Slashdot Mirror
How to Kill Spam Without the State
WaxParadigm writes "The Colorado Freedom Report, an online libertarian publication in Colorado, has an article today about How to Kill Spam Without the State. Will our heavy-handed attempts to stop spam through legislation have the outcome we desire?" The article advocates putting the burden on the end user, saying "We must also take personal responsibility to kill spam. We can't pretend the politicians will do it for us. Their incentive is to develop a cute re-election flyer, not solve the problem. If you're still tempted by the political approach, ask yourself one simple question: who is more technologically savvy, your average spammer or your average politician? There are steps each of us can take to kill spam, and to help foster a culture that encourages spam killing." While this forgets the onus of spam on the ISP and telco companies, it should well be part of a multi-tiered plan against spam.
Yet another piece of libertarian propaganda.
They say we should give the responsibility to the end user because politicians can't handle it because "spammers are more technically savvy then politicians". Is it true? Yes. However, I'd say that even politicians are even more tech savvy then Joe Emailer.
This is yet another piece of their tired rhetoric full of holes. Take it with a bucket of salt.
Spam is revenue for the State, and it isn't a good idea to kill it. Spam has also fetched more revenue for anti-spam s/w firms, than for the purportedly promoted products.
It stands to reason therefore, that the most likely writers of spam are THE SAME ONES WHO PEDDLE ANTI-SPAM WARE.
Thus, to kill spam:
1. Do not trust the State to do anything.
2. Do not buy, solicit or encourage anti-spam software.
3. Use free anti-spam tools wherever possible (this is easier with Linux).
4. Unless spam hogs your bandwidth or disk usage, don't bother.
5. And lastly, or rather firstly, spend money on a CD Writer and media to take backups, rather than on anti-spam s/w.
You will lead a cheerful, richer life.
If you keep throwing chairs, one day you'll break windows....
No matter how technically savvy you are, if your email address is picked up by a spammer you will receive spam. Whether it hits your inbox or not, somewhere along the line someone has had to relay that message to your mail server and the bandwidth is already wasted.
Get a good filter, use whitelists, whatever. Just don't think that you will be able to eradicate spam without governmental help.
Take personal responsibility. Yeah, right. I don't get any spam. I filter it all out. Does that matter? NO! I'm one person and part of a very thin sliver of the total net population. I actually know what I am doing. The other 95-98% of the people out there do not, and will not. They have trouble getting Outlook Express working and you are going to talk about 'user responsibility'? What a clueless asshole.
Any article with the word 'schlong' in it is suspect, in any event.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Firstly, stop buying things from spam!
My friend once commented on how all he hated getting so much spam the everyday. I myself get maybe one or two pieces a week, so I started to show him the basics of filtering out some of the crap.
So what do you think he says? He doesn't want all his spam automatically deleted he said, because sometimes something interesting comes! He even likes to follow the links two visit the sites.
Fuck I wanted to smack him right in there and then. Actually I'm in a bad mood right now I want to go back and find him and smack him anyway.
Yeah but I think the idea is how it should not end up in your inbox in the first place.
I just got a legitimate email returned because spamcop claims that the smtp server of the webhosting provider has an abnormal rate of spam.
The worse thing about spam is that filtering systems create false positives...
My provider requires authentication but everyone knows that you can create spam using a IP address from a well behaved smtp server.
Fear is the mind-killer.
"who is more technologically savvy, your average hacker or your average politician?"
ABOLISH ALL LAWS AGAINST HACKING!
it's up to individuals to make sure every single port is secure against someone wanting to cause damage to your computer/company/bank account.
for the end users i recommend a white-list filter that automatically deletes ALL email at the server so any graphics & HTML & script never get on the local computer unless the sender is in a database or address-book...
Heh. From "Just do it!" to "Just delete it!" in a mere 35 years...
Sheesh, evil *and* a jerk. -- Jade
It's obvious what to do about the #1 problem: people who run web pages should stop listing e-mail addresses in readily spammable form.
On my London Blog I don't use any form of obfuscation. The reason for this is I want people to contact me about my writing. I want to know what people think, and any barrier I put in the way will reduce the number of legitimate emails I get. I'm not confident that most of the Internet population would understand that they need to remove the REVOVE.THIS.TO.EMAIL.ME part of my address.
Sure, I drastically increase the number of spams I get, but popfile takes care of them all. The author of this article is still correct in his economic analysis. There is little burden for me using this method, but a much larger burden for my ISP.
Set your inbox to filter all HTML formatted email.. no more spam. Of course this can only work well for personal addresses for correspondence with friends who understand how to configure their mail client. If you want to be able to correspond with lots of people (ie link your addy on your website, on usenet, etc) I don't see an end to receiving spam any time soon.
Here's an idea about spam on the news: Why not make the following a rule for most groups: If a company posts commercial advertising on a group, it thereby gives the right to anyone to post copyrighted material from the said company. This should slow down unwanted ads, shouldn't it ? Would this be legal ?
> We can't pretend the politicians will do it for us. Their incentive is to develop a cute re-election flyer, not solve the problem.
Fortunately we have this completely spin-free political rag to set us straight on it...
Sheesh, evil *and* a jerk. -- Jade
They really wanted to give it a libertarian twist,
no matter what, didn't they?
99% of the users can't block spam serverside, and just putting the burden on them, will make them pay for the costs, since they have to download it (telephone, burden on bandwidth).
Not putting a brake on the origin will cause even more spam.
There is only one solution: put cost on sending spam AND their ISPs that try to get away with it. Moneywise, or with penalties.
I work the abuse desk for a regional cable ISP, and end up suspending several customers accounts per day because they're either sending or relaying spam (mostly the latter, and usually unwittingly). The majority of the complaints we get come from giant ISPs like AOL, but from time to time we get a mail header from some end user, and the ip is looked up in the dhcp log and the customer is suspended just as if AOL or RoadRunner were complaining.
"Who's going to believe a talking head?" - Herbert West
1) Set up a "trade site" anonymously. Very anonymously.
2) Get your hands on a spammer's mailing lists.
3) Send out several millons of spam with "new better penis enlargement" or some other viagra.
4) Receive all the offers. Even don't bill them, just send out the product. TRICKY PART: Don't send any viagra or other penis enlargers, send out cyanide or some other really lethal poison.
5) Run, wipe all your tracks before your mail reaches its destinations. Leave the "spamming server" with a note on the harddrive for the police to find: "These idiots deserved to die. As long as anyone answers to spam, such 'accidents' will happen. This is not our last action". Take care that it gets to the news.
Fear is a powerful weapon.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Have you tried Bluesquirrel's Spam Sleuth Enterprise? Works great!
.. yup, windows =)
http://www.bluesquirrel.com
These are some steps that I take:
;) I use the one in Apple's Mail program, using a combination of its built in abilities and custom filter settings to hit the big stuff.
1) Use a mail filter
2) Disable rendering of images in HTML documents. This way you'll kill most web bugs that indicate your account is valid.
3) Bounce messages. If it is connected to a live account you'll come up as an inactive account. This has helped before, but most of the time it just generates extra messages in your account.
Integrate Keynote and LaTeX
The only solution that I believe is viable is to prohibit companies from purchasing unsolicited advertising from spammers. Spammers don't spam for fun - they get paid to send the millions of mails out. In the end, there are companies and individuals behind them who choose to advertise via email. By making it illegal to do so, the need to stop spammers disappers, as the companies would be 100% liable.
A blog like any other.
We need more than this to stop spam. There's too many idiots about who'll buy spammer's products.
.com/.net, and Nominet is not allowed to be the licensing authority for .uk, and Domicilium is not allowed to be the licensing authority for .im) There can be more than one licensing authority per TLD.
I don't think SMTP itself is fundamentally broken - we just need some improvements to the administration.
In the early days of road transport, drivers were unlicensed - anyone with the money could buy a car and drive it. As traffic built up, eventually this was no longer tenable. As email traffic builds up - lack of licensing for MTA operators is becoming untenable. My server has rejected over 1.2 *gigabytes* of malware in the last week (mostly Swen worms). SpamAssassin kills 80 spam messages a day in my mailbox alone - and still about 15 a day get through. The option of "doing nothing" about email is no longer viable. Schemes like "sender pays" are untenable too (and unfair - why should I pay yet another fee to use bandwidth I'm already paying for once?)
What is really needed is a licensing scheme for people who operate MTAs, just like there is for amateur radio. In brief, here's an outline of what could be implemented. I know this will probably draw the ire of Slashdotters who think they should be able to just run an MTA on their cable modem connection with no qualifications - but this is *exactly* where the problem stems from: to be sure of not dropping too much 'ham' we have to accept SMTP connections from more or less anyone. And this means we get flooded with over a gigabyte of Swen worm traffic in a week.
This list of requirements is by no means comprehensive - it's just a starting point for discussion.
* If you want to run an MTA, you must be licensed to do so.
* A licensed MTA operator may only relay mail from their own network or from other licensed MTA operators. In the case of a home user, this means they can only relay mail from their LAN. In the case of an ISP, from their own netblocks etc.
* A licensed MTA operator may only receive mail from other licensed MTAs. This means you must reject email from the unlicensed (virus/spam spewing) MTA on adsl-192.14.5.6.pacbell.net.
* A licensed MTA operator may only send mail to other licensed MTAs.
MTA licensing can be based on digital certificates. The MTA oper's signature will appear in the header of the email.
To obtain a license, the MTA operator would have to take an exam. The awarding and administering of licenses will be done by TLD. (A good idea would be that the licensing authority must not be the same company or subsidiary of the company that runs the TLD, so VeriSign is not allowed to be the licensing authority for
The upshot of this is that if a licensed MTA operator passes spam or malware, they can have their license suspended or revoked, or fines levied. MTA operators at the ISP level will be *very* careful to ensure they don't harbour spammers because they'll lose their MTA license. They will be *very* careful they configure their system to not allow executable attachments, or at least scan them for malware. Small MTA operators will be *very* careful not to accidentally configure their mail server to be an open relay.
To obtain an MTA license, an exam should be passed not for a specific MTA such as Exim or Sendmail, but general good practise in operating an email server, and general knowledge about internetworking - just like amateur radio licenses don't have exams on a specific model of ICOM radio. Additionally, the MTA operator must provide positive ID when applying for the license - this way, we make sure the MTA oper is accountable for what their MTA emits.
Of course, an actual implemented system like this will be more complex than what's outlined in this posting. Of course, most Slashdotters will hate the idea expressed above - I wouldn't really like to have to take exams to keep running the mail server I already
Oolite: Elite-like game. For Mac, Linux and Windows
Here in New Zealand we just post spammers personal details in major newspapers... http://www.ananova.com/news/story/sm_811235.html?m enu=
Followed up with threats and obscene phone-calls, this is an effective tactic. There are now up to 100 million less spamails per day.
All very well for new addresses, I suppose. I've taken that approach myself, on my spamless email addresses. If it becomes a problem to spammers, they are likely to adapt by harvesting addresses directly from PCs using viruses and other malware.
proof, n. A demonstration that a conclusion is implied by certain premises and axioms.
"Personal responsibility" is a great idea. It's what I've been advocating for five years now:
What legislators have to do is make 'he was a spammer' a legal defence in cases of murder, torture and arson. I'll do the rest.
We will need to bring back vigilante mobs and lynchings. Of course, I'm totally in favor of this.
Get revenge: Unsolicited Commando
Spam exists because it works; enough people buy products that are advertised through spam that the increased sales more than make up for the cost of spamming.
Companies choose Microsoft solutions because Microsoft provides the most flexible, stable and secure systems, with lower TCO than the competition.
I believe both of these statements are false, but are believed to be true by people making the decisions. Why? Because spammers and (to a much lesser extent) Microsoft salespeople are dirty rotten lying scumbags out to make a buck by cheating whoever they can. On top of that, spammers also sell their service by claiming what they're selling is not spam - it's direct marketing to a targeted opt-in list of interested consumers over the Internet. We all know in reality it's completely untargetted and their definition of "opt-in" includes allowing your e-mail address to appear unobfuscated on any web page, using it to register a domain name or post to a newsgroup, or simply choosing an e-mail address that could be guessed at random. We know that, just like we know Windows almost never has a lower TCO than anything. But the people paying the money don't, because they simply don't know better.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
I'm starting to consider boring and pointless slashdot articles about spam, to be the new spam.
who is more technologically savvy, your average spammer or your average politician?
Who is more technologically savvy--your average bank robber or your average politician? Who is more savvy about poisons and guns--your average murderer or your average politician?
See, by your argument, most laws are useless because they were made by people not as good at committing the crime as the people who actually did commit the crime.
I'll be laughing at you all when my money's in the bank, and I can finally afford a big penis!
unsolicited e-mails anymore. I used to get hundreds a day. It kinda makes me feel lonely.
And I'm kinda out of touch now. I mean so far I'm thinking my penis is big enough, but what if one day the wife breaks it to me that she needs a little more oomph. I might not know where to turn.
Make Rosie O'Donnell sit on the spammers face. Between the crushing weight and the aweful smell it should kill them. Well that or it will turn them into a Dr. Phil clone.
If that doesn't work we can tie some spam to them and make them run naked through ethiopia.
No, this isn't a a daft claim like the one that do-not-call lists breach freedom of speech. I agree with the article that it's just not the place of the state, or even infrastructure providers like ISPs or Hotmail, to filter our private mail based on content.
Even if you think that governments might be technically competent to fight spam, should they be given licence to read (even in an automated way) and analyze all private correspondence just in order to stop some junk mail? [1] I'm not so concerned about blacklisting known spammers, etc., but
Spam is really, really annoying, but when does the cure become worse than the disease?
