SendMail CTO Sounds Off On Spam and FTC

CowboyRobot writes "Eric Allman takes his well-deserved turn in commenting on the state of spam, the dark future, and the need for intervention. He calls spam an "arms race" where "in the long run everyone loses (except the arms dealers)." As you might imagine, he's on our side, and he does a good job of clearly describing the current state of spam, and the possible solutions."

Comments

Arms dealers?

[BiggerIsBetter]

Isn't he one of them?

Re:Arms dealers?

[mirko]

According to the submitter : "As you might imagine, he's on our side"
So I guess he -at least- wants us to feel ok about him.

I like the idea

[Transient0]

of the do not spam registry that they mention in the article. But it seems like a real pipe dream considering how much trouble there has been getting the do-not-call registry up and running.

Also, most telemarketing is done from in-country because of LD charges. Not so with e-mail. It's pretty hard to enforce US laws on a Taiwan spamhaus.

Ah well, every little voice against spam warms me a little at least.

Re:I like the idea

[Nuclear Elephant]

The do-not-spam registry will not work primarily because A. spammers are already breaking the law to spam, and B. it's easy to set up an offshore spam factory outside the US to send spams. Unlike telemarketing, where making phone calls to other countries is too expensive, it's fairly cheap to bypass legislation and spam outside the US...not to mention a do-not-spam registry is stupid in the sole fact that it gives spammers a huge list of millions of VALID email addresses - doing their job FOR them.

Re:I like the idea

[Anonymous Coward]

If only it was Taiwanese spam that flooded my inbpx everyday. I mean their teen sluts are far more appealing than the American ones and the quality of the Viagra is far superior.

Seriously though. The bulk of spam originates in America.

Re:I like the idea

[Nuclear Elephant]

The bulk of spam is in english - you can send english spam from taiwan (or anywhere else) if you want. According to the last spam tech I spoke with, a lot of spammers are using algerian domain names, so actually setting up a box outside of the US is just the next logical step in the progression. How would you like to go to all the trouble of setting up a do-not-spam list, collect literally millions or possibly a billion addresses, and then have one spammer set up operation outside the US? It makes it all not really worth it.

Re:I like the idea

[capoccia]

The bulk of spam is in english
actually about 1/2 of my spam is in russian and 1/4 is in some asian language.
i only speak english.

Re:I like the idea

[Anonymous Coward]

Seriously though. The bulk of spam originates in America.

I used to tolerate spam when it was 1 or 2 messages a day with clear and concise sales pitches and points of contacts (even 1-800 numbers!), but these days spam accounts for at least 95% of my incoming e-mail per day. I guess I have to face the facts and abandon the e-mail address I've been using for around 10 years now. The trouble with all the spam I'm getting is there is NO clear way to contact the spammer even if I wanted to buy their product (which I don't). They either write their entire message in broken English to bypass spam filtering or their entire message is in Russian or Korean. Thank god for spamassassin... otherwise my inbox would be unusable.

Re:I like the idea

[Nuclear Elephant]

Da? Well case in point then.

Re: I like the idea

[gidds]

The bulk of spam originates in America.

Even if this were true, how does that help us spam-sufferers living elsewhere?

Re:I like the idea

[Transient0]

Seriously though. The bulk of spam originates in America.

Personally, I don't buy that that is true, but it's completely irrelevant to my point. Even if most spam does currently originate in America, if the U.S. somehow passes and enforces an effective anti-spam law, there is effectively zero cost involved in these spammers moving there business out of the States and still spamming Americans.

The same is true for any country that illegalizes unsolicited e-mail.

This is one reason (among many), why spam is much harder to control than telemarketing, the fact that telemarketing from another country is expensive.

Re:I like the idea

[phannah]

Long distance isn't an issue, considering most telemarketing is done by a few large, international companies. Being so, they have made use of the latest technology, VoIP over Satellite in South America for instance, which makes international long distance a concern of the past.

As far as Spam goes, it comes from everywhere, but what I've noticed lately is the biggest lot that gets through my ISP's filters is in Cyrilic, which sounds to me like a design issue, but, I could be wrong.

Re:I like the idea

[aborchers]

Even if most spam does currently originate in America, if the U.S. somehow passes and enforces an effective anti-spam law, there is effectively zero cost involved in these spammers moving there business out of the States and still spamming Americans.

As much as I find balkanizing the network to be philosophically repugnant, there is a second step that is not often discussed in the context of US legislation against spam.

Once spam is banned in the US, we (the network operators) have to block traffic from netblocks assigned to countries that are friendly to spam. The legitimate business and communications needs of those countries will then drive them to enact their own anti-spam policies to get off the block lists. If their only need for the network is to send spam, then they will soon find themselves isolated and ineffective.

I don't like it, but to me it looks more and more like the lesser of evils...

Re:I like the idea

[stilwebm]

The do-not-spam registry will not work primarily because A. spammers are already breaking the law to spam, and B. it's easy to set up an offshore spam factory outside the US to send spams.

If the do not spam registery, as proposed by at least some lawmakers, penalizes the beneficiaries of the spam, then the true source will still be subject to the regulations. Sure, some offshore businesses will continue to spam, and some big guys may move off shore, but it really will nullify many of the cost advantages of spam. Few people are going to refinance their mortgage with some stranger in Costa Rica (then again, I never thought people would do that with a stranger who randomly spammed them either).

not to mention a do-not-spam registry is stupid in the sole fact that it gives spammers a huge list of millions of VALID email addresses - doing their job FOR them

This is the hard part. How can you make it a crime to traffic or abuse a list of email addresses? I don't think it would hold up well in court. If it did, the validity of the lists would be come problematic - how do you prove the citizenship or residency of someone just by an email address? This is where it completely falls apart. If there were a DNS (do not spam) list, I think I would first sign up with a fresh new email address, say dnc@mydomain.com, just to see how it worked. I'd be surprised if it did not result in more spam.

Re:I like the idea

[theridersofrohan]

Also, most telemarketing is done from in-country because of LD charges. Not so with e-mail. It's pretty hard to enforce US laws on a Taiwan spamhaus.

That's true, but bare in mind that most (>90% ?) spam is from US companies advertising US products and stocks...

Also, if the idea takes up, more countries could implement this...

Re:I like the idea

[grahamm]

If making phone calls internationally is too expensive, why are so many companies moving their call centers offshore - to places like India?

Re:I like the idea

[Nuclear Elephant]

Because the money they save by paying their employees $2 an hour more than makes up for any expenes incurred from phone calls. Not to mention, call centers are primarily incoming, and so I imagine it can't be much more expensive than the standard 800-service to America.

Re:I like the idea

[mlefevre]

Most spam originates in the US currently (that is, it is people in the US causing it to be sent, although most of it comes via computers in other countries), but it's mostly not US companies, it's individuals. The stuff for stocks and property is usually a scam, and the actual stocks and any real property are also victims of the situation. The stuff for herbal/generic viagra/vicodin etc etc could equally well be shipped internationally.

The big time spammers are already involved in various illegal activities, but the enforcement is pretty much non-existant. If the FBI can't get them for the illegal activies, what chance is there of some other agency stopping them hitting email addresses on a list?

Re:I like the idea

[Anonymous Coward]

The solution to that is to make spam opt-in, so you do not have a 'do not call' list, you have a 'you may call' list and are only allowed to send spam to those people on the list.

Re:I like the idea

[dazed-n-confused]

a do-not-spam registry is stupid in the sole fact that it gives spammers a huge list of millions of VALID email addresses - doing their job FOR them

This is the hard part. How can you make it a crime to traffic or abuse a list of email addresses?

Salt the list with honeypot email addresses. Only supply the list under contractually binding terms and conditions which prohibit its abuse. Then just monitor the honeypot inboxes, and be ready to whack any Do-Not-Spam list-abusers for breach of contract so hard their ears bleed.

Re:I like the idea

[jrp2]

If making phone calls internationally is too expensive, why are so many companies moving their call centers offshore - to places like India?

As you might have guessed, it is not much more expensive. VoIP termination companies in the US provide very inexpensive calls into the US. It is no more expensive to call the US from India than it is from Omaha if you have decent enough volume (not much) to negotiate a direct deal with a VoIP provider. The only increase in cost is the Internet Access is likely a bit pricier in India. That is vastly offset by the lower cost of labor.

Same goes for calls to Europe, and from anywhere with decent Internet infrastructure. Actually, no big concern on the Internet infrasture either, as they will just use cheap satellite connections.

Re:I like the idea

[Anonymous Coward]

Spam succeeds because it is economically successful, because the cost of all the unhappy spam recipients is zero. "Education" to change the .0001% paying response rate to .00001% won't accomplish anything. If there is some way that all the unhappy spam recipients could add costs to the spam-sponsor, that might get us somewhere. The spam sponsor ultimately must provide some kind of contact information if they are actually getting orders. How to use this against them?

Re:I like the idea

[Anonymous Coward]

spam is NOT going to be made illegal. In fact they are legalizing it the last time I checked. New legislation is proposing an "opt out" policy, but the EU is proposing "opt in" which makes a lot more sense.

Re:I like the idea

[Stephan Schulz]

not to mention a do-not-spam registry is stupid in the sole fact that it gives spammers a huge list of millions of VALID email addresses - doing their job FOR them

This is the hard part. How can you make it a crime to traffic or abuse a list of email addresses?

Well, one thing you could do is to not publish the list of addresses, but only a list of md5-hashes of them. You could still verify if an address is valid (or rather was added to the do-not-spam-list, not quite the same thing), but at least you don't get an explicit list.

You might even use a rather expensive hashing algorithm (say 1 second per address) to make large-scale verifying of addresses hard.

Spam is advertising!

[Anonymous Coward]

Spam is the most successful way to use the Internet for the eBusiness sector. Without spam a highly profitable way to earn money will be gone and the internet rendered meaningless for further investment decisions.

Don't cut your own throat by sabotaging spam. Everyone needs to earn money. Money makes the Internet go round.

Re:Spam is advertising!

[Analysis Paralysis]

Spammer ahoy! Lock up your open relays! Ready your blocklists!

In case you didn't bother reading the article, it mentioned that the volume of spam was doubling every 10 weeks. This is nothing short of a threat to the viability of email itself. Would you even bother opening your inbox, if you knew that you would have to delete several thousand irrelevant, unwanted and (in many cases) fraudulent emails just to get to the 10 or 20 useful ones from friends and family? Spammers are intensely selfish - being quite happy to abuse the network infrastructure provided and paid for by others for their own gain.

Your statement about the meaninglessness of the internet shows that you haven't a clue (outside of those spam-rimmed spectacles) what the Internet is about. People do not wish to be deluged with unsolicited junk any more than the likes of Alan Ralsky likes receiving tons of junk snail mail.

Of course, you can try to prove me wrong - post your email and real address and let's see if you can swallow your own medicine.

Re:Spam is advertising!

[Chatmag]

Spam may be the most profitable, but far from the most successful. Considering the amount of capital needed to run a spam/scam campaign, it is virtually all profit. Analysts estimate Google has annual revenue of 60M to 100M, and I have never heard of Google spamming. Our 2002 annual revenue was just over 48M, and we have never spammed. Targeted advertising is far more successful than any spam campaign.

Most spam emails I see in my Inbox are scams, bogus prescription drugs, and Web site affiliates violating their related site TOS. Spammers would never be able to generate revenue comparable to the top Internet properties.

Re:Spam is advertising!

[Anonymous Coward]

Spam may be the most profitable, but far from the most successful.

Huh? What are you talking about?

Re:Spam is advertising!

[Anonymous Coward]

True. If spam doubles every 10 (or even 100) weeks, we only have a short time left before SMTP email is rendered unusable and port 25 itself needs to be blocked upstream (spam rates of multiple megabytes per second are really a DoS attack, no matter what they claim).

There are two solutions:

1) A new protocol to replace SMTP, that _somehow_ provides non-mobile authentication (i.e. a credential that is tied to an identifiable person, not something as malleable as an IP address or even as cloneable as a MAC address)

or

2) A protocol on top of SMTP (e.g. CAMRAM, TMDA, etc) that severely limits the ability of an two previously-unconnected persons from sending each other email, and preferably does so as close to the originator as possible.

Personally, #1 sounds way harsh (you'd have to fingerprint (or worse) every ISP subscriber). Therefore, #2 is the only way left.

That's why I see the future as something like CAMRAM (one of whose layers uses CRM114 as a backstop Bayesian filter before it decides whether to invoke the "Prove You Love Me" protocol. This layering provides some advantages over other protocols).

Perhaps it's time to ask ICANN for a new SMTP port that is only used with CAMRAM or other authenticated email protocols. Then users can shut off port 25 upstream and that will end the DoS issue. Port 465 (smtps) is just SMTP over SSL; a good start, but not what we want here.

Re:Spam is advertising!

[Chatmag]

"Targeted advertising is far more successful than any spam campaign." Conversion ratios of targeted banner advertising versus spam shows that targeted advertising far outdistances any spam campaign.

Spam is profitable only due to the fact that there is little or no investment to operate a spam campaign. Any other advertising campaign requires a capital investment in web servers, bandwidth, tracking, product or service fulfillment, etc.

Re:Spam is advertising!

[abirdman]

The fact that so many spammers don't have to invest in any actual product has a positive effect on their bottom line as well. That's why they're so evasive about their address/phone/contact information. Most, if not all, of the 100+ spam emails I receive every day are obviously completely fraudulent. I find it amazing that anyone actually responds to any of it.

The spammers are outlaws, but it would be good if the few actual identifiable vendors who profit from Spam could have their feet held to the fire. They can't ALL be overseas. For the rest, I say block them all if that's the only way.

As for the article, I'm afraid we've /.'ed the poor website and I won't get to read it for another 12 hours or so... *sigh*

Re:Spam is advertising!

[Anonymous Coward]

Where are you pulling your numbers? Revenue is *trivial* for fraudsters to pull in, given the many thousands of rip-off artists in the world, especially those who do identity theft and dig deep into your savings (such as the Nigerian bank deposit scam spammers).

It's *profit* that they rarely make. Most spammers are suckers who bought into wildly advertised pyramid schemes, but there are enough suckers born every minute to make the spam a never-ending deluge. Like people heading to the gold rush, it only takes a few (fraudulent!) cases of people making a big profit to keep all the suckers lining up, digging through the trashpiles and finding fool's gold to encourage or maybe swindle the next round of suckers.

I say...

[Exponent X]

Less SPAM, more Vienna Sausages!

Spam is bad...mmmkay?

[Nuclear Elephant]

Is this really necessary to post a different article every day of someone in our field who agrees spam is bad? It's like there's a template for every article on slashdot about spam:

CEO of [NAME] reported today that SPAM is [GOOD|BAD] and recommends [LEGISLATION|CRACKING DOWN|PRODUCT].

There are enough freely available working solutions out there now that work with Mr. Allman's product (such as DSPAM and BogoFilter) where we really have gotten to the point where we can quit complaining about spam and actually succeed in the high 99% at stopping it. If everyone quit whining and installed one of these tools, nobody would get spam, and the spammers would be out of business.

Re:Spam is bad...mmmkay?

[pirhana]

I am sorry to tell you that you dont understand the average internet user at all. Installing any such spam filter or tool is well beyond the capability of 95% of the users atleast. Classifying mails as "spam" and "ham" and training the bayes engine and all are good for geeks, but not for the average user.Belive me for this. For him/her, these are just unacceptable solution and spammers exploit this weak point. As long as substantial chunk of users are non-geeks, spammers can flourish.And anti-spam laws are relevent in this context.

