Time-travel Spammer Strikes Back

HopToit writes "Robby Todino is apparently upset about being outed a couple months ago as the source of all those wacked messages about 'Dimenstional Warp Generator Needed.' According to Wired, someone has pulled a major joe-job spam attack (forged 'From:' lines) on three popular sites in retaliation for making fun of Todino's goofy search for alien technology. Robby, if you're out there, you have ceased to be amusing."

Comments

Sore Loser?

[General Sherman]

Like all good bond adversaries, this one won't die.

Re:Sore Loser?

[crossconnects]

Redundant??!! It's the first relevant post!!

Re:Sore Loser?

[`Sean]

Like all good bond adversaries, this one won't die.

And, like all good Bond adversaries, this one has a nice secret hideout in Woburn. The 4 Oak St. address in his whois info is bogus. 4 Oak St. doesn't even exist. Oh, no, I found his secret hideout by scouring Google, showed up on his doorstep, and he denied being Robert Todino. Jim Todino, however, seemed to be quite perturbed by the fact that I was standing there.

It was amusing at the time but, now that you mention Bond, it's laugh out loud funny. I had the tall and extremely badass looking trenchcoat-clad sinister villain (Robert, I presume) standing in the doorway with the smaller sidekick (Jim) behind him covering his back. Like most adversaries, the sinister villain was cool and collected where the sidekick was stumbling for words.

Wacky.

Anyway, my account of being one of the forgery victims of Robert is on my blog.

spam is beginning to be a real problem

[cft]

It seems that everyone in his right mind despises telemarketing. Spam too. Ask anyone, and they'll tell you that there are few things they hate more in life. It seems as if there are no exceptions to this rule -- everyone, bar none, hates telemarketing and spam.

But it can't be true. Someone must be responding to this stuff by spending their money. Because for some reason, telemarketers and spammers stay in business. Somehow, it must be worth it for them.

If everyone hated the stuff as much as they say they do, if everyone hung up on the unwanted calls and deleted the unwanted mails in nothing flat, like they say they do, then the problem would fizzle out before long. No one could make money doing it, so there would be no reason to keep trying. And yet, the crap just goes on and on and on.

I've read rumors that a certain small percentage of the people called or mailed actually do respond and end up buying something; usually the figure is put about 10%, or something similarly low. Hard to believe that such a business would be worthwhile if the response rate is so low; but whatever it is, it must be high enough that the incentive for telemarketing and spamming is maintained. Otherwise, there'd be no such thing.

A national no-call list is a nice idea, but I can't see the problem going away altogether as long as the telemarketers and spammer still believe there's a chance to make money. Certainly the spammers are not going to let some trivial thing like a Federal law stop them. (They'll just go on spamming from Antarctica, or wherever.) If we really want the problem solved, once and for all, we have to ensure that there is no future for those businesses, and that would require educating the public, right down to the last man, woman and child, to always follow this rule without exception: If someone calls you or emails you to sell you a product, then whatever you do, don't buy that product!

Re:spam is beginning to be a real problem

[Anonymous Coward]

> Hard to believe that such a business would be worthwhile
> if the response rate is so low;

When the delivery of spam is almost entirely no-cost to the spammer, then any response rate above nil is going to be worth something. Pity

Re:spam is beginning to be a real problem

[Anonymous Coward]

Believe it or not, if 1% of people buy something via spam, it acctually turns a profit.

Re:spam is beginning to be a real problem

[Frymaster]

10%?

when i was in school i took some pr course where it was presented that a direct mail campaign (snail mail, addressed directly to the recipient) with a response rate of 3% was considered a "roaring success".

spam can survive even with miniscule response rates (one hundredths of a per cent) because the actual transmission is free. direct mail has postage and printing costs. telemarketing needs actual wage-earning callers and phone connections. but spam once you find that open relay, spam is free.

with costs like that, revenue can afford to be low.

Re:spam is beginning to be a real problem

[Anonymous Coward]

More like 0.1 % or even less. As the other eluded to, whether 1 or 1,000,000 people recieve the email, the cost is pretty much the same

Re:spam is beginning to be a real problem

[zeroclip]

10%? A bit much. Last numbers i've heard was less than 0.01% respond. Much less that actually buy's someting of falls for the scam. But when you think of the number of spam messages sent 0.01% adds up.

Re:spam is beginning to be a real problem

[Anonymous Coward]

Can't stand to be called on the phone but will sit for hours on end in front of the television allowing brains to be stirred by the marketer's electronic spoon.

One thing they got right in the second Matrix movie is the illusion of choice as a method for controlling human beings. Telephone marketing is intolerable since control is in the hands of the caller. Television marketing is tolerable because a small amount of control is in the hands of the viewer. Just enough control to watch ads on another channel. Sad, pathetic, vulnerable, humanity. Got us all figured out and riding us for all we're worth.

Re:spam is beginning to be a real problem

[mr_tommy]

But the real problem is, that Businesses see this as a legitimate practise. They convert real world business ideas and apply them online : example : Marketer comes up to you in the street and asks you if you would like a demonstration of Super Blobs magic washing up liquid. Now, ok, not everyone does say yes (one fingered salute from me :D) but many lonely housewives do! (sorry about the stereotype).

As the above rightly comments, the real problem here is people encouraging this business practise by sending them hard earned currency. And the fact that they do this doesn't just affect us in terms of email spam; the register recently published an article that suggested that people who were looking to come online were scared by the percieved threat of spam.

Someone, somewhere, somehow needs to come up with a solution to spam. It's got to be tough, universally implemented, and i fear quite restrictive.

Re:spam is beginning to be a real problem

[Anonymous Coward]

They eluded to it, eh? You don't say!

People, they are the worst.

Re:spam is beginning to be a real problem

[Anonymous Coward]

OK grammar nazi, ALLUDED. Alluded, THEY ALLUDED TO IT.

Re:spam is beginning to be a real problem

[greentree]

actually i've heard that telemarketing companies make a profit if they have as little as one successful call per every 500 calls.

Re:spam is beginning to be a real problem

[Anonymous Coward]

What we clearly need to do is identify the idiots who respond to this shit. I suggest mailing everyone once a year with a stupid offer, and then killing each and every person who responds in a horrible, blood curdling manner. On television. That ought to put a stop to it.

Re:spam is beginning to be a real problem

[Anonymous Coward]

Damn. I put some thought into that above post but I get the feeling noone has seen it. This prompts me to return to my normal mode of never posting anything to slashdot, or anywhere else on the internet. Like throwing quarters into the toilet.

Re:spam is beginning to be a real problem

[Anonymous Coward]

OK grammar nazi, ALLUDED

Hi, same guy again. This isn't a grammar issue, it's a usage issue. If words are the bricks, grammar is the plan for the house.

And I'm the local council building inspector! You're welcome!

Re:spam is beginning to be a real problem

[Anonymous Coward]

I read it, and I sort of agree with your analysis.

Re:spam is beginning to be a real problem

[Zocalo]

Somehow, it must be worth it for them.

I think it really depends on how you spin it. It goes without saying that someone has to be making money from spam, and also that there are gullable fools who buy the stuff on offer. The problem is that many of the gullable fools are not the same ones that actually buy the porn and pills being peddled, but those that by the spamming services too.

The spam "business" seems to be constructed in several levels. At the top you have the metaspammers (see the ROKSO for a list) who don't really sell anything other than spamming tools and services. These guys are the ones raking in the bulk of the cash, and are probably the only ones with the werewithal and resources to run the global spamnets without getting nailed (so far). Underneath those is a mesh of "affliate programs" and small fry who do spam their own products and finally, at the bottom, are the dregs of humanity that actually buy the physical products.

The problem is, that everytime something like this comes up on Slashdot, Kuroshin, or even the "mainstream" TV and press media, there is a chance that someone has the following chain of "reasoning":

1. There is money to be made in spam.
2. Why shouldn't that be me?
3. How do I spam?

And all this does is send another gullable fool off to the metaspammers that peddle the "guaranteed" opt-in address lists, bulk mailers and similar services. The money floats up to the top of the tree and the cycle perpetuates. Occasionally, I'm sure, one of these guys gets lucky and makes a decent amount of cash in exchange for thier soul, but I'll bet that the majority do not, and soon pull out of the game with a somewhat lighter bank balance. The spam business seems to be a pyramid scheme in all but name, if you ask me.

Re:spam is beginning to be a real problem

[Anonymous Coward]

check your maths: i think it's more correct to say 0.01% multiplies out. queen's english and all, bub.

Re:spam is beginning to be a real problem

[dipipanone]

This prompts me to return to my normal mode of never posting anything to slashdot, or anywhere else on the internet

Promises, promises...

Re:spam is beginning to be a real problem

[Anonymous Coward]

actually i've heard that telemarketing companies make a profit if they have as little as one successful call per every 500 calls.

The required success rate would depend on a few small details, like the product cost, the price, the cost of doing business, ya know, stuff like that. It wouldn't be a standard one out of 500.

Re:spam is beginning to be a real problem

[i.r.id10t]

Not only that, but telemarketers pay good too, so there are plenty of employees to work through. I worked for 3 hours for a telemarketer (calling for PBA) just calling to confirm orders and I was getting twice minimum wage. That was fantastic, considering it was $7 an hour, in the late 80s, and in a college town with 60,000 students wanting part time jobs.

Re:spam is beginning to be a real problem

[Spoing]

But it can't be true. Someone must be responding to this stuff by spending their money.

Unfortunately, a few years ago, that someone was probably my father.

I got a clue that he was responding (if not buying) things from SPAMed adds when he started to ask about some super-fancy-printer utility -- exactly the thing he would never stumble uppon all by himself.

When I said he didn't need it, he said that it's cheap, and that he might just get it anyway. Curious -- since the program was such an odd thing -- I asked where he was getting the offer from. "I got this email." Do you know the company? "No." That's spam. Never EVER reply or buy ANY of that stuff. "Why? They're just trying to make a living, and who knows maybe I can use the program." (GRRRRRRRRRRRRRRRRRRRR...)

Well, after a talk with him he *said* that he didn't reply to the message and would take my advice to delete the messages unread...but I know my dad. After about 6 months he finally got a clue, and joined the annoyed masses who dispise and know what SPAM is. In those first few months, though, I can't tell you how many messages he replied to and if he bought anything.

Re:spam is beginning to be a real problem

[Jah-Wren Ryel]

Many people are too stupid to understand that responding to telemarketing or spam for an item that they *do* want will only encourage more telemarketing and spam for items that they don't want.

There is a guy I know at work who has been getting telemarketing calls for DirecTV. He was actually going to call them back (the telemarketer) and take them up on their offer. No matter how many times I tried to explain it, he didn't think that:

a) he could probably get a better deal if he shopped around for like 5 minutes on the net
b) that he'd probably end up on a "sucker list" and that this telemarketer would now call him to sell other things as well as sell his name/number to other telescummers to bother him with all kinds of stuff he didn't want

5 minutes of convenience today was enough for him to accept the hours of bother that was sure to come in the future.

But, if you ask him if telemarketing and spam piss him off, he complains just as much as the next guy. It is dumbshits like that which telemarketers and spammers are talking about when they say that do-contact lists are keeping them from people who want their services. Assmunches like that guy are the reason these annoyers are business.

Instead of a do not call list, I think we should pass a law that requires mandatory jail time for people who do buy stuff from telemarketers. (Fuck the constitution, Ashcroft's already done that, might as well get something good for society out of it!)

Re:spam is beginning to be a real problem

[PaleBoy]

"Usually the figure is put about 10%, or something similarly low. Hard to believe that such a business would be worthwhile..."

Firstly, I think the number is probably much lower than 10 percent. More likely a fraction of one percent. I haven't conducted a spammer poll lately.

Let's say that .1 percent return money. So let's say that you get 10 bucks for your Vi@gra each time you sell it.

What's the cost of sending out 1000 emails, and getting 10 dollars? Nothing. How about 10,000 emails, and getting 100 dollars? Same cost. 100,000 emails should get 1000 bucks. At no cost.

Sure, there may be bandwidth, but email isn't exactly a bandwidth hog. And plenty of these guys will just use H4X0r3d boxes to pump out spam remotely.

So as long as there is one idiot among a thousand, spam will exist.

Re:spam is beginning to be a real problem

[Ryokos_boytoy]

Well, if the news coverage of these murders was done right. I would think the morons wouldn't consider ordering anything out of fear.

Maybe instead, we get an urban myth started that claims this and maybe get 1 in 5 morons to stop buying. They already have some reservations but the added "...horrible, blood curdling manner. On television." death thing could make a difference.

Re:spam is beginning to be a real problem

[Anonymous Coward]

Man, you're gonna have your hands full when you start seeing all the definatelys and articals out there...

Re:spam is beginning to be a real problem

[lonesome phreak]

It's profitable because that 10% are usually victims of identity theft when they use those sites. They may go to purchase $10, but their informatio is used to get $5000 out of them. So, they don't need a large response.

The FSU is started to get into this on a very ogranized level too. One of the theories is that some of the recent worms where done by organized crime syndicates over there.

Re:spam is beginning to be a real problem

[dwkunkel]

Try Malinator . It works for me.

Re:spam is beginning to be a real problem

[Anonymous Coward]

Not to mention teh, the definate artical itself

Re:spam is beginning to be a real problem

[ScrewMaster]

Everyone hates spam. You can hate spam and still be foolish enough to click on one of the things (doing so should result in a substantial electric shock automatically applied to one's temples.) Spam is a plague upon all our houses. I get about five hundred per day now: fortunately Mozilla's filters and the black hole databases my server connects with cut that down to around thirty actual, but still ... that's a huge burden on the entire system. In any event, the reason spam works is that it is effectively costless to send out, say, a hundred million messages. Then, if you get even a few purchases from those messages you've made money, but in the meantime you've clogged millions of Inboxes and buried fat pipes from here to China (or more likely, from China to here, ha ha. They complain about all the "subversive" material available from the West and we complain about all the "perversive" material filling our mailboxes. Penis patch, anyone?)

Given that spam's response rate per message received is generally lower than any other form of marketing one can discount the few people that actually click on those links as mere statistical anomalies, people that in previous eras would be pushing up daisies because they were too stupid to remember to breath (ain't modern medical science grand?) The burden placed on the network by these sociopathic "spammers", just to acquire those few mindless "customers" is simply criminal, and I mean that literally. The actual response rate to spam is far lower than than ten percent: a tiny, tiny fraction of one percent. In my own case, for example, this rate has remained at a constant zero since I first went online.

Re:spam is beginning to be a real problem

[Anonymous Coward]

That particular meme of response is so worn out, it no longer qualifies as a sentient statement. You are either very young, or very stupid. Help keep electronic America clean, and shut the fuck up.

Re:spam is beginning to be a real problem

[cfuse]

How about a national 'how to say no' class?

Re:spam is beginning to be a real problem

[HermanAB]

No, it is not the recipients that are suckered - it is the companies that pay the spammers to send the useless advertisements that are suckered. The spammers just blast the shit out, they don't care that most gets deleted and that the advertizers get swamped with death threats - they are laughing all the way to the bank.

Re:spam is beginning to be a real problem

[Alsee]

10%? LOL. Spam often generates profit with a response rate of a hundreth of a percent. One person in 10,000. It is essentially free to send spam, therefor any response they do get is almost pure profit.

If we really want the problem solved, once and for all, we have to ensure that there is no future for those businesses, and that would require educating the public... don't buy that product!

Waste of time. Far more than 1/10,000 people are either mentally ill, senile, or just plain stupid.

-

Wow...

[Jin Wicked]

Someone needs to get that guy on Coast to Coast AM, with Art Bell/George Noory stat.

Knowing that show, there's someone else in the audience that actually does have all that equipment he's searching for. =)

Re:Wow...

[xpurple]

If I had mod points I would up this guy. This would be a perfect topic for Coast to Coast AM!

Re:Wow...

[Anonymous Coward]

By the way, that's not a guy...

Time travel

[Anonymous Coward]

The very fact that we received spam proves that time travel is impossible: If it was possible, someone would invent it, travel back in time and beat up all the spammers so that they would never have sent any in the first place.

Re:Time travel

[Lord_Dweomer]

Unless....in the future, the spammers have already won!

Time Cops

[t0ny]

we need to send Van Damme after this guy.

E-mail tax

[cft]

DISCLAIMER: I am not trying to be flamebait here, this is my honest opinion:

I'm torn about the idea of an email tax. While in general I don't like the idea too much, it does occur to me that this might be the only way of dramatically reducing spam.

Look at it this way: Even a wicked-busy web maven likely sends less than 1000 emails a day outside of their own company LAN (with a few exceptions I realise. Individuals likely send less than 100 per day in general.

So, say you put a tax, to be administered by your ISP on each email, of say 0.1 cents per email. Big Business guy gets charged $1/day, home user $0.10 per day. By no means big money. Johny McSuperSpammer, however, who sends out 10 million emails every day, gets a handly little bill for $1000. Kind of changes the economics of his penis enlarger ads.

Like I say, I'm not a huge fan of paying more, but it does seem like making emails cost per message sent might be the best/easiet/only way to dramatically reduce spam.

Furthermore (ideally), to make up for the cost, you ISP could take $5 per month off your bill, to make up for the extra you're spending to send email. They still make money, because of the tax, the financial hit for you is minimal, but the spammers get hosed.

Re:E-mail tax

[bhima]

How do make mailing lists work with scheme?

I subscribe to Dilbert and a couple of SuSE lists. That's about 150 messages a day. Do you expect SuSE to pay these? I'm sure that you scheme would be the end of such things.