[1] (Obviously they're going to do this anyway, but we don't need to condone this or make it acceptable.)Run SMTP over SSL and make all connections that are not listed in DNS MX records login with local username and password. Then, have the server sign the message of a logged-in user with server's key, which is registered with a certificate authority. If enough ISPs adopt that and there are cheap mail-only services, people will have an option to only accept signed messages or at least move unsigned ones to a separate folder.
Then, once all e-mail (that gets read) is tracable to a particular person/company, outlaw spam. No need for a no-spam list, because nobody wants spam. People can always sign up for whatever mailing lists interest them. No need to harvest e-mail addresses given for totally unrelated purposes.
Will it get rid of all unwanted e-mail? By no means. But its irresponsible to just complain or try to pass laws without making simple changes to the software first and seeing how well it works. You don't install a UNIX system with an empty root password and then whine about intruders, do you?
What could also be effective, is listing their names on www.ihaveasmallweenie.com
I cant walk down Oxford Street without 20 people trying to hand me flyers but that doesnt mean it should be illigal. Spammers are assholes but they are only assholes because we know that what they are doing is technically legal and theres nothing we can do about it. Filtering spam might get rid of allot of it but it doesnt give us the satisfaction of hurting the spammers. To get this satisfaction we have to go over and beat the absolute crap out of them until they cant even use a mac! Obviously thats over-reaction but thats what people think and thats why spam laws get in. Actually what am i saying, screw them, make it illigal and sue their asses. I hate advertising more than anything, if i had to put up with telemarketing and tv ads every 5 mins i would go apeshit and shoot people.
This comment does not represent the views or opinions of the user.
It's obvious what to do about the #1 problem: people who run web pages should stop listing e-mail addresses in readily spammable form. I hereby announce a new policy for the Colorado Freedom Report: I will not post e-mails on the page except in graphic form (or with some other disguise). This creates a mild inconvenience in that users will have to type in the e-mail rather than merely hit the mouse button, but I figure if it kills just one spam, it's worth it.
Um no, if I lose just one business lead because someone can't be bothered to type in the email address then that's worse than all the spam in the world.
Never mind the people sending the spam (allegedly including unaware victims of spam-relaying viruses). Let's institute heavy federal penalties against people *advertised in* spam. Of course, there's still umpteen million ways to screw up such a law, but it seems to me that it's easier to track down the owner of an 800 number or a web site or a PO Box than to track down the sender of a spam. This law would whack some spammers (spamvertising their own crap) and dry up the customer base of the rest.
/dev/null it goes.
Until someone does this (and does it *correctly*), here are the rules that I currently use to keep things manageable:
1) Messages containing my ISP's boilerplate text for "I stripped out a virus attachment, but here's the rest of the message in case you wanted to see it"... I *never* want to see it. Off to
2) Messages larger than about 250K (except for two specific ones that I expect to get on a regular basis) are filtered to a "large messages" folder, so that I don't waste CPU time scanning through all those lines and lines of stuff.
3) SpamAssassin takes a look. Anything with a score of 5 or higher goes to a "probably spam" folder (in case of false positives), not that I've had any yet.
4) Messages sent to my mailing lists get sorted into folders for those lists.
5) Filter out messages that were bcc:ed to me (i.e. my name is nowhere in the To: or Cc: headers). If they contain "Cumulative Patch" or "Undeliver(ed|able) (to|mail to|message to)", then they're Swen crap (probably disinfected by the infected person's ISP, since they didn't get trashed in step 1); trash them now. Anything else goes into a "maybe spam" folder. (I think I've had one false positive over the past few weeks.)
6) Anything that makes it this far can go ahead and sit in my inbox. The volume of mail reaching my inbox (both ham and spam) is fairly small, like one or two dozen per day. The mailing lists (combined) get a few to several dozen per day.
This is another instance where my Libertarian views diverge (at least from this clueless ahole's view point.) I want spammers put in pound you in the ass prison. They are costing me and my ISPs money. Let the Guberment put the fear of god into their useless hides. Spam is spam if it comes from some cofused granny, a clueless newbie or some acomplished spam arist. I don't want any. Kill the the spaming bastages, kill them dead now or lock them up and toss the key. Enough is enough.
If you don't like what I write don't be a CS and mod it down. Refute it.
Yea I can't spell. So what is your point?
Once identified they should be publicly humiliated re-educated and their computer confiscated.
Repeat offenders should be taken to the center of town and publicly beaten.
Only with the reduction of spam generated income will spam decrease! Hey who knows Infomercials and Televised Home shopping may disappear as well!
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
In order to deal with spammers, we have to analyze their vulnerabilites. Understanding their weaknesses is easy once you answer this question: What do spammers fear the most?
That's easy. Look at spam messages. You'll see forged return addresses, redirections through open relays, spoofed Received lines, etc.
What does this mean? Spammers are most afraid of being tracked and identified.
And they have a good reason to be afraid. When spammers are identified, they get their ISP accounts terminated, and may get stuck paying hundreds of dollars of cleanup fees. They're harrassed, sued, threatened, they quickly earn a terrible reputation. They'll go to extremes to remain anonymous.
The key is to make it difficult or impossible for spammers to forge headers and obfuscate their emails' points of origin. How do we do this? Require cryptographic authentication of all mail going through any MTA. No exceptions, ever. Every time a mail goes through an MTA, it must be signed by that MTA. Any message without a signature or with an invalid signature gets dropped. By requiring crypto signatures, responsible MTAs can be easily tracked, and spamming MTAs can be blocked.
Key creation, distribution and endorsement can be through a central authority, though I prefer a PGP-style web of trust because central authorities can abuse their power. Naturally, any MTA caught distributing spam should immediately get their keys revoked, and the revocation should be distributed to MTAs as widely as possible, causing all emails from that MTA to be blocked in a matter of minutes. If an MTA wants its emails to reach its destinations, it will crack down hard on spammers.
The difficult part is convincing ISPs to require authentication and drop unsigned messages. However, if a large ISP such as AOL or Comcast can be convinced to do this, MTAs will have a strong incentive to start signing messages, and authentication will start to catch on.
Meldroc, Waster of Electrons
It didn't mention any suggestions on how to remove spam. It didn't mention anything about software like Mozilla or SpamBayes. What a waste of a read.
Seriously, what the fuck is going on in our world right now? The fucking terminator is on my TV telling me that he never groped women nor does he envy Adolf Hilter. He says it's a democratic ploy to discredit him. He's the fucking TERMINATOR for god sakes, he's a cold calculating calculator manufacture for mass human death. C'mon.
I think the weekly world news is right, the aliens are backing him. That's why the Democrates are so scared of him that they have to "discredit" him. If he becomes Govenor, he's going to pull a fucking TOTAL RECALL on their asses out there. Come to think of it, mabey that's why he's running to begin with....
Then Rush says some dumb shit on NATIONAL TV about some "black guy", he quits the show, then they come out with the OXYCONTIN abuse story.
If email communication had to be somehow authenticated, then you could demand that anybody sending you an email should authenticate himself with your email server first.
That way people without the necessary authentication could not send.
I know there are tools out there that already do that, what is missing is that a few big players in the ISP/ email market (Yahoo, MS, AOL) come together and change the defacto standard way machines interchange email with each other.
IANAL but write like a drunk one.
Ahhh, there's no justice like angry mob justice.
""
--
The Marines: The few, the proud, the not very bright. - Slashdot tagline 04/21/05
So if someone is pissing through our letterbox, the libertarian response is "Get a bucket", rather than stop the person pissing through the letterbox. My that's brilliant! And the way to reduce gun deaths is for people to learn how to dodge bullets matrix-stylee.
"You know you want me baby!" - Crow T Robot
who is more technologically savvy, your average spammer or your average politician?
That is the totally wrong question.
Politicians know that they don't know everything. That is why they have staff and expert advisors.
Politicians, however, have something that we the tech-community do not: Police, jails and option to use them.
Spam won't go away 100%, ever. But if the spam rate were on par with the murder or robbery rates (i.e. I have a single-digit percentage chance of getting one spam during my life), then I'd be satisfied.
What we, the tech-community, can do is help them find the culprits. All we need are bounties high enough to make it worth our time.
Raise your hands, you unemployed geeks who would jump at the chance of becoming paid-for spammer hunters.
Assorted stuff I do sometimes: Lemuria.org
Is there an online bayesian filtering service, that keeps an individual spam profile? I delete most of my spam without downloading it using a webmail service, I'd really like to enhance this to use bayesian filtering but I don't want to download all that spam. I also would like to do this from work (as I do now), and then just download the remaining email over my modem at home. I might even be persuaded to pay for this service.
1. Create a replacement for SMTP.
;))
2. Give it a buzzword.
3. ???
4. Don't profit, because you've made it an open standard.
Seriously. E-mail is an outdated relic from the past. Why, exactly, are we not replacing it?
Has all the talent died? Has the Internet reached its peak - that's it, so long, thanks for all the 404s?
Oh, sure, adoption. Thus the cute buzzword. Give that to a suit, and say, "You won't be spammed! No more bandwidth is wasted! You save money!" and you'll see it take quicker than a fly on shit.
It's not like we haven't replaced things before. (Nobody uses Archie or Gopher anymore, do they?
All I want is for the state to keep their nose out of it. As it is now, you jail jail-time for killing spammers, which is a clear violation of my citizin right to protect myself and my property. If they would just stop interfering, we could sove the spammer-problem by ourself.
On the other hand, if the state insists on taking away our right to defend ourselves, the state has the duty to defend us. The current situation is not acceptable.
Your email authentication scheme doesn't reduce the bandwidth required by spam except at the very last stage. The mail still hits your ISP's servers and probably gets bounced. The net result is still a significant amount of bandwidth is used by spammers. Whether your address is reached or not, no one is preventing spam at its roots, which is at the individual spammer level.
Only the threat of actual punishment doled out by the government can act as a deterrent. Good sense and common decency haven't worked wonders in curbing spammers.
I consider myself to be a small-"l" libertarian, not as extreme about it as when I was younger, but I don't understand the reluctance to bring the state in on this problem. It's thoroughly in line with libertarian philosophy.
What does a libertarian say is the role of the state? To protect the people from force or fraud.
What do you call a message that has a fake From: address, fake headers, a subject line that says "Increase your Penis Size 2 to 4 Inches me@mydomain.com ubbnvp6443853 rtoh" and even has a fake Unsubscribe link?
It's called fraud. Nearly all spam engages in some sort of fraud and much of it is pure fraud. If you tried to buy what they're selling you'd get absolutely nothing in return.
I'm not so sure about the efficacy of bringing the state into this; it could be that law will be ineffective in dealing with such a problem, but I do know that much of what spammers do is immoral and fraudulent and should be illegal.
Despite the fact I'm basically a liberty-oriented free-market-loving sort of person, I've never described myself as a Libertarian, and this article is a good illustartion of why. Basically, he says, "do nothing, solve the damned problem yourself." Which is what we're currently doing, and it's why we're all so pissed off by spam.
Seems that most folks I know who call themselves libertarians fall for this sort of shallow thinking... they're basically non-violent anarchists. But the State can play a helpful role, without resorting to stupid "I just outlawed spam, vote for me next week," nonsense.
For example, the state can make it illegal to forge headers or use non-existent return addresses. It could require all UCE to be sent from a server registered or traceable to the sender. It could formally codify the SMTP protocol, and specify what constitutes fraudulent use of it.
Of course, such measures *by themselves* won't do anything to stop spam, but they can enable ISPs to manage it more effectively. Perhaps they're insufficient, perhaps others have better suggestions, but it highlights the proper role of the state, which is to establish a structure in which people can deal with one another in good faith. It does this by outlawing (if not preventing) fraud and deceptive advertising, by recognizing contracts, and other similar measures.
Too many people, though, call themselves Libertarians without having fully thought out what the state's role should be (hint: provide for the common defense, promote the general welfare...).
It's harder to search for your email-address that way. People sometimes write about me and includes my email address. I prefer to be able to search for it and find what have been written where. It could be a link to my webpage, a quote from usenet or something else. Ofcourse then I can lobby those pages as well and have them replace it with a more generic web@mydomain.com to atleast ease filtering.
Harald
The author is right in one regard, legislation won't do it. If everyone who is capable of deciphering the email headers to try to track down the originators of SPAM would try to report just one piece of spam to the offender's ISP, it would possibly begin to make a difference. The math is simple -- there are only a certain number of reputable (ie., non spammer-friendly) ISPs. If even 1000 people a day would use the available tools (www.abuse.net for one), and report this junk, eventually spammers will be forced to move to the spam-friendly ISPs. Then it's just a matter of adding the spam-friendly ISP to your favorite black-hole list, and you've just done your little part to stop spam.
Kill spammers!
Batlock...
Aww, the pope's going to die, the terminator loves Hitler and has the goodwill of the martian people, Rush is a druggie and a racist, and there hasn't been a GNAA post in a while.
The world is become a sad place.
On my web sites, I never write the \@ sign. It will be represented by a transparent png. No wait, it is a script that sends a gif to IE, and png otherwise :( .
Now if only I could get people to use the BCC field... I tried polite ways, I tried to educate people and I started flame wars. Usually, I end up being scrapped off people's contact list...
Have Linux installed at your place in Amsterdam, for cheap
I'm starting to think that some kind of law enforcement must be enacted.
Spammers actually steal.
They start by stealing your email address.
Then they steal some poor newbs box and send the filth.
Then they steal all the bandwidth from each and every isp who's borders are crossed.