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

Bogofilter may not be for everyone, but DSPAM implements server-side...which means it's the sysadmins for the ISPs who install it and allow their users to opt-in or opt-out of spam filtering. All the average user has to do is forward messages they deem as 'spam' to an email address. pretty brain-dead easy.

Re:Spam is bad...mmmkay?

[mumblestheclown]

Your observation about the slashdot stupid spam story phenomenon is a good one.

Your last paragraph, however, shows that nevertheless you completely don't get it, and, by completely, I mean that you really sound as clueless as can be on the topic of spam.

Let's see how many standard spam-thread replies are required for your two sentences of nonsense at the end.

• SPAM is an arms race - single tools don't work, because eventually they will be beaten, as has happened to ALL tools as yet, including bayesian filters.
• SPAM tools such as you suggest are basically for the 3l337. you are basically saying "spam is not my problem if *I* can avoid it. this is a) antisocial and b) bs, because ...
• your note does not in any way address those billions of dollars of bandwidth wasted before spam gets to your personal box.
• if you stop 99% of spam now, by a rough guesstimate of what the parent article alluded to, you can roughly expect to get 100 times more spam than you currently do in 2.5 years time. ergo, problem not solved.
• you still haven't worked on the issue of spam definition.

In short, any article, post, or message that claims that Product X is an acceptable solution to SPAM just doesn't get it.

Re:Spam is bad...mmmkay?

[Oddly_Drac]

"If everyone quit whining and installed one of these tools, nobody would get spam, and the spammers would be out of business."

Deary, deary.

You obviously aren't seeing the sharp end of the wedge and the people trying desperately to increase both the false positive rate and therefore the value of these tools. It is like an arms race, and anyone who has even approached the subject knows that arms races have no end. Better to simply slap a lawsuit on trading entities that use spam as a sales vector and drive the spammers out of business by cutting their food supply.

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

Apparently you don't understand how [good] spam tools work, I think is the problem...but first let me suggest that you re-read my previous posts. I suggested that everyone quit whining about spam and install some software. I also made a comment that this was something that could be done at the ISP, leaving the 95% ignorant people on the Internet to have to not do much except forward spams. Now back to how spam tools work...your last couple of statements suggest you don't understand how any good spam filter works. It's not based on a filter list, or an IP list, but the tools actually have the capability of learning new types of spams. This means in 2.5 years time, 100 times more spam will be sent, forwarded into DSPAM, and *learned* by DSPAM without any rules lists to maintain. Spam is always changing, and therefore the only truly effective spam tools much learn. So if you decide you don't want to install a spam filter - fine...enjoy your spam... but 2.5 years from now I still won't have seen much of any spam.

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

So then we must develop spam tools that do not subject themselves to high false positive training =)

Re:Spam is bad...mmmkay?

[Oddly_Drac]

"So then we must develop spam tools that do not subject themselves to high false positive training =)"

I'll pencil it in for after over-unity power generation, Microsoft secure computing and my night of passion with Christine Aguilera.

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

You put Microsoft Secure Computing before your night of passion with Christine Aguilera? Your priorities are whacked, man!

Re:Spam is bad...mmmkay?

[Oddly_Drac]

"You put Microsoft Secure Computing before your night of passion with Christine Aguilera? Your priorities are whacked, man!"

It's sorted into the likelyhood of it happening, mon frere, rather than in my desire of it happening. That's a completely separate list that I would produce, but it was subpoenaed by the courts over some 'injunction' or another.

Kylie has absolutely no sense of humour, despite her elfin perfection.

Re:Spam is bad...mmmkay?

[mumblestheclown]

Do us all a favor: look up the word "Bayesian" from my post and do a little research on what smart people say are the medium and long term weaknesses of such filters before you make yourself look like any more of a fool, ok? Also, while you're at it, why don't you go and do a little research and understand that a) the isp-to-end-user pipe isn't the only problem and that b) this effectively means that ISPs filter emails with the very real potential for false positives.

Your responses really do make you look foolish. I'm ever the more amazed that you were able to make a good comment about slashdot spam articles given how little you apparently actually know about spam.

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

Whine and insult me all you like... and you can throw all the papers you want to my way, but the proof is in the fact that I DONT GET SPAM (except for the mindless responses such as yours posted to slashdot).

You guys can moan and groan all you want about how [insert tool] won't work, or you can shut up and install the thing. I personally don't care if you wanna whine for the rest of your life - some of us are whiners and some of us are born to a higher purpose.

Re:Spam is bad...mmmkay?

[Blackknight]

Then they deserve all the spam they get. I'm sorry, but I have no sympathy for people that are unwilling to learn how to use anti-spam tools. Mozilla Mail and Thunderbird both have excellent junk mail controls that are simple to use, there is no excuse not to use them.

Re:Spam is bad...mmmkay?

[bfields]

Whine and insult me all you like... and you can throw all the papers you want to my way, but the proof is in the fact that I DONT GET SPAM (except for the mindless responses such as yours posted to slashdot).

One of the things mumblestheclown is pointing out is that the fact that you personally are currently managing to filter out your spam is *not* sufficent evidence to prove that the software you are using will be an effective long-term solution.

The software you're using (however clever it is, however hard it tries to "learn" new types of spam), has easily exploitable flaws. The spammers haven't gotten around to exploiting them because it probably hasn't seemed worth their while--probably not enough people are using the same type of filter yet. But they will, eventually. At which point filters that take a fundamentally new approach will be required. Which the spammers will eventually figure out a way around. Etcetera.

Most spam filters are designed with the goal of filtering out spam that is similar to currently circulating spam; they make no attempt to resist an intelligent person who has spent some time thinking about how to circumvent the filter.

Bayesian filters are no exception here.

--Bruce Fields

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

I know I'm not the only one who has deployed DSPAM on my system, and judging by the number of people reporting to the lists I'd say it's a success for everyone else running it too. In response to your comments about an intelligent person who can think about circumventing the filter...this really isn't accurate. If you look at what spammers are doing today to _try_ and circumvent spam filters, they seem to only be succeeding with static tools like spamassassin. Although the term 'Bayesian' filtering is a very loose term, they all usually have the following traits in common:

1. Unknown tokens are assigned a moderately neutral value.
2. Only the most interesting tokens are used in the actual calculation
3. Statistics are stored on a per-user basis

With the above 3 mechanisms, it is very difficult to craft a spam that will make it through a majority of filters, and here's why: since each user has different email behavior, the innocent tokens that exist in their system are going to be very different meaning that a spammer can't simply "run their spam through a filter" like they can with spamassassin. With a tool like dspam, where chained tokens are used, it is even more difficult to determine what the most commonly innocent tokens are. Since only the _most interesting_ tokens are used (and not the most common), most of the common words a spammer might choose are never used in the calculation. Many spammers will flood emails with junk words that may or may not hit...such as "tomato" or what have you. These tokens, when they don't have any significant hits in the user's database, is given a fairly neutral value which causes them to be ignored in the calculation. When it all hits the fan, ultimately a good spam filter will detect whatever spammy words a spammer has embedded (or even tried to hide) in the email and ignore any of the junk words that were unknown to the user's dictionary (or didn't have enough hits). The only way to get a spam through is to provide more tokens that are not only innocent, but more innocent than spammy tokens (e.g. 0.01 in value) and these types of tokens are very different for each user. Like I siad, since DSPAM uses case-sensitive chained tokens, the spammer would need to come up with two adjacent tokens, case sensitive, that a majority of users are likely to have as very innocent in their dictionary...not a very easy feat.

I'm not blind enough to say it's impossible to do, just very difficult...and should some spams get through that are crafted to hit these tokens, the spam filter should quickly learn and adjust these tokens to a slightly more neutral value - meaning the NEXT time they spam, they'll have to find another set of very-innocent tokens.

While it may be somewhat feasible to craft an email that targets a small group of people, spammers don't make any money off of that - they only make money when a large mass of their emails can get through, so even though I could find some way of getting around YOUR bayesian filter, it's extremely difficult to find a way to get around a hundred thousand people's.

While I do realize that there are potential exploits involved, and have read several papers on such, I think many of them are overrated. Even in my own testing many of the exploits haven't significantly impacted filtering. Should a spammer find a way that really does beat the system, it's only a matter of a little time before whatever development "tweaks" are made to fix the problem.

Re:Spam is bad...mmmkay?

[bfields]

With the above 3 mechanisms, it is very difficult to craft a spam that will make it through a majority of filters

This is a bit like pointing out that exploiting some buffer overflow is difficult, and concluding that buffer exploits will never happen. The problem of course is that it only takes one person to figure out the exploit and automate it.

I haven't read the papers about bayesian filters (reccomendations? I'd be interested), but I'd think the first attack would be on the tokenizer. What does a bayesian filter do, for example, with a message consisting of nothing but tokens it's never seen before? (It should be possible to convert an arbitrary message to a message with unique tokens using unicode tricks and mispellings and such.)

Also my understanding is that bayesian filters only capture the frequency of tokens, with little or no information about their ordering. So tricks like appending ham-like messages to spam might be effective. As you point out, the notion of "ham-like" may vary significantly from user to user:

the spammer would need to come up with two adjacent tokens, case sensitive, that a majority of users are likely to have as very innocent in their dictionary...not a very easy feat.

We'd need to do experiements to determine if this is an easy feat or not; it could be that analysis of a few popular mailing lists and such would yield enough data about what "ham" looks like to be useful to a spammer. I'd think that Spam filters that really depend heavily on a small number of user-specific "good" tokens to identify ham would have unacceptably high false-positive rates. A great deal of the legitimate mail that I receive (e.g., mail from the linux kernel mailing lits) is not directed specifically at me.

It seems to me that the frequency of tokens in a message captures much too little information about the message, and it should be relatively easy to find ways to automatically munge spam messages to make those frequencies look innocent, without greatly degrading the spam signal.

--Bruce Fields

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

Paul Graham's paper on Bayesian filtering, although incomplete, is a great start to understanding how it all works. http://www.paulgraham.org.

Several attempts have been made to attack the tokenizer, which is one area DSPAM has a considerable lead on other tools. DSPAM performs several different deobfuscation techniques prior to tokenizing a message. From simple things as removing embedded html comments to more complex issues such as j/u-n,k t,e*x$t, DSPAM makes every attempt to deobfuscate such messages - and is very successful. Mis-spellings are actually ideal ways to identify spam because they show up much more frequently in spams than in innocent spams - DSPAM treats them just like any other token.

DSPAM tracks ordering to some degree - if a token shows up in a particular header, or a URL, etc., it makes note of the (for example URL*[Email Address] is a LOT more guilty than just your email address). Even attaching ham messages doesn't quite do the trick, for the reasons I mentioned in my previous email.

Frequency isn't measured on a per-message basis but just totals. E.g. if the word 'offer' appears once or 20 times in a message it makes no difference to most filters...for obvious reasons.

Re:Spam is bad...mmmkay?

[bfields]

Paul Graham's paper on Bayesian filtering, although incomplete, is a great start to understanding how it all works. http://www.paulgraham.org.

You mean this one?

Several attempts have been made to attack the tokenizer, which is one area DSPAM has a considerable lead on other tools. DSPAM performs several different deobfuscation techniques prior to tokenizing a message.

In other words, spammers have already started to attack bayesian filters (or at least filters that identify keywords) and DSPAM is using techniques to deal with those particular attacks. The bayesian filter didn't automatically learn to defend against the tokenizer attacks--humans had to intervene and write code. And the code they wrote doesn't deal in general with attacks against the tokenizer--it deals with the particular attacks that have been tried so far.

We can both imagine further attacks on the tokenizer, and we can both imagine defenses against those attacks. This is an arms race. It's not a very satisfactory long-term solution.

Even attaching ham messages doesn't quite do the trick, for the reasons I mentioned in my previous email.

I believe the reason you gave was that you thought the "ham"-identifying tokens would be too particular to the individual receiver? Again, I'm not so sure this is true--for example, any filter that I use has to (at a minimum) identify as "ham" almost all email from the linux-kernel mailing list and a dozen other lists on various topics. Any spammer can download the archives of a few big mailing lists and test out their spam against a bayesian filter that passes mail on those lists.

I doubt the ham each of us receives is *that* unique. And if even only 10% of the mail we receive is significantly generic, then this is enough---a spam filter that wrongly identifies 10% of my mail as spam is close to useless to me.

--Bruce Fields

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

Bruce,

Bottom line is you can complain about it all you want or you can actually try it and see that it works. I've got better things to do today - cheers.

Re:Spam is bad...mmmkay?

[bfields]

Bottom line is you can complain about it all you want or you can actually try it and see that it works.

I've never doubted you on that. I use spam filters myself, and find that they work; that's not the point. Your original claim was that spam filters were now good enough that we no longer have to worry about the problem of spam. What the rest of us would like to point out is that the fact that some spam filters currently work reasonably well is *not* sufficient evidence to establish that they will work on their own as a long-term anti-spam solution.

--Bruce Fields

Re:Spam is bad...mmmkay?

[joeykiller]

Then they deserve all the spam they get. I'm sorry, but I have no sympathy for people that are unwilling to learn how to use anti-spam tools.

How elitist can you get? The problem isn't that people are unwilling to learn anti-spam tools, the problem is that they need them in the first place.

Anti-spam tools also does not prevent one of the most annoying things with spam, especially when on a narrow line: You have to spend time and money downloading the spam before it can be identified as spam.

Re:Spam is bad...mmmkay?

[Nuclear Elephant]

My original point was that spam filters are good enough and therefore we no longer need to worry about legislation, do-not-email lists, and other less effective forms of filtering. If everyone who complained on slashdot about spam would install a filter at their ISP, I think you'd find there would hardly be any spam left in the world. Obviously, additional resources are going to be given to improving the effectiveness and learning capabilities of spam filters...but so far the effectiveness of even the most basic filters hasn't changed over the past few years that Bayesian has been hot. We should always be working on improving our software, but my point was that there are a million other "solutions" people are wasting their time with on this board.

Re:Spam is bad...mmmkay?

[Blackknight]

In an ideal world they wouldn't need to, I agree.

But the reality is that spam exists, and users need to learn how to deal with it.

The more I think about it......

[The One KEA]

....the more I realize that no amount of technology or legislation is ever going to completely eradicate spam from our lives. More and more it seems to me that the only way we can get rid of spam is through educating the next generation of Internet users to ignore it.

Spammers spam because they make money. Educate people to ignore spam, and the spammers don't make money. Bingo, no more spam!

I know it sounds like a pipe dream, but what other options are there?

Re:The more I think about it......

[Nuclear Elephant]

Speak for yourself. I haven't gotten a spam in months, although my quarantine box has caught thousands. My kids aren't going to know what spam is because they'll never see one.

Re:The more I think about it......

[Frit Mock]

Wrong!

With decreasing number of positive responses(for the spammer), the spammer increase the number spammails sent, as this compensates the decreasing number of positive responses. It does not matter by which means positive responses decrease.

That's the viicious circle already in place with spam.
Spammers double their spamm in a few weeks, because theire positive responses decreases, due to spam filters and increasing ignorance.

It defnitley will continue that way, until the point, where email at a whole is completely useless.

1. Spam
2. ???
3. More spam
4. Profit

Re:The more I think about it......

[AKnightCowboy]

....the more I realize that no amount of technology or legislation is ever going to completely eradicate spam from our lives. More and more it seems to me that the only way we can get rid of spam is through educating the next generation of Internet users to ignore it.