Re:E-mail tax

[MarkJensen]

Sure. The honest ISPs will have to bear the burden of administering this tax (for which, they will have administration costs - passed on to users). But what about these Hong Kong spamming sources? Or anything outside the jurisdiction of the 'email tax law'? An email tax is both unworkable and ineffective

What is needed, and has been pointed out in many other places, is a reform of the SMTP method. SMTP was designed many, MANY years ago when the only people on networks were technicians, academics, etc. These people created a system for THEM to use. They didn't really anticipate spam, because for spam to become effective, email needs to be wide-spread to the point near ubiquity. When email services are as common, you are going to get a lot of simple-minded gullible people out there. And these are the people who click on those ads, and bring in the spam revenue.

So, I guess we either need to reform and properly lock-down email sending to show only accurate information, or require a simple I.Q. test before logging into email! ;) Of course, the latter opetion would surely bring about the swift demise of AOL...

Re:E-mail tax

[ghideon]

The only problem being enforcement. If there is a country with lax taxes (or lack thereof), then there is nothing to stop the spammers from moving their ISPs to that country and spamming from there. The virtual-ness of the Internet makes it that much easier, as opposed to having to move a real, physical office to another country.

Re:E-mail tax

[The Fanta Menace]

Not going to work. I don't use my ISP to send mail, at least not in a way they can detect. I use my own server, instead.

Are you going to tax me to send email between the users on my machine? If so, how are you going to monitor the logs? Are you going to give government authorities permission to audit my machine whenever they see fit to? Looking kind of authoritarian, now, isn't it?

How about cron jobs sending me email? Do I get taxed for them, too?

Instant messaging? Tax for that? What about when people get fed up with your email tax and implement an email system over an IM service instead? Or just implement some other of email over any other protocol to bypass your tax system?

Filters are an effective way of combatting spam. Much better - and less oppressive - than a tax. SpamAssassin catches 99% of the spam I receive. It, and other filters, are so effective that spammers are now changing the content of their text to attempt to bypass it. And when they do this, it reduces the effectiveness of their advertising, so in the end, they lose.

Re:E-mail tax

[Sexy Bern]

Surely this falls down when the spammer bypasses a legitmate (ISP's) SMTP server?

Spammers will have their own SMTP servers, or find/use open relays.

Re:E-mail tax

[Anonymous Coward]

If they could enforce that surely they could simply enforce laws outlawing mass send outs. Who the fuck other than spammers needs to send out 1,000,000 emails at a time? Yeah I guess big corporates well couldn't they just apply to be exempt from that law.

Re:E-mail tax

[Neillparatzo]

"I don't use my ISP to send mail"

That's not a magic bullet. My ISP, and I suspect a lot of others, block all outgoing SMTP traffic that doesn't go through their own server. If you're relaying your email to an outside SMTP server, well, you're just pushing the problem up a step - where is it getting its Internet access from?

Personally, I'm all in favor of taxing SMTP traffic, and heavily. Talk about a way to make a lot of people adopt an alternative quickly.

Re:E-mail tax

[Anonymous Coward]

The day e-mail tax is born e-mail will die and be replaced.

The internet (personified) uses to route around narrow-minded regulations and/or copyrights.

I advice you to use the Junk Mail controls of Mozilla. They never failed me.

Re:E-mail tax

[The Fanta Menace]

No, my box is the SMTP server. It sends out mail directly to the destination addresses. Therefore you have a choice of making me a tax collector (unworkable, due to the number of people also running boxes in such a configuration) or snooping port 25 and charging based on the amount of traffic that goes over that port (in which case you'd also be unfairly taxing people who are using port 25 legitimately for purposes other than SMTP. I have been known to run VPN links over port 25 because it was the only way to break out of a firewall in certain situations).

Even if you did succeed in getting an idiotic law like this through, I'd immediately set up VPNs to the servers of all the people I email on a regular basis to avoid the taxes (and the snooping). A bit of civil disobedience can go a long way to striking down dumb laws.

Re:E-mail tax

[Isomer]

Shrug, if you want to stop people sending forged email then use PKI. Don't accept mail from people unless it is signed by someone you trust. It's easy to implement, it's reasonably secure. It doesn't change any of the protocols on the internet today, all you need to do is set up a key and start signing email.

Sure spammers can get a key but if nobody signs their key, then they can't spam. So every time they want to spam they need to get a key signed. People who sign spammers keys regularly are going to get their signatures revoked.

This increases the "cost" of spamming by making it hard for spammers to get legitimate keys, but making it relatively cheap for joe bloggs who just has to create a key and perhaps get it signed by his ISP and a couple of friends.

ISP's signatures wouldn't mean much, but it would be enough to get you started on the web of trust, after a few people have signed your key your key will start becoming more important to more people.

So, step up and use GPG today!

Re:E-mail tax

[squiggleslash]

As the guy said though, a lot of ISPs block outgoing port 25. Earthlink is one. Another thing many ISPs do is put their dial-up customers on a list called the DUL which many other ISPs, including (in my experience) Earthlink/Mindspring/Netcom, AOL, Bellsouth.net, and probably others, use to block incoming email.

I don't understand the logic of doing so (no, I'm not asking for it to be explained again - I'm aware of what the logic is thank you very much, I just don't understand it - it's dumb, it makes an assumption that's patently false) but many in the anti-spam community believe that using your own SMTP deliverer makes you a spammer, and many ISPs have signed up to the concept. This might have been bearable had they created some simple, automated, mechanism for determining what SMTP server to use (Linux distributions tend to come with self-delivery set up by default to avoid a set-up step, and I personally prefered running my own deliverer because I tended to roam between a couple of ISPs), say via an extention to PPP (like PPP currently sends DNS server information), but nothing of the sort's been done.

Re:E-mail tax

[Xugumad]

The problem with this is that you need to be able to get the public key of whoever is sending you e-mail, in order to verify that e-mail. That's going to get complex.

Personally, I'd like to see SMTP moved to being over SSL. ISPs would get their certificates from some central signing authority, much in the same way SSL certificates are handed out already. Users would get an SSL certificate with their account, signed by their ISP, so they could send e-mail to the ISP's SMTP server, which then forwarded it on. Then all SMTP servers are told not to accept e-mail from systems with unverifiable keys, and you have a very good start to a trusted e-mail system.

There are problems - it will be necessary to have a list of revoked certificates, which is likely to get quite long until people figure out they can't effectively work around this. It will involve more load on the SMTP servers, although the decrease in spam might counteract that somewhat. However, I think it would work.

Re:E-mail tax

[Illbay]

You assume, however, that the Feds or the New World Order or whoever the hell gets to collect this "tax", will know who "Johnny McSuperSpammer" is.

Sorry, but that ain't gonna happen. These people thrive on the anonymity, and they simply won't be getting this bill.

Re:E-mail tax

[Megane]

Once you say the magic words "central signing authority", you're putting dollar signs in someone's eyes. Verisign charges what, $900 for an SSL cert? And what does it get you? You're added to a stupid database. Browsers won't bitch about an invalid cert just so you can get https working. That's all. Because there's no way to get the security of https without the authentication.

Re:E-mail tax

[frdmfghtr]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I agree with you on that point...I have often considered doing the
same.

There is one small detail holding me back...except for the Microsoft
security bulletins I get via e-mail, nobody I send/receive e-mail
with knows PGP/GPG/etc. exists.

My e-mail signature line is this:
- --

PGP Freeware is a free, easy way to secure your e-mail.
http://www.pgp.com

So I am trying to get the word out--I even sign e-mail with it,
knowing that whomever gets it won't know what the hell PGP is. PGP
doesn't exectly help either; getting the freeware version of PGP
takes some looking on their website. (here's the link to it,
btw...http://pgp.com/products/freeware.html)

Time to change my sig line...

A second question that may come up is this: What if a spammer starts
signing e-mail? Then what?

Any sort of filter would not only have to look for a PGP signature,
but a GOOD signature; it is reasonable to assume that you nor I are
going to have the public keys for spammer on our keyrings, so the
answer is this: "Yes, as long as you are looking for a signature
that can be validated on your keyring."

My little bit of wisdom for the day.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
Comment: Protect your privacy, with the FREE version of PGP

iQA/AwUBP6UDPkUNhXFkSR7TEQKRnACfWmeCqK4ZH825wgWo ao +Cve26RwYAmwa/
w0T8Ss2Bbq24/9+wJquJD06y
=nj0q
- ----END PGP SIGNATURE-----

Re:E-mail tax

[Illbay]

So, I guess we either need to reform and properly lock-down email sending to show only accurate information,...

If I understand correctly, however, this is already possibly using the SMTP. I know that I can instruct Sendmail to bounce messages that don't meet the criteria described in the various RFPs relevant to mail transport, for example.

I found a couple of such Sendmail config routines on the SPAM-L mailing list for example, but since I'm too "chicken" to futz with sendmail.cf directly (cowardly-fashion, I use the sendmail.mc/m4 thingy for poking the config file) I didn't implement it. But I am assured they work to bounce a HELL of a lot of Spam. And I'm sure more sophisticated Sendmail/SMTP checks can be fashioned along the same lines.

Re:E-mail tax

[October_30th]

Even if spam doesn't show up in your mailbox it doesn't mean that the spam aimed at you doesn't exist. ISPs and the net infrastructure in general is getting more and more clogged by spam.

An auditable mail protocol (each mail would leave a trail) and some sort of an e-mail tax (few cents per mail) wouldn't hurt a normal user but it would hit spammers.

Re:E-mail tax

[Illbay]

Problem isn't "unsolicited email," though. It's unsolicited BULK email.

As a "business" I often get unsolicited email simply from people who got hold of one of my biz cards and emailed me out of the blue to inquire after my services. I don't want them discouraged in any way, so I wouldn't implement any kind of "challenge-response" or "sign-countersign" system for that very reason.

Re:E-mail tax

[Illbay]

Personally, I'm all in favor of taxing SMTP traffic, and heavily.

Taxes only hurt the honest. They don't hinder the dishonest because they will find a way to keep from paying the taxes.

Government solutions typically fail utterly; only the "invisible hand" of the market can succeed.

Keep the gov out of all of this.

Re:E-mail tax

[Anonymous Coward]

We have an auditable mail protocol, headers are written in plain english. There is no way I can justify charging my users for email, they could be mailing somebody on the same machine. What about the mailing lists we run? What about the automated alerts I get from firewalls, who's sending these, I'd say it's the person scanning MY network but wish me luck billing them for it. Charging for email breaks the network in so many ways it's unthinkable. I suggest you think again.

Re:E-mail tax

[Anonymous Coward]

I wrote: "The day e-mail tax is born e-mail will die and be replaced."

Stupid!

Re:E-mail tax

[Anonymous Coward]

only the "invisible hand" of the market can succeed

Yes, and the tigher it grips, the more things will slip through its fingers.

This "the market is always right" theory is such bullshit. What about Microsoft, what about walmart, what about enron? Direct consequences of not regulating enough, and detrimental to the whole of society.

Re:E-mail tax

[MarkJensen]

Great! Now if we can only get all SMTP to be secured... However, that is what appears to be the problem. :(

I don't want to have a legitimate email bounced/rejected because someone he goes through is using 'default' SMTP, and a server in-between is secured... I still think that as long as it is optional, it will not be implemented (at least correctly).

If we could get 90-some percent of the world on secured SMTP, then maybe it will force migration on the remaining percentage...

Re:E-mail tax

[Illbay]

You use short-term examples to "disprove" a long-term phenomenon.

Another example of folks who think the history of the world began the day they were born.

Re:E-mail tax

[junkgoof]

Do it on a sliding scale. First hundred emails a day are free. Second hundred at $0.001 each. Once you get into the hundreds of thousands a buck each. Rebates if you can prove people were actually happy to receive your mail. Problem is there are some companies that send lots of email you may actually want to hear from. Real virus and security warnings, maybe. What it takes to stop spam is for judges to show a little common sense, and decide that spam, like bribes to politicians and their parties, is not free speech. Tracking down spammers and suing away their scam-gotten mansions would be fun.

Re:E-mail tax

[October_30th]

We have an auditable mail protocol, headers are written in plain english.

As long as the headers can be forged, they're as good as useless. Forging them should be made illegal and a stechnically difficult as possible. I'm sure technology exists already and all we need is political will.

Every person using the net should also have an offical e-ID granted by his/her nation and it should be embedded in e-mail headers (possibly in every packet). Think of it as a passport: it's an official document, you can be uniquely identified by it and using a falsified passport is a serious crime all over the world.

Re:E-mail tax

[BrokenHalo]

How do make mailing lists work with scheme?

I can't see how this can work if the spammer sends his crap via an open relay (as, of course, 99.x% of spammers do). Who picks up the tab then? I agree that spammers should be made to pay (preferably with their lives, but that's just my opinion) but this doesn't sound workable.

Re:E-mail tax

[Lumpy]

SO therefore in the end, the kernel mailing list, and the mailing lists for all the large and high activity + high member count projects now no-longer can afford to operate.

Nope, your idea is unacceptable. Amend it so that a project can have a "tax free" status and not be charged only when they send their email from the exact IP address specified in their application, or some other acceptable "out" for these users.

Re:E-mail tax

[Anonymous Coward]

"Filters are an effective way of combatting spam. Much better - and less oppressive - than a tax. SpamAssassin catches 99% of the spam I receive. It, and other filters, are so effective that spammers are now changing the content of their text to attempt to bypass it. And when they do this, it reduces the effectiveness of their advertising, so in the end, they lose."

The problems with filters:
1) they require the end user to install - these are the same people who are buying the spam (1%, or 0.1% are, at least). If they are too stupid to realize it's a bad idea to buy from spammers, how are they going to realize it's good to filter spam?

2) filters do nothing to stop spam from clogging up the network. If filters reduce spam responses from 1% to 0.01%, all that will happen is that spammers will increase the amount of spam they send, clogging the pipes.

Spam needs to be stopped at the sources, the only ways to do that are to at least get the ISPs to verify that email is actually from the sending address.

Re:E-mail tax

[cpghost]

Some companies don't accept HTML-formatted emails anymore, because the BULK of all SPAM is HTML nowadays. I implemented for many companies an autoresponder which, upon recognizing HTML mail sends back a reply asking for users to

• either respond to the challange, by sending the message back a la ASK (actually it is a modified ASK-like system)
• or configure their E-Mail client in such a way as to disable HTML mail at all. This option lists the reasons why HTML mail is bad, and provides a link to a page with illustrated instructions for popular M$ and other MUAs.

Of course, this scheme is not perfect, because it doesn't catch every SPAM, and, more importantly, because it rejects otherwise legitimate email. However, the advantages clearly outweigh the shortcomings, at least for those business users, so they decided to use this method out of sheer necessity.

Any email address which has been around for some years is bound to become a regular SPAM victim. This is especially true for business email addresses dissiminated by biz cards or ads in print media, which cannot be changed easily.

Re:E-mail tax

[lpontiac]

If authorities were able to track email well enough to levy and enforce a tax, they'd be able to track it well enough to outlaw, and prosecute those who send, spam.

Re:E-mail tax

[scrytch]

Shrug, if you want to stop people sending forged email then use PKI.

Taken from the excellent list You Might Be an Anti-Spam Kook If:

the (Final Ultimate Solution to the Spam Problem) [FUSSP] requires that anyone wanting to send mail obtain a certificate that will be checked by all SMTP servers.

the FUSSP involves certificates, but there is no barrier to spammers buying many independent certificates.

you know that certifying that a user legitimately claims a name and has never used some other name is cheap and easy.

Re:E-mail tax

[GoofyBoy]

>This "the market is always right" theory is such bullshit.

The market is evenually right. In the short term there could be inefficencies.

Re:E-mail tax

[pentalive]

You just put your favorite mailing groups on your whitelist.

Re:E-mail tax

[TheLink]

Doh. The main thing is that's a cop out phrase. Sure the market "eventually" corrects itself, but that's because of people who refuse to accept the bullshit, or whatever it is that they feel is wrong. But if too many people just sat by and figured the market will correct itself, one day it just won't.

You sound like one of those economists. So here's my lightbulb joke for those economists:

Q: How many economists does it take to change a light bulb?

A: Economists don't change light bulbs, they sit theorizing in the dark while waiting for Adam Smith's invisible hand to do it.

Re:E-mail tax

[fdiskne1]

The ones that would pay would be those who leave their mail relays open. One major bill from the ISP would cause them to fix it quick.

Re:E-mail tax

[bhima]

Yes!

This is a step in the right direction

Beatings for Spammers, Folks who respond to spammers,and folks who run open mail relays!

Re:E-mail tax

[corbettw]

What about people who have their own domains, like me, and can't afford to pay the ~$1000 someone like Verisign is likely to charge for this service? Suddenly I have to drop the domain I've been using for years and get an Earthlink account just to send email?

Re:E-mail tax

[duffbeer703]

Network congestion in the long run doesn't really matter. There is a glut of bandwidth out there.

"Stopping spam at the source" is about as effective as "just say no". Spam won't go away until SMTP is modified to require MTAs to sign transmissions.

Re:E-mail tax

[TheTomcat]

Even a wicked-busy web maven likely sends less than 1000 emails a day outside of their own company LAN

The company that I work for sends ~15000 legitimate emails per day (order, refund notifications, etc). These are not spam.

What about mailing lists? I'd hate to run bugtraq if it were taxed (not that I _do_ run bugtraq, of course).

S

Re:E-mail tax

[WalletBoy]

How do make mailing lists work with scheme?

Maybe we'll go back to using USENET news. I prefer that to mailing lists anyways. Sure there's spam in newsgroups too, but at least the ISP server has to only download one spam per posting instead of the same spam multiplied 1000 times for each customer.

Re:E-mail tax

[Anonymous Coward]

so putting them on my white list will stop the government from taxing them?

neat! I would have never guessed a program would control what the government does.

oh wait. it wont, your sugestion is completely useless :-)

Lumpster is right, you are wrong. have a nice day.

Re:E-mail tax

[YOU LIKEWISE FAIL IT]

I implemented for many companies an autoresponder which, upon recognizing HTML mail sends back a reply asking for users to

Where is the "+1 My Hero" moderation when you need it? :-(

YLFI

Re:E-mail tax

[Illbay]

Sure the market "eventually" corrects itself, but that's because of people who refuse to accept the bullshit,...