They steal the fake from address, which ends up being listed on rfc-ignorant.org because the only way to stop the torrent of bounces is to refuse bounce messages.
They steal the privacy of the delivered trash with embedded web bugs.
They steal the time of good people who must install filters, or use dnsbl's.
They are stealing the very heart of the net. The good faith that the internet was founded upon.
So yes, by all means be proactive in stopping spam, enact laws which have teeth, and offer a truly positive approach to spam prevention.
FRY THE THIEVING BASTARDS.
One of the nicest ways is a "teergrube" (tarpit) - a special SMTP server that is tuned to process incoming mail really, really slow, thus making the spammer's tools very ineffective. It doesn't take much bandwith or other resources to run one - everybody who has a computer connected to the net and doesn't need to run a "real" mail server (or is willing to configure a teergrubing proxy that only traps spammers and lets the real MTA take care of ham mail) should do so.
Most spam is sent via open mail relays. If you are bored or annoyed enough, take the time to read spam mail headers (the interesting one is the last "recieved" line, usually), and inform the admin of the open relay, so that they can close it or get the fuck out of the internet. Also, inform a blacklist like the Open Relay Database, so that mail servers will reject mails from these hosts.
Try to poison they address databases. Set up a web page invisible for human users that contains lots of addresses that don't exist. But be sure that these addresses also will never exist - only use subdomains that you control, or those mentioned in RFC 2606 (Reserved Top-Level Domain Names), hoping that stupid spamware will try to send to these addresses anyway.
None of this is at odds with client-side filtering or legislative initiatives, just some additional ideas. And annoying these bastards feels good.
Programming can be fun again. Film at 11.
I understand that the mayor of Baltimore is proclaiming how wonderful he is that the murder rate has gone down in his town. But he didn't mention that this reduction was not due to better policing etc. but simply due to better doctors - the same number of people came into the hospital with serious injuries, but more survived.
I've heard the whole viruses are written by MS haters argument also, and what's always baffeled me is that it seems that most of them are written in VB which I cannot imagine any self-respecting MS hater even knowing.
If not for users, how about 'personal responsibility' for admins?
On a mailing list I help run, we turned on Postfix's DNS checks(not RBLs and the like, just "does connecting host have valid forward DNS? Does it match what they claimed?" etc- postfix can do a half dozen DNS-related checks to make sure you're legit. It was ENORMOUSLY successful, virtually killing off all soam overnight, because so much spam has so many fake headers.
We had zero problems with users with funky setups(ie sending work email from home, their own domains, etc). We had ENORMOUS problems with a dozen ISPs whose freaking mail servers often didn't even have FORWARD DNS! Worse, some claimed, when contacted by their users, that it was a problem with OUR dns.
The problem was mostly with clustered outgoing mail servers, where ISPs didn't give a shit enough to set up proper DNS for each cluster member. Do you think they had reverse DNS? :-)
So, we can take personal responsibility by a)refusing to accept connections from servers which have bad/no DNS and b)fixing our own mail server's DNS. That would be a biiiig step...
Please help metamoderate.
Let's say that I run a company that provides Real Estate software solutions to companies, and I pick out a couple of hundred estate agents and email them about my new software? AND, if people tell me to remove them, I am responsible enough to do it.
Personally, I don't think of that as Spam. It's targeted quite closely to the people.
Click here to unsubscribe
I posted this before but was too late to get any response:
What if ISPs simply charge each other for traffic depending not on the direction of traffic but depending on which side initiated the TCP connection. That way the person downloading from a web site will be the one paying (because he made the HTTP connection) and not the web site host. And the person sending the email will be the one paying (because he made the SMTP connection) and not the recipient.
If only a few big ISPs agree to work like this others will follow and soon even small ISPs will start charging their customers for traffic based on this method.
Could this help to put an end to spam?
I for one feel comforted by the fact that if, God forbid, the day comes that I can't get it up for my wife, and I feel so bad and depressed, and my mortgage interest rates are so high.....
I feel comforted that everyday, there is veritable kornikovia(sic) of options.
who is more tech savvy?
what does that have to do with legislating on spam? i'm sure a lot of murderers know more about killing people then most politicians (excluding bush of course, he was getting rather good at it in texas but he's really shining now that he has a military to order around), but we're ok with politicians passing laws about murder. i'm also sure ceo's and financial people know more about illegal stock trades then most politicians (damn, bush is an exception there too), but we want them passing laws to keep our pensions safe. actually, we still want that to happen. the same points apply to healh care, job creation and education (though the parenthetical comments about bush don't apply on those topics)
i guess my point is that politicians pass laws on a wide variety of issues that concern the people they represent. to do that they have to consult experts in various fields - and that's the skill politicians need: the skill of asking for help and sifting through bullshit. and that's how they can best serve their people.
and obviously the other point is that bush knows an awful lot more than people give him credit for. too bad ken lay didn't get some business advice - maybe harvard could have bailed ken lay out too.
US Citizen living abroad? Register to vote!
no such thing. as soon as you give your monIE/digits to the softwar gangsters of the fraudulent kingdumb, you are their hostage.
stuff that isn't approved (kickbacks paid in full) buy the kingdumb, won't work on your pc/network.
ALL of your 'net activity is perusable from fudcontroll @ maggie.lahman.com.
this is what you wanted? lookout bullow.
Why exactly is it that Americans or Slashdotters or Slashdotters who are Americans are so scared of their Government? One thing that comes from reading /. with this naive brain of mine is: should I be too?
Look out!
You want to get 250 greenhouse gases every day?
not a problem
...
bogofilter[http://bogofilter.sourceforge.net/] catches 99% of all spam sent to me
and i have never had a false flag yet
i'd say those r pretty nice ratings
Why not? We have one here in the UK -- the Mailing Preference Service.
If you sign up to it, direct mailers are forbidden to send you junk mail. The direct mailers have to pay its costs, and it's mostly effective.
They even have a 'baby mps' to stop bereaved mothers from receiving baby-related junk mail/samples.
Tracking spammers is trival! Just buy one of their products and trace where the money goes...
Design a new protocol. Dan Bernstein has some idea with his Internet Mail 2000 thing, to make storage the responsibility of the sender, not the recepient. If you want a certain message get it off the sender's machine, if not let it rot there and eat up space.
This article was a waste of my time to read.
For those who haven't read it (and I hope you haven't -- don't waste your own time), basically it says this:
End-users should take responsibility for spam, and the best way to prevent spam is to stop putting email addresses in mailto: links on web pages and in unmunged form in posts to Usenet.
However, it really doesn't explain how the author thinks that people can do something to take responsibility for receiving unsolicited (!) email.
The article fails to mention dictionary attacks and worms, both of which have the potential to find millions of addresses which aren't listed on any web page or in any newsgroup.
I'd be truly surprised if there weren't a worm in the works which would not only act as a mail relay, but which would take care to forward mail to every address listed in a person's address book. Rather than worry about maintaining lists of email addresses, spammers could feed their message to the network of worms (possibly through IRC, or maybe even an instant messaging protocol), and the network would feed messages to every address listed on an infected user's hard drive, and probably to several variants of the addresses as well.
What the article fails to address is this: how can the person who never publishes their email address anywhere take responsibility for spam in the face of dictionary attacks, and when they have no control over friends putting the person's address in their address books?
The article says that when fighting spam, you shouldn't look to the politicians, because they have not the technical knowledge to make legislation stick.
In response to that, I suggest that you not look to the article for spam-fighting advice, because the author seems not to have the technical knowledge to actually develop a solution, or even offer suggestions beyond never publishing unmunged headers.
To those of you who read the article, I feel your pain. You will never get those wasted moments back. But did anyone else cringe when he suggested using graphics to display email addresses in Usenet postings?
My thought is that people advocating posting graphics to Usenet with every post probably don't have a spam solution either. In fact, they're suggesting placing a higher load on NNTP servers, in effect doing the same thing to news servers as spammers do to mail servers: clog them with extra, unneeded garbage, reducing their overall capacity with respect to legitimate communication.
Oh, and have a nice day, everyone!
Somebody get that guy an ambulance!
Hey I want to receive spam. It is my right, as a citizen of the United States. Who are you and what authority do you have to deny this right of mine?
I think spam is informative and it informs us of new products, interesting mortage oportunities, good deals, pyramid schemas in which if everybody participated we would all be rich (except the leaf nodes) and other goodies.
You are Facists.
Anti-spam legislation is a bad and wrong-headed solution to the problem of spam. Filtering is a stop-gap measure that doesn't solve anything.
The key is this: Spam is already illegal! Even entirely ignoring vandalism and theft-of-service, when was the last time you got spam that:
1) Had a legitimate and correct return mail path
2) Actually honoured an 'opt-out' request
3) Advertised a legitimate product
In other words, nearly all spam is fraud, and should be prosecuted as such.
We have laws on the books against fraud, theft, false advertising, and vandalism. The only thing that makes spam even remotely different is the question of jurisdiction, and even that's pretty easy--if the spammer is in your country, you should be prosecuting him.
Now how do we get the government to act? Simple--just believe all of the return email addresses on the spam. If I get 30 messages a day that claim to be from hotmail.com addresses, then I'm going to send them all to hotmail. Either they really are hotmail users (no chance of course, but they'd be kicked off if they were), or someone is illegally misrepresenting themselves, and defrauding hotmail to do it. Hotmail should be getting tens of thousands of reports a day from dutiful citizens, until they start to go after spammers stealing their domain name.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
If the government were to mandate such a change, how many would consider this an unspeakable blaspheme to freedom of speech?
How many would write their congress person?
Spam has to be stopped at the source. Do these libertarians not understand how much bandwidth goes wasted? I'm getting tired of their incessant anti-tax initiatives at the local government level while they barely pay lip service to the excesses of the federal government.
Please don't bother your Congressmen or Senators proposing legislation that might not work 100%. Just keep on filtering the spam I send you, I know you would have never bought from me anyway. That you can filter legitimizes my business and my waste of your bandwidth.
P.S. To be sure of not getting a false positive, be sure to send all filtered mail to a special folder. Waste your storage space storing the mail until you manually go through every piece to be sure you didn't accidentally filter something important. Of course, this will take exactly as much effort as it would have to just check the e-mail when it first came in, not to mention the extra effort spent in setting up the filters and the extra space for storing your incoming spam folder, but what the heck. If you think that you can scan e-mail for false positives faster this way you are just fooling yourselves, if you are scanning faster e-mail that you expect to be all spam, you will miss the very false positives that you think you are looking for. And any fales positives that you do catch will have been delayed, perhaps days or more. You geeks enjoy wasting time this way, and I certainly appreciate it. It makes the work of all us spammers much easier. After all, slashdotters like Moderation abuser tell you that Bandwidth is cheap, disk is cheap, CPU is cheap , which is good, because at the rate spammers like me waste it the costs still adds up. I am gald I never pay for it, and I would just as well that everyone else takes the additude that all of the resources I waste are cheap than band together and pass laws against us. No one should care about spam because Bandwidth is cheap, disk is cheap, CPU is cheap and it is your job to filter it.
Think you've seen this before? Don't complain. Just go through lots more work to set up special filers on your computer so that you will not see it again. Crawl into your holes, let us attack the real problems we have in getting our spam to the clueless marks that will respond. You should have to do that. It's the true geek solution, and I would really like it if you did.
And don't pay any attention at all to the fact that those anoying telemarketers suddenly topped calling you two days ago, not because you wasted time and money getting caller-id and setting up systems to filter them out, but rather because the do-not-call list became law. Heck, in my case, even those annoying calls where someone who hang up as I answered, which used to happen several times a day, completely stopped. But just recite that laws can't work, the end user must have their bandwidth wasted and go to extra work to filter their spam themselves. How else can spammers count on reaching the sheep who don't filter their mail and will respond to our great offers?
No Karma is given if one is modded up "funny".
notice the standard libertarian assumption that, if you (a) aren't a libertarian and/or (b) want gov't action against ________________ [fill in the blank with spammers, in this case], you are a person without a sense of "personal responsibility." notice also, the standard libertarian assumption that, as a libertarian, the author is a cut above the rest of us "schmoes."
the fact is, spammers are thieves, stealing services from bandwidth providers. it's not clear to me why the author of this piece, and libertarians in general, regard this behavior as something that can be stopped if i display "personal responsibility" on the internet. it also is not clear just what that actually means, but never mind. and it is not clear exactly why they are less than eager to legally stop this behavior, but my suspicion is that it is because spamming is a business; and libertarians just can't bring themselves to take serious action against that "entrepeneurial spirit." if you're doing it to make money, a libertarian will bless you for it.
i'm dubious about laws against spammers, because i think they will be ineffectively administered. it's not that the technological means of tracking down spammers don't exist, it's that such a process would be time-consuming and expensive. i think that prosecutors just don't want to invest in it. that may be a necessary decision -- funds for attorneys general are not unlimited, and they have to deal with rapers, murderers and wife beaters, too.
i think a bounty law, that would allow individual citizens to bring spammers to book, would be more effective. imagine forming a company comprised of some technically proficient individuals, lawyers and maybe accountants, who working together could track down big-money spammers and present all the technical, legal and financial information about the spammer to a prosecutor, in exchange for either a state-sponsored reward or a percentage of the seized property.
that would rule.
mp
"The secret to strong security: less reliance on secrets." -- Whitfield Diffie
Good subject line.
... Libertarians give Libertarianism a bad name. They don't want a solution, they want a sort of quasi secular/quasi religious vindication for everything. (Side note: said leader also ststed in his monthly newsletter that if it would have been the "old days, before gov't intrusion, we'd have settled it with pistols! .... say WHAT???)
