest would all bounce.

Two, they could stay anonymous with disposable addresses and appropriate routing/masking.

Same problem. We are talking about huge amounts of traffic here. Many spammers find that they spend most of their time just trying to secure bandwidth for outbound messages, and now yuo want them to secure anonymous inbound bandwidth?

Three, spammers don't give a shit about ISP terms of service.

Exactly right. And because they are anonymous the victum ISP must go to extrordinary measures to track them down for punishment. Requiring a valid return email address makes it much easier to track down the miscreants, and thus easier to apply the punishment. Rmember that spamming is just like selling knives door to door: it is a numbers game. If the doors are a mile apart you can't make a living selling door to door, and if the inbox requires that you authenticate you can't make a living selling spam.

Four, ten responses for a penny might be ludicrous, but there might be other economies that would work. *shrug* I don't know a lot about people in low-wage countries but even a child can be trained to recognize 3 cats instead of 2 in a picture.

True enough, but it comes down to margins again. Spam works because the difference between sending a million and 10 million spams is pretty small. C/R changes that, if for no other reason than that the spammer needs to deal with the authentication process for each inbox. Even if the spammer develops a robot to respond to the challenges the costs associated with maintaining the valid inbound email address will eat his margins. Spammers spam becaues it is easy money. Filters don't change the equation, they just change the numbers. C/R changes the equation.

Anonther Interesting Article on Spam

[twoallbeefpatties]

This story was printed recently as the cover for a weekly indie paper in Boston. The story reads more as a cover sheet for neophytes rather than for the hardcore Slashdot crowd, so you've probably heard most of it already, but there are a few points of interest:

-- Some legislators have built up backing for a "do not email" list, similar to the "do not call" list that can get telemarketers in trouble. However, there's little hope it will pass. Not only would most offshore spammers ignore the list, but a list full of working emails would be gold to most spammers.

-- The article briefly restates the idea that putting a price tag on emails could help the problem. The idea is that spammers make profits only because they can spam freely in such large quantities. If there were a 10 cent bill attached to emails sent, spammers would see greatly diminished returns. Small price to pay?

-- The article also gives this interesting thought in a "do's and don't's" sidebar: Use "plus addressing" (offered at EFN) if you care about who's giving out your e-mail address. Here's how it works: Get an e-mail account. For example, nospam@efn.org. What's different with plus addressing is that nospam1, nospam2, nospam3 and so on will also be sent to you, only they'll each come into individually labeled folders. Next, when you sign up for a Victoria's Secret card and they ask for your e-mail, you give them one of those plus addresses, such as nospam14. If you ever get a spam e-mail sent to the nospam14 folder, you know which organization sold or shared your e-mail, and therefore where not to buy your panties.

Re:Sender Verification for SMTP has existed for ye

[amcguinn]

So why create a new one?

Don't compare

[phorm]

Underage drinking, pot use, etc...

What you are describing are actions done by private citizens. Quite often younger citizens.

Now in many cases, spam is a business practice: for both the spammer and whomever he/she is advertising for. While regulating businesses may not have an immediate effect, or a fully-encompassing one, it is generally more effective than regulating private citizens.
Businesses stand to lose a lot. If pushed to bankruptcy and your business is tied to your personal life, you could even lose a house/car/etc. So yes, it could be more effective.

Now, if most private citizens were spamming, it might be not effective (see RIAA: filesharing). I have enough faith in humanity that is just a few evils causing most of the spam.
Getting the laws in place, and more importantly enforcing them should start to affect spam eventually, though.

Re:Don't compare

[anthony_dipierro]

Now, if most private citizens were spamming, it might be not effective (see RIAA: filesharing). I have enough faith in humanity that is just a few evils causing most of the spam.

That's an interesting question. I was under the impression that it was mostly private citizens spamming. If it's really just a few bad apples, why haven't we been able to stop them yet? Just catch the individuals, and publish their identities to the ISPs. Any ISPs which serve them anyway get blacklisted as well.

It seems to me that's the whole reason that spam is so big. It's not just a few big corporations doing it. It's any bozo with a half-assed business idea and a poorly developed conscience.

Outlaws

[Detritus]

Taking an idea from Icelandic history, why not declare spammers to be outlaws? An outlaw is outside the protection of the law. You are free to take his property, beat him or kill him.