You are UTTERLY wrong.

You need to recall, for example--difficult to do for much of our "younger generation" who think that anything that happened in human history before they were born is irrelevant--that the "power of the people" is a very recent thing. Throughout most of history, "the people" took what was given to them and shut the hell up.

Yet "the invisible hand" has always been there, and it has little to do with popular enlightenment or deliberate uprisings. Rather, it has to do with individuals coming independently to the same--or at least a similar--conclusion about their own self-interest, and acting accordingly.

Their decisions, and the consequences thereof, ultimately work together to succeed or fail, and the successes go on to breed more success.

The most emphatic example of this was the settlement of the new world. Although "corporations" had a lot to do with this--mostly through providing the capital--it was the bravery and ingenuity of individual men and women, acting in their own interest, knowing that they could have it better than they presently did, taking the RISK.

And this legacy is the reason the United States of America towers head and shoulders above any other society in terms of economic power and clout. Only here has the individual had so much power, and that power was fought for and earned over centuries.

We are only in the first century of pissing that away thanks to the socialism that began with the New Deal, and it will take some time for ingenuity and self-interest to be crushed under the weight of law (and the enforcement thereof) but if things do not change, it will eventually happen.

But the light will spark anew, someplace else.

Because the "invisible hand," ultimately, is about the yearning of the human soul to breathe free.

NOT, as you smarmy anarcho-leftists would have it, their yearning to organize violent protests, burn cars and ransack Wal-Mart.

Re:E-mail tax

[Isomer]

Shrug, I don't expect my idea's to be that great, I'm posting them on /.!

GPG is based on the web of trust. Spammers can't "buy" keys, they can perhaps convince people to sign their key, but if they do that then people who sign spammers keys end up with their keys not being trusted for signatures. People hopefully will form their own close knit communities of people who have the same interested/same line of work/relatives/friends etc.

The other PKI idea is to only accept encrypted emails, as encryption is a CPU intensive operation, encrypting emails to hundreds of thousands of people suddenly becomes prohibitive.

Re:E-mail tax

[bhima]

No that you say it, USENET was (probably still sort of is) great. I wonder what it would look like with a kill filter that was like the E-mail spam filters (that I can't spell) that are available today. Is there a good application out there that does this?

Re:E-mail tax

[Vintermann]

You don't need to look up the sender's PK and check that it's OK. There's a computation cost in hashing and signing mail. Although small, it's enough to make mass-mailings more expensive, and so spam less profitable.

So it's enough to check that the hashcode fits, really.

Re:E-mail tax

[instarx]

Maybe a better slant would be to tax commercial email. That way we poor emailers who don't try to make money from it won't have to pay.

However, if you can't get these guys to work within the laws now (hijacked addresses, porn spam, Nigerian scams, etc.) how are you gonna get 'em to pay taxes? Plus how do you charge offshore spammers which probably make up the majority of spammers.

To paraphrase the gun industry - "When you have an email tax, only criminals will have free email."

Re:E-mail tax

[rocca]

You don't need the overhead of SSL, just the registry itself will do. If every mail server was on a mail server registry then you'd simply only accept mail from listed IP's (or give preference to this IP's).

You would manage the list with real-world verifiable credentials and a liability form. The registry would ideally be managed by a non-profit, and charge something like $100 for being on the list. This money collected would be used to sue those that violated the terms of the registry.

It would be very easy to implement, we already have the negative version (ie which IP's to block), so instead it would be a whitelist of IP's. It would only take AOL/MSN/Earthlink to support it to catch on...

Easy Solution

[FannyMinstrel]

Why doesn't he travel back in time and kill all of their grandfathers? They would cease to exist.
Wait. Then he wouldn't need to kill their grandfathers. And then he would.
And...
And...
Excuse me.
[Opens Window]
I can fly!

Re:Easy Solution

[p00ya]

RTFA! He needs to spam us all first to get the equipment to travel back in time to take back what was stolen from him! Or something...

Question

[Anonymous Coward]

What the fuck is a "Joe job"?

Re:Question

[Anonymous Coward]

It's the slashdot equivalent of a blow job only it's called a "Joe job" because it's gay.

Re:Question

[FannyMinstrel]

A joe-job is a spam run forged to appear as though it came from an innocent party, who is then generally flooded by the bounces or complaints.

Re:Question

[Anonymous Coward]

That's when you get Joe to do it for you while you type with two hands.

Re:Question

[Anonymous Coward]

While you type dirty to another man pretending to be a girl - why wouldn't you just put a wig on Joe and be done with the computer?

Re:Question

[sosume]

Its referred to in the article

Joe Job [joa~juhb]
A Joe job is an e-mail spoofing exploit in which someone sends out huge volumes of spam that appear to be from someone other than the actual source. A Joe job is sometimes conducted as an act of revenge on someone who reports a spammer to their Internet service provider (ISP) or publicly advocates anti-spam legislation. The perpetrator is said to be Joeing the legitimate owner of the e-mail address they use. The Joe job is one of the oldest spamming operations in existence, and one of the simplest ones to carry out: the spammer may not have to do anything more than change the "Reply To" address in their e-mail program.

Re:Question

[AndroidCat]

Not a bad definition, but it leaves out the reason that it's a "Joe-job". The large (but probably not the first) action by a spammer that crystallized the term was against a spammer-whacker named Joe.

Sorry for not having Joe's full name handy. Coffee load just started.

Re:Question

[Anonymous Coward]

'cept he wasnt really a spammer whacker but just someone protecting his own network.

Re:Question

[Anonymous Coward]

Joe is your coffee.

Re:Question

[AndroidCat]

Certainly. Most people on news.admin.net-abuse.email are just protecting their network/email box. Whacking the spammer is just a fringe-benefit.

The spammer joe'd Joe because he got his peepee whacked. (Spammer's are declared as having a virtual peepee for whacking purposes, regardless of any Quirk objections.)

Re:Question

[AndroidCat]

My coffee is far more cthonic than Joe. (Damnit! Cthulhu, coffee and Clippy! That Illiad keeps stealing my IP! ;^)

This says it all?

[isfuglen]

Todino's father, Robert Todino Sr., previously told Wired News that his son has psychological problems and earnestly believes in the possibility of time travel.

Are spammers going to start pleading "insanity" when they get arrested? "The aliens made me do it!"

Unraveling

[jxliv7]

.

Any good time traveler would know that to unravel Robby's mess it's just a matter of going back a few dozen months in time and changing a few details, so there must be more to this than that.

After all, the primary justification of a conspiracy is the lack of evidence.

But any healthy paranoia accumulated over time shouldn't be discounted, either.

Re:Unraveling

[Mycroft_VIII]

I assume you mean preventing the 'device' from malfunctioning in the first place?
Usually won't work. least-wise not without creating a direct paradox snarl. nasty mess, but fortunately not likely, well eigther not likely or it just 'pinches' itself from reality most of the time(no way to tell wich, kinda like how 5 and -5 are BOTH the square root of 25).
Best bet is actually to just yell for help by essentially placing a message to the future in such a way as to make shure it gets attention after you left. since this made /.'s front page
he got it right as far as making a big enough noise to leave a lasting impression but not so big as to be likely he'd have read it before he left. That is if anyone knows he went back, and starts digging to find out what happened to him they'll likely find his note. But it's not likely to be a 4th grade history book item.(sorry guys, slashdot's not that important:) )
better would have been to use a newspaper from the day he left as a one time pad and explain the encryption method in his e-mails. guesse if he forgot to set up a decent future mail system, he wouldn't have thought about other safe, do-able, methods of yelling for help though.

Mycroft

Re:Unraveling

[Patrik_AKA_RedX]

But it's not likely to be a 4th grade history book item.(sorry guys, slashdot's not that important:) )

I do believe /. will be in the history books of the future. Most likely under the subject about the huge drop in productivety in time periode 2000 - 2010.

I even believe that the most active users are being observed by scientists of the future...

more tragic than funny

[real_smiff]

i'd never heard of this but after reading the two wired articles i feel sorry for everyone... really, the guy needs medical help, and probably shouldn't be allowed onto a public network (computer, mail, whatever).. and the people taking the piss, well.. it teaches you to be careful, there really are nutters out there, and the internet just lets them fulfil their full nutty potential :o

(off topic, but you'd think it obvious that any time machine breakthrough would be all over the news right! ; i guess basic rationality doesn't come into this though. scary.)

Re:more tragic than funny

[AllUsernamesAreGone]

"you'd think it obvious that any time machine breakthrough would be all over the news right!"

Sure. In a naive and innocent world. Even in a world that wasn't run by massive military industrial bodies with considerable interest in exclusive ownership of technology rights, actually telling the public as a whole that you've managed time travel (let along telling them how) would be too dangerous. Human beings can do enough damage without screwing around with causality as well.

Re:more tragic than funny

[MarkJensen]

(off topic, but you'd think it obvious that any time machine breakthrough would be all over the news right! ; i guess basic rationality doesn't come into this though. scary.)

It did make the news. Then, those who built it went back in time and got rid of the evidence... ;)

Re:more tragic than funny

[GMontag]

(off topic, but you'd think it obvious that any time machine breakthrough would be all over the news right! ; i guess basic rationality doesn't come into this though. scary.)

Just like the 50 MPG fuel-injectors?

Just like no-cost phone service?

Just like Al Gore winning the election?

Just like $10 super computers?

It's the greedy corporations keeping all of this out of the news, I heard it on Pacifica Radio, also being silenced by GreedyCorp!

Re:more tragic than funny

[gl4ss]

"comedy is a dead art form. tragedy, now that's funny!" - bender.

at least it went quite something like that. xmas episode.

Re:more tragic than funny

[Anonymous Coward]

Hey! We must have missed one .. MarkJensen .. Okay send out a team of Editors to find and replace. (And would someone tell me how to get rid of Clippy from this time-travel software?!)

Re:more tragic than funny

[wud]

"Just like no-cost phone service?"

Free pay phones made the news.. and they had them in philly for a few months, then everyone destroyed them....

i know that was offtopic

Re:more tragic than funny

[kalidasa]

Paranoia doesn't work that way, though. He saves the phenomena by convincing himself that the time travelers are prohibited from interfering, and are surveilled for violations, and so have to be very careful about how they use time travel. He also believes he is being surveilled, either by the contemporary government or the time cops.

You know who we need right now?

[mccormick]

I mean, seriously, where is John Titor when you need him? Why didn't he warn us about how the very technology he spoke so highly about and by which he distorted our timeline and entire worldview would have already been the very tool by which the Enemy (spammers) spread their lies and confusion?

John, come on.. The 1980s can't be all that great, can they?

Re:You know who we need right now?

[October_30th]

Well written, pretty consistent and sufficiently evasive not to get caught with outright lies. Smells like a university project by some political/social sciences students...

Re:You know who we need right now?

[GMontag]

Yea, but all we got was a bunch of Noam Chomsky imitators.

Where to really look...

[cruachan]

For fun putting aside the 'do they exist?' and 'can they get here easily?' questions I've often thought that if you really want to find visiting Aliens and the like then you have to find something on earth that would be worthwhile coming to see - an alien tourist honeypot if you will.

The only thing that I can think of that potentially fits this bill is a total solar eclipse. Although there's some compelling evidence that life like ours can only evolve in a similar 'double planet' system like the earth-moon, there's really no reason to expect intelligent life to be around at exactly the same time as the apparent moon and sun size matches sufficiently closely to see a total eclipse. Indeed total solar eclipses have only been visible on earth for a hundred million years or so and will continue only for a few hundred million more - quite a small window in the history of our planet and something sufficiently rare that it may be worthwhile diverting a few light years to see.

So if I did want to find an alien or the like I'd look in the middle of a path of totality

Re:Where to really look...

[Mycroft_VIII]

I've got no mods points today, sigh. +insightfull belongs there though.

Now for bonus pseudo-points and to be more directly on topic. What are the big draws for terrestrial time travellers. :)

Mycroft

Re:Where to really look...

[anagama]

Space travelers would probably be unimpressed by an eclipse. I'll tell you the real draw: supermarkets. Don't believe me? Take a trip to Japan, then wander through a supermarket - you will be amazed at how fascinating it truly is.

Aliens would probably find most things here interesting because it would be so foreign - and that's all it takes to grab a "person's" attention, something he/she/it hasn't seen before.

Re:Where to really look...

[Anonymous Coward]

That's a very human-centric point of view. Why do you assume that aliens would give a shit about any kind of things that interest humans? It could be that they find craggy asteroids to be a thing of wonder, they could not even care about the "unusual". It could be that they get a kick out of the monotonous and find deviation from the norm to be an ugly scary thing that offends every fiber of their being. Anthropomorphizing aliens makes about as much sense as the guy in this article. Your view of aliens as advanced highly intelligent tourists is a little bit ridiculous.

And WTF does this have to do with the topic?

Re:Where to really look...

[Anonymous Coward]

Why come to Earth for that? It seems to me that if you had an interstellar spaceship you could park it the correct distance behind any planet with a sun and see a continual total solar eclipse as long as you had fuel for the thrusters. It would be great lighting for parties.

Re:Where to really look...

[Cujo]

The moon's shadow is always somewhere, just not always on the Earth's surface. If you have an advanced spacecraft, it ought to be easy to observe a total eclipse of any convenient star any time you want.

Re:Where to really look...

[ultranova]

If the unusual (say, shaking grass) doesn't draw your attention, then you'll be eaten by whatever caused that unusual phenomenon (whatever made the grass shake) long before you have a chance to develop spacecraft. And if the unknown offends you, then it's unlikely that you ever try to explore it, stopping technological progress; again, the spaceship never gets built. So yes, I'd say it's likely that any space-traveling aliens are curious about the unknown, because they wouldn't be space-traveling if they weren't.

Re:Where to really look...

[GMontag]

a hundred million years or so and will continue only for a few hundred million more - quite a small window in the history

Statements like this are why I never lend money to anybody in Astronomy or Geology.

Re:Where to really look...

[Anonymous Coward]

And if they're the equivalent of backpack travellers, then it seems likely they'd try to blend in with the population. I imagine the ibiza's of outer space are not located on earth, so you won't find the alien equivalent of germans here.

Re:Where to really look...

[cruachan]

That is of course true, however the difference with the earth-moon system is that you can observe the eclipse from the surface of (to quote trek) a class M planet supporting an advanced multicellular fauna. Plus there's always the strange behaviour of the dominant intelligent lifeform to observe. Think total eclipse experience here ;-)

Re:Where to really look...

[Persecuted_Telemarke]

Although there's some compelling evidence that life like ours can only evolve in a similar 'double planet' system like the earth-moon,

What evidence is this you speak of? Sci-fi novels don't count.

Re:Where to really look...

[cruachan]

http://www.bbc.co.uk/radio4/science/nature.shtml

Is a good place to start - listen to the Accidental Moon program from 27/Oct/03

Re:Where to really look...

[Anonymous Coward]

Although there's some compelling evidence that life like ours can only evolve in a similar 'double planet' system like the earth-moon, there's really no reason to expect intelligent life to be around at exactly the same time as the apparent moon and sun size matches sufficiently closely to see a total eclipse.

The "evidence" on most of this is just hunches. The things we know are that life as we understand it requires certain atmospheric features, certain oceanographic features, certain temperatures, and a certain radiation environment; the moon seems to contribute to these factors, but who knows? We won't know for sure until we actually find non-terrestrial life.

Re:Where to really look...

[dheltzel]

I think they would come here for laughs.

Therefore, we should publicize the details of our legal and political systems, that would surely bring them in. Then, once they are here, we can keep endlessly amused with our "manager-cams", that follow corporate managers around all day and show them making decisions. Sort of a real-time, cosmicly-friendly Dilbert channel.

Re:Where to really look...

[TwistedGreen]

Of course, we're just ascribing human curiosity to this hypothetical alien species. What if they are motivated not by curiosity, but by a relentless thirst for conquest? Or what if they are looking for supermarkets after all, but for a different reason... because they're really, really hungry?

Maybe we don't want to attract these aliens after all...

Re:Where to really look...

[Anonymous Coward]

...there's really no reason to expect intelligent life to be around at exactly the same time as the apparent moon and sun size matches... something sufficiently rare that it may be worthwhile diverting a few light years to see

I'd think an intelligence capable of diverting a few light years would be able to just as easily take an arbitrary solar system and position their craft such that the apparent size of any planet would be the same as the apparent size of that sun.

Given the ability to move freely through space, I think you'd find that for every planet orbiting a star, there is constantly a point in space that is experiencing such a 'total solar eclipse', neh?

Give him a call..

[MesiahTaz]

Todino Robert, (781) 933-8869, , Woburn, MA 01801

http://www.google.com/search?q=todino+robert+wob ur n+ma&ie=UTF-8&oe=UTF-8

If you have that dimensional warp generator, flux capacitor, tin foil hat or whatever, I'm sure he'd love to hear from you.

Re:Give him a call..

[Anonymous Coward]

Perhaps he would be interested in the used DeLorean I'm trying to sell? I got it up to 88mph the other day on the freeway.

Give me a call at 718-387-6962 if you're interested.

Let's review..

[mumblestheclown]

In the real world, badly-designed car locks would make cars easier to steal. To combat this problem, people would insist that a) the locks be re-engineered to be better and b) people who steal cars be treated as criminals who, when caught, get strict punishments.

In the bizarro world of the internet, we likewise have broken locks. Email, specifically, is like a car with really, really shitty locks on it. However, instead of knowing about this problem for many years now and a few (some equally bad) proposals for fixing it, the main mode of dealing with the problem is:

• threads on slashdot where everybody bitches about how bad the locks are or what jerks the thieves are
• general discussion that technological problems need strictly technological solutions. even if this we're true (it's not), the fact of the matter is that lack of effective communication is a social problem.