Libertarians in my area (Greenville SC) are nothing but whacko anarchists. Their leader is often engaged in vigilante justice.
A few months back he COMPLETELY "ruined the peace and progress" of an anti flag rally by pushing a black guy out of line. (Anti flag = no civil war flag/ACLU/Jesse Jackson issue)
This "leader" of the Libertarians has also sued my business over service - he bought a computer from me - then tried to hook a Parallel printer into the SCSI port - fried the computer - then wanted me to replace it under warranty. He later came on the 6 o clock news stating that it was black judge that handed the decision out because of his "push" and took no consideration of the facts. So, I agree
Yell & scream & rant & rave... it's no use... you need a shaaaave ~ Bugs Bunny
Put your company's name in Spam, pay a million dollar fine per day.
Spam stops. Simple. Straight-forward. Effective. Needs no tech to implement at all.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
We don't need laws specific to spam. We need laws to be generalized to stop any unsolicited communications that are forged with the intent to deceive the recipient.
Keep the Classic Slashdot.
those stupid chain letters tht friends and family members are forever forwarding to you. You know the kind...sent to so many of your friends for "good luck" or some such shit. I dont know why people forward that crap.
SELECT * FROM User WHERE Clue > 0
0 rows returned
gullible old people? i'm serious. most of the people i know are already combating spam through technology and other methods. keep in mind that the main target demographic is people who cannot figure out that it is spam, and wouldn't know what to do with it anyway. if you can figure out how to reach them, then your idea might work.
You Might Be An Anti-Spam Kook If...
Source: Posted to IETF mailing list by Vernon Schryver.
you cannot name several potentially fatal flaws in the UFPSTTSP.
So, again those liberarianiscts are at it again. ...... .... .....
Let me see. In between (in no particular order, go to item 1000):
1) Working my day job
2) Doing my non-day consulting work
3) Doing occasional committee and club work at my son's school
4) Studying the insurance market to try to understand how I can get the best plan and lower premiums
5) Reading the business papers daily to figure out where the economy is going and where I should be
6) Volunteering for my favorite political candidates (still a democracy somewhat)
7) Reading the general news to stay ahead of where the macro social and political things are and are headed
8) Maintaining my German by reading turn-of-the-century novels
9) (No car, thank heaven so no need to bother about all that!)
10) Studying the fixed income markets and the mortage sheets to figure whether to refi again or not
11) Contributing to Open Source discussion groups
12) Studying and paying my bills
13) Reading my personal email (including Spam that gets through/is only suspicious)
14) Helping my wife with her work VPN and other home technical projects
15) Helping all my friends with all their technical problems
16) Writing contracts for various construction projects in my house
17) Studying the wireless market for the best cell phone deal (with this item i can start thinking about shooting myself...or others)
18) Studying the POTS market for the best POTS service
19) Studying the Cable/DSL market for the best high-speed data service
20) Studying the Disability Insurance market for the best coverage/premium
21) Studying the home-care/nursing home market for my father
22) Talking to my father everyday
23) Visiting my father 100 miles away
24) Reading Slashdot
25) Maintaining my website
26) Reading (some of) the handful of technical journals I subscribe to
28) Installing and working with some relevant new technology I've found
100) Learning how to pick and choose among drugs on an unregulated drug market
101) Trying not to get poisoned again from that Salmonella-contaminated beef from the supermarket
102) Protesting at all the automobile , electric power generators, mining, chemical, plastics, battery, consumer goods, etc. companies to get them to stop making my immediate environment barely livable for organic life
103) Trying to get a signal from that underground radio station in our community to get away from Monopol Communications programming
1000) Fight spam on my own
Rapidly become a monopoly?
kartune85 : Incapable of reason, observation or learning. A kind of dim, drab, flightless parrot.
Let's see... the big ideas that they gave us were: ... uhh, there was no #2.
#1) Don't put your email address on web pages.
#2)
Aside from that, the article pointed out that it's relatively cheap to delete spam. Excuse me, is this guy a spammer during his off time?!?
Quite simply, I *don't* post my email address to web pages. Somehow, or other, the spammers get ahold of the email addresses anyhow.
Here are some other ways: (1) You ISP sells your email address. No kidding. I have one email address, .omnitel.net, for which I suspect this is true, because the spam started rolling in immediately, and did not stop.
(2) Some friend's email provider sells recipient email addresses. This is another one. When some of my acquaintances got a certain famous webmail address, because it practically was part of the OS that they got and was free like mail.yahoo.com, it took one email from them, and the spam started rolling in.
(3) Some friend of yours fowards one of those semi-viral human-engineering emails "to all", and then another friend forwards it "to all", and some spammer down the line, who let that little wormie go, reels in fish after fish just by processing the thing. Oh, you can tell those friends, "please, please, PLEASE don't send this to me". But the next time he/she runs across another hyperfeminist laud, or something says "don't let another person die! Forward this TO ALL with headers attached!", why it comes your way. *sigh*.
The only way we'll end spam is having a penny-per-sent-email charge. If my ISP started doing this, and billing me that 1 cent per email, but also billing all other ISPs that sent email 1 cent (and blocking those that didn't pay) I would thank them from the bottom of my heart. Of course, when my business email didn't go through, I would call my business contact, give them the address of the free and open-source automatic accounting software, and tell them "have your ISP start this up, and spam will stop. Don't, and your emails won't get through." Very quickly, we'd pay the 1 cent per email charge, and find that those who paid got their email through; those who needed it to be free wouldn't.
Meanwhile, I'd only get spam that was worth more than a penny. In other words, I'd get spam that most people would be reasonably likely to buy.
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
"New laws will simply be circumvented"
/. just a little while ago, they aren't that intelligent. I'll take a law that gets some spammers fined or jailed.
/. and you'll see how little money it takes for a spammer to continue.
Right. Laws are useless. Bad guys will just get around them. We shouldn't have any laws. We shouldn't have any laws that aren't 100% perfect.
Judging from the interviews with spammers, an excellent example was in
"for example, can you apply your laws outside of the US and is the Internet a US-only thing?"
Simple, if you send spam while you are inside the US, then you have performed an illegal act. This will not cut down on people living in China sending spam to the US, but it seems that the majority of spammers are in the US.
"The big boys of the spam industry will not be affected."
So you say. Yet you offer no rational for saying so. Unless they move to another country, they will be affected.
"Everybody employs anti-spam technology. Spam doesn't reach people. People sending spam therefore do not make money. Spam stops."
Right. Even if every email program shipped with anti-spam software, spam would get through and people would reply to it.
Again, just read the old interview in
Instead of your ranting against laws, why don't you look at the actual law?
Opt-out lists are useless. All they do is provide the spammers with real email addresses which can be used in other spams or sold for a profit.
Opt-in is the only way to go. But with junk snail mail, you don't have to do opt-in. You can send junk to every address. But the sender pays for the delivery.
Don't just rant against laws. Make suggestions that can be implemented. Saying that everyone should use anti-spam software is not something that can be implemented. Everyone won't even use anti-virus software right now.
As the article points out...spam is here to stay and the only way it'll die is if people stop responding to those damn viagra emails. Why does it always have to be the case of one guy ruins it for everyone?
Anyway the best spam deterrent that I've discovered so far is this service called shadango.com that I started using about two months ago. It's frickin' solid. It enables me to check both my hotmail and students address from the same interface and my inbox has been virtually junk-free. Check it out....Jeff Lindl recommends it highly!
That's my two cents,
Jeff Lindl
expect any romantic stuff from there.
a part is here
I'd tell you the chances of this story being a dupe, but you wouldn't like it.
Laws like the ones that were supposed to get rid of shit like drugs? We all know how well THAT has turned out, don't we?
It's a shame that Libertarians are thought of as "wack-jobs" for believing in the concept of personal responsibility. How weak are people who need to depend on the government to protect them from every little inconvenience that comes their way?
I for one am tired of people who want to impose a parental government on the rest of us simply because they are too lazy to take care of their own problems. Giving people a little credit, rather than continuously telling them they cannot achieve anything without the government holding their hand, will empower them to learn how to take care of themselves.
"Ask not what your country can do for you." --John F. Kennedy
That is the true face of libertarianism my friends.
I'm sorry all you naive nerds have been bamboozled by these psychos. Don't feel bad I hear in the 20s lots of nice boys join the KKK never intending to help lynch anyone.
That's very naive my socialist friend... the libertarian response would be "get a gun and feel free to remove the pisser from your private property by any means necessary".
Isn't the real issue that we have poor cost metrics and service agreements on the Internet?
The cost of sending spam is virtually invisible to the spammer.
That's it, plain and simple. As long as 'one single potential customer' responds, it's 'Step 3: PROFIT!' (I know the spammer paid for the bulk mailer program, and pays for his/her rotating ISP fees, but the costs are effectively near zero.) But that spam wasn't really free, we all pay for it. Does anyone have a good estimate of how much Internet bandwidth gets wasted on spam? Or how much recipient time gets wasted downloading it, even if it is then automatically filtered and thrown away?
Today I pay a flat fee for my cable modem, and it carries certain Terms Of Service. Same back when I was on dialup. There is supposed to be an aggregate bandwidth cap on cable, but I never worry about it except when I'm going to download a new set of ISOs. There were dialup time limits as well, but in that case they were mostly worried about camping on the modem pool, not bandwidth usage.
Is it possible to come up with a more refined billing model that could effectively shift costs back to spammers without killing mailing lists?
The living have better things to do than to continue hating the dead.
Bad moderators, bad, bad, bad moderators.
Strange women lying in ponds distributing swords is no basis for a system of government.
It's so nice to read responses from the clueful.
It's just like the American (other countries aswell) war on drugs. You can never stop the supply as long as there is a demand. Spam will never be eliminated until it's not possible to profit from it.
UNIX/Linux Consulting
I know it sounds barbaric and cruel, but I truly think that until that happens the spam will keep flowing.
I mean put a guy in the hospital for a week and people will take notice.
Sure even then the spam won't stop, but I bet you'd see a drop off.
The major advantage and disadvantage of internet is that there is no red tape. There are no "form"alities and no way of procrastination. This is a boon and a bane both.
I suggest that a bit of bureaucracy be introduced by ISPs. If you want to send email to my customers,
(a) fill out a 10-page form in triplicate, one for you, one for me and one to pass on to law enforcement authorities should they need it. The form must be signed by a govt. officer above a certain rank.
(b) For commercial establishments, deposit a refundable amount of $ww,xxx.yy for the period you will be sending emails to my customers. The amount shall not attract any interest. The amount will be adjusted according to the volume of the email.
(c) All emails not from those who submitted such a form shall be rejected.
These provisions may be suitably modified as per customers' reactions and changed conditions.
This will introduce some delay and some red-tapism into the picture. Red-tapism is the best way to kill an enterprise.
There are numerous ways to know that a piece of mail is not spam, and we should use them all and accept them all.
1) Transitive trust.
a) If a PGP name server is known to contain links to actual people, then messages signed from that server are ok -- if they are spam, you can track down the sender.
b) if an ISP is known to enforce a no-spam policy, ditto.
c) If the HELO domain name resolves to the IP via a trusted DNS server (e.g., dynamic DNS from tzo.com), ditto.
2) white list
a) users, per user
b) ISPs, per ISP (I don't get spam actually mailed from aol.com anymore -- I think I can usually trust them).
3) challenge-response -- if you challenge incoming emails, surely you will process them when they arrive.
4) time-limited email address from web pages, combined with known-user databases. dr2chase+2003-10-03@etc will work for initial communications (from clicked web links) for only a few days, though anyone initiating an email exchange in that window can reuse the address as much as they want (this is to allow easy-click sending and correspondence from web pages).
5) hash-cash -- prove you solved a hard problem uniquely associated with this particular email, and you've proved that you cannot be sending too much mail per day. Therefore, you must not be a spammer.
The main point here is that ANY one of these methods can be used to show that a message is not spam. Mail receivers should deploy all of them, now. Mail senders should also get to work -- in particular, user agents should include "this will look like spam" sensers, so that they can ensure that legitimate messages do not look like spam.
The other half of the spam solution is to use "economic" punishment in the sendmail protocol. Don't ever reject email -- a clean rejection is cheap and fast. Hold the connection open. Delay before replying. Use that time window to gather information ("look, 100 incoming SMTP connections from the same source in the last 30 seconds").
Turning off your internet connection is not a technological solution. That would be a luddite solution. 'Bounce all emails to spammed addresses...' What do you mean by that? You mean I get spam at one email address and now I should bounce everything going to that address?
Yeah, you're right. You weren't even trying.
>
They really wanted to give it a libertarian twist,
no matter what, didn't they?
Yep, and as Libertarians they fail to recognize a few important facts: we've already give the state the power to control commerce, print money, etc. We have already given up many essential rights (how many pollutants have you ingested this morning) for business, etc. Yet when the grass-roots wants to make a change for the better suddenly its the old "personal responsbility" line. Its like they want to freeze any politcal change but don't undertstand the history of the US is one of protest and change. Protest and change and the workings of a democracy will, in the end, be much more powerful than some hackneyed ideological position that citizens shouldnt be using government for their own end.
The internet by its nature forces us to share and be civil if we want it to last until the end of 2005. If the net or the rights of individuals are in danger then there is nothing wrong with try to bring about change. Heaven forbid people get together a launch a class action suit against those who have harmed them. Of course to the libbers the spammers theft of resources is an acceptable loss for the mantra of "personal responsbility." It seems only victims should be responsbile while spammers get a free ride. Replace spammers with big business or what have you and its the same philosophy.