That's like telling your kids to ignore the high-pitched painful squeeling noise that has continually been emitted in your neighborhood at all hours of the day and night for the past 10 years.

"Honest kids, after 3 or 4 months of your ears bleeding you pretty much get used to it and it becomes background noise. Here, put these earplugs on."

Re:The more I think about it......

[The One KEA]

So if I follow your logic, does this mean that the reason why spam is so bad is because we are actively trying to defend against it? All of the effort that people spend writing spam software and spam filters and patches to MTAs to implement spam-catching frameworks is actually helping increase the amount of spam "out there"?

Following your logic further, you are implying that if we get rid of our spam filters and actively try to unsubscribe from the supposed "lists" that our e-mail addresses have gotten onto, spam levels will drop?

No flames intended, but that doesn't sound very logical to me. Can you provide any evidence to support this theory?

Re:The more I think about it......

[The One KEA]

And you probably will. Soon its presence will become habitual and you will no longer notice it and allow it to annoy you.

Like I said, spammers do this because they think they can make money. Right now, they DO make money spamming people. If they don't make any money, why would they do it? Because they enjoy /.ing mail servers?

Re:The more I think about it......

[azav]

Or we could pool our money and hire a hit man to have them killed.

Just one at a time. Let's start with Eddie Marin.

Re:The more I think about it......

[pirhana]

I beg to differ with you. Regardles of any level of education , there will be fools who will fall in to this fraud. I admit they are a microscopic minority .But that doesnt matter and spammers can keep moving with that as the per capita expense of spam is near to zero. It bas been reported that even the manager of a 6 billion dollar mutual fund had placed orders for "penis enlargement pills" (http://www.wired.com/news/business/0,1367,59907,0 0.html).

Re:The more I think about it......

[Transient0]

While I don't know if it stands a chance to actually eradicate spam as you suggest, you make a solid point.

Spam is far too slippery to actually legislate, but we are already developing pretty decent methods for filtering. Perhaps spam is an arms race, but we seem to be a step or two ahead of the spammers and it is costing me no money and only a small amount of time to stay there.

I think the real trick is to make things like not putting your real e-mail address on forms (paper or electronic) and setting up a reliable filter on your in-box matters of common sense rather than just geek-common sense.

Re:The more I think about it......

[alba7]

does this mean that the reason why spam is so bad is because we are actively trying to defend against it?

No. It just means that it will get a lot worse before it can get any better. Spammers feed on a tiny population of prey. The need a certain amount of victims per month to cover their fixed costs. Lowering the ratio of gullible victims leaves them two options: starve or chase more.

[...] you are implying that if we get rid of our spam filters [...] spam levels will drop?

No. Perhaps spammers would not have improved their offensive technology, if defense had not improved. But now that they have it, they will use it.

Re:The more I think about it......

[Frit Mock]

Isn't the horribly increasing number of spam mails evidence enough? If they would double their profit as fast as they double their spam rate, they would be richer than everyone else.

Can you imagine reasons to increase the number of spam-mails sent? Of course, profit is the reason.

But do they make more profit? I think it is obvious, that they don't increase their profit in the same way, as they increase their spam.
(Spam increases by a factor of 2048 per year, according to the article. Imagine they would have a revenue of ridiculous 1000$ last year from spam, then this years revenue would be over $2m, if both revenue and number of spam is directly correlated ;) And next years revenue $4b ... oh, the about the same as the GNP of the US after 2 years, when starting with 1000$!?

Nonsense, the spam increases in the same way, as filters improve and the number of spam that bypasses all filters stays constant, on average.

Real evidence is difficult here, but you'll find evidence if you take a look on how "normal" marketing works.

For every marketing caimpaign, weather it is tv-spots, paper-mails or anything else, they first estimate the response-rate for that campaign. Normaly the estimation is based on previous caimpains. And after that, the actual ammount of spots (papermails or whatever) sent is determined, or the campaign is canceld because of cost.
However cost is (almost?) not a factor for spamming and they can increase the number of emails sent up to the sky, because email is cheaper than anything else.

I don't actually suggest, removing spam filters and stopping the fight against spam, but I belive, that the fight _is_ senseless.

The importaint figure is how many positive responses, they get and this is (soley) based on the number of advertises that individuals recognize. Regarding spam, the number of mails, that pass filters an pop up in you inbox.

Some examples for a evidence of the vicious circle, besides increasing number of spammails.
First there where spammails, then simple (text) filters.
Then there were spammails, that avoided detection from these simple filters (multipart alternative mails).
Then filters were constantly improved, and spammails were improved to avoid these filters to.
Now, there are spams, that avoid any filter, by using images, to "hide" there content from the filters. What's next, OCR-Filters that bring these images down to a text version and filter that?

Whatever has done to filter out spammail was sensless, still the number of mails that hit our inboxes are constant, although we upgrade out filters permanently.
Of course, your email account is worthless if you don't filter and don't constantly improve your "anti-spam".

The result is always the same for the user, you have to live with a certan amount of spam, if you like or not and there is nothing you can do about it. Any measurement against spam, just increases the number of spam.
Sad but true. The only "perfect solution" to stop spam is to cancel your email account.

A catch-22 situation as long as you _don't_ want to decide weather you accept any mail (as email was intended) or to accept only mails from people with an _explicit_ permision. Anything in between (as any spam-filters is), will always leave enough room left for spammers.

Re:The more I think about it......

[MCZapf]

The billion dollar fund manager is surely educated, but not in the ways of the Internet. All he knows is that the Internet is an exciting new avenue for commerce. He doesn't know the difference (legitimacy-wise) between spam and a banner ad, and that's why he'll shop via both.

Re:The more I think about it......

[bfields]

Spammers spam because they make money. Educate people to ignore spam, and the spammers don't make money. Bingo, no more spam!

That might help. Though it only takes a few suckers.... (Either among the customers, falling for the spammers' sales pitches, or among the spammers, falling for the spam-software sellers' sales pitches.)

Actually the vast majority of my "spam" right now is the result of a virus that could just as well have been written by a teenager on a whim.

As long as the system is so fragile than anyone can exploit it with a minimum of effort just for fun, there's always going to be a problem.

--Bruce Fields

Re:The more I think about it......

[Frit Mock]

Yes, but can we stop them making money? And how can we stop them making money?

There is almost no cost in spamming. Furthermore, cost for spamming does not increase proportional to the amount of spam mails sent.

Spammers don't pay for the bandwidth they use, because many spammers hack into a server, place their address list, a mail template and a little spamming tool. The Bandwidth used is paid by innocent people, owning the hacked servers.

That said, we can't efficently (significantly) increase cost for spamming.
But better anti spam technology significantly increases cost for the spam defence.

And _all_ previous anti spam techniques have just prooven, that spammers can increase the amount of spammails sent by incredible factors. Anything ever done against spam did not hurt them!

If you ask me, who is on a lost position, anti spam is ... at least, if there are not major changes. Just making spamming more and more difficult is not a major change and leads to ever more spam.

A mojor change I can imagine, would to turn around the principlie from first accepting every email (and then filtering) to first accept _nothing_ and then grant explicit permission. But that also has major drawbacks, as everyone can imagine.

Re:The more I think about it......

[pjrc]

no amount of technology or legislation is ever going to completely eradicate spam from our lives

Therefore, worthless are methods that greatly reduce but fall short of complete eradication?

Re:The more I think about it......

[chromatic]

we seem to be a step or two ahead of the spammers and it is costing me no money and only a small amount of time to stay there.

You don't pay for bandwidth, system administration, and hardware? I do. Spam definitely costs money and time I'd rather spend elsewhere.

I'm calling bullshit on this part:

[Rogerborg]

>The seventh is opt-out with an unsubscribe link that actually confirms your address as belonging to a live account.

The author doesn't say whether he believes this happens, but he implies so by adding another similar case: "The unsubscribe link removes you from the list in question, but it also adds your address to another list."

I'm calling bullshit on both of them. I challenge anyone here to cite any quantative evidence that replying to spam has resulted in them receiving so much as one extra message.

No, anecdotes don't cut it. Neither does common sense, or "Well, it stands to reason" arguments. Neither does the availability of "verified" address lists. I can create a billion psuedo-random addresses, call them "verified" and slap whatever price tag I like on them. It doesn't make it so, and remember what sort of people we're dealing with here. You don't think they'd screw each other over for a few bucks?

As far as I'm concerned, spam is so untargetted that replying to an unsubscribe cannot possibly make it worse. It's vanishingly unlikely to make it better, but how, exactly, does it make it worse?

Examples, statistics please. No more anecdotes, no more gut feelings.

Re:I'm calling bullshit on this part:

[Anonymous Coward]

You don't think they'd screw each other over for a few bucks?

If I was dealing with the sort of people who send animal porn to kids in industrial quantities, I'd be wary of pissing them off. We are talking the most viscious of Canutes.

Re:I'm calling bullshit on this part:

[dinivin]

Just curious, but do you have any proof that shows that clicking on one of those unsubscribe links actually removes you from the list?

Dinivin

Re:I'm calling bullshit on this part:

[kfg]

How about the story the other day where they actually interviewed a spammer who said he "loved" unsubscribe emails?

It may well be an "anecdote," but it's an anecdote straight from the pigs mouth.

KFG

Re:I'm calling bullshit on this part:

[arkanes]

Well, you can do your own research, but I've both read interviews with and had personal conversations with spammers who do this. You'd need alot more time and bandwidth than I have lying around to scientifically test it, but I know for a fact that some spammers do so. They certainly don't respect the opt-out links, which begs the question [shut the fuck up, anyone who wants to argue with me about what that means]: Why have them at all?

Re:I'm calling bullshit on this part:

[platipusrc]

I don't know if this is what you're looking for, but I was bored the other day and going through a JunkMail folder on an account with a whitelist, and saw a spam that told me it would let me remember 20x as much with 1/3rd studying, I would be able to read faster...etc, you get the drift. I replied to that message and later on that day, from another account with the same domain, I got another spam from them.

Re:I'm calling bullshit on this part:

[Zocalo]

I challenge anyone here to cite any quantative evidence that replying to spam has resulted in them receiving so much as one extra message.

Do it yourself. Find a few unsubscribe links in some of the dodgier spams that include the email address they were sent to in them. Replace that address with a new non-guessable (and disposable!) email address and "unsubscribe", if you suddenly get spam on that account, then you've just disproved your call of "bullshit". Can't argue with evidence you've gathered yourself, can you?

OTOH, I did read an article about a guy who *did* unsubscribe from everything to see what effect it would have, and his spam level did go down. Whether that would still hold or not is another story, but I certainly wouldn't recommend anyone unsubscribe from a spam list.

Re:I'm calling bullshit on this part:

[Anonymous Coward]

I'm calling bullshit on both of them. I challenge anyone here to cite any quantative evidence that replying to spam has resulted in them receiving so much as one extra message.

Put your money where your mouth is "Rogerborg". You willing to put up $10? $100? $1000?

Re:I'm calling bullshit on this part:

[henbane]

As far as I'm concerned, spam is so untargetted that replying to an unsubscribe cannot possibly make it worse. It's vanishingly unlikely to make it better, but how, exactly, does it make it worse?

If you remember this article from the nytimes posted a while back. This guy really seemed to appreciate out of office reply. An anecdote? Yes, but from a self-proclaimed spammer.

Re:I'm calling bullshit on this part:

[Oddly_Drac]

"I'm calling bullshit on both of them."

Fine. Here, have some candy and stop annoying the adults.

The problem is that spreading this kind of FUD is fine because it keep everyone from punting their email address around with gay abandon. All of a sudden the average joe user thinks, 'Hey, my email address has value to someone.'

The more important thing to ask is if anyone honours the unsubscribe links. I know that all of the lists I've written (double opt in, etc) and the lists I'm subscribed to do, but unsolicited email is coming from a value-added list that someone's bought or spidered. I'll be buggered if I *ask* to be removed from a list that I didn't even know I belonged to without solid assurances that it would get back to the root source.

"I challenge anyone here to cite any quantative evidence"

I run several emails accounts; one is ultimately public and receives around forty spams a day...another goes out to friends and people who know that the 'forward' button is a dangerous tool. The second receives No spam.

I know it's anecdotal, but FFS, go give it a try for yourself.

Re:I'm calling bullshit on this part:

[dazed-n-confused]

Examples, statistics please. No more anecdotes, no more gut feelings.

OK: here's a year-old ComputerWorld article documenting a study that did exactly that. Its title? Unsubscribing from spam counterproductive.

The best anecdote/example/statistic?

"We then set about religiously unsubscribing from the invitations sent to one of the addresses, but not those sent to the other. We've had it running for three weeks at date of writing and more than twice the volume of spam has come back to the 'unsubscribed' mailbox as to the untouched one."

So this study found that unsubscribing made spam volumes more than double.

Feeling better now?

Re:I'm calling bullshit on this part:

[schon]

I'm calling bullshit on both of them. I challenge anyone here to cite any quantative evidence that replying to spam has resulted in them receiving so much as one extra message.

I'm calling bullshit on you. I challenge you to cite quantative evidence that replying to spam DOES NOT result in receiveing extra spam.

No, anecdotes don't cut it. Neither does common sense, or "well, it stands to reason" arguments.

If you're gonna make that kind of challenge, then it's reasonable to assume that you have that kind of proof to support your own position.

Let's have it. We're all waiting.

Re:I'm calling bullshit on this part:

[golgotha007]

I run several emails accounts; one is ultimately public and receives around forty spams a day...another goes out to friends and people who know that the 'forward' button is a dangerous tool. The second receives No spam.

i've used this method since 1998 or so, and it works really well! since that time, my 'private' email address was spam free, but then just this year, a family member decided to send me an online birthday card.

that was it, this one single submission to a free birthday card now nets me between 5 and 10 spams a day. it is progressing as my email address is now undoubtably being sold on new mailing lists.

so, heads up everyone that uses a private email address for friends and family. be sure that they know how to keep your email address private as well as yourself.

Re:I'm calling bullshit on this part:

[Rogerborg]

What part of "anecdote" are you unclear about?

This article quotes no figures, supplies no details. It's unverifiable, and it's provided by a .com with an interest in producing content. Its credibility is precisely and only that which you choose to invest in it.

On the other hand, it confirms your preconceptions, so it must be true!

Re:I'm calling bullshit on this part:

[Rogerborg]

Look, chump, read what you're replying to. I'm not interested in your unrelated anecdotes. I too have an account that receives no spam, but what relevance does this have?

If you've got nothing to say on the subject at hand, why not just keep your opinions to yourself, or better yet, start your own thread.

Re:I'm calling bullshit on this part:

[Rogerborg]

>I'm calling bullshit on you. I challenge you to cite quantative evidence that replying to spam DOES NOT result in receiveing extra spam.

No, your pants are on fire.

I have no position, I made no claims. Don't for one second assume that you can simply turn the argument around and disprove something that I didn't say.

I'll take it from your passive-aggressive stance that you don't have the evidence that I asked for, shall I?

Re:I'm calling bullshit on this part:

[Rogerborg]

> How about the story the other day where they actually interviewed a spammer who said he "loved" unsubscribe emails?

That would be an anecdote.

>It may well be an "anecdote,"

It's an actual anecdote. There's no need to "quote" it.

>but it's an anecdote straight from the pigs mouth.

Spammers are lying vermin... except when they're telling us what we want to hear, apparently.