Re:Let's review..

[thoughtcrime]

If you really want to use the car analogy, I'd say it's more like this:

Cars have locks that are just fine when used properly. However, many people are very gullible, and if you go up and ask them, they'll let you borrow their car. You can steal their car after asking to borrow it, and most of them will be too embarrassed that they lent you their car in the first place to ever file a police report. The success ratio is high enough that every day multiple people will walk up to you and ask to borrow your car. To date, we've come up with no useful way of keeping these would-be thieves from taking up your time or your brainspace.

Re:Let's review..

[Anonymous Coward]

I wish that people actually thought about what they were saying before posting.

SMTP IS NOT BROKEN!

The fact that anybody in the world can email me without any trouble whatsoever is a FEATURE, not a flaw.

Instead of treating it as a broken lock, treat it as a social problem, like "neighbours from hell".

Re:Let's review..

[Stiletto]

SMTP IS BROKEN!

Why don't you post your email address here and I'll show you how broken it is. Would you like mail from president@whitehouse.gov, or maybe brittany@spears.com?

Re:Let's review..

[Anonymous Coward]

Would you like mail from president@whitehouse.gov, or maybe brittany@spears.com?

No, but I'd be happy if you'd forge mail from one to the other. It might keep them both occupied long enough for the country to emerge from the half-flushed toilet bowl we're sitting in right now...

Re:Let's review..

[Anonymous Coward]

SPF will prevent joe-jobs like this, besides I can read email headers. It doesn't look broken to me. Next.

Re:Let's review..

[Nodatadj]

Umm, you missed the point I think...

In your analogy cars == credit card details.
In the original post car locks == mail transport protocols.

The guy is mentally ill

[Anonymous Coward]

In the article, the reporter states that Todino's father says his son has mental problems. OK, fair enough. Then his father needs to step up to the plate and get the guy some help.

Barring that, the people being joe'd really need to follow up on this. Either this guy is an unrepentant spammer, in which case he needs to be made to pay the price, or he's mentally unstable, in which case he needs professional help. The latter possibility is really more serious, since Todino could conceivably go off the deep end and do something more serious. Possibly, the best approach would be for them to contact Todino's father and tell him that if he doesn't get his son some help immediately, they're going to pursue the case with law enforcement. Assuming the father's statements are true and that he gives a damn, this should at least get the ball rolling.

Re:The guy is mentally ill

[Anonymous Coward]

The latter possibility is really more serious, since Todino could conceivably go off the deep end and do something more serious.

No offense, but that's a rather uninformed view of mental illness. I've been fighting depression for about half my life and I'm finally getting past it, and I've seen this attitude before. The world is not made up of sane people and loonies who are likely to go crazy at any moment and start killing people.

I admittedly did some rather odd things when I was in heavy depressive states, but despite behaving stangely I would never ever have done anything harmful to anyone. I'm generally an overly polite person, and I when people found out I had mental problems it seemed to trigger the "but he has so quiet, always kept to himself" idea that people have heard about serial killers. It's not very fun to have people suddenly become afraid of you.

Clearly this guy has problems, and he should be held accountable for the joe job he pulled, which should include some psychiatic help, but we don't know the guy. Reacting with fear when you hear "mental illness" is not productive.

Almost every family has people with serious mental illnesses, it wouldn't hurt to educate youself on the topic a bit.

Re:The guy is mentally ill

[Anonymous Coward]

Clearly this guy has problems, and he should be held accountable for the joe job he pulled, which should include some psychiatic help, but we don't know the guy.

Ok man, we'll do that, just please don't hurt us.

Re:The guy is mentally ill

[TheRaven64]

his attitude before. The world is not made up of sane people and loonies

Indeed. There is no actual evidence that the sane people exist at all...

Re:The guy is mentally ill

[bluesangria]

A decent post, why anonymous? Oh well.
Regarding this statement:

Possibly, the best approach would be for them to contact Todino's father and tell him that if he doesn't get his son some help immediately, they're going to pursue the case with law enforcement. Assuming the father's statements are true and that he gives a damn, this should at least get the ball rolling. It is *very* difficult to enforce medical treatment on someone who has NOT been legally declared mentally incompetent and assigned a guardian. This is why you have a situation where many clinically diagnosed schizophrenics, manic depressives, etc. can STOP taking their medication and going to treatments and they are perfecty within their rights to do so.
Note, I'm talking about mentally ill people referred to as "high functioning", meaning they are mostly normal acting or their quirks are not considered "dangerous" to society, i.e. wearing tin-foil because the "aliens are out there" is ok, but killing "all girls who look like Brittany Spears" is not.

In general, a high-functioning, but clinically mentally ill person is going to be very emotionally tiring to live with, but there's really nothing Todino's father can do. His son is an adult and therefore dad is no longer the responsible guardian. Filing a motion to declare his son mentally incompetent and assigning dad as the guardian has its own drawbacks, not to mention earning the unending emnity of the very person you are trying to help. It's just too much of a lose, lose situation.

Re:The guy is mentally ill

[Anonymous Coward]

If you've known clinical depression firsthand, then you would probably agree that it does not cause one to construct elaborate and irrational conceptual models and to persist in believing that they are true in the face of evidence to the contrary.

I would contend that the behaviour exhibited by the spammer is delusional, and more akin to schizophrenia than depression. If it is true that the guy is suffering from a mental illness that causes him to believe things that are not true, and if it is true that he has engaged in retaliation against people he believes have done him wrong, would that not constitute a reasonable cause for concern about future actions?

I would think that even people that understand that mental illnesses are typically brain chemistry imbalances sometimes exacerbated by environmental factors would still be concerned about the guy's future actions if left untreated.

At the very least, he's going to spam again, and if that doesn't justify cramming some lithium down his throat, strapping his ass to a gurney and running a couple hundred volts through his cerebral cortex and maybe another hundred through his testicles for good measure, I don't know what does.

Re:The guy is mentally ill

[WoodstockJeff]

Then his father needs to step up to the plate and get the guy some help.

In today's world, it is virtually impossible to force someone to get help. Courts no longer order even psych exams, let alone confinement, unless someone has demonstrated violence towards others. It no longer matters that forcing such help might cure the person, or help them maintain what sanity they retain...

Re:The guy is mentally ill

[uptownguy]

If it is true that the guy is suffering from a mental illness that causes him to believe things that are not true, and if it is true that he has engaged in retaliation against people he believes have done him wrong, would that not constitute a reasonable cause for concern about future actions?

Welcome to how the rest of the world feels about Americans who have been watching Fox News since 9/11...

Re:The guy is mentally ill

[ConsumedByTV]

At the very least, he's going to spam again, and if that doesn't justify cramming some lithium down his throat, strapping his ass to a gurney and running a couple hundred volts through his cerebral cortex and maybe another hundred through his testicles for good measure, I don't know what does.

Wait just a moment.

Do you really believe that?

I mean that, stop and think for just a moment at what kind of a world we would have to live in for that to happen. Physically torturing someone for sending spam?

You sir, are a fucking idiot with no idea of what it is like to watch someone get shock therapy.

Re:The guy is mentally ill

[Anonymous Coward]

Remember, spammers != people.

Re:The guy is mentally ill

[Lord_Dweomer]

"meaning they are mostly normal acting or their quirks are not considered "dangerous" to society, i.e. wearing tin-foil because the "aliens are out there" is ok, but killing "all girls who look like Brittany Spears" is not."

But we can still kill the REAL Brittany Spears right?

Re:The guy is mentally ill

[Anonymous Coward]

I mean that, stop and think for just a moment at what kind of a world we would have to live in for that to happen.
Physically torturing someone for sending spam?

You sir, are a fucking idiot with no idea of what it is like to watch someone get shock therapy.

Really? What's it like? Did they fight and plead with you not to hit the button? Did you give them a mouth guard? Did their muscle contractions pop any loose restraints off? Did they wet themselves afterward? After watching it, did you say "Golly, that was unpleasant! I guess I like to receive spam after all."

Anyway, I will do as you suggest and stop and think for a moment about what kind of world we would have to live in to physically torture someone for sending spam. Mmmm... ok, I got it: A world that has improved the order of its priorities.

We currently live in a world that allows for killing and torture so that lucrative reconstruction contracts can be created and awarded to U.S. companies. We currently live in a world that keeps men prisoners on death row for ten years and then executes them while refusing to perform DNA tests that might exonerate them. We give severe punishments to those whose crimes affect few, and we ignore those whose crimes affect millions. That seems backward to me. Seriously. In comparison to the total misery created by a crime and the likelihood of any one person being affected by the criminal, spammers should serve much longer sentences than murderers. So should retirement fund plunderers and corrupt politicians.

You need to pick up some WSBurroughs or something; might improve your dark humor detection a little.

I've been "Joe'd".

[real_smiff]

yep this has been happening to me but until today i didn't know there was a name for it. i just called it "some bastard using my domain in his from address". it's regular and automated, but not on this scale though, thank lord.

i kind of feel slightly better now. knowing there's a name for it.

definition linked to in Wired article: http://searchcio.techtarget.com/sDefinition/0,,sid 19_gci917469,00.html

part of the problem (and i feel like i should be careful what i say eh ain't this silly) is that many ISPs tout an "unlimited addresses" feature allow anything@username.isp.com - and some spammers are realising this. or trying everything to get around filters... :/ a right pain in the behind!

Re:I've been "Joe'd".

[Anonymous Coward]

This is exactly why SPF is being created.

wow

[Anonymous Coward]

Farber said e-mail systems must be hardened against fraudulent use.

The sounds like something Captain Obvious would say. If that actually happened by cthulu we would have no spam!

lol

[real_smiff]

who modded the conspiracy theorist up?! :p heh, well fair enough, but we've gone OT. i dunno what there really is to discuss about this article. i guess it could be interesting for anyone who got one of these spams and read it to find out he really was serious.

Advertising is valid....

[Anonymous Coward]

Hear me out for a sec.

Advertising is a valid form of communication that is not protected by free speech. Telemarketing, spam, junk mail are legit.

BUT

They would be acceptible if a) there wasnt sheer crap pedalled, not to mention illegal, with pathetic tatics like header faking and b) THERE WASNT SO FUCKING DAMN MUCH.

I am one of those poor scmuck who walk about delivering junk mail. Sue me, I need to eat too. BUT, I think on the long walks I have thought about the situation. Most people, believe it or not dont mind the valuable (*cough cough*) advertising. what is pissing people off is that THERE IS SO FUCKING MUCH OF IT. It just never ends. There are three (!) seperate junk mail companies out there in Aust all wanting 3 - 5 sets of pamphlets delivered each week.

Really, the junk mailers, spammers and telemarketers are digging their own grave. They are burying us with shit. If they did it in moderation AND made the adverts worthwhile, for services and products that were seen to be half okay, there would be hardly a problem. But, look at the situation. Bullshit e-mail spanm thats all about porn and illegal drugs - make no mistake, the drugs like Viargra are illegal to be sold like they are pedalled via e-mail!. Telemarketers calling, calling and MORE calling. Junk mail that overflows letterboxes.

Frankly, I dont mind doing the junk mail round. Just about all people say hello if they see me. No one chases me with pitchforks (*). But how much longer? Hey, dont scream at me, those junk mailers are just paying me and if they are, I'll deliver. It's them who are screwing the pooch by the constant bombardment.

Admittedly, I feel like just tipping all that shit into the bin somedays.

So please, ignore what I do legally, even if you dont like it. Read my points instead, I think you may agree.

(*) - And if you did have a pitchfork, it's likely I'll outrun your ass. All that walking / jogging as made me bloody fit. Maybe I cant outrun a bullet, but I can dodge :D

BVHWEEEEEP! BVHWEEEEEP! BVHWEEEEEP! BVHWEEEEP!

[Anonymous Coward]

Hat-stand radar activated! Begin doughnut filter deployment procedure!

I'm sure he's probably a really nice guy and all that, but it doesn't change the fact that he's a raving loony.

On to something strange and new?

[BrynM]

Imagine if activists started doing this. I could see some of the nuttier protesters trying to get away with similar antics (black bloc?). Politispam? Anti-e-spamlishment? Anything to disrupt normal business.

...Not that I would condone anything like this. My e-mail box gets full enough as it is and eventually the effectiveness would wear off as spam filters started getting more examples of the stuff. However, this illustrates just how wild the internet still remains - even with all of the legislation and legal action regarding technology. This guy just ran rampant it seems. It's kind of nice to know that people can still do that.

Anti-spam laws are very dangerous

[t_allardyce]

earthlink.net seems to have a pretty good way of dealing with spam - when you send an email to an earthlink account for the first time it gets put in the user's "suspect" folder, then you immediately get an automated response with a url, you go to the page and enter the standard coded-number-in-a-distorted-image and can optionally add a short request message and your name, then the recipient can accept you and all further emails go straight through with no problem. You would only need to check the suspect folder if you were expecting something like a password reminder or welcome message. This is the sort of solution that will end up being adopted not some stupid "charge for emails" idea and we dont need laws that add to the complexity of everything and could potentially restrict freedom of speech (a law saying you cant send spam could provide ammo to the courts/legislators for starting other laws which go much further).

Re:Anti-spam laws are very dangerous

[scrytch]

The system you describe is something called "Challenge-Response", which is vastly broken in a number of ways. Sure the recipient isn't bothered by spam, they just offload the problem to everyone else, like blind people, email helpdesks (at one job I typically just binned customer support emails from people using Matador) and forged sender addresses -- every single C/R system I've seen is stupid enough to send challenges to people in the From: line, either message or envelope. More than one C/R vendor has been known to spam the senders who sent to a "protected" mailbox. This sort of cost-shifting is the very basis of what makes spam a problem in the first place.

sh*t forgot my point - don't bounce mail!

[real_smiff]

at least not before checking the headers. the 'from' address should match mail server(s) passed through (someone correct me if this is way out, i'm no mail expert). otherwise you could just be adding to the spam problem... i used to make this mistake and bounce everything i could, thinking it was "revenge". Oops. shameful. and if this is too far OT, mod me down. just trying to make a constructive post vis-a-vis this topic.

Re:sh*t forgot my point - don't bounce mail!

[schon]

the 'from' address should match mail server(s) passed through (someone correct me if this is way out, i'm no mail expert)

Consider yourself corrected.

In many cases, the From: header won't match the servers - for example, if I send a work email from home, I'd need to know if it bounces. It would be bad form if the recipient's mail server decided to silently drop the email.

We had a sale on DWGs just last month...

[shift8key]

and this guy missed it. $39.95, plus sales tax, (in 2003 currency) with FREE shipping. What a dork!

MOD PARENT UP

[Pingular]

This is THE most interesting thing I have ever read, thankyou for bringing it to my attention. I'm in your debt.

How The Hell?

[Anonymous Coward]

How on fisking earth is the first relevant post redundant?

HOW?

Re:How The Hell?

[Anonymous Coward]

They're modding jokes "Troll", offtopic alien crap "interesting", and taking down any AC offtopic stuff asap. Add that to the unfair redundant and you've got widespread shitty moderation... fuck em.

Re:How The Hell?

[Anonymous Coward]

How on fisking earth is the first relevant post redundant?

HOW?

It will be redundant... in the future.

Re:How The Hell?

[Illbay]

Mod parent up!

Re:How The Hell?

[Anonymous Coward]

> Laird o' the Nac Mac Feegle!

Ahha! Impostor!

"Nae quin! Nae laird! Nae master! We willna be fooled again! Nac mac feegle wha hae!"

Bouncing is moronic. Stop it.

[droleary]

What strikes me is that the major problem is not the spammers doing direct DoS attacks on the targets, but that they're using brain-dead behavior of mail servers to pull off DDoS attacks. If you control an MX, please configure it to issue a 550 error during the connection if you can't deliver the message instead of accepting it and then bouncing to what you almost certainly know is an innocent party. A party who is not the sender of the message, by the way, which means you anal types who say "RFC says I must bounce" have to note that it also says you must not lose a message, which is what a bad bounce does. Please be a friendly network neighbor and stop bouncing spam.

OT: Regarding your sig.

[Anonymous Coward]

I get a 404 in what I can only assume is Dutch (looks like a funny mix of Swedish, German and Spanish to me.)

Re:OT: Regarding your sig.

[The Fanta Menace]

Ah, thanks. That never went anywhere because it all got too complicated for me. Didn't even know where to start.

Bad analogy...

[Kjella]

In the real world, badly-designed car locks would make cars easier to steal. To combat this problem, people would insist that a) the locks be re-engineered to be better(...)

In the bizarro world of the internet, we likewise have broken locks. Email, specifically, is like a car with really, really shitty locks on it. However, instead of knowing about this problem for many years now and a few (some equally bad) proposals for fixing it, (...)

The thing is, what lock I got on my car doesn't affect any other car. In fact, they're in general completely incompatible. Can a key from manufacturer X be used to open a car of brand Y? No. Does that matter? Also no. That leaves room for experimentation and real effort in making a "safer" car.

You can create your own ultra-safe e-mail system but it doesn't do any good because the other 99,99% of the world isn't able to communicate with it. That's why there's so many ideas, but nothing that actually gets used.

The second reason is that there's no real commercial incentive for fixing e-mail, at least not for free. That is why they try proprietary solutions, which in general fail because there's already something that's free, universal and works - sorta works at least.

If you want to create a new mail system, you'd need the following to succeed:

A system that is in fact well designed, user-friendly and effective on a large scale.
A BSD-licenced server implementation that can work on all the major platforms.

You might say that's unreasonable. It is. But if you want to overcome the momentum that the current e-mail has, I don't think you can do with less...

Kjella

Re:Bad analogy...

[mumblestheclown]

QUOTE:

If you want to create a new mail system, you'd need the following to succeed:

1. A system that is in fact well designed, user-friendly and effective on a large scale.
2. A BSD-licenced server implementation that can work on all the major platforms.

Good post, Kjella. #1 is a given. #2, however, is your politics creeping into the game.