Re:Outlaws

[jcr]

I like that idea.

-jcr

Blanket statements are dangerous

[phorm]

You know what, most businesses don't support filetrading. They prefer to avoid the legal entanglements and inform employees that warez software and unauthorized Mp3's (aka unowned) are not permitted.

And you know what... they're also the ones that suffer the most productivity/bandwidth/etc loss due to spam. Yes, it's a problem for everyone, even Joe SixPC... but businesses are the ones who are most affected, and thus will be the ones to push for an anti-spam solution.

Target the vendors

[spagiola]

The spammers can and do try to remain anonymous, but their very purpose is to make people buy something, which means that at some point there has to be a way for customers to reach the vendor paying for the spam to be sent. And that's what should be targeted. Fine those who pay to have spam sent, and they'll stop doing it. There need to be some safeguards, of course, so that a competitor does not maliciously have spam sent in another's name, to get their competitor fined, but that should be something that can be addressed.

So?

[Anonymous Coward]

some of the proposed laws could be harmful, or at best useless

That's never stopped legislators before - why start now?

Only one type legislation that could work...

[SirGeek]

Force anyone using a standard DSL or dialup (read this as a NON business account) to use the ISP that you are connecting to's mail server by blocking all accesses to port 25 except for their mail server ( This is trivial for them to do at their routers - drop all TCP/UDP connections to port 25 except for their server). Wouldn't this effectivly kill most spammers ? They could also do stuff like, limit people to no more than say 50 emails/hour ( how many people will actually hit that limit ). If they have people riding the limits, that should send up some sort of red flag to check what the person is mailing out ( from the sendmail/qmail/etc. logs ).

Bubba Asks???

[Arbogast_II]

As long as the Internet is an international open network, is there really much an individual nation can do to regulate it??? As long as the SPAM is sent from outside the offended nation, can much really be done about it??? I don't know, just asking...

Doesn't SPAM exist more for Technical than Legal reasons??? IE, Email is sent over the net without a reliable electronic ID, hence you can't easily filter out SPAM???

National "Do Not Spam" List is Possible

[dwheeler]

Personally, I think it's absurd that I have to sign up for a special list just so that I can use my own email inbox. However, that may be the only tractable way to proceed by legislation. And I think it's critical that spam be made explicitly illegal. Murder still happens even though there are laws against it, but the threat of action certainly helps deter it. If spam were illegal, there would be fewer people doing it. And if just the top ten spammers were captured, separated from their possessions, and possibly jailed, there'd be a whole lot less spam (they send most of it, and there'd be a lot of disincentive for anyone to replace them).

However, what will not work is requiring every email have an "opt-out" box. That's just a way of getting more spam; any opt-out list has to be one, single list. And having a national email list, with cleartext email addresses, is clearly a non-starter - that would just ensure more spam, by those who don't care about the law.

The simple solution is to store cryptographic hashes of email addresses - not the email addresses themselves. That way, having the address list doesn't actually give you a list of valid email addresses - it just gives you a way to (painfully) check if a given name exists on it. More details are at: http://www.dwheeler.com/essays/stopspam.html#opt-o ut-list>

This isn't perfect, but it might be a step in the right direction.

The current legislation makes it okay to spam as long as you do a few stupid things that harms consumers. That's worse than the current situation; at least some state laws have a small bite. But it makes sense - they're listening to the spammers, and not the people being harmed. They need to enact stronger laws than they've been willing to consider so far.

I agree

[macdaddy]

This is something we anti-spam zealots have feared for some time. By outlawing certain types of spam we are in effect legalizing the other types of spam. For example if we say that all spam with adult content must have "ADV ADLT: " prepended to the Subject line then all spam with that mark can't be considered illegal spam, hence no lawsuit can be filed. The spam issue is a grand one. The ONLY people who can provide accurate and meaningful insight on the problem are the people who actually deal with it on a daily basis. If you don't know all the spammers tricks then you can't begin to dream of crafting a law that encompasses any and all of them. The NANAE regulars should have a enormous amount of input into any law that might get passed IMHO.