Re:I'm calling bullshit on this part:

[IANAAC]

By what I've seen, you are not removed. For those of us that have shell access to our mail files (/var/mail/whatever):
vi your mail file and take a look at some of the 'opt-out' links. Many, many times, they're dead, non-functioning links, that are a) not remotely related to any other link within the email or b) malformed so as to return an error. I look at my mail file this way every day and run into this pretty consistently.

Re:I'm calling bullshit on this part:

[gowen]

This article quotes no figures

We've had it running for three weeks at date of writing and more than twice the volume of spam has come back

This article quotes no figures

Which bit of "more than twice" did you fail to comprehend?

Re:I'm calling bullshit on this part:

[EvilTwinSkippy]

I am from Crete. All Cretans are liers.

Re:I'm calling bullshit on this part:

[kfg]

No, it's not an anecdote, which is why I put it in quotes.

It is testimony.

"Did you take out the trash?"

"Yes, honey."

That still leaves the issue of lying vermin, however.

"I did not have sex with that woman."

KFG

Re:I'm calling bullshit on this part:

[Rogerborg]

Wow, thanks for the unverifiable anecdote!

Spammers who do what? What exactly is it that they do with the verified addresses? They sell them to other spammers? Are you really saying that spammers trust each other enough to pay more for "verified" addresses? Can you support this with some evidence?

Perhaps they send more spam to those addresses. How? How can they send more spam? The costs are effectively free, spam is by its nature untargetted, and we've all seen (ooh, an anecdote) multiple spams from the same spammer in the same day. Under what circumstances would a spammer send less spam to an address? So, how can they send more?

Re:I'm calling bullshit on this part:

[Rogerborg]

Where did I say that it did?

Re:I'm calling bullshit on this part:

[Rogerborg]

> No, it's not an anecdote, which is why I put it in quotes

Yes, it is an anecdote, which is why I didn't. Gosh, this is fun.

>It is testimony.

In what sense?

• A declaration by a witness under oath, as that given before a court or deliberative body.
• All such declarations, spoken or written, offered in a legal case or deliberative hearing.
• A public declaration regarding a religious experience.
• The stone tablets inscribed with the Law of Moses.
• The ark containing these tablets.

Are you familiar with the phrase "cognitive dissonance"? Do you know what it means, or are you repressing that comprehension?

Re:I'm calling bullshit on this part:

[Rogerborg]

Ten trillion is more than twice a hundred, and is also statistically significant. Three is more than twice one, and is not. Neither of them are verifiable, nor are they remotely credible without at a minimum full email logs, or corroboration from an independent organisation not paid by the word.

What parts of "figures", "statistics", "details" and "verifiable" did you fail to comprehend?

Re:I'm calling bullshit on this part:

[Anonymous Coward]

How is it an unverifiable result? Conduct your own experiments until you're satisfied. Be sure to document the results and present them to us.

Re:I'm calling bullshit on this part:

[kfg]

You forgot to look up anecdote.

KFG

Re:I'm calling bullshit on this part:

[Anonymous Coward]

You are stupid and can't read!

Re:I'm calling bullshit on this part:

[arkanes]

They harvest verified email addresses and track them seperatly (and in addition to) ones they harvest from un-verifed sources like lists they buy from other spammers, the web, or usenet.

If you want scientfic research, do it on your own time - why the hell should I spend time and money just to satisfy you? Of course it's an unverifiable anecdote. I could falsify any evidence I create, too. Do your own fucking research if you want to be convinced. Anyway, as other responders have said, it's something very difficult to measure accurately - I know as a fact, because I've spoken with people who do it, that some spammers treat verified addresses differently than unverified ones. They certainly do NOT remove them from the spamlist. I do no know as a provable fact that clicking the link will result in more spam. I simply know that it does not have the desired effect, and thats all I need to know, and is all that the article claimed.

Re:I'm calling bullshit on this part:

[Rogerborg]

> They harvest verified email addresses and track them seperatly (and in addition to) ones they harvest from un-verifed sources like lists they buy from other spammers, the web, or usenet.

Look, I'm going to type this very, very slowly to make it easy for you.

And. Then. They. Do. What. With. Them?

Re:I'm calling bullshit on this part:

[schon]

I have no position, I made no claims.

Yes, you most certainly did.

You "called bullshit" on an assertion - saying that it was wrong. Your claim was that the statement was false.

You then demanded evidence, while providing none to support your own stance (your own stance was that the claim is false.)

If you had not made any stance, you would have stated "I don't believe this, but it's possible, can anyone provide proof," instead of stating "this is bullshit."

I'll take it from your passive-aggressive stance that you don't have the evidence that I asked for, shall I

And I'll take from your snide remarks and attempt to deflect my query that you don't have the evidence that I asked for.

Re:I'm calling bullshit on this part:

[Rogerborg]

Anecdote: A short account of an interesting or humorous incident.

As in anecdotal: Based on casual observations or indications rather than rigorous or scientific analysis.

As in, it's an anecdote when I say that I fucked your momma in the ass last night. It becomes testimony when I swear to it in court, and it becomes credible when I produce the pictures of her broken, bleeding, sobbing body.

Re:I'm calling bullshit on this part:

[Anonymous Coward]

If you've got nothing to say on the subject at hand, why not just keep your opinions to yourself

I guess he's just trying to be like you.

Re:I'm calling bullshit on this part:

[Rogerborg]

Coward, it's unverifiable because it contains no figures, no details, no logs, no evidence of any sort.

If an unsupported assertion by an interested commercial party that gets paid by the word is all the evidence that there is, then I'm going to consider that there is no actual evidence at all.

I don't have to do my own experiments. There's no grounds for considering them necessary.

Re:I'm calling bullshit on this part:

[Anonymous Coward]

You've totally lost it. As far as I can tell you just don't want to face the fact that there are evil spammers out there. There's no way any study can be "verifiable". You verify studies by repeating them. Go repeat it. It's not hard. Or are you afread of the truth?

Re:I'm calling bullshit on this part:

[Anonymous Coward]

As far as I'm concerned, spam is so untargetted that replying to an unsubscribe cannot possibly make it worse.

I have no position, I made no claims

I'm sorry, you were saying?

Re:I'm calling bullshit on this part:

[smitty45]

I have replied and 'unsubscribed' to a spam that was delivered to an alias I set up. The mail came to the account "info" at mydomain, and I replied with "myname1964" at mydomain, which I have never used or given out. That was about a year ago,

I began receiving spam to myname1964 at mydomain about 6 months ago.

There's some proof that yes, replying is bad.

Re:I'm calling bullshit on this part:

[smitty45]

I'm seeing a lot of arguments here. What if it turns out that some independent organization hasn't *done* the hard numbers on replying ? What if it can't be proven via a study that replying with an unsubscribe doesn't put you on yet another list ?

What is your point here ? Or just to get a lot of people wrapped up in an argument that has nothing to do with stopping spam at all, only to see yourself win an argument ?

I'm gonna guess it's the latter.

Re:I'm calling bullshit on this part:

[arkanes]

The guy I was talking to didn't go into detail. I don't care, really - I can come up with alot of things that I would do if I was a spammer. I'd give them priority in my runs, for example, so email to those addresses was more likely to get out if some of my runs were cut off.

It doesn't matter, anyway - whats important is what they do NOT do with them, which is remove them.

Re:I'm calling bullshit on this part:

[DavidTC]

In fact, it's incredibly fucking easy to verify it, and I've done it before.

All you have to do is follow one of the unsubscribe links, one of the ones that go to a page you tye in your email address, not the ones that encode it. And then type an email address, one that gets no spam.

As I have access to mail server logs, I typed in a non-existence address, a random string of letters.

The address gets about 30 rejects a day.

This not only shows spammers not only ignore unsubscribe requests, but they completely ignore the fact said addresses don't even exist.

And, no, I'm not providing logs. This is an easy enough test to run, and I'm deliberately never exposing that address in any forum ever again as an experiment. It's not dictionary attackable, and it's all from that single unsubscribe.

Re:I'm calling bullshit on this part:

[Anonymous Coward]

On a related topic, mailing some typo domains will get you spam as well.

I run a system. Call it foobox.example.com. My users have envelope senders of blah@foobox.example.com and their From: lines are just blah@example.com.

One of my users mailed an address like bar@longdomain.example.com instead of bar@long.do.main.example.com. Those people subsequently harvested the envelope sender. They even had a web page up for a time which told their secret to the world.

Now this user is getting mail attempts at the "foobox" e-mail address even though that is never used by any humans. It could only be these idiots.

So, if you have users who screw up stuff like the road runner platforms (blah.rr.com becomes blahrr.com), then look out. They're next.

Re:I'm calling bullshit on this part:

[Rogerborg]

>I'd give them priority in my runs, for example, so email to those addresses was more likely to get out if some of my runs were cut off.

Thank you. Now, was that so very hard? That's the first and only actual answer that I've received to the original question.

How often do spammers get their connections cut? What proportion of their spam gets lost that way? Do they start over with their new connection, or pick up spamming at the point where they left off? I know that you don't know any of this this, which is rather what I'm pointing out.

>It doesn't matter, anyway - whats important is what they do NOT do with them, which is remove them.

No, that's a subject for a completely different discussion. I never said nor implied that replying would make it better, I asked how ir could (and whether it does) make it worse.

Re:I'm calling bullshit on this part:

[Rogerborg]

Thanks for the anecdote. Now, how exactly does that relate to my question, which is how unsubscribing from an address that's already on a spam list can possible make it worse?

Do you have an answer to that question, or would you like to fire up another anecdote about a different question?

Re:I'm calling bullshit on this part:

[wcdw]

And with the type of people you just describe, you don't think there are _any_ of them out there who will capture your (now verified) address and sell it to someone else???

And yes, there are people who will sell any kind of trash at all as a 'verified' list, just as there are in any type of business. This does not imply that verified addressess are less valuable as a result - if that were so, there would be no cachet to these addressess, and no reason for the bottom feeders to lie about them in the first place.

If you're _REALLY_ looking for proof, might I suggest e.g. Google. This is a well documented phenonemon, and there is no reason /. should do your homework for you.

Re:I'm calling bullshit on this part:

[Rogerborg]

There are evil spammers out there. What I'm questioning is their practical ability to become more evil simply because you're verified an address.

>There's no way any study can be "verifiable". You verify studies by repeating them

Which is it to be?

It would be a lot more credible (as an anecdote) if it provided the raw data, including email logs.

On the other hand, you're an Anonymous Coward, so are probably not the sort of bottom feeding pond scum that would be interested in anything as useless as credibility or verifiability.

Re:I'm calling bullshit on this part:

[Rogerborg]

Oh, please be gentle. Abuse from anonymous cowards makes me and Baby Jesus cry.

Re:I'm calling bullshit on this part:

[dazed-n-confused]

If an unsupported assertion by an interested commercial party that gets paid by the word is all the evidence that there is, then I'm going to consider that there is no actual evidence at all...

And carry on attempting to 'unsubscribe' from spammers' lists? Good luck! And please let us know how well that works for you.

Re:I'm calling bullshit on this part:

[CaptBubba]

That's why I actually have three email accounts at any one time. One is the junk account, gets a few a day, because even though it is disposable I still don't toss it around. The second is the one I give out to people I trust, and gets no spam.

Both these accounts foward to the third account, where incoming mail is filtered based on the To: header. Mail coming into the junk acocunt goes into one subfolder, the personal account goes into another to be further filtered.

Works great. Becuase I NEVER give out my real email address, all the spam has to go through a filter. And if someone sends me something that gets me spammed, I can open a new account, and be sure not to give that address to them. Webmail is useless to me though, because the messages aren't filtered.

Re:I'm calling bullshit on this part:

[smitty45]

What, besides getting your own personal clarification on an irrelevant sidenote to this discussion, is your point here ?

You're requiring non-anecdotal evidence on a discussion board ? For what reason ?

Re:I'm calling bullshit on this part:

[pjrc]

Regarding the computerword article

This article quotes no figures, supplies no details. It's unverifiable,

The same could be said of almost every newspaper article, all news heard from the radio, and most news seen TV!

Well, usually on TV and sometimes in newspapers there will be a figure... but it's pretty easy to imagine a bar chart showing a bar twice as high for the unsubscribed account.

The article does supply a number of details, including where he created the two test accounts, roughly what he did with them to make them publicly visible to spammers, an assurance that exactly the same public postings were made with both accounts (including an admission of a mistake and having to repeat the same postings with the other account to keep them the same). Other details included the number of days until spams started to arrive, descriptions of some of the spam, the origin of one of the more obnoxious spammers (postmasterdirect.com) with specific details about number of messages repeated. A detailed description of one of the responses to the unsubscribe form with about 30 other unsubscribe checkboxes was also given.

That's quite a few details, for an article you say "supplies no details". Maybe you meant "raw data" (which is not commonly supplied in news reporting, but rather a summary of analysis of that data).

and it's provided by a .com with an interest in producing content. Its credibility is precisely and only that which you choose to invest in it.

Oh yeah, sure, Stephen Bell probably just made it all up. That's quite a conspiracy theory, since the test as described would not have cost anything and have been pretty simple to do. Computerworld did have an interest in publishing an article, and probably did pay Bell to do this simple study and write the article.

But if you're calling Bell a liar, consider that YOU have not even claimed to do a study as Stehpen Bell did. YOU have not quoted any articles, studies or provided any details.

All you've done is trolled. As a troll, you have an incentive to make obnioux posts and flatly refuse to believe any evidence contrary to your (absurd) position. It is you, not Stephen Bell, who is making everything up. If that is not the case, why don't YOU find the results of some study.... even a casual one like Bell's, that supports your position that responding to the unsubscribe links does not increase spam.

Re:I'm calling bullshit on this part:

[smitty45]

Why are you such a jerk ? What is your point with this verification of unsubscribe/replying ?

Either yes...it does put you on a new list, or no, it doesn't. What does either answer help, or provide to this discussion, besides your own little semantic tantrum about pointing out Allman's statement to be untrue.

The point is so minor that it warrants no more than about 2 seconds thought.

Re:I'm calling bullshit on this part:

[Anonymous Coward]

As far as I'm concerned, spam is so untargetted that replying to an unsubscribe cannot possibly make it worse.

And what evidence do you have to back up this claim of yours? Do you have any numbers to show that replying to an unsubscribe cannot make it worse? No anecdotes! Examples and statistics, please!

Re:I'm calling bullshit on this part:

[Anonymous Coward]

No, but I have absolute proof that by opting out, my Email definately IS added to spammer lists. I've been able to prove that beyond a doubt.

Our new system "generates" a unique "honeypot" Email address anytime we want to tell a spammer to "bug off". And sure enough I've definately started to get spam from these people (they are actually Russian Mafia).

Of course not ALL do this, but enough to cause concern and for me to think twice about opting out.

Re:I'm calling bullshit on this part:

[Anonymous Coward]

I accept your challange, and if you want to discuss this offline, then give me communication channel I can reach you and I can send you the logs to prove it.

Over the past 3 months, we've developed an email system that allows us to generate a unique email address we use when opting out of spam. When we opt out, we use our "regular" Email address, then we opt out again using a special unique email address we give to NO ONE ELSE.

Sure enough, we started to get spam from these people.

I usually don't like giving my Email out to slashdotters, so instead I'll encourage you, and other non-believers to send me Email, but to get past the filters, please use "Honeypot Address" in the subject line so I can get it.

send to 'lists@webcrunchers.com' and I'll ask the list moderator to forward it to me.

JD

Re:I'm calling bullshit on this part:

[Rogerborg]

>Why are you such a jerk ?