Your point about the fact that a systemic change is toughter than an individual change is spot-on. However, i propose that what's really needed for #2 is not one particular technology nor one particular license, but:

2. A community that recognizes that the problem as both a technological and social one (not that "SMTP is not broken" idiot from a previous reply who will argue also that a broken door lock is not broken because it does, indeed, let the owners into the car), sets forth clear and open STANDARDS to which implementations can be designed (not an implementation per se) based on #1, and then, critically, will have the influence and momentum to declare a cut-off date - I suggest 3-4 years in the future, at which point the existing SMTP based systems will be declared "officially obsolete."

Ideally, the system designed in #1 will have reasonable transitional capabilities - like the fact that early web servers had lots of configuration options for your existing gopher junk.

Re:Bad analogy...

[quantum bit]

A BSD-licenced server implementation that can work on all the major platforms.
Good post, Kjella. #1 is a given. #2, however, is your politics creeping into the game.

I think it's more a valid point than simply politics. Open Standards are much more likely to be adopted if there is a BSD (or similar) licensed implementation.

Do you think TCP/IP would have caught on nearly as well as it did if everybody had to write their own network stack from scratch rather than simply copy the BSD one and modify it slightly? Sure, many (open-and-closed source alike) ended up writing their own eventually, but having the original available for use until then made the protocol able to be adopted much more quickly. Ditto for DNS (BIND), DHCP, SMTP, and other protocols for which a free reference implementation is available.

Some time take a look through the list of RFCs and see how many Internet protocols have been written but either:

• Never implemented
• Only implemented by the vendor who wrote the protocol (as proprietary software)
• Only implemented by GPL software

Re:Bad analogy...

[davburns]

Looking at SMTP as a security solution leads one to try to understand what security policty the SMTP server needs to implement. Before spam, it was "anyone on the internet can append email to my mailbox, but only I can read and delete the email." Now, we're trying to implement "anyone who is not a spammer can append anything that is not spam to my mailbox, but only I can read and delete the email." That's harder, because we have to define spammers (ussually with DNSbls) and spam (with baysian and other filters).

Some users try to make their email addresses "secret" like a key. This works for some, but not for others. This is essentially implementing "People who know my address can append emails to my inbox, but only I can read and delete." The address is essentially a plain-text password, which is shared by all of one's corispondants.

Compairing this to the car lock, I think you can see why the analogy breaks down. The security policy for a car door is "only the owner or somone with the owner's premission may enter." This is accomplished through a key (brass or radio). It can be broken by a determined theif, but is ussually sufficient to make it not worth the risk of being caught. The lock mostly works because it has a simple security policy and there's serious consequences for even trying.

I think the "anyone may append" property of email is a big part of what makes it successful. Managing a list of "who may email whom" is an N-squared problem, so any AAA is unlikely in any protocol. I could imagine ways to allow email only from humans, but that breaks mailing lists and other useful things. There might be useful ways to modify and/or replace SMTP, but I think that "anyone may append" is both needed for the usefulness of email, and sufficient for spammers to abuse.

If we want to solve the spam problem without breaking the usefulness of email, I think we need to use all of the tools we can. We have to make it technically hard to spam. We need to educate users to never buy anything from spam, and we need to have serious consequences for anyone who tries.

it's not all bad

[DarklordSatin]

I tend to, at least, glance at every email that I receive (spam included) and I have to say that they're not all bad. Some spam is actually pretty amusing (the time travel spam was a good example.

In fact, I would go so far as to say that if every spam that I received was that entertaining, I probably wouldn't mind receiving spam at my current rate.

This guy is a fake!

[AstroDrabb]

Everyone knows that the *real* time traveler is named JOHN TITOR!

Re:This guy is a fake!

[jorlando]

that one was good:

Does China have a manned space program between 2001 and 2036?

I believe they are pretty close to putting a man in orbit. It shouldn't surprise you if they do that soon.

Re:This guy is a fake!

[AchmedHabib]

yes but no doubt this has been in the works for years, so I guess it sould be less of a surprise for those into space stuff.

Re:This guy is a fake!

[ConsumedByTV]

Pretty interesting stuff.

Cynicism and mistrust is not the solution

[October_30th]

I disagree. That approach means that instead of going after the real bastards, spammers and scammers, we give up and embrace cynicism and absolute, "trust no-one" kind of mistrust as a normal way of life.

AGREED,CHECK LINK AND MOD UP!

[Anonymous Coward]

amazing. thank you.

Wouldn't do the car analogy

[Sycraft-fu]

Car security is abysmal. Car locks (and most other locks) are trivial to bypass with just a little knowledge. I've personallly watched a trained locksmith enter a car in under 45 seconds without a key.

No offence

[Sycraft-fu]

But your particular experience with mental illness doesn't extroplate to the population at large. Different people will react different ways. Many, if untreated, will end up at a level such that they hurt themselves and/or others. To your stastically invalid personal experience I can relate an equally invalid but opposite experience:

A person that lived next to my parents developed a mental illness, schizophrenia to be precise. He coated all his windows in aluminium foil and was known to shout at nothing in the night. He was comitted to a mental instution where he got help and drugs and was released. The drugs allowed him to function generally normally. Then he stopped taking them and one night, shot himself fatally. Thankfully in this case he didn't hurt anyone else but very unfortunately he did kill himself.

Severe mental illness isn't something to be taken lightly. Any person seriously seeking non-extant parts to build a time machine has clearly lost touch with reality. As such he could potentially be quite a danger to himself and others as he seems to have a tentative connection to the real world. Professional help is most certianly in order.

While it is true that being severly mentally ill does not equal being a deranged killer, it does mean that a person has serious problem and is in need of serious help, not just for teh sake of others, but for their own sake. The grandparent poster is not out of line with the reasoning that this person need help before he can slip any further away from reality.

Re:No offence

[Anonymous Coward]

I agree with what you say. I was certainly a danger to myself when I was in that state. If he is really ill he should get help.

The original poster seemed to be suggesting that the guy might go nuts and take violent action. That's certainly possible, I don't know the guy, but "mental illness" is such a broad category it's not fair to lump psycopaths, serial killers, and terrorists together with depressives and obssive compulsives.

He wasn't out of line suggesting the guy get help, and I hope he does. I'm probably overly sensitive to percieved knee-jerk reactions on this topic. But there's such a wide gap between forging headers and attacking someone physically. I'd rather see people react with intelligence than fear.

Re:No offence

[Anonymous Coward]

STFU you nutjob!! And quit logging in with my account posting messages claiming that I'm nuts!!!

Heh

[chrae]

... spam attack on three popular sites in retaliation for making fun of [...] Robby, if you're out there, you have ceased to be amusing

In other news Slashdot user, HopToit, has become the target of the most massive recorded spam attack in 3,000 years.

Poor guy :)

Spam can be as serious as Murder.

[Andy_R]

Murder is the senseless waste of a human life.

Spam is the senseless waste of millions upon millions of tiny fractions of a human life.

There comes a point where the few seconds that each of us without spam filters spend deleting this crap adds up to the average lifespan of a human being.

If someone has sent that much spam, why should they not be treated in the same way as a murderer?

Re:Spam can be as serious as Murder.

[Anonymous Coward]

Hi. You're an idiot.

Re:Spam can be as serious as Murder.

[ChipMonk]

Yet, you sit there and read Slashdot. Pot, meet kettle.

Re:Spam can be as serious as Murder.

[scrytch]

"You cost me five minutes from my life, and I want them back! Nevermind, I would have wasted them anyway..."

Re:Spam can be as serious as Murder.

[Craig3010]

My God you need to get laid.

Re:Spam can be as serious as Murder.

[zangdesign]

For the same reason that no one will ever carry through on my plans to

a) enslave hackers and virus writers until they pay back the FULL amount of their economic damages

or

b) summarily execute them in a gruesome and tortuous manner

It this whole "respect for human life" that keeps us all bound up with arcane rules about how we should value even the smallest living thing.

Oh well. One day when our robot overlord masters descend from the skies, I will welcome them and then point them in the direction of everyone who is even the slightest bit annoying and hope that they will take care of the problem.

NOTICE FOR THE HUMOR IMPAIRED: I'm kidding. Badly written, perhaps, but kidding.

Re:Spam can be as serious as Murder.

[Anonymous Coward]

No, and I found it sad and pathetic that someone thought to mod this piece of drivel up. Murder is the intentional ending of someone's life; we (generally) don't distinguish between murdering the very young and the very old. If Joe Schmoe kills a 90-year old guy, should we wink at him and say, "the old man was on his way anyways. 3 months!"

And dear, what about the falsely accused? There must be a bonafide murder to imprison someone for it, limiting the number of innocents that can be put away. Think our system can distinguish spammers that well? How many spams merit life in prison? What if they did buy an opt-in list? Let's see, at 1 second per email, that's 32 million emails per year in jail. About 2 billion spams a day are received (10 for every man, woman & child). Thus, we should be putting 300 spammers away for life every day. It may even stop spam!

Honestly, I have nothing against penalizing spammers based on how much crap they send, but equating it with murder only serves to trivialize the most serious crime we have, and to give our police & D.A.'s far too much power (and the ability to play favorites with long prison sentences). Makes about as much sense as putting away non-violent drug offenders for 5 years.

Straightforward spammers (no fraudulent claims, valid return addresses) are essentially no different than other advertisers, sucking up the "precious" seconds of your life. If there's a penalty for this, it should be strictly economic-- no loss of liberty.

OTOH, much spam is fraudulent, uses phony addresses or both. The damage these emails cause is far greater and our current laws can address them, if we have the wherewithal to pursue them. With criminal (i.e., loss of liberty) penalties.

BTW, the current "can spam" bill recently passed in congress (read: you "can spam" now), will completely legitimize the 1st type of spam, and just increases the penalties for sending the second type, which our attorney generals have shown themselves to be essentially disinterested in pursuing. Brain-dead congress at its best.

Re:Spam can be as serious as Murder.

[Seedy2]

I'm glad I'm not the only one who thought this was a good idea.

Death penalty for spammers!
(or what ever your state/country uses for murderers)

Re:Spam can be as serious as Murder.

[Anonymous Coward]

we (generally) don't distinguish between murdering the very young and the very old

Actually, it has been legal to kill the very young in America since 1973 (Roe v. Wade) -- many states are still trying to get the killing of the very old on the ballot but other than Dr. Kevorkian there hasn't been as much headway in this direction...

Re:Spam can be as serious as Murder.

[jc42]

Heh; fun argument.

Way back when the US government passed the 55 mph national speed limit, there were a number of people who pointed out the same sort of problem. The usual reason was for saving lives. But a straightforward cost-benefit analysis, using pulicly-available actuarial and highway data, showed that when you added up the extra travel time from the lower speed limit, it would take roughly three lifetimes of travel to match a single traffic death. Since the extra travel time is "dead" time that can be considered stolen from your life, the same reasoning could be applied.

Not that this convinced much of anyone. But it was a fun bit of reasoning to read about.

We do have a problem that not just spammers, but pretty much anyone in a position of authority generally considers wasting your and my time to be not a problem. The only way I've ever found to fight this is when I'm working on an hourly basis, and I can tell someone "This discussion we have just had, which has accomplished little other than prevent me from doing the job I'm being paid to do, has cost your company $N. Should we continue the discussion, or should I get back to work?"

Unfortunately, even this isn't always effective. But sometimes it does result in me not getting invited to meetings.

Re:Spam can be as serious as Murder.

[freeweed]

And when 500,000 Slashdotters spend the time to read your post, can we kill you 10 or 15 years early?

Re:Spam can be as serious as Murder.

[Anonymous Coward]

It is not legal to kill the very young. It is legal to terminate an unborn fetus before it becomes a living person.

Also, no one is trying to legalize killing old people. They are trying to make it legal for old people to have help killing themselves.

Dumb ass.

Re:Bouncing is moronic. Stop it.

[DoorFrame]

Yeah, I'm going through this right now... but oddly enough I don't seem to be getting all that many bounced spams. Maybe their lists are fairly accurate? I don't know, I'm only getting about 25 or 30 per day and they're filtered out fairly easily. I do wish the sender wasn't using random usernames for each address, that would make it easier to deal with. Oh well.

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

Instead of a tax (why do some people always look to government for everything), why not use a micropayment system in which the sender must pay the recipient for delivery. If the sender is a friend or the e-mail is truly worth it, then the recipient rebates the sender's money. The recipient would set the payment level and publish it to the public.

For example, I would probably set my payment level at about 0.50 or $1.00, but if I stil get too many spams, then I would boost the charge to $2. I would also create a whitelist of people (friends, clients, mailing lists, and a few select businesses) who are automatically exempted. When somebody tries to send me an email, the MicroPayment Mail Transfer Protocol (MPMTP) would automatically inform the sender of the charge when they hit the send button. People not on the system would get automated return e-mail requesting that they join the system to complete the sending of their e-mail.

The point is that each person can decide how valuable their time is. Spammers (including those in Hong Kong) would be forced to target e-mails to only those people who would appreciate them.

Re:E-mail tax...Micropayments to Recipients

[October_30th]

Instead of a tax (why do some people always look to government for everything), why not use a micropayment system

And how do you implement such a system without backing it up with government-level machinery such as laws, law enforcement and judicial process? No, it's better to make it a government controlled operation from the start so that the standards are set the same for everyone.

Re:E-mail tax...Micropayments to Recipients

[GMontag]

Micropayments? NO! Microwaves!

I microwave my e-mail before reading to kill anthrax. It also gets rid of all of the spam too!

outsource and php programming

[chrisranjana.com]

spam should be avoided. Spammers continue to thrive ONLY because there are people who believe these spams and scams and lose money.

Challege/Response systems are very dangerous

[AndroidCat]

enter the standard coded-number-in-a-distorted-image

I'm using an ASCII terminal. Or a PDA with a small screen. Or VoiceXML over a telephone. Or I'm sight-impared. Or my ISP bounces your ISP's coded-number-in-a-distorted-image with request that they respond first with a coded-number-in-a-distorted-image, rinse, repeat. Or I have my filters set to autotrash any graphics in email because 99% of the time it's for penis pills. Or it was a Joe-job and your ISP sent me 20,000 coded-number-in-a-distorted-image challenge emails.

Now what?

Re:Challege/Response systems are very dangerous

[Seedy2]

error: respondent failed to actually read the post responded to.

The image distorted number is on a WEB PAGE the URL is sent in the email.

Re:Challege/Response systems are very dangerous

[AndroidCat]

Yes? And how does that help me read it when: ASCII terminal/PDA/Voice/I'm blind, you insensitive clod!/etc.

You read my last case, did you read any of the others?

Re:Challege/Response systems are very dangerous

[Frac]

Nothing in this world is perfect - I'm sure for any given solution someone like you is bound to go "oh, but what I etch out binary code on clay tablets, how am I supposed to live my life now if you implment this solution?"

It's only the first e-mail that verifies the address. If you can't inconvenience yourself for that one first e-mail for the sake of the hundreds of junk mail the earthlink account holder gets every week, maybe you don't deserve to be that person's friend.

Re:Challege/Response systems are very dangerous

[AndroidCat]

Or vice versa. *shrug* Oh well, I think I can stand the loss.

Re:Challege/Response systems are very dangerous

[t_allardyce]

your right i wasnt thinking before i posted, however knowing the internet im pretty sure that sort of solution will become the norm - look at flash vs svg or the sorry state of css implementation.

Although some of these problems could be worked around, instead of coded-image you could use random logic questions, ie

"the rabbit is blue, what colour is the rabbit?"

although they would have to be kept simple enough so that anyone could answer but randomly structured so spammers couldnt just cleaverly script responses.

That would be viable over voice, ascii and to the blind and deaf.

Re:Challege/Response systems are very dangerous

[AndroidCat]

Noted. (Flash and css noted and seconded. One company's page implied that something was broken on my machine because I have ActiveX turned off.)

And I'm not saying the challenge/response is all bad, just not the One Perfect Tool. It's only another tool in the toolbox to be used carefully for the right job.

The businesses that create these always seem to promote them for blanket usage. (Well, they are businesses after all.) However, a lot of them seem to go broke fairly fast. (Dot.boom business models?)

yoU mAy HatE r0bbIE, bUt I lOve yOu

[Anonymous Coward]

Call me.

Re:E-mail tax...Micropayments to Recipients

[Patrick May]

No, it's better to make it a government controlled operation from the start so that the standards are set the same for everyone.

Why does it have to be the same for everyone? If I want to configure my mail agent to only accept email that:

• Comes from someone on a whitelist OR
• Is signed with a PGP or GPG key on my keyring OR
• Includes a micropayment from a mint on my approved list

then where is the need for any involvement of anyone else, including the government?

Using the force of government should be the last resort, not the first. It always results in unintended, negative consequences.

Sincerely,

Patrick

Re:E-mail tax...Micropayments to Recipients

[Anonymous Coward]

The only government involvement we need is telling China and korea that their address assignments will be firewalled by major carriers unless SPAM is eradicated. SPAM is any unsolicited commercial email, it doesn't matter who sends it. The system breaks down when clowns start trying to turn email into a 'profit center', if it gets much worse people will gladly bend over for a nickle a mail. The question is why has the situation been allowed to degenerate to this level in the first place?

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

And how do you implement such a system without backing it up with government-level machinery such as laws, law enforcement and judicial process?

I agree that government and law form the underpinnings of our economic system. But government did not create eBay or credit cards. Government is moderately good at creating a regulatory context in which rights and responsibilities are balanced for the average and common good. Government is generally bad at creating innovative systems that are customized to the needs of individuals. Finally, government is ill suited to standardizing/regulating international phenomena like spam and e-mail.

No, it's better to make it a government controlled operation from the start so that the standards are set the same for everyone.