Lastly, the "do you want your politician writing insert_type_here laws" is a pathetic straw man argument. Politicans are supposed to write laws, that's their job, if they aren't using the proper advisors or writing the laws you don't like then its a problem with that law not the system as a whole.
Also, I fail to see how one can be "personally responsbile" when dealing with mass-mailing not even targeted at you. Because x amount of people are willing to buy penis pumps, something I cant control, I will continue to get spammed. If I dutifully delete spam and report spammers I still get spammed. The very reason, if not the only reason, so many want legislation is because the personal attempts have failed to bring about change and the libbers assumption that we're all a bunch of "run to the nearest authority figure" kiddies is dead wrong. Anyone with 5 minutes to spare on google would know how spam works, the damage it does, and why its so hard to stop.
Rather than doing the research or caring about the issue the libbers are just using this to get their marginalized views across and hey it worked, they're on slashdot.
No way to filter that crap till I have spent 5 cents printing it. Or phone spam during dinner time or any other part of the day.
Nope, have the government make it illegal & put the bastards in jail.
None of this opt-out crap either. If I want spam I can damn well opt in.
Now if only we can get rid of the snail spam the Post Office insists on shoving into my mailbox.
If someone is urinating on your property, that's an actual initiation of force, and hence a legitimate use of government to solve the problem. It is not easy to argue that spam (and junk snail mail for that matter) represents an initiation of force. That is the root of the issue for Libertarians: the role of government is to protect the citizens against the initiation of force, and nothing more. Why? Because concentrated power is the most dangerous force that exists in the world -- it needs to be strictly limited, not expanded to "solve" every concievable social problem.
The argument is not "shut up and deal with it" as the above post would have you believe. The argument is that spam does not represent a true initiation of force, and thus it is not a legitimate use of government to solve the problem. The analogy presented above is a nothing but a typical, predictable, childish evaluation of the Libertarian argument, one which completely ignores the basic principles which guide the Libertarian philosophy.
Not sure if this has been suggested before, but rather than all this expensive signing and encryption, why not just have each MTA append its IP to an X-header of every message before it goes out the door? The receiving MTA would check the header, verify that the message it received was, indeed, from the last IP in the X-header list, and either deliver the message locally or append its own IP and forward the message on.
This would not prevent spam initially, but it would provide traceability for a message. Spammers would be required to put their real IP on a message to have it delivered, and since they have no control of the message after it leaves their MTA, a clear trace is left back to them.
No, this does not prevent open relays from being a problem, but it would sure make them easy to find.
Inexpensive, clean, and relatively easy to implement on top of SMTP. Of course you'd have to get large ISP buy-in, but any sort of spam-killing is really in their best interest if only from a bandwidth point of view.
In the beginning, rather than blocking messages without this header, a warning could be issued to the involved parties informing them that they really should upgrade to an MTA that supports this extension.
Clear identification is the spammer's achilles heel. Exploit that and we'll be a lot closer to getting rid of spam.
-S-
is that fighting spam requires considerable time and resources. Putting a lock on your house is simple, and when criminals circumvent that lock, there is a punishment for that. Spammers are free to find all kinds of ways to get around your attempts to limit their intrusion of your space. I don't know the answers, but creating laws that punish this sort of behavior can only help people fight spam on their own.
taltimus
That's another advantage to my proposal that the laws should be focused, not on spamming per se, but on the use of filter-circumvention techniques (which should be prohibited just as other forms of computer cracking are prohibited).
The distinction between spamming and normal e-mail is sufficiently fuzzy at the edges (e.g. what constitutes "bulk"?) to give your position a grain of plausibility. However, a mailing that is tailored to get past spam filtering (e.g. forged headers, munging of "spammy" words) is equivalent to lock-picking one's way onto other people's property, and as such is a clearcut initiation of force.
/. If the government wants us to respect the law, it should set a better example.
This is really the only answer. Currently it's not against the law to send email with forged/spoofed return address. If I started selling stuff over the regular mail using someone else's name/address, I'd be arrested for mail fraud. That's all spam is, after all, and should have the existing laws covering fraud modified to apply.
I've always wondered if there isn't a good aproach to attack Spam using some kind of "distributed anti-spam" software - based on the fact that each spam message is sent to millions of recipients. If one (or 10, or 100,..., to prevent fraud) of the recipients would mark the message as spam, the MD5 hash of the message body would be added to a central spam list, and all other clients receiving the message could just compare it against the list, see that it's spam, and - flush- there it goes.. ;-) ). ;-)
This should efficiently kill a very large percentage of spam to ever reach the end user (that is until spammers find out how to make each message they send unique
has anyone ever tried something like this? --hmm.. otherwise I should patent this idea
Can you DDOS the spammer? If each spammed mail server contributed it could be a large attack. If mail can be identified as spam soon enough that you still have their IP (or still have the connection) could the mailserver start sending traffic back down the pipe? As they send millions of spam the traffic back could explode and call great attention to the spammers activities, maybe even interrupt the operation.
Spam is a non-violent a crime that has no effect on a huge portion of the population (people who are too young to be on-line, those who have no interest and those who can't afford to be on-line).
Jails cost a fortune. I have no desire to see one penny of my tax dollars spent jailing a spammer.
The libertarian view is that we should wack the stupid consumer.... that fraction of a percent that actually buys something from spam.
There is no way you can change a stupid fool into a less stupid fool. Legislation, education and simply calling them names won't make Bob a brighter boy.
There is a way to stop clever spammers: wack them with civil lawsuits. While we are at it, we ought to take ANY business that uses SPAM (yes, there are a number of legit businesses that pay for their spam) and wack them, too. I'd say 1000% sales tax on SPAM profits would be a nice start.
This is clearly the proper case for civil causes of action that simply destroys the finances of spammers. Take 200x what they make from spam and make it stick. Deny them bankruptcy relief and put them out on the streets. Take their children away as they are clearly unfit to raise civil citizens.
Refuse to give them any social benefits - just toast them. If we grind up a dozen or so we will get the message across. Most of these people are US citizens and are easily within the reach of US civil jurisdiction.
Just look at what major civil judgments did to the KKK - thanks to Morris Dees and the Southern Poverty Law Center.
Finally, as the election season starts again, remember that the political SPAM is protected 1st Amendment speech...so don't vote for the SPAM candidate - whoever goes SPAM first should be buried in old AOL floppies! But beware the political dirty tricks...we will see SPAM that comes from the opposing side masquerading as the candidate's ad --
This may be the 1st US presidential SPAM season.
I agree that the spammers main vulnerability
is their need for anonymity. ( In fact several
of the largest well known spammers have been
harassed and even received death threats. )
I disagree that signatures are needed. Instead
start a compaign. Provide software ( for free )
to people that scans saved mail messages and
1) Checks if the source is an open relay
( generally by checking for particular relay
software ). It then looks up the ISP of the
relay and notifies them.
2) Parse the header and lookup the ISP.
We then need the cooperation of the ISPs,
but most ISPs are being hurt enough by ISPs
that they will be willing. Any ISP that doesn't
cooperate will be blacklisted.
There will be people hurt by this: the idiots
that let their machine get hacked, or install
AnlaogX proxy or some other open relay software.
But these idiots are making a mess of the net
by letting their machines be used by hackers and
spammers. It's time to stop coddling people and
make them pay for their stupidity.
Charge per email, or develop a scheme to allow the reciever to reverse charges. THat would kill the economics of spam. THere is a reason why post offices require payment up front before delivering any snail mail. Email is not gratis, some one ends up paying. Let's stop hiding the costs.
putting the 'B' in LGBTQ+
1) Reply to spam, using your credit card. Do it via a couple of open proxies.
2) Refuse the shipment
2a) Select items that are 'electronic' - no shipping.
3) Dispute the charge, claim ID theft.
Its got $0.75 processing charges, its got chargebacks, its got 2 irresponsable parties (credit card companies and attitude about ID theft and spammers) Its got shipping charges.
I will say this....the killer pill idea - What a sadistic, nasty idea. Only the disturbed or someone who is an actual terrorist would do that. The + funny, not so. It should sit at +5 because, while a disturbing idea, even bad, disturbing ideas need to be heard.
KARMA! For each spam you kill, you get 1 point.
/. crowd.
Should work extremely well with at least the
Whistleblowers, cult critics, dissidents and people discussing sensitive subjects have a real need to keep their identities out of their email.
Today the strongest protection available is through chains of remailers, which carefully avoid storing records of where a message originated and where it's going next.
The best I can come up with is that any remailer that relays mail to the real network from remailerspace becomes the one and only signatory, and the rest of the world will blacklist it unless it's rate-limited to make it a bad way to send spam. Signing is easy since cypherpunk and mixmaster remailers are of course crypto-enabled.
There's a problem with rate-limiting, though. "Anonynmity loves company". High traffic is a Good Thing for a remailer because it makes it harder for an attacker to get any information about an individual message. An exit remailer could look for duplicates in its output and filter those as potential spam, but then spammers would just automate trivial changes from one message to the next.
If you're still tempted by the political approach, ask yourself one simple question: who is more technologically savvy, your average spammer or your average politician?
What an ignorant, assinine, ill-conceived, steaming pile of bullshit! You don't have to have expertise in something to make it illegal. The average pedophile knows more about how to lure children into cars than the average politician does. By the author's "logic", we should not have laws against child molestation.
The average junk faxer knew more about fax technology than the average politician did in 1991, yet politicians passed the Telephone Consumer Protection Act which banned junk faxes. The result: Junk faxes, which were following a growth curve similar to what we've seen for spam, have now been reduced to a tiny fraction of what they were when the law passed. It didn't require that politicians learn about fax protocols, computerized faxing software, switched telephone network protocols, printing technologies, or fax modems.
Speaking as the former network admin for a "Direct Marketing" aka "Opt-in Mailing" company, the industry is evil.
I've dealt with the hosting in China for the purposes of sending mail, changing ip's daily, thousands of domains, and the use of OpenSource anti-spam software in some very questionalable situations. (Using an anti-spam filter to 'review copy' to make sure its not going to be picked up)
And from all my experience, There's only one thing I can say. The mailers will get around what ever you do, be it state or personal. If you have an email account, regardless of the fact if you give it out, it -will- be mailed to. E-Mail addresses are a super-hot commodity.
Especially if you can get them with the opt-in information attached.
Think of it this way. You opt-in to company A, company A sells your address to Company B. You opt-out to company A. Company B doesnt care. Company B could have already sold your info to Company C, D and E.
Opt-out's are funny, they basically just prove that you're a real live person using that computer.. true spammers love to buy listings that contain those addresses, they dont give a crap if you opt-ed out, they just want live email addresses.
So in short, you want a spam free email account? good luck, do what most people do, create a hotmail account for a spam account, and have a real account that you use for real email.
I've seen databases of 35 million mailable e-mail addresses, and trust me, thats a highly profitable database (and no, i dont have a copy, so dont ask, heh.)
Welcome to the End
I assure you this isn't intended as a flame...which probably means it will end up being one anyway. ;-)
;-)
Forgetting all the practical arguments we should fight spam ourselves anyway at a philisophical level. We've seen what happens when government gets involved in telling us what we can and can't do on a day to day basis (DMCA, anyone?).
Legislating rules about the use of computers is not the brightest way to go about things. If we use the government and lawsuits to stop things we don't like, who is to say they can't be used to stop driving, or talking, or whatever. It's a bit of a stretch but it is a slippery slope when we get government involved in regulation especially of non-critical systems (not necessarily just computer systems).
Perhaps it's time to build a truley secure communications infrastructure with a transparent interface to the users. (i.e. digial sigs and public key encryption systems that are tack ons). Instead of trying to legislate away the leeches and looters of society lets just leave them behind and when they catch up again lets keep on moving.
There that's the end of my libertarian rant.
This is really bizarre. There are almost 300 comments on this item and no one has even mentioned Paul Graham's proposal for Filters That Fight Back:
The idea is to raise the costs of spam to the spammers, if not at the spam sending side, then at the spamwebsite side. Most spam solicits visits to a website. If a relatively small percentage of Net users were to employ Bayesian filters and/or other techniques to identify and segregate spam, then to accept the explicit invitation in each spam to visit one or more URLs provided, and maybe even download the entire sites a few times, the cost of running a spamwebsite server for the tiny numbers of orders they get would rise sharply.
I don't have it completely automated yet. I'm still using filters in my email client, but they are good enough that no spam gets through to my New Mail folder, and a whitelist ensures that there are no false positives in any mail from anyone I already know I wish to hear from. What goes to my spam folder contains a few false positives of people who have never written to me before, but mostly those whose email contains garbage like HTML.
Once a day or so I simply save the cleaned spam folder to a file and ftp it to one of my servers. There, scripts take over and faithfully accept the explicit invitations in the spam to visit their websites.
As more people do this, the traffic will dramatically increase at the spamwebsites, but orders will not increase. At some level or other, either in their server farm or to their upstream provider, those sites pay for bandwidth. As they get bumped up into higher bandwidth pricing tiers, their margins on the small numbers of orders they get from complete nitwits will drop.
Think of it as a servo system: If the level of spam annoys you, set your filter to fighting back. As more people do that, spam will level off and drop. As it drops to a level at which fewer people bother to set their filters to fighting back, an equilibrium will be achieved. There will still be spam, but a whole lot less than there is now. Think mosquitos and birds. Birds control mosquito populations. There are still mosquitos, but a lot less than there would be if there were no birds. Be a bird -- eat spamwebsites.