We'll come back to this one.

> What is your point with this verification of unsubscribe/replying ?

It's urban legend busting. There are whole sites dedicated to it.

>What does either answer help, or provide to this discussion,

This discussion is about the veracity of this one claim. You're thinking about other discussion related to this story.

>besides your own little semantic tantrum about pointing out Allman's statement to be untrue.

It's not a semantic tantrum, I'm questioning the basic veracity of it. Veracity is not a matter of semantics. And I didn't call it untrue, I called it bullshit. See, that's a semantic argument.

>The point is so minor that it warrants no more than about 2 seconds thought.

The passion with which it is defended by people who have absolutely no evidence beyond anecdote and "Well, 'cause" makes it particularly interesting. The more stubborn the legend, the fun it is to burst.

Oh, and I'm a jerk because I disagree with you. That's the definition of jerk.

Re:I'm calling bullshit on this part:

[Rogerborg]

>You're requiring non-anecdotal evidence on a discussion board ? For what reason ?

Mostly to tweak brittle zealots such as yourself who insist on confusing belief with evidence. Still, I don't really blame you. The Invisible Pink Unicorn in the Sky probably told you what to think.

Re:I'm calling bullshit on this part:

[smitty45]

"Mostly to tweak brittle zealots such as yourself"

A.k.a. trolling, because most likely, you have so little else to do. Or, I guess your disks have just filled up (which is your own fault, btw).

Well I'm hoping you don't spend the majority of your time searching for (very) minor points to make and urban legends to "burst"...but whatever turns you on, I guess...hope you got a buzz from this.

Unfortunately for you, you're not going to be able to prove either way whether unsubscribing has any effect, only that any non-anecdotal evidence exists.

So it's hardly "bursting" anything...it's an attempt (a feeble one, at that) to get some attention by trying to prove a non-existing fact, and it's a futile and sad thing to watch, to be totally honest.

Good luck with that, have fun. Jerk.

Re:I'm calling bullshit on this part:

[smitty45]

the passion with which you are pursuing this so-called "urbanlegend busting" is far more interesting to me.

I'm going to assume that there's a deeper reason for it. I'm gonna guess that it probably has something to do with an affinity for obsessive thinking, maybe mixed in with some insecurity indicated by a vigorous want of validation of your intelligence (i.e. you want to make sure you're heard on everyone's opinion on this), and finally a disdain for things that you can't accurately measure (otherwise you'd be taking people's anecdotes as interesting comments and wouldn't be on an 'urban legend busting' kick).

Take a look back at the responses you've given. Take a look at their condescending nature. It's as if you're arguing about a past or ongoing relationship, or some far-reaching political agenda...both of which aren't at all related to the larger discussion, and at best is a short-lived sidenote.

Take particular note of the way you taunt and talk down to people who aren't rigorously "following" your constraints on what you deem to be logical responses to your comment. It's very clear that that sort of thing is amusing for you, a sort of thrill that might help an otherwise meaningless day pass by, hm ?

But, of course, I could be wrong about that. What do I know ? I'm just an ol' *zealous* slashdotter.

Good luck. I always find a good deep breath and a nice walk will help with getting some clarity.

Re:I'm calling bullshit on this part:

[ePhil_One]

I'm calling bullshit on both of them. I challenge anyone here to cite any quantative evidence that replying to spam has resulted in them receiving so much as one extra message.

Oh, this sounds fun. I'm going to create a tracking email account then unsubscribe it to a bunch of lists (I get 300 spams a day, I think I can find some :)

I might even report back on the results...

Re:I'm calling bullshit on this part:

[JuggleGeek]

I'm calling bullshit on both of them. I challenge anyone here to cite any quantative evidence that replying to spam has resulted in them receiving so much as one extra message.

I have personally created a brand new, previously unused email address and used it to fill out a "remove" request on several occassions. And I've seen spam come to those addresses. So I'm convinced.

You seem to believe that spammers are honest and ethical. There is plenty of evidence to show that they are not, so I doubt I'll be able to convince you.

Spammers spam because the cost to send email to a million people is essentially the same as the cost to send email to 3 million people. They already know that most people do not want their spam. They have no incentive to remove any address at all.

They also know that many of the addresses which they mail are behind a filter of some sort. The ISP/business may use a blacklist, the user may use a spam filtering tool, or whatever. Knowing that spam sent to addressX actually gets through to a real person who reads the mail makes that address worth more to them and other spammers, so they sell it off.

Either you yourself of a spammer, or you're so naive that you'll trust whatever the spammer says, which makes you a great spam target. Is your dick 3 feet long yet?

Re:I'm calling bullshit on this part:

[JuggleGeek]

So, anything you disagree with is an "anecdote", and regardless of many many "anecdotes" which show you are wrong, you're still whining and yelling "You Chump" and such when people disagree with you.

Why is it so important to you that people believe that following opt out instructions in their spam will help? I can think of one logical answer to that, right off the bat.

Re:I'm calling bullshit on this part:

[Rogerborg]

>Unfortunately for you, you're not going to be able to prove either way whether unsubscribing has any effect,

And where did I try to do that? I asked for evidence that unsubscribing has a harmful effect. That's all that I asked. Nothing else. No evidence has been provided, only anecdote, assertion, and a non-credible commercial press piece.

It must really cut you up that your belief system is based on that. I'll send a prayer to the Unicorn for you.

Re:I'm calling bullshit on this part:

[Rogerborg]

>the passion with which you are pursuing this so-called "urbanlegend busting" is far more interesting to me.

You're confusing passion with persistence. Are journalists passionate when they ask a politician the same question over and over until they actually get an answer to the question that they asked? That's thoroughness.

>Take a look back at the responses you've given. Take a look at their condescending nature.

Something that you should realise is that this is my thread. If people want to provide unrelated anecdotes or opinions, they can do so in their own threads. When they provide them as a non-answer to a question that I asked, I get to point that out. Them's the rules.

>Take particular note of the way you taunt and talk down to people who aren't rigorously "following" your constraints on what you deem to be logical responses to your comment.

Ah, I taunt them because they're morons with poor reading comprehension. Our only point of disagreement is whether that's acceptable or not. It is, because I say so. You're welcome to handle things differently in your threads.

> I always find a good deep breath and a nice walk will help with getting some clarity.

You must live in a world where you very rarely get straight answers. ABC called, they're looking for a new White House reporter.

Oh, by the way: found any evidence yet?

Re:I'm calling bullshit on this part:

[Oddly_Drac]

"What if it turns out that some independent organization hasn't *done* the hard numbers on replying ? What if it can't be proven via a study that replying with an unsubscribe doesn't put you on yet another list ?"

One of the things I've been considering for a while is that this is one of those problems that almost steps into the world of quantum electrodynamics simply because the act of observation can change the outcome.

The point is that you'll never see a definitive answer on the subject, but a rough analogy of my argument was that while you won't die everytime you run across a road without looking, it's better to look rather than 'play the percentages'.

Minor point that got exploded by Rogerborg petulantly demanding peer reviewed papers only. ;)

Re:I'm calling bullshit on this part:

[Oddly_Drac]

"I'm not interested in your unrelated anecdotes. I too have an account that receives no spam, but what relevance does this have?"

You're absolutely right, I had no right to offer an opinion in your thread.

Perhaps it would be safer if you gave me your email address, then I could run submissions by you in the future?

G'wan?

Re:I'm calling bullshit on this part:

[smitty45]

"Them's the rules."

You mean a rule like this one:

"If I start a thread, it's MINE, and I can be a jackass to people who respond to me and expect them not to call me a jackass."

?

Hm. Don't see no link to no rules here like that.
Oh well. While you're praying to Unicorn's, pray for some help with not being a jackass.

Re:I'm calling bullshit on this part:

[DavidTC]

YOU are the only person who has at all suggested it makes it worse. YOU misread the article to support this concept.

All the article said is that they kept a list of removed addresses, which I have show is correct, by getting spam to one

They obviously send to all their lists, and no one has ever tried to imply otherwise in the past 3 years or so.

You are, simply put, strawmanning.

This, BTW, isn't meant to imply that such a claim is invalid...spammers do classify email addresses, and if you are someone who opts out, you'll get marked as someone who reads spam. They know, at the least, that you don't have a spam filter set up, so it's worthwild to send to you. (Of course, they still normally send to all their list, but they could, for example, send to you first, in case they get cut off.)

Providing evidence of this that isn't 'anecdotal'...I have no idea how you can prove spam even exists except anecdotally. And, hey, you made the assertation that spam exists, you prove it does without using anecdotes.

MOD PARENT UP

[The One KEA]

You have a point. In the early days of spam, I'm certain that replying to spam would definitely get your address marked as alive. Nowadays, though, spammers have so many addresses and are sending so much spam that I highly doubt that they could deal with any replies to the crap they send out. And even if they do get a reply, they have so many other addresses to cycle through that they probably at best ignore it, and at worst might actually mark it as valid.

I agree with you. Does anybody have linkage to a Web site that actually explores this?

Well deserved indeed

[Anonymous Coward]

When 99% of the spam on the internet passes through your product at some time, I'd say you should have an opinion.

OMG

[Dikky]

In Soviet Russia, the current state of spam is 0 ..

Sendmail is a Good Guy?

[Gothmolly]

Sendmail, promiscuous relay for all, Sendmail, providing remote root access since Day 1 on the Internet, Sendmail, of the indecipherable rules file , is on "our side" ? Are they even relevant except for inertia?

Lets talk to DJB, to Wietse Venema, to the MS Exchange developers first, before giving soapbox time to some suit.

Re:Sendmail is a Good Guy?

[Anonymous Coward]

OK, at first you were just the usual whinging slashbot, repeating the "Sendmail is BAD" mantra that people who've never run major mailserver like to parrot. (With the usual complaints, which all sound like "Ford cars must be slow, because the Model T was slow, and they must all be broken, because the Ford Motor Co. has had recalls where they fixed cars for free".)

Then you mentioned "MS Exchange developers" in the same breath as Wietse Venema and Dan Berstein, and finished off by calling Allman a "suit".

You must be a troll, then! Or profoundly, phenomenally ignorant.

Re:Sendmail is a Good Guy?

[Oddly_Drac]

"Are they even relevant except for inertia?"

You could say the same about anything the W3c outputs, but yes, sendmail is a standard. Like ASCII it may not be the best standard, but it's a standard. You can use anything you wish, which is the beauty of the whole enchilada, but unless you have a seriously large number of machines to administer, you mind want to consider scaling a change to another MTA from ol' sendmail.

"Sendmail, promiscuous relay for all"

Exchange is as bad if you don't set up authentication. Hell, any SMTP server is as bad if you don't set up *some* form of authentication, but I guess that mentioning that would have stopped your anti-sendmail troll.

"indecipherable rules file"

Assuming everyone else is as incompetent as yourself is a dangerous trap to fall into.

Re:Sendmail is a Good Guy?

[Anonymous Coward]

Or just too young to know any better... There were attempts to deliver email with other programs before sendmail. They were abandoned almost instantly and for many years sendmail was almost the only program in use. It's easy for some other programmer to come in late in the game and solve a few remaining problems, but sendmail was the innovation that made email usable.

Re:Sendmail is a Good Guy?

[doug]

Back in the '80s, all sorts of open forwarding were great ideas. Do you remember having to put someone%domain@att.com because AT&T seemed to have better routing abilities than your local box?

Root access always was a hack, but it is a quick and easy way to get around file permissions. Back before pop/imap when everyone read directly from $MAIL, you needed a way to restrict mail to the user and the sendmail program. Who bothered with complicated groups just for that?

I agree that these justifications have gone the way of the dodo, but anyone who's been around understands where they came from.

I'm not trying to defend how sendmail works today, just to explain why those features are present. Personally, I prefer the old "trust everyone" model for mail than the insanity that we have today, but that isn't realistic. DJB's paranoia is useful thing in these modern times.

- doug

Re:Sendmail is a Good Guy?

[Blackknight]

We run some pretty busy mail servers, and we don't use Sendmail. It's a pain to configure and is insecure. Exim fits our needs perfectly.

Re:Sendmail is a Good Guy?

[bobcat]

"Promiscuous relay for all"?

Perhaps prior to 8.9 - but we're up to 8.12, bucko.

But don't let me stop you from making critical comments about things you know nothing about. I don't want to ruin your fun.

Re:Sendmail is a Good Guy?

[F4Codec]

The % hack routing is nothing compared to the old UUCP address style.
Who can forget addresses like
cuae2!gatech!mcnc!seismo!rutgers!princeton!a llegra !ulysses!faline!be
llcore!mrevox!lcuxlm!whuts!hou xm!vertigo!roller

Ahh - nostalgia!

why can't mail servers talk to each other?

[LennyDotCom]

Why can't certain specified mail servers be something like the look outs. If a certain percentage of them recieve the same email in a specified amount of time then they can designate it as spam and delete it from all the mail servers. then ISP's could subscribe to the "lookout server" list and delete any messages that have been designated as spam?

Re:why can't mail servers talk to each other?

[AKnightCowboy]

If a certain percentage of them recieve the same email in a specified amount of time then they can designate it as spam and delete it from all the mail servers. then ISP's could subscribe to the "lookout server" list and delete any messages that have been designated as spam?

Go lookup RBL on Google.

Re:why can't mail servers talk to each other?

[The One KEA]

That would be a good idea. Until some 3l33t h@XoR d00d cracks the protocol used by the mail servers to cummunicate and starts seeding false positives to allow spam to get through them.

Re:why can't mail servers talk to each other?

[Juggler]

This is what both the Razor and DCC projects are about, although their approaches differ slightly.

This is almost exactly what the DCC does. This strategy works very well for certain types of spam, but it doesn't catch everything and needs manual intervention to allow legitimate mailing list traffic through.

Re:why can't mail servers talk to each other?

[Anonymous Coward]

Mailing list traffic doesn't actually look like Spam, so perhaps coupling that with something like Spamassassin would be a good idea.

Re:why can't mail servers talk to each other?

[Anonymous Coward]

It would get complicated as Spammers would start inserting random stuff into each email they send to get around these filters. Though the key spam phrases and format would still be there, so is likely to be picked up by something like Spamassassin.

Re:why can't mail servers talk to each other?

[clifyt]

"If a certain percentage of them recieve the same email in a specified amount of time then they can designate it as spam and delete it from all the mail servers."

Mailing Lists...

Thats the big problem. I run a few mailing lists and I'm on a few others. I was on a spam filter just like this.

You get idiots that don't know how to subscribe, so they just press THIS IS SPAM button and then it filters its headers and otherwise out to everyone else on this service telling them its spam, and then after a while that list is just blocked.

This sort of thing was easy for me to fix...I'm a geek. I would periodically (like every few hours...kinda mitigating the idea of a spam filter) check my deleted messages and click the THIS IS NOT SPAM button and I would get it again.

BUT every so often, folks would start complaining on the mailing lists...they might be good musicians or great psychologists (depending on which list I was admining), but piss poor geeks (which is why I'm around). I'd look and they'd be getting the messages. I'd throw in an hour or two of free support only to find out they are running a spam filter their wife / husband / son / secretary / whomever installed...and it was categorizing this stuff as spam.

Its a good idea, but until we can moderate the idiots that continually click on anything they don't want to deal with as Spam, then we will have a problem.

Re:why can't mail servers talk to each other?