The point is that not everyone wants the same standards. Some people may not value their time or not care about spam and thus chose a low hurdle (and a 0.01 tax is a very very low hurdle for spam, IMO). Others might place an extreme value on their time or loath spam so much that they place a high value of their time. So the recipient should set the payment.

Moreover, it is not the government that bears the cost of spam, it is the recipient. The recipient's "labor cost" far exceeds the cost to the internet infrastructure. Therefore the recipient should get the payment.

Since the recipient should set the payment and the recipient should get the payment and the issue is international, I would think an organization like VISA would be better at running the program than any of the Earth's 180-some-odd governments.

Re:Bouncing is moronic. Stop it.

[StormReaver]

The problem with your suggestion is that spammers will then use the accept/reject mechanism as a means of verifying email addresses, something equally bad.

no animositIE towards robbIE

[Anonymous Coward]

just as manIE who have soul DOWt, he is his owned reward. we're just monitoring the 'stuff that matters' deficit, & a few other things.

Re:E-mail tax...Micropayments to Recipients

[October_30th]

You make some very good points, but I am still sceptical when it comes to a private organization handling the transactions. The recent and still ongoing (?) ICANN/Verizon mess comes first to my mind.

You can vote out a government, but you can't vote out a corporation (unless you can buy them out).

The guy's crazy -- like a fox

[Anonymous Coward]

Did anybody open the HTML attachments with the time travel spam? They were advertisments for penis pills, viagra, and all the usual suspects. The weird-ass messages simply spoofed spamAssassin, et al., into passing this rubbish along...

Vincent "The Chin" Gigante wandered around Greenwich Village in a bathrobe, pretending to be crazy, to escape a murder conviction. Robby "Captain Time" Todino covers his slimy business with feigned nuttiness.

They both deserve the needle.

The customers are the companies.

[Kwil]

When you think about it, do you think joe-blow spammer has a warehouse full of penis pills or runs a pharmacy from his backyard?

Of course not. Spammers don't need to sell a single thing. All they need to do is convince the companies that they'll sell something. And when you come off with a pitch like "I can market your product to 10 million people through e-mail. If you get even a hundredth of one percent sale rate, that's still 1000 units sold," it's pretty easy for someone who doesn't know the hassle and bad reputation spam causes to think "Hey! That's a good idea!" with dreams of money bags flowing in as they think of the typical response rate of 3-5% of mail order catalogs.

And for illegitimate and questionable products, they're always looking for ways they can push their message without risk of getting busted. So there's a built-in long-term market for spammers to sell to right there.

Re:The customers are the companies.

[kimgh]

Of course not. Spammers don't need to sell a single thing. All they need to do is convince the companies that they'll sell something.

Absolutely! Any effective anti-spam legislation or technique must target the companies who hire the spammers. So far, only the State of California appears to recognize this to any degree.

death penalty

[Anonymous Coward]

We're just going to have to start killing these scumbags.

It's the only way.

How long until e-mail is replaced by M$ mail?

[pe1chl]

How long will this "we need a new e-mail system" go on? The discussion about a new protocol to replace SMTP has gone on for ages, but nothing has happened.

I predict that Microsoft will come up with a new, better secured way of transferring mail messages over the Internet. It will be a closed architecture that requires Windows on all client and server systems. It will take over from e-mail overnight. In about a year's time, you will get more and more comments like "Oh, you still have such and old-fashioned mail address, one with a @ in it?" from most of your mail partners, certainly in business uses of mail...

Why? Because the advocates of open standards only talk about the problems of migrating to a new standard, and don't actually start designing and migrating.

Re:How long until e-mail is replaced by M$ mail?

[Anonymous Coward]

"Why? Because the advocates of open standards only talk about the problems of migrating to a new standard"

And whenever flawed systems are presented, they don't stand their ground, immediately caving in to the newfangled system? Doesn't look like it to me.

Re:How long until e-mail is replaced by M$ mail?

[Patrick May]

It is being worked on by the IETF. The ASRG working group appears to be making some progress.

There is no way that Microsoft can take over the email system because they simply don't have the near-monopoly on servers that they have on the desktop.

Patrick

Re:How long until e-mail is replaced by M$ mail?

[mt-biker]

I predict that Microsoft will come up with a new, better secured way of transferring mail messages over the Internet.

Almost. More likely an open-source project will come up with the next-generation Internet messaging system. Microsoft will create their own "extensions" to the system which will ("unfortunately") render Microsoft's version of the system incompatible with the "standard".

Microsoft will count on their domination of the market to ensure that their, and only their, solution becomes the defacto standard.

Re:How long until e-mail is replaced by M$ mail?

[pe1chl]

They are working towards a monopoly on services. That is even worse than a monopoly on servers would be.

Useless signature?

[Bananenrepublik]

So what's your public key? Or how am I meant to verify your signature?

Re:Useless signature?

[frdmfghtr]

ldap://keyserver.pgp.com is where it can be obtained via PGP's PGPKeys utility...I am one of those who doesn't have (nor has a need for) a personal webpage.

I s'pose I could put it in my journal too...done

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

I am still sceptical when it comes to a private organization handling the transactions

Agreed! I am not 100% comfortable with the idea, either. The thought of Microsoft becoming the micropayment manager for the majority of the world's e-mail gives me the willies. I only think that private companies will do a better job than government -- whether they do a good job is another matter.

Perhaps private companies might form and administer these networks, but government might define minimum standards and create interoperablity requirements. To me, that leverages the strengths of both groups -- private companies are relatively good at creating some level of value that people are willing to pay for. Government is relatively good at creating some level of fairness that people are willing to vote for.

Many systems would be better than the current system in which the cost of communication is so low that people are encouraged to spam the system with communications that are worth nothing.

Re: Advertising is valid...

[SouthwindCG]

I agree that advertising is valid, when there's a legitimate product being offered from a reputable source. I don't mind seeing the occasional email from computer hardware and software companies, stuff that I've opted to receive.

What I hate is scammers who as you say do the pathetic tactics. If I set up filters blocking bogus headers, keywords and the like, it means I don't want your junk, plain and simple.

As an example, I put 'viagra' in my blocklist. So in comes an email with v1agra or v|agra in it. What does the spammer think I'm going to do? "Oh, he got past my filter. I guess I have to buy his product now." Duh. If you have to deceive your way into my Inbox, it means I wouldn't ever buy from you anyhow. Spammers are idiots.

Keep your wits about you. Those pitchfork-wielding junk mail haters are crafty. I used to do that job too, flyer delivery. ;)

I WILL PAY AS MUCH TAXES AS POSSIBLE

[Anonymous Coward]

The next time I read some clueless person throwing the idea of "taxation of email" in here again, I'll throw up!

The day a email tax is born will be the very same day when email will die!

How should your begging(!) to pay a(nother) TAX for email prevent foreign spammers to spam you? You will feel fucked in the ASS after paying MONEY and still receiving offers of penis enlargement! The only thing you can do against spam is NOT buying that CRAP!!!

Re:I WILL PAY AS MUCH TAXES AS POSSIBLE

[jc42]

The day a email tax is born will be the very same day when email will die!

Nah; it'll just morph into something not legally recognized as email.

In fact, just this sort of thing has already happened many times, for several reasons.

Thus, my wife and I have a joint account with a local ISP that also supplies things like email accounts, unix shell accounts, etc. We had been using our mail readers to access this account from home. But one day it stopped working. A few hours of testing verified that our (cable) ISP had started blocking outgoing connections to port 199 except on its own machine. They want all our email stored on their machines, not on some competitor's machines.

It didn't take long before the other ISP announced a solution: They simply set up a web interface to their email accounts. Now our home ISP can't block the access, because they only see a TCP connection to port 80. The url starts with "https://", so the email is encrypted, and they can't tell that it's email. Even if they suspected this (which I'm sure they do), there's not much they can do. They can't block all https pages, because online commerce depends on them.

It's much like the shutdown of Napster. The only real result was to replace it with a whole flock of other P2P services, no two alike. Shutting them down will just annoy your customers and encourage replacements that your blocking/taxing code can't recognize.

Re:E-mail tax...Micropayments to Recipients

[Tony Hoyle]

Without laws nobody would pay.

Credit cards weren't setup by the government, but they were made possible by it - Lender A lends you the money, and refuse to pay, you go to jail. Without such a law credit cards would never work.

There's nothing like that for email. I'm perfectly at liberty to say 'anyone who sends me email must pay $1' but there's no law to enforce it... certainly not from the spammers - although 99% of spammers are US based they use open relays in korea/poland/russia to send their emails.. and they're not easy to trace either. Even if I could trace them why would they pay? (this is why shareware never worked... nobody actually registers their software - how many people actually pay for winzip for example?)

IMO Spammers when caught should have internet bans placed on them - if a court said Ralsky wasn't allowed to use the internet for 5 years it'd be cheap to implement and hit far harder than a fine (hopefully drive him out of business permanently).

Re:E-mail tax...Micropayments to Recipients

[wo1verin3]

>> If the sender is a friend or the e-mail is
>> truly worth it, then the recipient rebates
>> the sender's money. The recipient would set
>> the payment level and publish it to the
>> public.

Lets see how that would have worked when I got my Cease and Desist letter for posting screenshots from GameSpot

"Wow, a cease and desist letter. This mail truly isn't worth it, I'm keeping the senders money. Good thing I put the payment level at $50."

Where's YOUR control?

[StarKruzr]

I dunno about yours, but my TV has a power switch. Besides, who needs TV when you've got BitTorrent? :)

Re:Where's YOUR control?

[lone_marauder]

Right on my tivo remote.

Hey now...

[Craig3010]

I read this guy's father said he has mental problems.

NEVER ever fuck with someone that thinks Michael J. Fox was talking directly to him.

Think carefully about this

[Random832]

think about the definition of a "joe job"... it's intended to get someone in particular to be blamed for something... perhaps this is a two-layer joe-job, with the second layer (which fooled you all) being aimed at Todino?

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

Spammers when caught should have internet bans placed on them

I agree, but it would not do much good. For better or worse, the curent internet does not require proof of identity to get an account, set up a server, or send e-mail. And I'm sure privacy advocates would never allow that kind of traceablity to happen.

But if e-mail senders were forced to deposit money into a escrow account prior to sending an e-mail, they would have to steal the money (a definite crime) or pay the money to get their spam delivered.

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

"Wow, a cease and desist letter. This mail truly isn't worth it, I'm keeping the senders money. Good thing I put the payment level at $50."

LOL! And then the lawyers would just bill the client for it.

On the other hand, they could just send you the C&D via snail mail. Also, any new friends that aren't yet on your whitelist might balk at putting up $50 just to send that first e-mail to you.

Watch out Slashdot... this is libel

[Anonymous Coward]

I read the article, and until he gets convicted or confesses to doing the spamming, what you have done is considered libel. You cannot say that Todino is responsible for this spam attack because you have no proof. You could be sued, so if I were you, I would change your title to something less libelous.

This is a good point

[cpuffer_hammer]

This is the kind of thinking that we need to be doing.
If a new email system is created by a non free/open group. It could really put the FOSS community back a more than a decade or more.

ON THE OTHER HAND if the FOSS community was to introduce a email standard it could give us a boost of a year of so, if not more.
(The difference is that we will not (and can not) prevent then from using our methods))

This is a place where the EFF or FSF could make a big contribution to the process. If respected group was to start the process then we could begin to move forward. The process does not need to be prefect the first time it just need to be able to grow and change in an ordered and up gradable way.

Re:E-mail tax...Micropayments to Recipients

[pentalive]

1 - set email fee = $0.50
2 - Put email address everywhere
3 - ....
4 - Profit

Re:E-mail tax...Micropayments to Recipients

[pentalive]

I really like the idea,

would there be an upper limit to your per mail setting? could I set $100.00 per mail? (provided I have no friends, no family...)

Could people I send email to be added to the white list for a one time reply?

but we still need the gov. otherwise some will create an micropayment email client that generates fake micropayments just to get email in your box.

(I suppose that would be actionable under some fraud or counterfiting law...)

Bleh Re:Where to really look...

[khallow]

Statements like this are why I never lend money to anybody in Astronomy or Geology.

I bet you even worry about the signs ("+" and "-"). How pathetic!

Re:Bouncing is moronic. Stop it.

[WoodstockJeff]

If you control an MX, please configure it to issue a 550 error during the connection if you can't deliver the message instead of accepting it and then bouncing to what you almost certainly know is an innocent party.

In other words, do NOT attach a Microsoft Exchange Server to internet!

[actually, Exchange is just the most popular MTA that has no easy way to stop this behaviour, but there are others. Any MTA that doesn't have access to the a local delivery list will do it.]

naa, not him

[Snaller]

Its probably a double joe job - Robby doesn't wanna annoy random website users, he just wants to get out of this time frame!

Someone help me...

[scifiber_phil]

I had invented a time machine, but before I used it, someone from the future appeared in my room and told me to destroy the machine, or if I did not, I would severely screw up the future. I had just gone down to the basement to get the sledge hammer after the guy disappeared when another guy from the future showed up saying I shouldn't believe the first guy. The second guy says that if I destroy the machine, the future will go down a very dark path. What should I do? P.S. Please hurry, as I am really itching to push the start button.

Re:Someone help me...

[Aspasia13]

There is only one logical solution to this puzzle...

Get a lawyer and sue both these time travelers for patent infringement. With all the money, you won't have to worry about which crappy future you end up with.

Re:Someone help me...

[Patrik_AKA_RedX]

What should I do? P.S. Please hurry, as I am really itching to push the start button.

Click start, then "shutdown" and click "OK" then get some sleep.

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

would there be an upper limit to your per mail setting?

I would imagine that the micropayment service provider would cap the max payment to reduce the chance of fraud or limit liability in the event of fraud. Or the service provider might cap the max payment on the sender's side -- not letting a sender send an email to a $500 address if the sender's credit is poor or their account is under-funded. On the other hand, I could see some interesting business models come out of this service -- the tech support of a software company might publish a $20 email address (a good way to fund shareware too).

Could people I send email to be added to the white list for a one time reply?

The sophistication of the rules would be up the network service provider. If the system was based on open standards and an open network for transfering funds, then I could imagine multiple service providers offering different terms. For example one cut-rate provider might demand only a 5% cut of the micropayment (with a $0.01 mininum) for bare-mininum service. Another provider could offer very sophisticated sender analysis with continguent price tables, but charge 25% and a 0.10 minium.

but we still need the gov.

Absolutely! But government would play the same role as it does with the current credit card system or PayPal -- ensuring fair treatment, regulating abusive practices, mandating minium financial standards for service providers and providing a venue of ajudicating disputes.

Not that easy..

[AftanGustur]

If you control an MX, please configure it to issue a 550 error during the connection if you can't deliver the message instead of accepting it and then bouncing to what you almost certainly know is an innocent party.

I can tell you that the problem is all but easy to fix.

Not only do our Postfix servers (On the DMZ) have to accept mail to Exchange accounts (Servers on a different inside-DMZ) without knowing what accounts exist, but also for other mail servers we have no control over. For example, we send incoming emails back out over VPN tunnels to Japan, Germany and Washington without having the slightest clue or control over what accounts exist over there.

Before, I used to work for a big ISP that only serviced companies and the setup was similar there, we had this huge Sun Enterprise cluster to accept incoming email for our clients, and then sent the emails to each customer's dedicated server without having any control over them.

Re:Not that easy..

[droleary]

Before, I used to work for a big ISP that only serviced companies and the setup was similar there, we had this huge Sun Enterprise cluster to accept incoming email for our clients, and then sent the emails to each customer's dedicated server without having any control over them.

I'd like to have some sympathy, but it's really hard to because you're part of the problem. Because you cannot architect a relaying system well enough, everyone else must suffer? I don't think that is a good answer. I think dumb relays are a dated concept and are long overdue for a quick death.

Re:Bouncing is moronic. Stop it.

[Anonymous Coward]

It's not that simple. If you want to figure out that you can't deliver the message, you have to check. Checking takes computer resources. Now everyone has a really easy way of DoS'ing your server.

Furthermore, by returning 550 in the SMTP session, you've given criminals an easy way to search for valid email accounts.

Accepting and then bouncing the messages remains the more secure and better performing solution. (Even when it's a 'Joe job' unfortunately.)

I agree with the person who posted that we need a new protocol.

Re:E-mail tax...Micropayments to Recipients

[Politburo]

Is eBay (and paypal as well, since we're talking micropayments) really a good example? When daily we hear tales of fraud and abuse on the system, and calls for help go unheeded by the administrators?

BSD

[Simple-Simmian]

BSD is... (It's a Joke OK)

I concur. The BSD license is the way to go. It will assure adoption as stated. It also is becoming apparent the FSF will not go to court to defend the GPL. Just look at the SCO mess right now. The FSF will not go to court,SCO is mosifing teh GPL (not allowed.) What has the FSF said?. What is teh FSF doing? The BSD license model is looking better all the time and it had been tested in court.

Facts are we have to do something about transitioning to a new Email model. The one we have that allows all this Spam is broken. It's time to quit talking and do somethng before the Microsofts of the world mandate a closed solution that forces use of their products and fragments the system into 2 parts. Consisting those that will used the closed system (stupid consumers) and the rest of us. my 2 cents.

Re:BSD

[Anonymous Coward]

The SCO mess is only about the Linux kernel, not the GNU System in general. The FSF can't take SCO to court any more than you can, because neither the FSF nor you hold the copyrights being infringed.

SCO is mosifing teh GPL

Uh, what? Is this something to do with MOSIX or Motif?

Re:Bouncing is moronic. Stop it.

[Linux_ho]

If you control an MX, please configure it to issue a 550 error during the connection if you can't deliver the message

Many Internet-accessible MX hosts are not also running delivery services (POP, IMAP, etc.) They often relay the mail to a non-internet-accessible SMTP hub for the domain, which in turn relays the mail to the hosts running the delivery agents. There's usually no way the Internet MX host can know which users are valid.