Elminate the spammers, eliminate the spam

[Grishnakh]

I have an idea: the amount of spam on the net may be huge, but it's all coming from a small number of spammers. If these people were to "disappear" suddenly, the spam problem would pretty much disappear too.

Re:Elminate the spammers, eliminate the spam

[Backov]

Every time I advocate spammer assasination and torture, I get modded down. Damn liberals.

spammers

[Anonymous Coward]

heh friend of mine that does operate several porn sites, his boss requested that any spam filters be turned off so he can "see" what the competition is up to. His subscribers mainly are ones that have signed up though that get newsletters from him.

All very good ideas

[DrMorpheus]

And all very cheap to implement. If there was going to be any anti-spam laws then why not have the parent post ideas become requirements for all ISPs?
You could complain that it might be expensive to implement, but I seriously doubt it and it might even be a net savings for ISPs because they would have a significant drop in mail loads.

Watch out for "false positives"

[Fizyx]

A couple of my email addresses sometimes show up as the from address in spam (no, my systems haven't been trojaned). This is a nasty form of identity theft since I get delivery failure notices and complaints from recipients. What would be really nasty would be a subpoena for the same.

False positives are bad when you're filtering spam, worse when you handing out subpoenas.

Always funny

[efflux]

how people compare differing responses to different situations, ignore any context to clue them in as to why there are differing response, and then claim that they have uncovered some sort inconsistency in behaivor through some false analogy.

As a parting note, please exercise parallel construction next time. It makes it easier to indentify the qualities being compared.

Ex. How people spend so much time complaining about spam (unauthorized use of bandwidth), yet have no trouble at all with file trading (making unauthorized use of someone else's data).

Spam is useful

[tlacicer]

I for one love getting spam.

I mean who doesn't? You get to keep current with all the latest new mini wireless cameras. This way you can create your own p0rn and not have to keep relying on the p0rn spam :)

Ah, but somewhere along the line

[phorm]

There's a business/etc using the spammer to advertise their goods.

And many of the big spammers I have heard of on slashdot run spam as a business, albeit a semi-private one and often home-run (defining a business as an enterprise that provides their primary income, anyhow).

Re:Ah, but somewhere along the line

[anthony_dipierro]

Yeah, but in many cases the business/etc doesn't have direct knowledge that the spammer is spamming. And just because someone is running a business, that doesn't make them not a private citizen. I'm not sure of your point. Are you saying that drug laws don't work because getting thrown in jail is not as bad as facing bankruptcy?

Re:It's easy, practical and sensible to outlaw spa

[greenrd]

Whoa there! At risk of going off topic, are you sure you want laws based on morals?

What else should they be based on?

Bribes?

Honeypot

[Anonymous Coward]

This is a test. slashdot@kma.eu.org
slashdot@kma.eu.org

Re:Forget UCE, they need to go after the criminals

[rsborg]

After getting a few of these in a week's time, I checked the headers, and all seemed to come from China. I'm not sophicicated enough to trace them back any farther, but since these are so blatently criminal, I dont think they'd be originating in the US, as the potential for prosecution is so high.

I really doubt people in China want your CC address or paypal account. More likely, it's open relays in China where spammers (probably US-based) open accounts. I can think of no simple solution to this issue, perhaps best is to just cut off these ISPs (think: internet death thread) from the major ISP links here in the US. No need to kill all of China, just the last point of accountability on their side, and let them clean up their own act.

Re:Forget UCE, they need to go after the criminals

[Anonymous Coward]

Here's an example of one that came from New Zealand but was sent through an unsecured relay in China (go to bottom of thread to see how it was traced).

Broad laws. Too broad.

[satyap]

I kinda agree with him. The laws usually leave out important things like the definition of spam. See also laws about copyrights online, piracy, etc.

It was me

[www.sorehands.com]

I placed the orders not for the product, but to track the spammers. The vigra is not returnable, but you must consider the cost of the pills, kits, etc. as a cost of going after the spammer (like the filing fees, service, etc) and figure that into the amount that you may consider settling for.

For example, I bought penis enlargment pills from a company in California, then returned them in person with a witness along with my demand letter. They kept spamming, but I have not gotten another spam from them after they were served with a lawsuit last Monday.

For more information on my spam fighting activities.

Rule 1!

[www.sorehands.com]

Spammers always lie. If what spammers do is so legal, why do they hide?