[matuscak]

Spammers would start inserting random stuff into each email

Inserting random junk to defeat checksumming has been happening for years.

sorry, a gut feeling is good enough

[Schlemphfer]

You've asked for statistics, but this is a case where none are really needed. Logic is good enough. What you've asked for can't be all that easily studied. Harvesting email addresses from opt-out lists has to be about the sleaziest thing a spammer could do. And you'll agree that the sleaziest spammers forge headers. So, how on earth could you be 100% certain that your act of opting out has caused a given piece of spam?

All you can do is look at the spam industry itself, and ask, "why wouldn't they harvest opt-outs for future spamming?" By opting out, after all, you've just given proof that the email address in question is valuable to you. Why wouldn't they want to take advantage of that piece of information. Do you think spammers suddenly adopt scruples on this point? Given how unscrupulous spammers are in every other aspect of what they do, I think it's absurd to think they treat opt-out lists with any integrity.

That opt-out lists will be abused by spammers is common-sense. I think the burden of proof is on you to show otherwise.

Re:sorry, a gut feeling is good enough

[henrygb]

Harvesting email addresses from opt-out lists has to be about the sleaziest thing a spammer could do.
I can imagine worse.

And you'll agree that the sleaziest spammers forge headers.
Yes, but so do the moderately sleazy.

The scale of spam is now at such a level that I doubt that the spammers are targeting their lists at all. They will add opt-out lists to spidered lists, usenet lists, invented lists, previous response lists, virus/worm created lists and all the others without giving any one list priority over the others.

The advantage of opt-out lists is that some slightly responsible marketers (i.e. those with a wider reputation to protect) might not then send messages. Since these are often the hardest to filter, as well as having too many graphics, it could be a benefit.

Re:sorry, a gut feeling is good enough

[gl4ss]

however when somebody else adds your email to a legitimate email list you don't want(for whatever reason, hell, maybe you did it yourself while drunk and can't remember) opting out is quite wise. however, just clicking on links on dubious emails is not very wise, better at least do a look around on the site the opt out links to(that is, directly just go to the site instead of having referrer/something to id you information available for them).

Re:sorry, a gut feeling is good enough

[Rogerborg]

> You've asked for statistics, but this is a case where none are really needed. Logic is good enough.

Because "logic" supports your position.

>What you've asked for can't be all that easily studied

It's trivially easy to study. The only question is how much time do you want to spend on it.

>Harvesting email addresses from opt-out lists has to be about the sleaziest thing a spammer could do.

I doubt that they do things just to be sleazy. What's the benefit to them in doing it? Or, given that it's zero cost to them to send spam, what's the benefit to avoiding unverified addresses? Please answer this question, as it's at the core of my argument.

>And you'll agree that the sleaziest spammers forge headers.

Relevant in what way?

>So, how on earth could you be 100% certain that your act of opting out has caused a given piece of spam?

I'd settle for statistics, preferably from an independent organisation.

>All you can do is look at the spam industry itself, and ask, "why wouldn't they harvest opt-outs for future spamming?" By opting out, after all, you've just given proof that the email address in question is valuable to you.

Gosh, yes, you're right. Now, follow through on that thought.

>Why wouldn't they want to take advantage of that piece of information.

Of course they would! Where on earth did I suggest otherwise?

What I asked, and the question that you're avoiding answering, is what on earth they could actually do with that information that would make you receive more spam.

They could sell the addresses, right? Who to? Would you buy anything "100% GARAUNTEED!!!!!" from a spammer? They could send more spam? How? That presupposes that they might under other circumstances send less spam, and by your arguments, what's the chances of them doing that?

>That opt-out lists will be abused by spammers is common-sense.

Abused how? Concrete examples, please.

> I think the burden of proof is on you to show otherwise.

You're entitled to that thought.

Re:sorry, a gut feeling is good enough

[JuggleGeek]

however when somebody else adds your email to a legitimate email list you don't want(for whatever reason, hell, maybe you did it yourself while drunk and can't remember) opting out is quite wise.

Disagree. If it is a legitimate mailing list, the list will send an email with a confirmation, and you will have to confirm (usually either by replying to the email, or by clicking on a URL) that you want to be on the list. If somebody else signs up your email address, and you ignore the confirmation, then you shouldn't hear from that list any more.

So if I'm on a mailing list, regardless of whether it "looks legitimate" or not, if I didn't ask for it, and I didn't confirm that I wanted to join it, then they are sending spam. I don't know how much they are sending, or where they got my address. Another user may have mis-typed his email address, or typed in what he thought was a BS address. Or the list may have bought a list of "verified opt in addresses". Either way, they are sending me spam, and I'm not going to opt out. There is too much evidence of spammers using opt outs to look for addresses that reach a real person. And there are simple ways for a list which really *is* legitimate to avoid that situation.

We need a secure email protocol

[*weasel]

spam - and what defines spam - isn't the pertinant question. The important fact is that spammers exploiting SMTP make 'opting out' impossible.

There is too much assumed honesty in SMTP.

Yes, it was a key factor in getting everything going, and yes, its beauty is in its simplicity.

however, much like open relays, this assumed honesty has outlived its usefulness. It is being corrupted to a degree unforseeable by the original protocol architects, and it is time for something new.

I don't pretend to know the specifics to building a secure, unexploitable system. And it would almost certainly be a messy conversion. That shouldn't mean that it isn't worth doing.

Let each user and ISP decide for themselves what spam is. But we need a secure email system so that when Spam is identified, that particular sender can be effectively blocked.

This drug will never take off

[Anonymous Coward]

Watch how this drug will never get an approval in the USA where True Love Waits.

--

Male contraceptive '100% effective

Part of the treatment is given by injection Scientists have developed a male contraceptive which was 100% effective and side-effect free in trials.

The hormonal treatment is a combination of an implant under the skin and injections - meaning men do not have to remember to take a pill every day.

Researchers from the Anzac Research Institute, Sydney, Australia, gave the treatment to a relatively small sample of 55 men for a year - and none of their partners became pregnant.

However, it will be some time before the treatment is widely available.

The treatment is a combination of an implant containing the male sex hormone testosterone, which was replaced every four months, and a three-monthly injection of a progestin, a hormone used in female contraceptive pills.

The reversible treatment works by making use of the body's own natural system which is involved in initiating puberty.

The combination of the two hormones temporarily turns if the normal signals from the brain that stimulate sperm production.

But the process also turns off the man's own testosterone production - so he needs to be given extra doses of the hormone to keep him healthy and maintain his sex drive.

In the study, none of the couples used any other form of contraception, and no serious side effects were seen.

Once the treatment was stopped, normal fertility levels returned within a few months.

Professor David Handelsman, who led the research, said: "This is the first time a reversible male contraceptive that will suppress sperm production reliably and reversibly has been fully tested by couples.

'IT WAS MY TURN Chris Hains, a Sydney policeman, is now the proud father of baby Connor. But before he and his wife decided to start a family, they took part in the trial of the male contraceptive. He said: "My wife Nicole was having problems on the female contraceptive pill so the doctor suggested she came off all contraceptive medication. "It was an opportunity for me to take part in the trial, and take on the burden of contraception." Around seven months after Chris stopped having the contraceptive injections, Mrs Hains became pregnant with their son Connor, who is now four months old. "This shows the way for a final product to be a single injection containing testosterone and a progestin which will easily be given by local doctors on a three-four monthly basis and still maintain male sexual health.

He said it was now up to pharmaceutical companies to develop their research into a usable drug.

Longer and larger trials were also needed, he said.

Previous attempts to develop an effective and convenient male contraceptive have encountered problems over reliability and side effects, such as mood swings and a lowered sex drive.

Dr Richard Anderson, a specialist in reproductive medicine at the Medical Research Unit Human Reproduction Sciences Unit in Edinburgh, said: "It's a very significant step forward.

"Nobody else has done real efficacy studies for a long time - and at the end of the day, that's what you need to do."

"How soon it is available depends on how much the pharmaceutical companies are going to become involved.

"Once they start developing a product, it could be available in just a few years

Liz Davies, of Marie Stopes International, told the BBC: "We welcome any advance in contraception, and particularly those that broaden the options for men to take responsibility."

She said women were likely to feel able to trust their partners to have infrequent injections.

"Whether they would have confidence in a man having a pill every day is another thing."

The research is published in the Journal of Clinical Endocrinology and Metabolism.

Re:This drug will never take off

[syn3rg]

I guess this is the best this spammer could do since the sendmail patch.

He wrote sendmail

[Anonymous Coward]

As the subject says. Eric is the creator of sendmail.

http://www.sendmail.org/~eric/

Economic mechanisms don't need to impose a cost

[ajb44]

...because the 'email' economy doesn't have to connect to the real economy, as long as you (or your ISP) sends roughly as many emails as you receive. Which is true of personal emails. Genuine mailing lists would need a free pass, which could be set up when you opt in. ISPs Of course, an ecash mechanism imposes a cost in CPU cycles. But spam prevention doesn't need as strong a mechanism as the real economy: even if the spammer manages to spend each incoming email 100 or even 1000 times, they still can't send enough to make money. Maybe an ecash algorithm can be devised to take advantage of that. The real problem is adoption. Unlike filtering, the above has to be applied to all or most of the email system; people can't adopt it on their own and expect to get any benefit.

No, not really

[doug]

He doesn't provide material directly to the combatants (spamers and spam fighters), but is more interested in helping the people on the ground. Think of it as support for NGOs like the Red Cross or Doctors without Borders. His software is used by both sides, but in real wars aid convoys get ambushed routinely.

At worst he'd be a medical or pharmacetuical company selling to the victims.

I think it is clear which side he wants to win, but his efforts are more dedicated to keeping email functioning than fighting spam

Re:No, not really

[catman]

more dedicated to keeping email functioning than fighting spam

Is there any way to keep e-mail functioning without fighting spam? (Of course, we could just give up and go back to FIDOnet ... )

Secure email protocols won't help.

[Anonymous Coward]

It sounds like a good idea on the surface, but it won't work.

I got hit by a spammer last week who was changing his host names every couple of messages. And not just on the envelope - he was changing 'em in DNS because he had his own nameserver! He got shut down by the mid-level carrier after about 12 hours, during which my servers received thousands of messages that I had to block by IP. Today, though, I am getting the same stuff, now coming from a cracked cable-modem user.

Hundreds of the spams that hit here every day are sent from cracked systems connected to Comcast, RoadRunner, and Verizon DSL.

If you allow anyone to send mail, regardless of how that mail is encrypted or secured, the spammers will find a way to illegally take advantage of that legitimate mailserver and send their trash.

This is because they are criminals. Not "legitimate businessmen" and not "entrepreneurs exercising their freedom of speech". Criminals who purchase accounts with stolen credit card numbers and move on as soon as an ISP shuts them down.

Re:Secure email protocols won't help.

[Skapare]

Did he have THAT many domain names to put in the reverse DNS? You did check each of those names in forward DNS to see if the address record matches the connection, right? Can you extract a list of those domain names from your logs?

Re:Secure email protocols won't help.

[Anonymous Coward]

Yep, that's how I (and other complaintants) got his DNS server shut down.

He'll come up with something new tomorrow, though, and until there is some meaningful punishment for his crimes he'll continue to commit them.

That already exists.

[Alioth]

That already exists.

It's called the Distributed Checksum Clearinghouse (http://www.rhyolite.com/dcc). I use the DCC as part of my SpamAssassin configuration (sitewide, called by Exim) and around 85% of spam I receive is already listed in the DCC. The latest version (2.60) of SpamAssassin, plus the SBL plus the DCC works as a very effective shield. My JE (link in the sig) describes my recent experience with SA 2.60.

Re:That already exists.

[Kphrak]

Make sure you use the DCC with SpamAssassin rather than merely alone, though (sounds like you don't have this problem, but just for the education of other readers). The shorter and more filled with garbage a message is, the more likely DCC will not be able to form the same fuzzy checksum as a different message.

Re: list are shared

[Anonymous Coward]

I had to kill one of employee accounts a few weeks ago because she had clicked on an unsubscribe. I do all I can [spamassassin on webhost, mercury32, popfile, and my eyes] but that one got thru.

A while back I ran across site that had been putting together who owns/sells/buys what. The jpg prints on 40" X 105" which is bigger than our HP755C [36"] and guess what the center blocks are comprised on only about 5-6 people.

The currrent regs/laws say if I "unsubscibe" that business can not send mail but says nothing about giving the "validated" info to all its child orgs and then passing it own.

Your another here suffering from TWHUA [talking with head up ass].

Fraud and the money trail

[swb]

If the government would enforce the laws against fraud, deceptive advertising and some of the outwardly criminal schemes advertised via spam by following the money trail, it should put a big dent in the spamming business, perhaps enough that the trailer-court spam king seen on Slashdot lately would have to figure out something else to do.

I do not believe that a "do not spam" law would work; at worst, the law of unintended consequences guarantees we'll end up having to give John Ashcroft a sperm sample to get a license to run a mail server due to the slippery slope of regulation. At best, we'll have an empty law that punishes no one.

Instead we've got Ashcroft forming an American Schutzstuffel to protect us from ourselves, and his big anti-crime initiative is to go after people that make bongs. Gee, I feel safer already.

As long as people willing to commit fraud or other "entrepenuers" feel they can lie, cheat and steal via email with no consequences they will, and someone will be willing to deliver the message for them. Get the seller via the money trail and you stop the spam, and can probably nail the spammer as an accessory as well.

Re:Fraud and the money trail

[pmz]

give John Ashcroft a sperm sample to get a license to run a mail server

Please don't cast Mr. Ashcroft with the money shot. The reason porn works is that people want to watch it.

Junk Class Mail.

[Mr Coffee Cup]

I didn't see a real definition of spam in the article. (I did RTFA, but I'm on my first cup of coffee.. it might have been there, bear with me)

The first question was, "What is spam?" This is much harder to answer than it at first sounds. For example, some people define spam as "any e-mail I don't want to get," even if the mail is for a list that they really did sign up for. As one panelist pointed out, some people really do want to receive pornography. Most people agreed that getting a newsletter that the recipient has actually requested is not spam. My personal take on the only "reasonable" definition comes down to consent: If you request that you receive something, it's by definition not spam. However, reselling such a list may or may not result in spam, and not everything unsolicited is spam.

It occurs to me that spam is better defined by the sender's intent rather than by the victim's lack of interest or want of it. I'd define spam to be randomly targeted bulk e-mail, similar to junk snail-mail. A blanket coverage message. The sender intends to sell the reader something, be it a product, idea, etc. I get bills in the mail all the time that I don't want, but they're different than junk mail in that they require attention, and are specifically targeted.

Re:Junk Class Mail.

[Anonymous Coward]

It occurs to me that spam is better defined by the sender's intent rather than by the victim's lack of interest or want of it. I'd define spam to be randomly targeted bulk e-mail, similar to junk snail-mail.

The problem is that the bulk emailer probably considers his list focused. In fact, if probably is: focused on hotmail users, people who have posted in thus-and-so newsgroup, visited a particular web site, or even just real addresses. A sender intent on selling something can justify just about any means to accomplish that goal.

Person to person communication in the future

[Filik]

Darn, article got slashdotted before I could read it, so this reply is just general musings.

The spam problem has to do with the whole future of person to person communication, as well as the whole future of adverticement. Whichever way it will be solved, a very likely outcome is that in 10 years it will no longer be possible in any way to get in touch with someone you don't already know from outside the Internet, and the first decade of Internet will be looked back upon with nostalgia as the only decade of totally free communication. This is because the real problem lies in the initial contact.