Don't try to pass this off on mail admins. We're doing what we can, spending way more time setting up ways to filter out this crap than we should have to. Direct your bile at the spammers.

which means you anal types who say "RFC says I must bounce" have to note that it also says you must not lose a message, which is what a bad bounce does.

I do not think "lose a message" means what you think it means. I like the RFCs. I just don't think your little suggestion does much good except for the poor joe-jobbee. I've been joe-jobbed. Yeah, it sucked. But I'd rather delete a couple thousand messages once in a blue moon than ask every admin on the Internet to set up their mail servers so that the spammers can more easily validate their address lists.

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

Is eBay (and paypal as well, since we're talking micropayments) really a good example? When daily we hear tales of fraud and abuse on the system, and calls for help go unheeded by the administrators?

And there is no fraud in government???? Fraud is endemic to all human institutions. The only issue is what is the rate of fraud and how do you limit its impact on the victims.

Since I would imagine that most people would set a modest sender's fee in the neighborhood of $1 or less and most people send out very few emails per day, most sender accounts would be capped at $5 to $50 per day of charges. Maybe somebody might want to steal your senders account and send themselves money, but it wouldn't be an easy (or untraceable) way to make money. I suppose there is always the risk of someone hacking the account system, but then anyone who uses a credit card or has a bank account faces this risk.

and you just created a new business opp.

[IANAAC]

'Make money over the internet by accepting ads in your email!!!'.
Sorry, but all that's going to do is create another way to propogate your email address out to yet more spammers, while doing nothing to reduce traffic.
I know there are those that say we've got more badwidth than we need, but frankly, just becuase the bandwidth is there, do we have to saturate it?

Re:E-mail tax...Micropayments to Recipients

[Patrick May]

Without laws nobody would pay.

Most micropayment systems for email will attempt to clear the transaction before presenting the email to the intended recipient. If it doesn't clear, the email doesn't get through. The only laws needed are the laws of mathematics.

Sincerely,

Patrick

Mod this plagarazing fuck-wit down.

[YOU ARE SUCH A FAG!]

Way to use anti-slash, fag-master.

Can't slop together 30 original words together about spam? Too busy sucking off other anti-slash dicks? Christ almighty, even the trolls on Slashdot suck.

Re:E-mail tax...Micropayments to Recipients

[GordoSlasher]

If I could force the sender to pay me $100 per email, I'd setup a bunch of honeypot email accounts with common names: john@mydomain.com, etc. I would never publish those addresses but the spam will start flowing immediately, resulting in big bux for me.

In fact, every ISP could make a killing by scanning their logs for the trial-and-error addresses the spammers try, then setup accounts for those addresses and let the income roll in.

Re:E-mail tax...Micropayments to Recipients

[dcmeserve]

I would also create a whitelist of people (friends, clients, mailing lists, and a few select businesses) who are automatically exempted.

Well, once you start putting in filtering options like that, I have to wonder if it's really all that better than current ideas.

What does a micropayment really serve that a message sent back to the sender requiring an intelligent reply does not? I find it doubtful a spammer will be able to program bots that will be able to parse all possible request-for-confirmation replies they get back after sending out a batch.

Frighteningly easy to be committed

[SuperBanana]

It is *very* difficult to enforce medical treatment on someone who has NOT been legally declared mentally incompetent and assigned a guardian

Actually, it's exceptionally(frighteningly) easy, at least in Massachusetts. Your parents, as well as any nurse, doctor, law enforcement officer or judge can determine you are a danger to yourself and have you indefinitely committed, with no due process. You get a review, but the time window is "several weeks" if I recall. Now, picture having spent several weeks in a mental institution(probably a state one, and keep in mind, funding for mental facilities has been severely slashed thanks to Governor Mitt Romney) and trying to convince a panel of psychologists you're not insane. I'd probably go insane just from frustration and despair. The phrase "yeah, sure, buddy, you're not crazy, we don't hear THAT one all the time" comes to mind.

The Boston Globe did a big story about it several years ago; one of the cases I remember involved a patient of a psychologist decided to stop having sessions with her, and when she asked if he would hurt himself, he refused to answer the question, saying she should know him better than that and he found it insulting. A matter of hours later, uniformed cops broke into his house, slammed him to the floor and handcuffed him in front of his wife and young children- and he spent weeks in a mental facility despite the efforts of his wife to get him out.

It's terribly frightening- the same possibilities for abuse exist as with the Indian law which allows you to declare a relative dead, and is widely used to steal property from unpopular relatives(the Peace ig Nobel Prize winner was a victim of this.) At least those people aren't imprisoned against their will, denied counsel, and unlocateable (citing the new patient confidentiality rules, mental hospitals will simply deny a patient exists.)

Re:Frighteningly easy to be committed

[Anonymous Coward]

It's terribly frightening- the same possibilities for abuse exist as with the Indian law which allows you to declare a relative dead, and is widely used to steal property from unpopular relatives(the Peace ig Nobel Prize winner was a victim of this.) At least those people aren't imprisoned against their will, denied counsel, and unlocateable (citing the new patient confidentiality rules, mental hospitals will simply deny a patient exists.)

Hey, that's the exact inverse situation than in Indonesia: there you routinely declare your dead relatives to be alive, until you can afford the funeral (before the funeral, the cadavers are kept at home, while relatives pretend they are just "ill").

Obivious solution

[Anonymous Coward]

As long as people keep supplying Dimensional Warp Generators, the spam will continue. Clearly, we need for everyone to stop making these generators available through spam requests, and only sell them at offical time travel flea markets.

Breaks eBay and similar automailers...

[Denyer]

...I can see the use for limited home traffic, but how many people are simply going to decide that the Earthlink crowd can sit and stew in their lonely corner. I'd certainly bother to make contact with far fewer peoople.

Also, you've just banned blind and partially-sighted users from the net. I'm sure these aren't the only people who'd find such a solution crippling.

Why would he want to go back?

[Codifex Maximus]

I mean think about it.... he knows which companies are going to be successful so he can be rich, he has advanced immune system so little or no sickness.

Heck, where did he get this Platinum Gold? How did he run out of Galactic Credits? (Are they legal tender in 2003?) Did he buy the Platinum Gold with the Galactic Credits? He wants the "unit" teleported to a "Secure" location that has been revealed via a non-secure channel? He promises to pay for the device if given information on how to pay; once again via a non-secure channel?

I think I saw a dimensional warp generator in a pawn shop in the south side of Ft. Worth, TX. It still has 2 months on the note. At least I *think* it was a DWG - it *could* have been an old RCA tube radio but you never know until you look at the serial number plate.

He better be careful... he might end up with the MIBs on his doorstep.

/. ing spammers

[Anonymous Coward]

How about organizing a week when readers of /. volunteer to click all of the links in the spam they receive. /. visiting their web servers might send a message. Bouncing/Replying may be useless, but the links in their messages have to go back to them. Maybe it'll stop the one sucker that was actually gonna buy something.

Bah!, why would I think that I could get /.ers together to do something like than when I can't even get them to buy penile growth pills that I KNOW they need!?!

Guess I'm on my own.
Hmmm, I need an incoming email filter to load every filtered spam page and spider all links within it 100 times before deleting it.

Re:/. ing spammers

[kcb93x]

Hmmm, I need an incoming email filter to load every filtered spam page and spider all links within it 100 times before deleting it.

Hmmm....normally, I don't respond to AC's...but this one's got an idea with it...the only problem is, it would allow them to certify the email address is real...so make it so it will *only* load those that don't have a bunch of random gibberish (all pointing to same page, but each unique to email sent to)

I know I'd install it. Heck, make it so I can have it que up the pages, since I'm on dialup, I'll let the fucker run all night. (Til I get highspeed- then it can just run in the background)

Here's an idea I think someone should run with.

Here's the time-travel spam I got in 2002

[Kymermosst]

It was so interesting I never deleted it.

For your viewing pleasure:

Time Travelers Please help! 22353

Hello,
I am a 21yo M offering a $50,000 reward to help me take my life back. If you are a Time Traveler who has the Dimensional Warp Generator #52 4350a wrist watch, the XK memo replica or similar technology I need your help.

I must return my mind to my former self so that I can take back my life which has been destroyed by the evil aliens. They have done Terrible, Terrible things to me starting with nanaprobe tracers, mind-transducers that she slipped into my
food, and now I am fighting and dying of CJD. I have known two others who were messed with by these same evil beings, returned to there former self, foiled their schemes and successfully taken there life's back. If you can help please email me at: [EMAIL DELETED]

Below is the result of your feedback form. It was submitted by
([EMAIL DELETED]) on Saturday, September 14, 2002 at 19:38:02

x: 32883

This one a month earlier:

3:20:46 AM Time Travelers PLEASE HELP!!!

Hello,

If you are a Time Traveler from Dimension D1263GT10, year 2008 or Dimension D2044GT5, year 2432 and or in possession of the Dimensional Warp Generator wrist watch, the Carbon Copy Replica model #52 4350 series or similar technology I need your help! My entire life and health has been messed with by evil beings! I simply need the safest method of transferring my
consciousness or returning to my younger self with my current mind/memory. I need an advanced time traveler to work with who can help me, I'd would prefer someone with access to teleportation as well as a variety different types of time travel. This is not a joke! I am serious! Please send a separate email to me at: [EMAIL DELETED] if you can help! Thanks

Formulario enviado por ([EMAIL DELETED]) em Sabado, Julho 13, 2002 at 08:16:43

x: i
email: [EMAIL DELETED]

(Yes, I deleted e-mail addresses to protect the guilty, but hey, it's principles.)

Another interesting note: The first time I tried to submit this: Lameness filter encountered. Post aborted! Reason: Please use fewer 'junk' characters.

So, at least we know he's lame.

WOW, what a whack job.

[slappyjack]

This guy, reminds me a lot of Frank Chu. Frank is this crazy guy who walks around downtown San Francisco carrying a picket sign that says some bizzare gibebrish about politics and "The 12 Galaxies."

He's also generally known for showing up at most major gatherings in the city.

His fan page: http://www.12galaxies.20m.com/

Shit about Frank Chu on Google.

of corse, I think Frank it too whacked out to send millions of emails, but if he could, he would.

Re:E-mail tax...Micropayments to Recipients

[C3ntaur]

An interesting idea, but I think it has the same problems that are keeping public key authenticated e-mail from catching on. Suppose I suddenly have a MUA that bounces every unfunded and unwhitelisted e-mail it receives with a message that says "You have to deposit $X into my PayPal account before I will read your e-mail. If I deem you/it worthy, your $X will be refunded, and you'll be added to my whitelist so you won't have to do this again."

Now if the sender wants me to see his e-mail, he'll have to do the following:

1. Sign up with PayPal if he's not already, and fund the account.
2. Make a payment to my account.
3. Add information to the e-mail that references the payment, and send it again.
   

If the instructions in my bounce message are detailed enough, even my tech-illiterate mother would be able to follow these steps and get her e-mail to me, but the real point is the hassle factor. What about the hiring manager who just got my resume from some recruiting firm? Will he really bother, or will my bounce message and resume just go in the bitbucket? What about automated e-mail, like the MTA bounce message I get for making a typo in the recipient line? Even if I've anticipated the automated e-mail and whitelisted it in advance, what happens when the addresses of those senders change, like after a buyout or merger?

E-mail authentication, whether it involves money or just encryption, is a chicken-and-egg problem. As for using a whitelist and blocking anyone that's not on it, I can imagine too many scenarios where I would miss something from a sender that's not on my whitelist.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Bouncing is moronic. Stop it.

[droleary]

It's not that simple. If you want to figure out that you can't deliver the message, you have to check. Checking takes computer resources. Now everyone has a really easy way of DoS'ing your server.

That doesn't make sense. It has to check anyway in order to deliver the message. A bounce means additional work of storing the entire message (instead of giving the error as soon as To header is found invalid) after accepting it, and then the bandwidth usage to bounce it. The cost of a bounce is at least double the cost of an error.

Furthermore, by returning 550 in the SMTP session, you've given criminals an easy way to search for valid email accounts.

If spammers still cared about address validation, they wouldn't be forging the From in the first place. I don't think any have cared about having "good" addresses for at least the last 2 years.

Accepting and then bouncing the messages remains the more secure and better performing solution. (Even when it's a 'Joe job' unfortunately.)

Your reasoning has been shown to be incorrect. Please adjust your world view accordingly. Thank you! :-)

Re:Bouncing is moronic. Stop it.

[droleary]

They often relay the mail to a non-internet-accessible SMTP hub for the domain, which in turn relays the mail to the hosts running the delivery agents. There's usually no way the Internet MX host can know which users are valid.

I will agree that relays are a tricky issue. I also think that relaying is a dated issue. There is really no reason to have a dumb relay anymore. If I can get web hosting for $5/month, it should certainly be possible to anyone who needs to accept email for a domain to have a mail server always available to accept messages directly. Alternatively, as a server accepting messages for relaying, you should require the downstream to accept all recipients. You have failed to make a case for bouncing either way.

Don't try to pass this off on mail admins. We're doing what we can, spending way more time setting up ways to filter out this crap than we should have to. Direct your bile at the spammers.

Everyone who could possible address the situation but does not gets a bit of my bile. There are clearly steps you can take to eliminate improper bouncing.

I do not think "lose a message" means what you think it means.

Then what does it mean? The message doesn't get to the recipient, and the person who actually sent it gets no error or notification of failure. Sounds lost to me. Please show how I am mistaken.

But I'd rather delete a couple thousand messages once in a blue moon than ask every admin on the Internet to set up their mail servers so that the spammers can more easily validate their address lists.

If spammers gave a fuck about valid emails, there wouldn't be so much bouncing and forged From headers in the first place! And let's hear you whistle that same tune when the ever increasing loads of spam turn your blue moon rarity to a daily sunset certainty.

selling new ways

[John Bodin]

Sony already does this.

They go along major tourist areas with a couple posing as tourists and get people to take pictures of them with the new state of the art camera they happen to have. Then if asked they start telling the ones approached to take the pics of this fake couple about the great new features it has.

From what I was told it works as they are getting directly to the ones that most likely would use the camera or such.

Re:E-mail tax...Micropayments to Recipients

[wo1verin3]

if they sent it snail mail I never would have gotten it, not using a real address.

Re:E-mail tax...Micropayments to Recipients

[G4from128k]

Once you start putting in filtering options like that, I have to wonder if it's really all that better than current ideas.

Filtering, by itself, has three deficiencies.
1) Filtering does not address the bandwidth problem the way micropayments do. Filtering happens after the message arrives, payment occurs before the message is sent.
2) Filters suffer from both false positives (rejecting wanted e-mail) and false negatives (accepting spam).
3) FIlters are also subject to an ongoing arms-race -- spammers keep finding new ways to spell p3nis.

What does a micropayment really serve that a message sent back to the sender requiring an intelligent reply does not?

Micropayments are superior for 2 reasons:
1) Micropayments occur at send-time and incur no delays in reception. If you pay the money when you send the e-mail, then you can be sure the e-mail gets to the addresss (no gaurantee that the recipient opens the e-mail). In contrast, the intelligent reply system involves delays: I send a message, later I check my mail and find that the message did not get delivered because I've got this intelligent replay email from the recipient. If the sender is not online 24x7, the sent message is delayed.
2) But the greater flaw with intelligent reply is that it is potentially defeatable through automated, zero-cost mechanisms. I'm sure spammers are working hard to automatically parse the intelligent response e-mails or recognize the coded image. It may slow them for a time, but it does not solve the root of the problem - communications is too cheap.

Whatever happened to MX validation?

[dozer]

A year or two ago, I heard some sort of proposal to extend RFC 822 to add an additional step in processing and forwarding email to get rid of From header forging. It sounded simple and effective.

Let's say my MX is currently connected to internet host 199.199.199.199 receiving a message that the From header claims to be from "billg@microsoft.com" My machine would then query a server at microsoft.com (probably using some form of DNS) to ensure that 199.199.199.199 is indeed a server authorized to send mail as microsoft.com. If it's not, chances are very good that the message has forged headers and should be punished by SpamAssassin (or whatever).

Of all the proposals I've heard, this one is by far the most practical. Why haven't I heard anything since?

ahh but here is the good bit about it

[Anonymous Coward]

It seems that everyone in his right mind despises
telemarketing. Spam too. Ask anyone, and they'll tell you that there
are few things they hate more in life. It seems as if there are no
exceptions to this rule -- everyone, bar none, hates telemarketing and
spam.

But
it can't be true. Someone must be responding to this stuff by spending
their money. Because for some reason, telemarketers and spammers stay
in business. Somehow, it must be worth it for them.

If everyone hated the stuff as much as they say they do, if everyone
hung up on the unwanted calls and deleted the unwanted mails in nothing
flat, like they say they do, then the problem would fizzle out before
long. No one could make money doing it, so there would be no reason to
keep trying. And yet, the crap just goes on and on and on.

I've
read rumors that a certain small percentage of the people called or
mailed actually do respond and end up buying something; usually the
figure is put about 10%, or something similarly low. Hard to believe
that such a business would be worthwhile if the response rate is so
low; but whatever it is, it must be high enough that the incentive for
telemarketing and spamming is maintained. Otherwise, there'd be no such
thing.

A national no-call list is a nice idea, but I can't see
the problem going away altogether as long as the telemarketers and
spammer still believe there's a chance to make money. Certainly the
spammers are not going to let some trivial thing like a Federal law
stop them. (They'll just go on spamming from Antarctica, or wherever.)
If we really want the problem solved, once and for all, we have to
ensure that there is no future for those businesses, and that would
require educating the public, right down to the last man, woman and
child, to always follow this rule without exception: If someone calls
you or emails you to sell you a product, then whatever you do, don't buy that product!

Challenge-response setups are mailbomb proxies

[Anonymous Coward]

Simply enough:

Joe spammer sends 10 million messages to Earthlink, using your email address as the sender - you don't think spammers use their own address do you?