The weak point in Graham's proposal is that it really needs a universal whitelist to prevent spammers or other malicious third parties from causing massive traffic to innocent websites by sending out spam that provides URLs that are not the spammer's. It's not clear how such a whitelist would work, who would run it, how sites would get onto it (or off, if they turn bad), or whether someone will come up with a neat P2P solution.
It is clear, though, that anyone receiving 20-100 spams a day can easily review the filtered spams or the extracted URLs and simply delete those that appear innocent. Then scripts do the rest.
Look at the bright side: there's always seppuku.
About a third of the spam I get could be construed as some sort of sexual harrassment or lewdity that should represent an initiation of force, that should therefore be prosecutable. It's like someone making obscene phone calls.
The argument is not "shut up and deal with it" as the above post would have you believe. The argument is that spam does not represent a true initiation of force, and thus it is not a legitimate use of government to solve the problem. The analogy presented above is a nothing but a typical, predictable, childish evaluation of the Libertarian argument, one which completely ignores the basic principles which guide the Libertarian philosophy.
The analogy presented by the grandparent post is just frames the argument presented by the article within someone else's philosophical viewpoint. Perhaps the poster thinks that the "initiation of force" includes spamming, an "attack" which costs the victim time and possibly money, even though it does not involve physical force. Or perhaps the grandparent poster is simply more pragmatic, e.g. concerned with results rather than philosophy.
Either way, there's nothing wrong with bringing new viewpoints into the argument. There is no impetus for those people who analyze an argument presented with a Libertarian perspective to analyze the argument from that perspective. There is also no reason for anyone analyzing an argument to accept the author's assumptions. The grandparent post may well be putting down Libertarianism in general as well as arguing against the argument presented in one particular article. He has every right to do so.
The real guts of the UCE/Spam issue is the sale of email address lists.
People make money by harvesting your email address and selling it to spammers without your knowledge, consent or permission.
That's the industry that needs to die, so that the only people you can Spam are people who have provided you with their email address directly. No trading of "email address with our partners" unless you specifically PAY for that service.
Spam is the best example these days of the tragedy of the commons. Perhaps they should have read that chapter of their economics book instead of reading Ayn Rand in the bathroom for the 46th time.
The article points out one fundamental observation about the spam problem - people keep buying stuff from spam emails. I would like to suggest a somewhat controversial solution that nonetheless seems like it would be effective. I for one think that it is extremely difficult if not impossible to find a solution that will keep spam out. But we can stop spam forever if we destroy its market. ISP's have the ability (though maybe not the right) to discourage their users from responding to spam messages. If the return rate of users to spam drops by a few orders of magnitude, even the extremely marginal cost of sending email can destroy spammers' profit margins. I have a brief writeup proposing a policy and enforcement mechanism that is not without its concerns, if anyone is interested. spam.pdf
If spammers had to wade through millions of false requests to buy their products, then they'd give up too.
shut up, you smelly communist
Here's one possible solution to the problem of spam.
It's all fun and games until someone loses the key to the handcuffs.
It's going on my property without my permission.
Much like telephone calls.
The private property libertarians would probably
not say it's ok to trespass. How come it's ok
to spam?
Personally, I report every piece I get through spamcop.net - it's gone down in volume, but I still get more than the average bear. I also have my e-mail address obscured in various ways on my website, so it's not that, either.
Now, I know I pay for my e-mail. Any one with common sense knows it. Where is my ISP getting the money to run those servers and hire the support and admins for them? I pay for it at work because I know pay raises this year are lower, or even non-existant, because we need to keep the infrastructure up and running.
So, because of this fellow's delusional state, he is basically proving the case that we pay twice: once through our ISP bills, and numerous times through having to deal with spam.
If spam was something coming from the ISP and other providers we may deal with, and our bills came down accordingly, I could see his argument. But this is such a misguided, uninformed attempt to handle spam that I'm surprised it made it to the front of /.
Spammers are abusing. Spam is not legit advertising - that revenue (the vast majority of it, at least) is not making my access to the Internet free the way network television or broadcast radio is free. If the author of this article would like to come down from the mountains and live in the real world for a while, then he might get a clue. If not, please keep this waste of skin off /.
But that is exactly what it is. You use the "initiation of force" argument as if the only thing that matters is stopping other people resorting to violence. Somewhere down the line, the fraud and theft involved in spamming gets ignored.
Unfortunately, your argument is entirely based on the libertarian simplism that your are either fighting or cooperating and there's nothing in between.
And more unfortunately still, your reply is nothing else but the smug self satisfied name calling one expects from the self superiorising libertarian camp. Thanks for confirming the stereotype.
"You know you want me baby!" - Crow T Robot
Consider this: spammers will do anything and everything they can to make their emails seem like they're not spam. Until we achieve new milestones in AI (and perhaps not even then), your PC will not know whether an incoming email is a recommendation from an old friend who you ran into on the street, or an unsolicited "recommendation" from a paid spammer. We need a system for punishing email that lets the recipient decide which emails are spam.
Second, the only part of a spam that cannot be forged, spoofed, or hidden is the URL (or other contact point) of the web site advertised. Thus the only dependable way to punish the one responsible for the spam is to create cost for that site. This is as simple as clicking the link (preferably many, many times - an automated script would come in useful). This will drive up the hosting costs of the site, and drive down the percentage of site visitors who buy anything. While you're at it, you can throw in fake names, addresses, credit cards, etc. to further tax their payment processing system (anything that makes the site request an authentication from the credit card company would be a good way to push up their costs).
Right now, spammers enjoy a very low, but positive, response rate to their spams. Imagine if, for every idiot shortsighted enough to provide his credit card and contact information to a complete stranger with dodgy business tactics, there were several users who received this spam and loaded the site without any intent to purchase. Quickly, spam's economic equation would turn unprofitable. While a little bit of simple technology (a script that mimics a browser hitting the site a few hundred times) would help, you could also just repeatedly hit those links and ignore the content (might make for some interesting stories if an IT department sees proxy logs, but if everyone started doing it I'm sure they'd catch on, especially if you use a script that doesn't actually display the likely-objectionable content).
It's no panacea, but having 1% of recipients punish the advertised web site will be more effective than having 99% of the recipients filter out the spam entirely... and there's no reason that filtering and punishing couldn't peacefully coexist as anti-spammer tactics.
So stop hitting delete, and start clicking those links!
That depends on your definition of force.
I argue that spammers are forcing ISPs, and through them me, to carry unwanted and irresponsible traffic over our networks. That, it seems to me, provides all the justification the goverment needs to regulate this activity. Further justification arises from the nature of many of these messages, and the fact that virtually no effort is made to protect minors from them. While I admire the libertarians on some issues, particularly their stance on individual freedom and civil rights, I can't agree with their policy on limited governance, unlimited corporate freedom, and unregulated commerce.
(Score: -1, Stupid)
Sites with MTAs (mail servers that transmit messages) would add special "reverse MX" DNS records that give a list of all the valid IP numbers for their server. This is slightly different than a normal MX record, but I'm not going into the fine details (which I don't entirely understand anyway).
Upon receiving a message, the receiving server would do a lookup on that special RMX record for the domain in the From: header. If there is a response, the IP number of the connecting MTA must match one of the valid IP numbers which that domain says are its mail servers.
Like any change, it requires many sites to adopt it. But it's fully reverse compatible with existing smpt infrastructure. You'd think such a simple, backwards compatible proposal would be a "no brainer". (this is different from the existing practice of doing a normal mx lookup... see below for a link to the full RMX proposal).
For the sad story of resistance to any changes, no matter how compatible they may be with existing SMPT, start reading at section 12.4 of the Internet Draft RMX Proposal. This proposal is pretty well written and quite accessible to most people who know a little about SMTP.
For anyone who buys into the "we gotta implement strong crypto/authentication" arguement of the parent post (such as 3-4 moderators who mod'd it up), please take some time to skim through that internet draft... such as section 3 after having read the part at the end about the incredible resistance there has been to even such a very simple and compatible change.
PJRC: Electronic Projects, 8051 Microcontroller Tools
I'm surprised that one or several people haven't signed some or all the politians up for just about everything under the sun and made their e-mail's worthless. Think they'd get the picture and maybe get on the ball to get something passed as quickly as they got the do not call list stuff passed the other week?
Oops!
And people can deal with 1 or 2 spams getting through every day; hell we tolerate fliers in our mailboxes. But the majority of spam is easy avoid/filter with a little effort; enough that we don't need to call our government masters in to protect us.
"Ask not what your country can do for you." --John F. Kennedy
The response from an adolescent anti-authoritarian is "Get a bucket".
The response from a real libertarian is that the pisser is violating property rights, and should be stopped from continuing to do so and punished for having already done so.
/. If the government wants us to respect the law, it should set a better example.
- Cost == CPU effort == time == money
- Bulk email mailers cannot afford high cost
- Email that proveably cost something to send is likely not bulk
- Higher cost implies the sender believes in (or is targeting) the message
- Verifying the cost must be computationally trivial for the recipient
BACKGROUNDThe SHA-512 FIPS standard produces a 512 bit, cryptographically secure, (hence collision-resistant) checksum of a piece of data. When compared bit per bit, two random checksums will statistically share 50% of their content; ie: the expected number of identical bits in a pair of SHA-512 hashes is 256.
In short, it would require a certain amount of EFFORT to find a pair of strings, that when SHA-512 hashed, deviate significantly from sharing 256 bits. This CPU effort is the cost involved in the proposed scheme. The more effort one is willing to make, the more likely one finds such a pair with a high deviation. However, verification of this deviation by the recipient only involves computing two hashes and counting bits.
DETAILS
The proposed system would work with older mail clients, requires no cryptographic keys or PKI infrastructure, and can easily be adjusted for "inflation", ie: the gradual speedup of CPUs.
The sender of an email precomputes the following (where '.' is the concatenation operator)e ct).sha(body))
X = sha(sha(sender).sha(recipient).sha(date).sha(subj
The sender subsequently produces a random string (alphabetic would be preferred, since the string will ultimately be embedded into the header information of the email being sent), and computes
score = abs(256 - matchingBitsBetween(X, sha(randomString))
The sender performs this calculation a number of times with different random strings, keeping track of the string with the highest score. The more CPU time the sender is willing to dedicate to looping and trying out different strings, statistically the higher the best score will be. At some point, the sender decides that either
(a) enough CPU time has been used, OR,
(b) the best score now crosses an acceptability threshold.
Now, the email is sent, along with a header item such as:
X-CPU-Token: iwpayzsk (+48)
The recipient, upon opening the email, extracts the sender's email address, date, subject and body information from the message, combines it with their address (which may be pulled from the header, or the email client), and computes:e ct).sha(body))
Y = sha(sha(sender).sha(recipient).sha(date).sha(subj
and
score = abs(256 - matchingBitsBetween(Y, sha(X-CPU-Token))
This score can then be used for filtering; scores above a user adjustable threshold could be put into a separate folder.
As CPU power increases, it may become necessary to increase the minimum score of the CPU token threshold. This would be done to thwart off bulk mailing agents who find it acceptable to calculate tokens with a deviation of 40 bits, due to what they feel is an appropriate use of resources. At 45 bits, it would take too much time to calculate the tokens for millions of emails -- until CPU power increases enough. It would then be recommended that users bump the slider in a dialog box up (to, perhaps, 48 bits).
RESULTS
A straight-forward C implementation of this scheme, running on a 500MHz Pentium 3 machine is capable of producing tokens with an average score of 48 bits in about a second.
Verifying the token upon receipt occupies a trivial amount of time.
I agree. We should just kill them instead. As cheaply as possible. Stoning? Drowning?
No, it's not -- both are deliberate attempts to circumvent a barrier that I have placed around my private property in order to protect it from unauthorized use.
(And what the devil do you mean "physically trying to hack your box to get an e-mail through"? Have spammers started resorting to black-box jobs to open people's computers and directly write spam onto their hard drives?)
The example you provided is easy to filter out as well.
I can only conclude that you are being deliberately obtuse. The specific example I provided is one of millions of possibilities, all of which must be detectable by a filter (without generating false positives from other ordinary phrases).
Even if I do have a filter that is up to the job, the fact is that the spammer is attempting to force his junk past my barriers (i.e. he is attempting a form of computer cracking or a form of breaking and entering, whichever analogy you prefer). Attempting to commit these offenses is itself illegal, even if you don't succeed, and properly so.
the majority of spam is easy avoid/filter with a little effort
The majority of would-be thieves are easy to avoid/foil with a little effort (don't forget to lock your doors, keep low-level windows closed and properly maintained, maybe install an alarm system).
In the real world, these measures are backed up by laws against attempts to circumvent them. If they weren't -- if crooks could work at your lock all day without having to bother concealing themselves -- people would need bank-vault security just so their stuff would still be there when they got home. The same principle should be applied here: combine self-defense with legal backing for self-defense.
/. If the government wants us to respect the law, it should set a better example.
The best possible means of controlling spam is to run one's own mail system(s). However, doing so correctly takes decent levels of skill in Unix-type OS's, TCP/IP networking, firewall setup and security basics.
I don't think it's at all reasonable to expect that all end users of E-mail have those skills. It takes considerable time, effort, and outside help, even for someone with lots of prior network and computing background (it took me about a year and a half), to become what could probably be considered a 'competent' SysAdmin.
Even assuming the right skills are present, one still needs an ISP that will (1), provide one or more static IP addresses on a broadband connection, and (2), allow their customers to be self-hosted. Such ISPs are, in my experience, rare at best.