You might argue that we can still communicate via boards, chat channels and similar things, where you can give out crypt-keys to those you wish to continue communicating with, but remember that these will be the next target for adverticing after open email collapses. I'm sure adverticers will even write AI's to simulate people so that they can lure the crypt-keys from innocents.

Product exists

[TheMidget]

then ISP's could subscribe to the "lookout server" list and delete any messages that have been designated as spam?

I think such a product already exist. Lemme remember the name of the company that makes it... soft-something? Ah, there I remember: Softmicro!

SQL injection

[TheMidget]

I've occasionnally looked at spammer's database schema's and indeed many do have procedures in place to remove your address when you unsubscribe. Moreover, your address is then often enough added to a "blacklist" whose apparent purpose is to prevent re-adding of your address to the distribution list.

So, using an unsubscribe link could work with those. Not sure however, whether typing ' or ''=' into the unsubscribe box would work: even the dumbest spammers have backups, unfortunately.

SPAM filtering technology

[scovetta]

I just installed a spam filter for the first time, SpamPal. However, of the 50-70 spam messages I get per day (and perhaps 10-15 non-spam), it flags non-spam around 1% of the time, and lets spam through about the same percent. I can handle a few spams a week.

So my question really is, is the state of spam-filtering still improving, or have we reached a plateau where the spammers will just find more and more ways of defeating them. Much of the spam I receive contains characters like: Viagra so the filtering is a bit harder.

Re:SPAM filtering technology

[Frit Mock]

Try to filter a mail, that consists of a small html body, just to display a gif-image (the actual content) contained as attachment.

If you manage that with OCR, then the spammer might send a puzzle of images ... or send a little JScript, that decryp an attached crypted binary ... or, whatever neccesary to bypass existing filters.

A filter is a filter, some things pass others don't. If spam doesn't pass anymore, the next generation of spam that pass existing filters *will* be constructed.

So the answer is, yes, spam filters constantly improve, but no, you won't notice any improvement.
What you will notice is an increasing number of spammails, as one counter measure from spammers to ever more filtered mails and a race on spam/antispam arms.

Re:SPAM filtering technology

[spitzak]

But it should be pretty easy to filter out attempts to hide the text this way. Don't forget the filter has access to the actual codes in the mail, not the resulting image on the screen.

Re:SPAM filtering technology

[Anonymous Coward]

Spampal is in bed with Bill Gates... looks like it ONLY works on WinBlows systems.... Yukk! I'll stick to SpamBayes...

Re:SPAM filtering technology

[General Fault]

Can we use the DMCA on our side here? I hate that law too, but maybe we can try to kill 2 birds with one stone. I am expecting a little criticism here, as I am not a lawyer and I have not read the entire DMCA yet. However, I have heard about some of it's implications. One of those (as I understand it) is that anyone who tries to circumvent a security system is acting illegally. A security system is designed to keep information either in or out of a system (i.e. keep viruses, Trojan horses, etc. out and critical information from getting out). So, would a spam blocker be considered a security system? It keeps unwanted information out of a system. Can we throw the DMCA back at those who created it by suing spammers and businesses that have used techniques to circumvent spam blockers?

Slashdot site mirror

[gvr]

Why doesn't Slashdot mirror articles? The slashdot effect, while being somewhat charming, is frustrating. As long as slashdot would respect the "Disallow: /archives" robots.txt tag this should be ok, no?

I assume I am not the first person suggesting this, but anyway...

Re:Slashdot site mirror

[CmdrTHAC0]

Try reading the FAQ sometime; it's a great resource. It'll tell you all about the legal issues surrounding a Slashdot mirror.

White listing

[Blackknight]

White listing may be the only way to go. Have a list of people that are allowed to send you messages in your mail client, which would drop mail from them straight to your inbox. Anybody not on the list gets dropped to the Junk folder, which you could sort through and add the people you wanted.

Re:White listing

[Frit Mock]

I agree, explicit permission is the only way to go.

But there is a major disadvantage. You do more often don't know who will send you are email, than you know.

Just look at your mails at work, how often they are forwarded/replied between different people who actually did not know before.

You forward a complaint from one of your customers to your buisiness partner, but the guy recived the mail can't help and forwards it to the an expert. The expert needs some more information from your customer ... and then?

This example will become realy complicated communication, with whitelists ... Your customer either takes the good ol' phone or is a lost customer then.

Spammer logic?

[Garwulf]

I honestly don't understand the logic of spammers. I've been contacted by a spamming service before (they spammed me offering their services), and it just blew my mind.

At this point, I think there is a mass-marketing laziness about the entire thing. In order to get the spam email through all the filters, you have to have a fake email address. You also have to keep changing email addresses, as the filters will pick up on your email address and you'll only get to use it once or twice at best.

And yet, with all this in mind, I still have received more than one spam talking about how wonderful spamming is as a marketing tool. Reach hundreds of millions, they advertise!

And in reality, get ignored by them.

Partial solution

[Epeeist]

Personally, I don't buy that that is true, but it's completely irrelevant to my point. Even if most spam does currently originate in America, if the U.S. somehow passes and enforces an effective anti-spam law, there is effectively zero cost involved in these spammers moving there business out of the States and still spamming Americans.

This is only half of it. Apparently much of the spam received outside the US originates from Florida. I can't see this changing, even if the US passes an anti-spam bill since it will presumably only apply to spamming Americans.

What it needs is a multi-lateral agreement. Perhaps it could be done through the UN ;-)

Covern military action is ok with me...

[Anonymous Coward]

Laws are only effective if the punishment is strong enough deterrence. It is what keeps the chaotic neutral in check (I being one of them). A do not spam list will only give the disreputable a list of good targets, hoping to catch that 1 in a million, drunk, at the pc, with a Visa card. I believe legislation only works when it has teeth.

And as for educating lUsers, don't waste your time. Unless it is with a spam campaign?? Or perhaps threatening lUsers with hostile military action??

Die spammers Die /.end pipe dream./

Email DNS, Web of trust etc..

[Jan Venema]

An email should be registered. Older emailaddresses could be more trusted than super new ones.

If everyone would just ...

[Skapare]

"If everyone would just ..."

I hear those words about spam and proposed solutions all the time. But the fact is, and will always remain so, that you cannot get absolutely everyone to do so (whatever that might be).

Consider the first possibility: "if everyone would just stop sending spam". Most of the spam comes from about 200 or so different spam gangs. Most of the rest comes from a few thousand naive victims that try it once or twice, get cut off, and never do it again (and thus losing their investment into the spamware and "list of millions" they paid some spamgang for). Already, 99.999% of internet users do not send spam. A solution that requires getting so close to a percet 100% just isn't possible.

Now for the second possibility: "if everyone would just stop reading the spam and buying from spammers". Spam works because the costs to spam senders is so utterly low, that even sending to every internet user is a lower cost than trying to trim the list down to those few people that really want what the spammers are peddling. This goes along with "just press delete". But it doesn't take much in response for the spammers to actually make a profit from their spam runs. And spammer's for hire are making money even if their clients lose money, so as long as there is a supply of naive vendors who are willing to part with their money to get a spam run in their name, spammers profit. Again, this is a case where closing the gap between 99.99% of people who don't even read the spam and the 100% needed to make spammers and their clients go away, is just not going to happen.

But there is a third possibility: "if everyone would stop using ISPs that permit spam". If even so much as 50% of users who are using ISPs that permit spamming were to cancel and switch to a better ISP that doesn't, that would definitely have a substantial effect on that ISP. I bet even 10% would get noticed, although I think a bit more, like 25%, might be needed to get some of the worst ISPs to act. Of course many people do whine about things like "there is only one ISP here" (not anywhere near 50% face this problem) and "it costs me money to switch" (it costs the victims of spammers even more money for you to continue to support an ISP that is able to give you a discount by accepting pink money from spammers). If we were to simply identify the top 10 worst ISPs for permitting spam to come from or through their network, and get a whopping 25% to 50% of their customers to leave (preferring to go to the top 10 best ISPs for not permitting any spam in or out), this would make a substantial impact and cause some CFOs to panic. And this doesn't require anywhere near 99% to be a successful anti-spam campaign.

The above campaign can also be pushed harder if many of us refused to accept email from those ISPs (and thus anyone in their network) as a sort of boycott against spam support. Of course there will be whiners here, too saying "You have no right to block my email since I don't send spam" (but if they are supporting a spammer anyway, guess what).

My whole point is that we need to avoid any "solutions" that make it necessary for absolutely everyone to do something. There will be plenty of people that won't. Instead, the solutions we need are the ones which only require a practical number of people to take that action. If you don't like the ones I propose, then propose your own and say how many people would have to act to make it work.

Re:If everyone would just ...

[pmz]

"If everyone would just ..."

I hear those words about spam and proposed solutions all the time. But the fact is, and will always remain so, that you cannot get absolutely everyone to do so ...without tyranny. Therefore, the fallacy of the Democratic platform.

Re:If everyone would just ...

[curunir]

If everyone (where everyone is the three single entities of Microsoft, AOL and Sendmail) would agree to implement a compatible HashCash solution (spec publicly available, of course), then SPAM would be prohibitively expensive (too slow since the sender is paying in CPU cycles).

As soon as you cross the threshold from profitability to loss, SPAM all but disappears from the internet. And unlike your "If everyone just..." scenarios, the everyone I'm describing is actually realistic.

Re:If everyone would just ...

[Anonymous Coward]

ISP's are doing everything they can to stop spam, their main problem is their Naive users, stupid enough to open attachments infecting their PC's, turning them into Spam Proxies.

So, when you get spam from a particular ISP, this spam is not because the ISP "permits" the spam, it's because their customers are clueless and open attachments and use buggy operaing systems like WinBlows making it so easy for them to do these stupid things like open attachments, not patch their OS when a new bug is discovered, or whatever.

Of course ISP's COULD be a little more pro-active in educating their users about the dangers of opening up unknown attachments, or offering their users a link they can go to eliminate their infections. They ALSO could get a little more agressive in cutting service to those stupid peope who DONT dis-infect their machines and remove the trojans.

Re:If everyone would just ...

[Skapare]

Certainly some ISPs are doing all that they can. Most are not. For example, those that do not block incoming connections to known proxy ports are not doing all that they can. So when I get spam from a particular ISP, this spam is very often because the ISP is not doing certain things it could do to prevent or at least significantly reduce spam. Another thing they can do is to block both inbound and outbount SMTP (except to the ISP's own mail servers or own network) to customers that don't ask for an exemption (spammers might do that, but most of the problem is from people who wouldn't know what SMTP is). This would prevent connections that bypass the ISP mail servers. Then by adding throttling to the mail server that limits numbers of outgoing mail from a single customer, they can reduce the problem in cases where the spammer directs it through the ISP mail server.

I do block the generic (e.g. DHCP, dialup, etc) addresses of ISP customers. This does, unfortunately, affect smarter people with better managed home (or business) mail servers. If the ISP were to allow them to have valid reverse DNS on their static IPs, my blocking, which is based on domain name, would not affect them. And if the ISP were to NOT put their own domain on reverse DNS of any customer with SMTP enabled, and such a customer spammed, I could block that customer by their domain name instead of the ISP.

But too few ISPs are clued in about all the steps they could do to prevent spam, reduce spam, and make it easy for others to prevent spam. That, or their PHB bosses wear too much clue-teflon.

Re:If everyone would just ...

[Anonymous Coward]

No, they're not doing everything they can. They're doing the absolute minimum possible to stay in business. Spamblocking is a business blackhole that can suck your morale and capital quite dry.

In most cases of spam these days, the spammer is either using a throw-away account ($20 or one-month free subscription, not a bad rate for sending out 20,000 ads), or bouncing their spam off some other sucker's unsecured SMTP server. And they can continue to operate for at least a few spam runs, if not for many months, from that throw away account because ISP's lack the resources or refuse to exert the resources to track, verify, and expunge spammers.

Necessary policies to fully block spam including blocking port 25 to client addresses, blocking port 25 from clientn machines except to the ISP's mail server, keeping logs of DHCP client use to determine who exactly sent a spam, etc., etc. It's a hell of a lot of work and will cause a lot of screaming and even lost business from their customers.

Spam is spam

[F4Codec]

I doubt there will ever be an effective defense against spam, just like its predecessors we really haven't solved the overall issue of identifying it or making it unattractive to the sender.

Some random points to ponder:
1) What is spam, one mans spam is another mans ham, so there is NO universal measure (although some good approximations).
2) We've never managed to shut down the telemarketers cold calling. There not too much of a nuisance (depending on your definition of nuisance - why do they alsways call at meal times?) as they have to pay a significant cost per call, and automation is largely unsuccesful.
3) Junk mail is also costly to send, compared to email, and I still get lots of that.

I suspect the real answer, much like with junk mail, is to move house occasionally. It feels rather like giving in to me though.

Luckily this is easier with email than real life, but still a royal pain. Meanwhile bayesian filtering is the best I've found so far.

Re:Spam is spam

[Anonymous Coward]

2) We've never managed to shut down the telemarketers cold calling. There not too much of a nuisance (depending on your definition of nuisance - why do they alsways call at meal times?) as they have to pay a significant cost per call, and automation is largely unsuccesful.

The combination of an unpublished phone number and Colorado's Do Not Call list have reduced my telemarketer calls from about two per evening (that was with an unpublished phone number!) to essentially zero. Telemarketers can be beaten, if certain clueless judges would respect the difference between "Freedom of Speach" and "Forced to Endure Harassment".

Email Marketing Works, Spam Doesn't

[johnnyb]

I think the thing that will kill spam is the success of email marketing. I work at a company that does email marketing - i.e. - VERY targetted campaigns (usually under 1,000 recipients, most of whom have some sort of business relationship with the client), easy ways to unsubscribe, always a valid reply-to address, etc. The results are great - we usually get about 80% opens and 10-30% click-throughs. We have one list/service that has 1,000 emails and gets 500 click-throughs when we send to it!

I get frustrated when I hear about ClickZ calling an email campaign to 800,000 people, where many people got the email up to six times, and they got a 4% open rate with a 4% click-through rate OF THE OPENS (i.e. - a 0.16% click-through rate), and called it a great success. Email marketing is a great tool, but spam really hurts it.

For example, I _love_ getting my email at half.com telling me that a book I want is available at the price I was looking for it. It doesn't even seem like marketing. It's cheap, trackable, targetted, and they can load it with whatever other marketing message they want, too.

Anyway, one thing that annoys me about slashdot is that everyone seems to think that all email-marketing is spam, when there are at least some of us that are trying to do the right thing.

We actually have customers that we tell them _not_ to use our service because they don't have a legitimate list. We tell them to start right now and get everyone's email address they can - have places on every form for people to get their email address, have a "newsletter sign-up" link on their website, etc., and then call us in a year with the list they put together and we'll help them with a campaign.

Troll????

[Anonymous Coward]

why is this a troll again?

i sincerely do not understand 90% of slashdot moderations.

THE SOLUTION TO SPAM IS INFORMATION

[defile]

The easy solution to spam is to make the identity of the spammer known to all.

Do their neighbors know that they live next door to a spammer?

When a customer walks into your store, do you know if they are a spammer?

When someone hits on you at a bar, do you know if it's a spammer who is hitting on you?

When you're on highway patrol and catch someone speeding, do you know if is the spammer that is speeding?

When you walk down the sidewalk and pass by a car parked on the street, do you know if it is the spammer's car?

When your kids go to school, do they know the spammer's kids?

When you are delivering (paper) mail, do you know if it is the spammer's mail?

When you are serving food to someone, do you know if you're serving food to a spammer?