Even so, let a judge and jury tell the spammers they are wrong!

Make money from home with your computer....sue a spammer!

No!

[www.sorehands.com]

It is called agency! The tenet of agency theory is that a principal is liable for the acts of its agents.

Originating

[www.sorehands.com]

You don't only go after the person who originates the spam, but link in the chain. If someone hires a spammer to "market" for them, you go after them under agency theory.

Here it is properly formatted

[Anonymous Coward]

Jun. 16, 2003
Cable-TV descramblers! FDA-approved diet pills! Viagra without a prescription! Instant access to XXX movies! Dramatically enhanced orgasms! If you have ever received e-mails advertising products and services like these -- some quite within the law, some clearly outside it -- chances are they came from a guy like Howard Carmack, professional spammer.

Using three computers and working out of his mother's home in Buffalo, N.Y., Carmack sent an impressive 857,500,000 unsolicited e-mails in one year, something that is perfectly legal in New York State. But Carmack crossed the line, according to EarthLink, his Internet service provider, when he set up 343 accounts using stolen credit-card numbers to send these e-mails.

EarthLink took notice and began a year-long cat-and-mouse game to discover Carmack's true identity. "My name's not on anything," he boasted at one point, according to investigators, when they reached him on his uncle's cell phone. "You'll never catch me." Fingered by his upstairs neighbor and a former employer, Carmack went to ground. A private detective was hired to stake out his mother's house. Carmack was finally caught running from his car to the front door and was served with a complaint. Now out on bail, he has been found liable in a $16.4 million civil lawsuit by EarthLink. Charges of criminal fraud filed by state attorney general Eliot Spitzer are still pending. "There are many more like Carmack," Spitzer warns. "This sends a message that we are pursuing them." Spitzer, a man who knows how to put himself in the spotlight, was the avenging angel of Wall Street last year. Now he is on a cybercrusade against spam.

And no wonder. In the space of a year, according to research firm IDC, the number of uninvited entries into U.S. In boxes has shot up 85%, to a total of 4.9 trillion. Driven by cheap technology and the promise of easy profit, spammers have gone from pests to an invasive species of parasite that threatens to clog the inner workings of the Internet. For the first time last month, according to MessageLabs, more than half the emails received by U.S. businesses were unsolicited. The time we spend deleting or defeating spam costs an estimated $8.9 billion a year in lost productivity. Sensing an enemy as unpopular as al-Qaeda, lawmakers are pondering a plethora of solutions -- some of which, spam watchers say, could end up doing more harm than good.

Why do spammers flood the Internet with ads nobody wants to read? Because some people do read them, and a tiny fraction actually respond -- which in the world of direct marketing is like money in the e-bank. Take former spammer Scott Hirsch of Boca Raton, Fla., who sold his e-mail marketing business last year for $135 million and retired at the age of 37. Florida is home to more spammers than any other state, and Hirsch -- who started his first bulk e-mail list way back in 1996--likes to take credit for helping make Boca Raton "the spam capital of the world." Hirsch filled his mailing lists with the e-mail addresses of people who had "opted in" by checking (or forgetting to deselect) one of those ubiquitous boxes on website order forms. "When people want to receive [e-mail]," he explains, "you get a much higher return."

But for an increasing number of Hirsch's imitators, spamming is a numbers game that rewards excess. "The more times they deliver the message, the more money they make," says Charles Curran, general counsel for America Online, which last week filed lawsuits against more than 100 spammers. "They all want to get as close to infinity as possible." This is getting easier all the time, as high-speed Internet access gets cheaper and computer processor power continues to double every 16 months. Meanwhile, the software tools for spamming continue to improve. Web crawlers harvest e-mail addresses en masse from chat rooms and newsgroups. Dictionary-attack programs string together words or names in multiple languages, random numbers, an "@" and the names of common mail servers. Presto: millions of

So how many...

[julesh]

So how many sobig.f related messages have everyone here received so far? Over the last 3 days I count in excess of 300, if you include bounces and mailing list software saying "huh?" cause it doesn't understand any of the "commands" in the message... for some reason I'm getting *many* more bounces than I am actual copies of the virus (anyone know why? Does it use a different selection method for sender addresses than target addresses?).