It's well within the realm of possibility for ISP's, the big backbone providers, and domain registrars, to put a very serious dent in spamming right here and now. Some things they could all do include:
(1) For domain registrars: Be absolutely scrupulous about requiring accurate contact info in ANY domain registration. We're talking valid address, phone number, and contact name and E-mail addresses. VERIFY that information BEFORE issuing a domain registration. Considering that most spammers want to remain anonymous, this simple change alone would throw a huge wrench into spammers' gears.
(2) For ISP's: Stop hosting spammers NO MATTER HOW MUCH THEY'RE WILLING TO PAY!!! This is a big problem, as spammers are willing to pay serious $$ for ISP's to ignore their own Terms of Service.
There should be a universal policy of suspending an account at the first hint of a spam complaint regarding it. Once said complaint is investigated, the account should be immediately terminated, AND a substantial clean-up fee charged, if there is clear proof that the account was involved with spamming. If not, simply lift the suspension.
(3) For the big backbone providers (and they're the ones who could really help if only they weren't as indifferent as the former Bell System): ENFORCE your own Terms of Service! If one of the downstream ISP's they're supplying bandwidth to is infested with spammers, and does not seem interested in controlling the problem, cut that ISP's pipe fercryinoutloud! Tell them that the pipe remains cut until they dump ALL their spammy customers, permanently! If SpewSpewNet (aka UUNet) did this with even ONE of their big spam havens, I think it'd make a huge difference in the Internet's 'Quality of Life' as it were.
If the ISP in question goes out of business as a result, well, they have no one but themselves to blame for hosting network abusers and criminals.
Regrettably, I doubt we'll see any of the above taking place. Too much greed vs. too much common sense, and greed usually wins.
Bruce Lane, KC7GR,
Blue Feather Technologies
How about this: F.U.
Turning off your net connection is a perfectly valid solution. You don't NEED email, you WANT it. If spam is too nasty, just don't get any more. Find a new way to communicate with people. I hear telephones work pretty well.
Bouncing emails back is not impossible. Spamassassin doesn't bounce emails, but a similar solution could. Take spam labeled as such from spamassassin and send it back as if it bounced.
Crying "save us, Government" is just stupid.
What else is the "Colorado Freedom Report" about?
Or did some guy at WebSense just see "Colorado" and "Freedom" and think "militia"?
This article is just bitching about people who bitch about SPAM.
I didnt see a single new, practical suggestion to people for reducing SPAM.
Not really worth the read.
DO NOT PANIC
It has blocked over 5000 emails over the last 3 weeks for me. My email only gets what I want it to get...no message 'filters' that never seemed to work. It's a great serivice!
Kevin
The obvious, and simple solution is to punish the companies that benefit from the spam. Why has no one tried this approach before? Clearly, in any given piece of spam most of the contact info is bogus: the return address, the sender's name, and often the route it took to get to you. Without exception, there is one piece of info that is accurate: the conduit for your money. So, research this info and enforce the anti-spam regulations and what-not on them. Poof, no more spam problem.
In the article he pulls out of nowhere this sentence:
...
. Interestingly, "e-mail addresses registered at e-commerce sites, posted to online discussions on Web sites, or listed as the contact for domains in the WHOIS database generated little spam."
This is utter nonsense. I have been using dynamic email addresses and I think I have given out atleast 50-100 different email addresses to different businesses. The *only* ones that got spammed and I repeat
the *only* ones were 3:
1. The address used to register my domain with yahoo.
2. An address used to post on online discussion group at www.designcommunity.com
3. This address was never given out. This is my real ISP address which I havent given out to anybody.
Infact this address gets spammed atleast 20 times a day. Not a lot, but considering I never gave out
Anyway, whenever this address gets spammed I see a whole bunch of email addresses in the same domain.
So its quite obvious who the real culprit are and that these statistics are pulled out of thin air.
DO NOT PANIC
Ranting about laws that won't work is what makes good laws good, genius. Lose your condescending tone, you'll appear like a smart person if you do.
Are you Sarah Connor?
I have a friend that treats spam snail mail by ripping it to pieces and send it back in the return to sender envelope.
He just cost that company a postage fee and the time to open that envelope.
If everyone clicked into the web sites and started doing things that took the spammers time, effectively spamming them back, it would become less efficient.
If you send out a million E-mails and you get 100 takers, you have a profit. But if you get one million takers where all but 100 of those are just trying to cause spammers to spend time, such as asking questions, some types of spam would disappear.
There are some types of spam that you can't spam back so it won't work for everything. But if you get an offer to lower your mortgage rate you have to meet with someone. Spend an hour of his time and see how happy he is about that.
The Internet is full. Go Away!!!
It is not a technological solution, as your original post suggested.
Again, not a technological solution.
Please point out where I ever said that. The only thing I pointed out was that your 'technological' solutions, were, in fact, not.
I have 6 e-mail addresses.
I get spam on ONE e-mail account. Deliberately.
I DON'T get spam on MY e-mail accounts.
I DON'T use spam filters, neither personal nor
my isp's.
If I HAVE to fill out a form I use the damn spam
address and check it the next day.
I HAVE been on the net for over 10 years and I
will continue to shake my head and call you
folks morons until you get a clue.
testing out my trending skills
Politicians, by contrast, usually aren't dumb - they tend to be lawyers or doctors or other professionals who can be part-time politicians, and even the ones who are real-estate developers have some clue about business - but they are often making laws about things they don't understand, and about things that change faster than the law-making process can adapt. Some small fraction of them are great statesmen or philosophers, but the average politician doesn't depend on them too strongly except as a PR figurehead; great fundraisers are more directly valuable...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Is not anti-spam vendors, or people who make money on the few hits garnerned by replies (other than Symantec and Learning Tree, but that's a story for another time)
Rather, the majority of spam comes from suckers who bought into get-money-quick and be-your-own-boss internet marketing schemes. These poor schmoes in the US and Asia buy these kits, which may even come with rented rackspace out of the US to mailbomb from and proceed to splatter their wares to these double-opt-in lists in the hopes of making a return on their investment.
Of course, no one is dumb enough to buy any significant amount from one person. They'll keep hammering that list, getting more desperate, trying to "build a customer base" until finally they default on their hosting contract or whatever.
Meanwhile those marketing "gurus" walk away laughing all the way to the bank.
They get joe-credit-card-debt-schmoe to do the dirty work for them.
They don't have to spam or advertise. They just need good placement in google, which isn't too hard to come by these days. The lazy, the "entrepeneurs" will find them, and a fool and his money are soon parted.
And everybody else has to suffer.
It's not as simple as just ignore it, or don't buy the stuff.
Sleazeball marketing gurus will sell you the Brooklyn Bridge and promise you the moon, a 50% response rate if you just use THEIR NEW, IMPROVED SYSTEM
THAT'S THE PROBLEM!!!
And if anyone knows how to fix this, they get the Nobel Peace Prize, I swear to fucking god.
Fuck Beta. Fuck Dice
"Jails cost a fortune. I have no desire to see one penny of my tax dollars spent jailing a spammer."
I agree. We should just kill them instead. As cheaply as possible. Stoning? Drowning?
Electrocution with their own power supply. Right on the 'nads too! yeah! :)
The central idea behind reverse-DNS/MX proposals is to answer the following 2 questions:
1. Does a particular domain have a list of authorized IP addresses that are allowed to send out e-mail on behalf of the domain?
2. Is the IP address of the mail server that is attempting to talk to me on that authorized list?
The devil is, of course, in the details/implementation. (Can we do it without breaking older versions of BIND? What attacks is it suspectible to?)
Here's the (4) proposals that I know about (since I just went looking yesterday):
RMX proposal - No news on Mike Rubel's page since June 2003. Not much on the official home page either. The last published draft is June 2003.
DMP - Last IETF draft published Aug 2003 and expires at the end of Sep 2003. However, version 5 of the document has not yet been posted and the author(s) does not have seem to have a central site to check for news.
DRIP - Last draft was published July 2003, expires Dec 2003. I don't see anywhere a central home page to check for news.
SMTP+SPF - Last update was mid-July 2003. I'm not sure if there is an IETF draft being floated or not.
Wolde you bothe eate your cake, and have your cake?
Without the state to punish one for doing so, you need only identify the spammers, and kill them. Problem solved!
The big problem is that it limits your ability to use your current Internet connection to send mail from whichever personna is appropriate for the message, at least without connecting through the personna's email provider's outbound relay. For instance, my Mozilla mail knows how to be my main home email address, and my work email, and my Yahoogroups John Doe address, and my Yahoogroups address with my real name on it, and my old Earthlink email address that's 99.9% spam now (the rest is ISP announcements). If I receive something on my home email address and want to forward it to a subscriber-only mailing list that my work email address subscribes to, right now I can just send it as my work address. But if my company used RMX, and the mailing list checked RMXs, it would see that it came from my home ISP's mail relay and reject it.
This kind of thing is especially an issue for the big free/cheap email providers, who are the target for this kind of thing, because they're some of the most common forgeries, but they're also the ones you most often want to use for public addresses that you change when they get too much spam.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The thing I don't quite understand is why everyone complains so much about spam, the user brings it, most of the time upon their own mailbox. I have numerous e-mail accounts and the only ones that get spam are the accounts I have actually signed up for stuff on. If you don't want spam I suggest you not sign up for free vacations, porn accounts of the like. Once you have been added to a mailing list you're swamped but if you avoid signing up for the things you don't get it. A law probably will not be passed, we get solicited all day everyday in our lives, what make electronic mail any different? Nothing..... Spam is a way of internet life, for most spammers it is their only job and only source of income and all there money comes from you intially signing up for something you damn well know you are not going to WIN. -sk8
By contrast, it's the statists who whine about how the state ought to provide everybody with buckets. Ok, ok, so the Libertarians are actually more likely to be interested in the long discussion and recurring Internet flamewar with the statists than in actually fetching the bounty hunter...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I say that if every website changed to only display contact e-mails in a picture form, it would only spawn a new level of pseudo employment. You know how people used to get paid for having a stupid add bar open when browsing. Well someone could possibly call this quarters ($0.25) for e-mail addresses. There will be bozos out there that will have a new bar open that allows them to type in the graphical e-mail address they see and turn it into machine readable format and automatically update some master spam e-mail list. Basically spammers will pay people to provide them e-mail addresses from the graphics that are used to hide those addresses.
I never saw the point of getting paid to take up my desktop space, and won't see the point of this either. But if I can think of this I imagine spammers can too. Then again maybe I just gave them the idea. Doh....
Regards,
Ryan Pritchard
Fun Extends All Basic Life Expectancies
Now if we could only apply this thinking to CIPA (the Children's Internet Protection Act), which requires filtering of "all images" which are "pornographic" or "offensive". Not only can we not decide as a society where the boundry lies, but we're supposed make a computer apply HAL-9000-like judgement (which requires an emotional component) and use image recognition technology that is nowhere near that level of sophistication.
Fred
"A fool and his freedom are soon parted"
-RMS
I mean really, suggesting that we should KILL people who buy things from spammers out of their.. erm.. lack of confidence?
"ask yourself one simple question: who is more technologically savvy, your average spammer or your average politician?"
Ah the fallacy of petitio principii... It's a loaded question that assumes that technological proficiency is critical to solving the issue of spam.
And whether spammers are technologically savvy is highly questionable - hence the phenomena of "chicken-boner" spammers.
This guy is just repeating the usual libertarian litany. Okay, yeeeee-haaaww for personal freedom, boooooo to big gubmint. Fine, but the only practical advice he offers is to obfuscate email addresses on the web. That may work for a while, but email harvesters are just going to get better and better at deciphering common obfuscations. It will get harder and harder to fool them. Why bother?
"We need an internet culture that encourages spam killers."
Dude, we already have that culture. More than fifty million people signed up for the National Do-Not-Call list. It's no stretch to figure out that most of those people probably feel pretty much the same about spam. Given that level of public sentiment, banning spam seems to me a very legitimate use of the legal system, not a trampling of our individual rights. Sure, some spammers will simply move offshore. Many already have. But criminalizing spam will force them to hide in places where their traffic will be easier to block, and creating risk for their ISPs will raise the cost of spam.
who is more technologically savvy, your average spammer or your average politician
:(
That's a toss-up. I'd say the spammer wins by a small margin, but both are pretty sad with just a couple notable exceptions on both sides. What's worse yet is that the damage done by both is comparable as well...
Jobs? Which jobs?
You know for a group of people who generally argue for more freedom on the internet, the tables certainly turn when you people get annoyed at having to click a few times a day.
So what if it uses bandwidth? If you're just a regular guy getting spam in the US, the bandwidth you're forced to use by getting spam costs you less than a penny a year at most (look at the total possible bandwidth you could possibly use each month, in gigabytes, realize you pay 1 fee for any amount within 0 and that number, and calculate the byte/cost and multiply by the amount of bytes of spam you receive).
And those telecom companies who complain about spam and their own added overhead because of it? Well maybe they shouldn't provide service to spammers if they don't like it, just 'collude' to do something useful for a change.
But they probably wouldn't do that on their own, and do you know why? because the spammers are paying customers, and like it or not they still pay the telecommunications companies for their services (probably twice what you pay). So would legislation 'save' the companies money? Well it would save, as well as cost. Who knows what the exact numbers are, but we do know that the entire spamming industry would be brought to its knees, which would certainly put the costs way above the benifits cumulatively.
Oh and by the way, what's the definition of spam, anyways? Many, many things could be considered spam, including your boss asking you to work on sunday. Think about it, you don't want to work on sunday, but the boss is trying to buy your time off you for cash, and you *certainly* don't want the deal. Unrequested, unwanted, and a solicitation. Let's send your boss to jail.