When you receive a call to 911/poison control, do you know if this is a spammer calling 911/poison control?

Spam is a community problem, and the community is the one best able to deal with it.

All the community needs is information.

The problem will solve itself.

Re:THE SOLUTION TO SPAM IS INFORMATION

[Anonymous Coward]

s/spammer/communist/g

and welcome to the new millenium witch hunt...

The society cannot work on an "eye for an eye" justice system.
Why not also include spammers contractors ? Or ISP profiting from spam ? Or viagra customers (after all, they are voting for more spam with their money). Or any other lawbreaker ?
I see it clear : "You've been found guilty for stealing an album 10 years ago, and now you complain that you can't visit any music dealer ?".
Why not lapidation while you're at it ?

Just plain stupid.

I used to work at Sendmail, Inc.

[rossz]

In their configuration management department - until they laid off 40% of the work force. It was a nice place to work. That was my last permanent position. Nothing but short term contract jobs since then.

Eric, if you're reading this, I could sure use a job.

It's www.paulgraham.com actually...

[Zed Too]

Try www.paulgraham.com instead. The .org address is a photographer in Glasgow :-)

Teaching a spammer through a 15-inch hammer

[Anonymous Coward]

At best, we'll have an empty law that punishes no one.

No, at best, we'll rather have a law that means jail time at least for recidivist spammers.

They need some drastic illustration of the harm their "business" can do.
The proverbial one night with Bubba in Cell Block 3 should finally teach them to never ever try and sell penis enlargements again. Oh, and by the way, please webcast close-up video account of their experience to that lovely town of Spam Haven (somewhere in Florida IIRC).

Make your lawmakers make laws... Call your congresscritter now!

Re:Teaching a spammer through a 15-inch hammer

[swb]

Yes, it'd be great if it was that simple, but you have to remember that once lawmakers and marketers and everyone else gets their hands on it, you'll have to come up with real specific definitions of "spam", "opt-in", "requested" and so on. Don't tell me these are any more immediate and obvious than things like "obscenity" and "pornography", which we STILL can't figure out how to define.

And don't belive for a second that they'll criminalize this anymore than the do-not-call list was criminalized; it will only be a civil violation, with plenty of corporate shells to take the blame, default on the fines, and so on. A couple of spammers might get nailed for ducking the law via corporate shell games, but you can bet the violations will be other laws (tax, corporate governance, etc), not the "spam law".

Besides, most of what spam is is already *illegal*, we're just not working very hard at enforcing the criminal fraud laws we have now. More laws to layer on top of the laws we don't/won't enforce now isn't the answer. That's the big government way and it leads to madness.

What about conspiracy?

[Jetson]

Even if most spam does currently originate in America, if the U.S. somehow passes and enforces an effective anti-spam law, there is effectively zero cost involved in these spammers moving there business out of the States and still spamming Americans.

The solution there is fairly simple. Spammers have a product they want to sell. That product will usually originate in the country where the spam recipient lives (ie: U.S.A.), so even if the spammer hides behind foreign remailers you can still identify one of the parties that are within U.S. jurisdiction. The government can therefore lay a charge of "conspiracy to deliver spam" against John Doe and the U.S.-based company that contracted the spammer.

Re:What about conspiracy?

[DA-MAN]

Yeah but this sounds like a good way to put small companies out of business.

For example, say I sell cheap wireless aps online @ cheepaps.museum. Someone other geek who failed to recognize me as the alpha geek in High School decides to spam for my business in the hopes that I will face a lawsuit. I get sued under "conspiracy to deliver spam". I then gotta get lawyers involved and fight to keep my business going. New alpha geek takes command!!! See how this sucks for me! See how this could be an attack on anything but the largest of companies with tons of cash in the reserves!

Re:What about conspiracy?

[Anonymous Coward]

This is why the ghods invented PGP signatures, to authenticate your transmissions. No spammer wanna-be should be able to use that.

Moreover, it would be a violation of the Electronic Communications Privacy Act, since it would be both forging your communications and attempting to interfere with your *other* communications. And since you're a business with a real product, you're likely to get a far more usable response than the usual circular filing performed by law enforcement about existing abuse.

For example, it could be considered wire fraud, since it actually involves money. If it exceeds roughly $30,000, you can probably get the Secret Service involved and get them to subpoena the spam-sending ISP (if it's in the States), or at least make a phone call to Interpol and ask them to do it.

By the way, this kind of abuse is called a "joe job" and is an old problem dealt with by plenty of anti-spammers.

Re:What about conspiracy?

[DA-MAN]

> This is why the ghods invented PGP signatures, to authenticate your transmissions. No spammer wanna-be should be able to use that.

I don't know of any spammer, wannabe or not, that sends spam with pgp signatures?!?! What in the blue hell are you referring to?

> Moreover, it would be a violation of the Electronic Communications Privacy Act, since it would be both forging your communications and attempting to interfere with your *other* communications. And since you're a business with a real product, you're likely to get a far more usable response than the usual circular filing performed by law enforcement about existing abuse.

Spammer already interfere with every day communications by getting real domains blacklisted all the time. This doesn't stop them, and although it is illegal, when was the last time you heard about a sting operation of a suspected spammer!?!?

Slow Email DOWN

[wonkavader]

The key is not to whitelist, blacklist, etc. The key is to make mass emails impossible.

The answer should be obvious. What do you care if your email to your Aunt Millie takes 20 seconds to send?

All sendmail or other mailers should demand a pain-toll before allowing you to pass. The toll should be plug-in, so that while there's always the first (common) one to fall back on and so new ways to get approval (such as $-based, blacklists, whitelists, etc.) can be added.

But at core, the common one should be a painful calculation -- a large public/private key handshake, for example. If the spammer has to buy a Cray to send out 10000 emails, then WE WIN.

The problem with this is that it demands a sendmail replacement. Everybody needs to have the sending component to get email to those with a pain-toll-based recieve version.

But the advantage is huge. Imagine a world where you can decide to allow all emails in for either:
a. A 10 cent donation to UNICEF
b. Those with a public key in your database (known firends/whitelist)
c. Those willing to do a 10000 byte key encrypt/decrypt function (one which goes fast on YOUR end).

SPAM as we know it simply GOES AWAY.

I would hasten to add that actual $-based systems can be added but are entirely optional.

Hey!

[Anonymous Coward]

As you might imagine, he's on our side, and he does a good job of clearly describing the current state of spam, and the possible solutions."

I'm a spammer, you inconsiderate clod!

Re:Hey!

[Anonymous Coward]

You're a spammer, you inconsiderate clod!

OMG!

[Anonymous Coward]

Then I can't become rich by helping out the family of a deceased Nigerian warlord? WHY are u people SO selfish??

Direct link to FAQ answer

[bartash]

Come on Taco, help him out with a direct link to the FAQ!

I must say I am frustrated this morning at not being able to read the
article. Acmqueue seems to be complete toast.

Would someone please post a mirror site!

[Anonymous Coward]

All I get is:

Fatal error: Call to undefined function: message_die() in db/db.php on line 88

When I try to access the link. I really want to read this, can anyone help?

HashCash has some limitations

[Skapare]

HashCash has some limitations that make it unworkable in the wild. The one I noted is that it is necessary for the recipient (e.g. the one who is trying to cut back on the costs imposed by spammers) to keep track of the stamps that have been spent, up to the expiration period. Further, the costs imposed by spammers are still imposed anyway, if the server is not the one verifying the stamps (and thus also keeping a database of spent stamps for every user it serves).

HashCash would also be a burden on legitimate mailing lists. Of course, to solve that problem, whitelisting of the mailing list would be used. But it tends to be inconvenient to whitelist during subscription. This could be solved by using the HashCash only on the initial signup confirmation, and whitelist thereafter for the bulk mailings. But this still has a problem. I get lots of spam already that mimics mailing lists I am on, using the mailing list itself as the sender, and my tagged email which I signed up with as the recipient. So having whitelisted it lets the spam in, and spammers will make more use of this technique by including such details in their spam lists.

If HashCash could be modified to also include information only the real sender can prove she has, without revealing it in the ability to verify it (e.g. PKC), that might help.

Visa Spam Flag

[DotDotSlasher]

Here's a spam-fighting idea - I haven't read of ideas similar to this one.
Not all spam wants you to spend money using a credit card (CC). But for those that do, allow a CC transaction to be labeled as "Spam".
This CC transaction is essentially contested by the customer contacting the CC company, providing a copy of the e-mail and details about the transaction. The CC tells the vendor that the customer really didn't want the item, instead the customer wanted to "tell" on the vendor -- that the vendor is sending spam.
Vendors with too many transactions labeled as "spam" have their accounts terminated.
Yes, there are holes in this: people angry at a company could tag transactions with that company as "Spam". Spammers could advertise for vendors that have no idea that customers are being led there via spam. It can be a pain to go through the entire buying process. Most sites these days require the CC's matching billing address be provided. The item could have been delivered by the time the vendor is notified.

(hmm... maybe it needs some work)

SPAM is NOT a federal or state problem

[gone.fishing]

State and federal laws will not eliminate spam. It is nice to have these guys on our side but spam is bigger than the federal or state gevernments. The bad buys will just move off shore to avoid the laws if they are enacted.

Like it or not, the internet is anarchistic in nature and it allows both good and bad things to happen because if that nature. Spam to me is like pollution, it will take the cooperation of many nations to bring it under control and it is doubtfull that even if that cooperation happens that it will be eliminated.

I don't think that the internet is ready to hae a real but virtual government although a set of virtual laws regulating spam and other criminal behavior that could be enforced across international boundaries would be nice it would also be restrictive. The politics would ruin the potential of the internet and it would be a nightmare to make fair for everyone.

For the time being, yes we should have local, state, and federal laws passed that regulate spam but some of the responsibility should be put on the user's end. The laws could require ISP's to filter UCE and they could require tools be built into email clients that would allow recipients to submit (report) the UCE that they recieve to a central repository that the ISP's could draw their filter info from. This would be analagous to the reqirements put on automakers to prevent pollution. As motorists, we are required to purchase unleaded gas and to have catalytic converters.

slightly OT: uce@ftc.gov = disk full

[Anonymous Coward]

Today, when forwarding the usual spam in my inbox to uce@ftc.gov, this is what I got back:

----- The following addresses had permanent fatal errors -----
uce@lhasa.ftc.gov
(reason: 554 Transaction failed, No space left on device)
(expanded from: <uce@ftc.gov>)

----- Transcript of session follows -----
... while talking to localhost.ftc.gov.:
>>> DATA
554 5.0.0 Service unavailable

...at least now I know, they didn't send it automatically to /dev/null.

:-)
ms

MOD PARENT UP

[Anonymous Coward]

That's a rather cogent observation... sorry I don't have mod points today.

Spam - The Screwfly Solution

[Mike Van Pelt]

I'm coming to the conclusion that what is necessary is to attack the "making money" part of spam. One way that might work is similar to the "release gadzillions of sterile loathsome parasites" method that eradicated the screwworm fly in the U.S.

Or, spam them back.

If the spammers get hundreds of thousands of bogus requests for more information or signups on their web page (signing up other spammers, of course) for every legitimate one, they could never find the dollar bills buried in all the crap.

What it would take would be an Eliza-like program to convert a spam into a request for more information, and (more complicated) a program to download a web page, find the form, and fill it in with data that looks legit enough that it will take a human followup attempt to determine its bogosity.

Yes, this would result in more network traffic wasted in the short run. In the long run, if it were to make spam uneconomical, it might be a net gain.

Turning the tables?

[John Bayko]

I had a thought recently.

If people would be willing to fundamentally change the protocol used for email, there would be a pretty simple solution for Spam, and untracable email in general - sender-hosted email.

The fundamental problem is that email is sent to a receiving server immediately, which receives it without much in the way of caring where it comes from. The sender might be illegitimate, or even gone by the time the receiver checks the email. The receiver pays for the storage resources - this is receiver-hosted email.

The solution is a protocol that doesn't sent email - rather, only a header is sent, and the message itself is stored for retrieval on a host that the sender runs, or pays for. The header contains the reference to the waiting message which is retrieved when the receiver wants to read it (and marked as read so the sender can automatically delete it).

What this means for spam - the spammers pay for their own email servers - no free rides. The mail is absolutely tracable - it must be on the specified server to retrieve it. And if the spammer account goes away for abuse, so does the email - spammers can no longer shotgun a million messages from a sacrificial account.

Security issues would be more of a problem, but are fairly easily solvable.

Alas, I have no time to pursue this idea. Too bad, 'cause I'm on the verge of just giving up email entirely.

Re:Turning the tables?

[Anonymous Coward]

The problem is that this is very easy for spammers, and very hard for filters.

The spammer can send a huge number of headers and then just provide a server returning a single, static message. Or a set of a few tens or hundereds of messages, even returned at random. You don't need a lot of server power or capacity to serve the same content to millions of people; you do need bandwidth, but not much more than spamming has required before.

Considering that many spams contain links directly to websites (and that there needs to be contact info to actually sell contacts), neither the bandwidth nor the traceability seems to be an issue to spammers.

So the only thing that might help is the possibility to shut down the spammer before many of the recipients get their mail. I don't think ISPs are quick enough to react for this to be significant, especially the ones that spammers sign up with...

As for filters, for them to work, the body of the spam must be available. Of course this solution should probably make filters unnecessary, but it doesn't seem promising enough in other respects...

BTW: If you're seriously on the verge of giving up email, consider using one of the recent Bayesian filters. Properly trained, they are getting to the point that you can expect one or two spam messages to get through (false negatives) per week, and zero false positives.

don't shoot the messenger, shoot his client!

[tri44id]

At least Allman has an excuse for focusing on protocol-oriented fixes -- he practically invented mail transfer agents. But any remedy that focuses strictly on email delivery systems will fail.

Spammers will exist as long as somebody pays them to send unwanted messages. Any legal or economic remedy has to allow for the punishment of companies that use spam for advertising, in addition to the delivery service. Kill off the customers, and the business of spamming will become much more difficult.

Focus on opt-in vs opt-out solutions is also half-baked. You probably don't know whether you've ever opted in to an agreement containing fine print that says "this agreement establishes a transferable, ongoing business relationship". If you have, then you're toast regardless of any existing or proposed law, since there's no real control over what the European Union's privacy framework calls "onward transfer" of information unless what's given once can later be taken away.

Do-not-spam lists will not work effectively unless they contain provisions to retroactively revoke any previous permissions. Requiring annual renewal of any opt-in permissions is probably going to be necessary.

"double opt-in" ?!

[Anonymous Coward]

"The first, double opt-in, requires that a subscriber e-mail two messages to get on a list. The first message requests addition of thus-and-such address (this first message can be done via a Web form, e-mail, or even scanned badges at a conference). The list owner then sends a confirmation ("challenge") message saying, "If you really want to subscribe, reply to this message"--usually with some random number in the subject to prevent guessing. Only when that reply is received is the address added to the list."

This is not "double opt-in", this is "confirmed opt-in". Accept no substitutes.

The second is confirmed opt-in. It works exactly like double opt-in, except that the confirmation message says, "You have been added; do this if you want to unsubscribe."

A more accurate name for this would be "confirmed opt-out".

What about educating people not to fall for it?

[Yogurtu]

After all, the one main reason we get spam is that spamming is profitable. If people stop ordering Viagra and cable descrambles from strangers who email them, there will be no point in keeping it up. Maybe we should make it easier for ppl to have anonymous access to sleaze, which seems to be the major selling point of spam.