We as a society are entirely too quick to jump into legislation when private solutions work fine (or could work fine). If you want your ISP to ban spammers, threaten to move to an ISP that does it already. That should change the opportunity cost of providing service to spammers a bit more in your favor.
I fear nothing but my government. Vote Libertarian.
Just don't think that you will be able to eradicate spam without governmental help.
True.
But, PLEASE PLEASE PLEASE don't think you will be able to eradicate spam WITH governmental help either, becasue that attitude leads to extra rules that only hurt the honest guy. Spam is here to stay. Deal with it. Can you define a legal line between unsolicited e-mail that you want versus unsolicited e-mail you don't? Until you can, Spam will live on. And it's NOT just that the mail was unsolicited. That's not what makes spam spam. If it was, then ALL e-mail conversations would be the result of spam, because someone had to the be one to send first, and that first sending was not solicited. And it's NOT just that the person sending you the message is a stranger to you. There are perfectly legitimate reasons to contact strangers via e-mail - such as asking a question about a piece of software to the person who wrote it, or following up in private e-mail to an interesting thread you saw in usenet.
Since there cannot be a good legal definition that separates SPAM from non-SPAM, the legislative approach is doomed to fail. Incidnetally, this is why the technological approach is also doomed to fail. SPAM filters are (and will always be) as unreliable as web porn filters - It either lets undesirable content through, or it gets overly eager and filters out legitimate content.
That is why I do NOT want anti-spam laws in place. No way, no how. If you want to accept the inaccuracy of spam filters, that is your decision, but given that filtering is inaccurate and unfair, it is a decision the recipient should make. It's up to him whether he can put up with that or not. It is NOT a decision to be made for you by legislation.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
Print out every mail they sent and force feed (literally) it to them!
However, there are friendlier solutions like Teergrube (google for it - it's German for "tarpit") which don't attack the spammer, but do respond to the SMTP protocol v...e...r....y...
Now, just because you shouldn't do active attacks on the spammer, that doesn't mean that you shouldn't have automated probing systems that check out any machine that appears to be spamming, report it to their ISP and/or blacklist systems, etc.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
"Explain this to me, I'm too lazy to run a few Google searches and educate myself." It's not as if the information on anti-spam techniques are difficult to find.
It appears you tend to respond "Ask Google" to a lot of Ask Slashdot articles. However, Google can't read your mind. Sometimes, the layman does not know the appropriate words to put into Google's query field in order to find relevant results. I myself have run into this problem. I'd ask Jeeves, but Jeeves doesn't seem to have much deep technical knowledge either.
Spam exists because it works
This means that one should approach reducing UCE by understanding how and why UCE works in order to attack those factors. This article seems to contribute to such an understanding.
Will I retire or break 10K?
The following law citations refer to laws in effect in the United States. Your jurisdiction may or may not have laws of similar effect. Nothing you read on Slashdot is legal advice.
he suggests something quite sensible about graphical email addresses on web sites
How is this "sensible" under section 508 of the Rehabilitation Act? Users behind non-graphical user agents, such as users with vision disabilities, cannot turn a picture of an e-mail address into an e-mail address.
I, on the other hand, open first contact through a web form that spambots looking for @-signs can't pick up but which remains accessible to anybody whose non-graphical web browser supports HTML forms.
Will I retire or break 10K?
because people still believe the myths of government effectiveness and usefulness. Look at what government involvement has done to the health care, education, and pretty much everything else it has decided to 'fix'.
/. willing to support legal action against the monopoly of Microsoft but also willing to bend over and let the power monopoly of the state screw their privacy in the hind end, all so we can see if it can solve the problem of spam?
The bottom line is this: When government decides to get involved, you end up with excessive regulation, cost, and you ultimately lose a little bit of your individual rights.
You don't even have to be a Libertarian to understand that the government is nothing more than a power monopoly. Why are so many people here on
Since everyone is talking about incentives, why don't we look at the incentives for people to be politicians. The incentives are power, fame, and $$$. Do you think anyone who is willing to throw away their privacy and move to D.C. on purpose is really all that concerned about solving the problems of the people stupid enough to elect them? Politicians are primarily interested in their own careers and $$$. This is why they spend so g-damned much of it, to the point that Federal Government spends approx. $1m every minute.
Politicians LOSE POWER when they solve problems, because their involvement is no longer required in whatever field they would theoretically have solved the problem. To retain power, politicians must constantly dig their fingers deeper and deeper into every issue they can think of, and they love it when well-intentioned but poorly informed people ASK them to get out their regulating gloves. Not only do they get to expand their power base, they get to be thanked for it!
The LAST thing free people should support is a government which only exists to monopolize power, money, and time.
Practically any approach is better than expecting the government to solve the spam problem. The best solution is probably not going to be found in the form of a single silver bullet but many lead bullets; a multi-tiered approach across all levels of networks.
Do you REALLY want people like Robert 'Cuckoo' Byrd and J. L. Ashcroft, Privacy Raider to have this sort of power over your online communications? Do you want to some day pay an anti-spam tax on your ISP bill?
I have watched the government reform itself and its programs every few years just to stay afloat, and I sure as hell don't want to pay for that sort of failure to be integrated into my inbox!
I suffer no spam (or telemarketing) problem because I am not too lazy to take measures to protect myself. Thus I know from experience that individuals working for themselves can eliminate the problem for themselves. For those who want to sit on their behind and have someone else (like the government) fix their lives, I would put forth this very appropriate quote from a Libertarian Party presidential candidate:
"Whatever it is in life you want, go out and get it. Don't wait for the government to drop it into your lap, you make it happen. You seize the day. Carpe diem!"
-Gary Nolan.
"The State is that great fiction by which everyone lives at the expense of everyone else." -Frederic Bastiat.
So how to keep the ability for people to use the net anonymously, say for a father-rape-support mailing list, while taking away the ability for people to use the same system for spam?
Ranting about the laws does nothing to improve the laws. Without offering alternatives all you're doing is ranting. Not to mention that he was wrong on whether the law would apply to spammers in America.
I've already given you some groundwork. I've shown you how email spam is different from junk snail mail. I've even shown you how opt-out would do nothing to decrease the amount of spam.
- goto www.godaddy.com
- register new domain
- use 100 email aliases (free with registration) to setup forwards such as:
- slashdot@mydomain.com
- creditcard1@mydomain.com
- bestbuy@mydomain.com
- porn@mydomain.com
- whatever@mydomain.com
- hand out aliases to appropiate company/person/list
- assign aliases to forward to your real email address which you NEVER give out
- sit back and let your email client filter everything
- If any spam does come in, you can instantly delete the alias and take whatever action you want against who sent it
I have been using this setup for over a year and I have NEVER had to deal with spam. Not bad for under $10 a year...:)An example of such a form can be found on my web site. It's a lot more likely than a picture of an e-mail address to conform to section 508 of the Rehabilitation Act.
However, for people on ad-supported web accounts without a solid form mail script, what solution do you suggest?
Will I retire or break 10K?
Why can't malicious hacker-geniouses turn the spotlight towards spammers? it can't be that difficult to piss them off in some way? How about spamm- err... email DOS'ing em??
-P
So if someone is pissing through our letterbox, the libertarian response is "Get a bucket", rather than stop the person pissing through the letterbox. My that's brilliant!
No the libertarian response to someone urinating in your physical mailbox in front of your house is to call the police so they can come and arrest the individual. Libertarians would also argue that as part of this individual's punishment he must make restitution to the owner of the letterbox. (i.e. he needs to come out and either clean it or replace it with a new one, or pay for someone to do the same). The libertarian response is not to wait for your neighbor to do something about it or to ask a politician to make a new specific law about urinating on letterboxes, it is take responsibility for your own problem and call the police yourself.
The point is that the law and politicians cannot solve all of life's annonyances and problems. Even if you vehemently disagree with the libertarian philosophy you would still be better off figuring out how to deal with spam on your own.
Stuart Eichert
Just a thought here: most spam has the sender address forged, but include (in the body) a real address for mugs////customers to order their rubbish.
Suppose we write a 'bot which uses known (eg Bayesian) techniques to catch spam, then sends an automated reply to that order address - with a forged sender, naturally. Said reply to be of the form "Bug off, spammer" or the like.
If such a device became widely used, the act of using a spam advertising service would be to launch a DDoS attack against oneself.
Ok, how about if several hundred of us actually decide to ORDER the crap in the worst spam (one comes to mind, which I get a dozen times per day, with a woman looking down a laughing guy's beach trunks). But, like, not pay for it, or use bad credit cards, or prank orders from Shirley U. Jest, or actually buy it and then file consumer complaints... something which will actually cost the spam company some real person time. Go after the 20% of companies sending 80% of the spam. No jury would convict us.
Gently reply
This spam buyer eradication program has already been going on for 6 months. Spam buyers are dropping like flies. Unfortunately, no media attention to date.
Gently reply
DO you have any idea how easy it can be to subvert all the cleverness of the spammer in hiding his IP and find it? You can't do this on demand for a particular spammer - but so what? They're all enemies, so action taken against any of them is for the good. Get a few proxypots going and you may be so busy getting accounts closed that you don't care which spammer you hit.
Just run a proxypot. You almost surely will trap spam, much or all of it will have been sent from the spammer's own IP. Ron Guilmette (Google for him, look for posts by him with the word Who's spamming" in the subject in news.admin.net-abuse.email) got over 100 spammers thrown off their ISPs in under 3 months using a network of proxypots to gather the data.
In addition I cannot describe the feeling of power you experience when you trap spam the spamemr thought would be sent through your proxypot. You rule him at that point. When you get back the email from his ISP saying he's ben thrown off you have the satisfaction of knowing you've caused a great deal of trouble for one of the scourges of the internet. Even if he gets a new account he may come back to your proxypot and try again to relay spam. Then you get anther opportunity to hit.
This could go so quickly that you'll pout because all the spammers were killed off before you had enough fun. Remember to nonetheless enjoy that moment when it comes.
If all relays acted like open relays but just too failed relay attempt and deleted them. This would make the search for open relays more difficult for the spammers.
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
Seriously. Do you realize how easy it is to break into most cars? I've locked my keys in a car at my house and manufactured a slim jim in 20 minutes, out of crap I had laying around, and was in the car three minutes after that, despite never using one of them before. (The secret is that you're sliding something forward (I think it was forward.) with the slant, not trying to 'hook' something and pull it. Took me two and half minutes to figure that one out. Next time I read the directions.)
And while I've never tried to hotwire a car, I can't imagine it can be more than an order of magnitude harder. Stealing a car is easy, and 'Gone in 60 Seconds' isn't just the title of a movie.
The main thing that stops cars from being stolen is, basically, laws. Laws against car theft, laws making theft harder, and laws making the results harder to sell.
And, by and by, car theft is not a problem. Sure, cars are stolen, but you do not normally expect to come back and find your car stolen, or really consider it a likely possiblity.
Pretending we shouldn't have laws against car theft because, after all, we have keys, and Lo-Jack, and car alarms, is stupid.
If corporations are people, aren't stockholders guilty of slavery?
1) Give convicted serial killers e-mail accounts for a couple of months, but force them to use MSN or Yahoo.
2) Give these same serial killers a list of 20 known spammers' home or business addresses and set them free.
3) ????
4) We all profit.
"Call the police"... So the police aren't government? And what happens when the police tell you they can't do anything because pissing throught the letterbox isn't illegal?
"You know you want me baby!" - Crow T Robot
SpamCop.net Reporting Service can do much of what you ask.
Will I retire or break 10K?
Actually, perhaps the only legal solution worth pursuing would be making PURCHASING from an email advertisement illegal (from companies you do not have an established business relationship with).
Then set your little trap, and prosecute/fine anyone who responds.
The cost shouldn't be on people who don't want spam, or ISPs whose bandwidth is abused, or the companies using it (it's a legitamate, if annoying, business practice), especially considering how easy it would be to destroy competitors by advertising for them. Put the cost on those actually creating the demand and revenue for the system.
When a spammer is located, serve him with a court order demanding he turn over all records of people who have purchased from him (so long as they have these laws, might as well use them constructively - if the RIAA can, why shouldn't the FBI?). Send fake spam (it'll cost in bandwidth for a while, but once people start dropping like flies, the need for it will decrease significantly).
GL
Aside from the fact that unsolicited commerical email is content based discrimination (being commerical -- unless you think it should be illegal for there to be ANY unsolicited mailing, such a friend mailing you without being invited to)
How about banning unsolicited bulk e-mail? Would this be considered content-based or content-blind?
Will I retire or break 10K?
speech is something that humans do, not companies. "commercial speech" is a contradiction.
Not necessarily. Some people are self-employed. Thus, an individual can produce "commercial speech" without going through a partnership or corporation.
Will I retire or break 10K?
The Spam Blog Of Shame.
...and waging chemical warfare on your own citizens.
For this to happen, PGP/GPG needs to be trivial to use, and integrated into mail. Defaults such as adding someone to your address book gives a basic level of trust (overrideable) would be good. Once this happens automatically, a web of trust would be able to grow rapidly; one could even develop trust databases (which would have to be secure in turn, and would rate one another).
Trust should be two-dimensional. Lack of knowledge needs to be distinguished from knowledge of untrustworthiness, as the most-trusted route could include "mugs", or those who have not yet been conned by someone.
Wikileaks, no DNS
Check out www.cloudmark.com. Community action is the foundation of this soluiton to spam. Individual end users do a much better job of saying what spam is and filtering it from their collective in-boxes than any politician will ever do!