Even if Earthlink use rate limiting so that only one challenge is sent, what about the 10 million other domains hit which send out the same challenge.

See why C/R is unworkable?

Re:Challenge-response setups are mailbomb proxies

[t_allardyce]

better mail clients would help - some sort of threading:

you send an email, you get a challenge, the mail client figures out "oh you sent an email to that domain 20 mins ago and the address you sent to is contained in the body of that challenge so i'll weight this is very confident and alert the user showing the original message they sent aswell" or something like that, however if you never sent a message to that domain and it doesnt contain any address you've recently sent to then the client will stick it somewhere else.

Ok so its unlikely that Microsoft would ever actually add something useful to outlook but id much rather recieve challenges from a bunch of mail servers than spam from a bunch of spam servers, atleast the challenges will mostly be more honest (ie. not try to hide what they are) and clearly labeled, and i could script my client to handle them where as spammers are always trying to get past filters.

A couple thousand bounces? Only if you're lucky

[Anonymous Coward]

Read the damm article. It wasn't a couple thousand, it was nearly a million across the three domains - and they got off lightly.

I had a joe-job at the beginning of 2002 which resulted in something over 1.3 MILLION bounces being delivered.

Show your real address, watch a spammer Joe it and feel the REAL pain. If you only got a couple thousand bounces, then it was an amateur at work.

Re:A couple thousand bounces? Only if you're lucky

[Linux_ho]

Read the damm article. It wasn't a couple thousand, it was nearly a million across the three domains - and they got off lightly.

I'm not saying joe-jobbing doesn't suck. All I'm saying is that setting up every MX host to know all valid mail addresses in its domain is stupid and impractical.

Obligatory

[Anonymous Coward]

Well, I for one welcome our new time-travelling overlord!

Spammer?

[Lord Kano]

Spam requires commercial motivation. This guy isn't trying to bilk anyone out of their money. He wants to spend money! In other words, he's begging to get ripped off.

Lk

Okay, okay, I admit it:

[negacao]

It's me buying all those penis enlargement kits.

Sorry for causing all that spam!

(on the upside, my penis is now 465,923 miles long.)

register email senders

[Anonymous Coward]

Here is a more "novel" idea to combating spam. Change the way the internet is working now.

Have domiciled email addresses. Force registration of email couriers. This would also require changes to the way we deal with the internet.

Require anyone who wants to send mail to register their server. Its easy, you are on the internet alreayd, so you ISP registers you, gives you a domain name and you are good to go. Any spam from you is easily traced to your physical address which your ISP has. Doesn't have to be too hard, just tell your ISP you would like to be able to send mail, on the form or where ever.

I think when rights are abused like this, their benefits outweigh their costs and we need to regulate this.

Mental Illness

[Anonymous Coward]

Unfortunately, I have to post anonymously because of the misinformed majority and the danger of folks at work subjecting me to the same prejudice. Mental illness isn't funny, nor is it easy to commit someone as many have suggested here. If this Rob guy isn't a danger to himself or others, even if he is a nuisance there's nothing that his father can do.

Mental illness unfortunately runs in my family. The fine-line myth is just that, a myth. Schitzophrenia, clinical depression, and Alzheimers. It wasn't until the late 90's I'd been diagnosed with clinical depression and wasn't until the same time that I discovered that it was rampant in the family, though one of those "deep dark secrets nobody talks about" - which only exacerbates the situation.

My own experience is difficult to describe for folks who haven't been there. A complete collapse of confidence in yourself, a terrible self-loathing, a fear of the judgement of others, a sense of hopelessness; this often results in suicide. Often you just can't get out of bed, don't want to read or watch TV, just want to cry - but can't - can't clean up, can't manage your money, can't deal with people. This is isn't laziness, it's mental illness.

The cause of my particular ailment I believe to be chiefly biological (seretonin) and Prozac took care of that, the other behavioral which required a good deal of therapy. I was on the verge of suicide by poisoning when I decided I'd give this treatment a try; always opportunity to go with plan A. After years of therapy, I'm doing great and career-wise I'm doing stupendously well. I still struggle, but no longer need therapy or meds - just to be mindful of my state of mind and behaviour.

My grandfather went insane due to a combination of Alzheimers and suffered with it for 30 years; he was extremely difficult to deal with, like a frail child. Sometimes he was lucid, very rarely he seemed completely normal, but most of the time he was like a six year old. He'd do wierd things like bend over to read newsprint two inches from his nose, only to read the article/ad again and again until he fell over.

I had a schitzophrenic neighbor who, when on his meds, was more or less functional. He was a math whiz and an incredible chess player, but on his meds he was pretty zonked. Off his meds, he'd do odd stuff like wear surgical masks and spray things (and some folks) with Lysol, hear voices all the time (pounding on my door at 3:30am and waking me up to bitch at me about talking about him and playing music too loud - total hallucination).

Mental illness isn't funny and isn't simply dealt with by "locking people away" - the state can't and won't provide adequate resources to treat the mentally ill, instead releasing them after observation - often to the streets - a lot of homeless are made up of the mentally ill.

Banning this Rob guy from getting online may be the only way to keep him from spamming folks, but it may do more harm than good where his mental health is concerned. Reason ain't gonna work with this guy, so cutting him off from the Internet may be the only solution as far as the community is concerned.

U R mentally stooopid

[Anonymous Coward]

Many, if untreated, will end up at a level such that they hurt themselves and/or others. To your stastically invalid personal experience I can relate an equally invalid but opposite experience...

So what's your point? The fact is that mental patients are less likely to become violent than the average. Go read a book, dumbass.

Easy solution for the spamming problem:

[master_p]

The solution is easy: the e-mail application must have two windows for the received e-mails: one for the mail addresses marked as 'acceptable' by the user and one for all the others. In this way, the user can browse the e-mails that interest him/her in one window, while deleting all the others in the other window with one click (if he/she wishes so).

This will not entirely eliminate spamming, but it would sure make received e-mail management a hell of a lot easier.

Re:E-mail tax...Micropayments to Recipients

[instarx]

nstead of a tax (why do some people always look to government for everything),

The main purpose of taxes are the redistribution of wealth to provide for the common good. No one could afford to hire trash collectors, firemen, police, build roads or get mail delivery without the collection of taxes and the redistribution of wealth to provide those services to all.

The other main purpose of taxes tax isn't the government *doing* anything really except encouraging behaviors or industries and discouraging others (in this case spamming). Just as in trash collection and police services it would be impossible to make a dent in the spam industry if it were up to each individual citizen to collect a few cents per message.

Remember that the government isn't some separate entity, but is made up of our representatives elected by us. We then let them know what we want. It is perfectly legitimate to want the government to "do" something about a problem that effects everyone.

On the other hand you better hurry up and use your democracy before the Bush/Cheney/Rumsfeld triumvirate nullifies the Constitution and starts telling you what THEY want.

Micropayments to Recipients: Tax is a blunt tool

[G4from128k]

The other main purpose of taxes tax isn't the government *doing* anything really except encouraging behaviors or industries and discouraging others (in this case spamming)

But this is a terribly crude tool that both fails to deter enough spam and penalizes legitimate uses of e-mail. It fails to deter spam because even if the tax were an outrageous $0.50 an e-mail, we'd still have spam. My snail mail box gets half a dozen pieces of spam (junk mail) per day. The $0.50 cost for printing, stuffing, handling, and mailing a piece of junk mail is no deterent to many marketers such as catalog retailers, timeshare hawkers, charities, mortgage brokers, credit card companies, etc. A $0.01 tax may weed out some spam, but too much of it carries such a high pay-off that it is profitable.

The tax would also punish legitimate uses of e-mail. The members of a family should have the right to send and receive e-mails without paying a spam-tax. A telecommuter should have the right to send/receive e-mail from his employer without paying some silly penalty tax. Innovative uses of e-mail (imagine the engines of long-haul trucks sending wireless e-mails on engine status, maintenance needs, etc.) should not be stifled.

Taxes are a very blunt tool -- no single tax level will balance the diverse uses and opinions about e-mail. That is why I'm suggesting that we give control to the recipient to decide how much spam costs and give control to the recipient to decide who gets free access.

Former High Tech

[Anonymous Coward]

Coincidentally, the coordinates given are on the path of the old Middlesex Canal.

The canal was the internet of its day, rendered obsolete by rail.

Micropayments to Recipients: Hassles & Hurdles

[G4from128k]

You raise some very legitmate issues.

Re: Hassle Factor & Chicken-n-egg

Yup, this is the biggie. Out-of-system senders would get an odious "join and pay-up" message just as you have described. But it is not as bad as it could be since once a person joins a micropayment network, they would never get another "join and pay-up" bounce message again. This is unlike some filtering/intelligent reply systems in which you might recieve a new hassle-factor bounce with every new recipient.

Re: What about the hiring manager who just got my resume from some recruiting firm?

This is a really cool scenario since it highlights the power of the micropayments system. If I were a hiring manager, I would set some modest, but significant, payment level (like $1 per resume). I would not whitelist anyone and I would tell all the recruiting companies to send "1 resume per e-mail". Now, it falls on the recruiting manager to actually filter the resumes and not send every resume in response to every job posting. Likewise, individual job seekers would become more selective. As a hiring manager, I would rebate payments to recruiters and individuals that sent in highly qualified resumes and keep payments from resume spammers. As a job seeker you might think that pay-to-apply really sucks, but if reduces the number of junk resumes that your resume ends up covered by, then I suspect it actually improves your chances.

What about automated e-mail, like the MTA bounce message I get for making a typo in the recipient line

Invalid/unknown user, mailbox, or domain bounces are impossible in this system because the recipient must be looked up by the protocol _before_ sending the message. The system must check the records of the recipient to determine the recipient's required payment. Bounces for other reasons (e.g., "quota exceeded", "virus detected") might be handled through a standardized set of return message codes. These bounces would need to be either handled by a code or secure message that prevents spoofing or exploitation (i.e., piggybacking a bounce message with spam).

what happens when the addresses of those senders change

Tricky! In a simple version of the system, when a whitelisted sender changes address, they would have to notify all their friends/business partners about the change and/or "pay-n-rebate" until rewhitelisted. In this way, its not any different from current spam-filters which can dump legitmate e-mails if a trusted sender starts sending from a different address. A more complex protocol would let a sender transmit a whitelist-modifying automated message to change addresses (or piggyback on their trusted "main" email address). This change-of-address/piggyback feature would need to be very secure to prevent hijacking.

I can imagine too many scenarios where I would miss something from a sender that's not on my whitelist

Is this any different from the current situation? My wife gets more than 100 spams per day (she has a 10-year-old e-mail address that some clients have publically posted, bless their hearts). Between aggressive filtering, and the crap that leaks through, she misses too many legitimate e-mails.

But a micropayment system would kill the economics on most spam to reduce the volume of it to a much more managable level. You would not need to rely on the whitelist or aggressive filters to let stuff into the inbox, people who pay would get into the inbox, people who spam would lose their money to you, new-found friends who send useful stuff would get their money back and could be put on the whitelist.

Thanks for forcing me to think more about this stuff!

Re:Bouncing is moronic. Stop it.

[Linux_ho]

I will agree that relays are a tricky issue. I also think that relaying is a dated issue. There is really no reason to have a dumb relay anymore. If I can get web hosting for $5/month, it should certainly be possible to anyone who needs to accept email for a domain to have a mail server always available to accept messages directly.

OK, I'll take the time to spell it out for you.

1) If you're running a domain with more than 1000 valid addresses it often makes sense to have multiple delivery hosts with an smtp hub routing mail

2) For security reasons, you don't want that central hub Internet accessible. If you're attacked, you want the organization's internal e-mail to continue functioning. I'm not talking about ISPs, I'm talking about organizations where e-mail is an essential communications medium.

3) a dumb relay is the simplest, most secure, nearly maintenance free method of getting that mail inside your protected network.

Alternatively, as a server accepting messages for relaying, you should require the downstream to accept all recipients. You have failed to make a case for bouncing either way.

If the downstream gives a 550 error upon relaying, the relay host bounces the message anyway. Your "solution" doesn't work.

I do not think "lose a message" means what you think it means.

Then what does it mean? The message doesn't get to the recipient, and the person who actually sent it gets no error or notification of failure. Sounds lost to me. Please show how I am mistaken.

Your problem is that the person who spoofed the reply-to is the one who lost it. If they don't put the correct info in the message, the RFCs don't require the mail servers to mysteriously determine the ACTUAL sender despite that senders attempts at anonymity. The MAIL SERVER doesn't lose the mail, the message was lost before it was ever sent if both sender and recipient headers are invalid. If you violate the RFCs when composing the message, you can't expect to hold the downstream servers accountable for "lost mail" which never had a valid sender OR recipient. It's not lost - it was never found. It's dead, gone to meet its maker. It's an EX-MESSAGE. :-)

Re:Micropayments to Recipients: Tax is a blunt too

[instarx]

My original reply was more to address the "why does everyone cry to the government" part of your message - I thought sking the government to control spam was a legitimate thing to do.

In another post in this thread I suggested a modification to a suggested tax on email to be a tax on *commercial* email. That would free common folk of an email tax. However, I also noted that if we can't get spammers to obey the few anti-spam laws that are on the books now how are we going to get them to pay their taxes (or the charges from individuals in your plan?)

Sure, taxes are blunt, but they are also relatively simple. I can't even imagine the complexity of administering millions upon millions of penny transactions for emails, the amount per email set by each and every recipient. Doesn't it make sense to have the people who are making use of most of the bandwidth of the internet simply pay taxes to support its infrastructure? I could also see people setting up hundreds of inviting email addresses to harvest all the spam micro-payments. I think that would actually increase spam rather than decrease spam.

I don't think charging for spam, whether in a tax or in micropayments will ever stop it. Taxes on commercial email however, will provide valuable funds for supporting the email infrastructure. Right now I think the best way to stop spam is a national do-not-spam list which is vigourously enforced. Frankly, I don't see a solution for international spam.

Incidently, that junk mail in your mailbox costs the sender a lot more than 50 cents.

Re:Bouncing is moronic. Stop it.

[Hard_Code]

If it causes less traffic, then it's not equally bad, it's slightly less bad. Servers should be programmed to introduce artificial delays so that farming accept/deny is then not possible. (frankly all servers should be doing stuff like this to determine DoS, etc.)

Mod down -1: Human "Slashdot" Xerox Machine

[YOU ARE SUCH A FAG!]

Again and again, ctf posts other people's comments

And YOU FUCKING MODS FALL FOR IT EVER TIME. Fix it! (always check anti-slash before wasting you mod points)

Jesus christ you people make me sick.

Great job, you replied to a troll.

[YOU ARE SUCH A FAG!]

Check it out

Don't ever let it happen again. Or I'll put you on my "friends" list.

Great job replying to a troll

[YOU ARE SUCH A FAG!]

He cut and pasted. He does it EVERY TIME. You fell for it.

Don't let it happen again, or I'll put you on my friends list.

Re:Bouncing is moronic. Stop it.

[droleary]

OK, I'll take the time to spell it out for you.

Nice and condescending right off the bat. I like that. Here's my retort: you're an incompetent admin if you can't manage (or manage to set up) a mail network without sending abusive bounces.

1) If you're running a domain with more than 1000 valid addresses it often makes sense to have multiple delivery hosts with an smtp hub routing mail

Irrelevant. I don't care if you have a host for every email and a 20 relay tree to reach them. Manage the setup properly and stop accepting messages such that you bounce improperly.

2) For security reasons, you don't want that central hub Internet accessible. If you're attacked, you want the organization's internal e-mail to continue functioning. I'm not talking about ISPs, I'm talking about organizations where e-mail is an essential communications medium.

Also irrelevant. Again, your internal structure does not in any way require you to send abusive bounces.

3) a dumb relay is the simplest, most secure, nearly maintenance free method of getting that mail inside your protected network.

Not true, plus it makes you a real asshole for everyone else on the Internet. Being a lazy fuck who doesn't care is not a bullet point you would want to broadcast. All you get is simple, not secure or reliable. If you disagree, please feel free to "spell it out" further.

If the downstream gives a 550 error upon relaying, the relay host bounces the message anyway. Your "solution" doesn't work.

Uh, what part of "accept all recipients" didn't you understand? If you're so foolish as to set up a dumb server, you damn well better make it dumb; so dumb it does nothing but pass things inward. To do otherwise makes you a source of abuse.

Your problem is that the person who spoofed the reply-to is the one who lost it.

No, your problem is that you accepted the message for delivery prematurely. Then you found you couldn't actually live up to your responsibility, so you throw up all over the Internet using information you pretty much know to be forged. You're dumping trash in your neighbor's yard. That's a jerk thing to do; stop it!

Re:Bouncing is moronic. Stop it.

[Linux_ho]

Uh, what part of "accept all recipients" didn't you understand? If you're so foolish as to set up a dumb server, you damn well better make it dumb; so dumb it does nothing but pass things inward. To do otherwise makes you a source of abuse.

Are you suggesting we never bounce any messages, including legitimate mail that has a typo in the username, or mail accounts that are no longer valid? You know, admins of legitimate mailing lists find those bounces very useful. I occasionally find bounces useful in diagnosing problems myself. People generally like to be notified if they make a typo in the address when they are sending a time-critical message. Not to mention that bounces are required by RFCs. Besides, even if we did set up the servers to blindly accept ALL mail to our domain and silently discard errors, there's nothing stopping users from using mailwasher, procmail, etc. and bouncing their spam themselves. You're calling me an incompetent admin? Yeah, that carries a lot of weight coming from you. You were right, I didn't understand what you were suggesting at first; I was giving you too much credit.

Re:Micropayments to Recipients: Tax is a blunt too

[G4from128k]

I thought sking the government to control spam was a legitimate thing to do.

This, we agree on! But I disagree that a tax is an effective way to do it. I also, like you, suspect that government will have a hard time really enforcing spam laws.

Doesn't it make sense to have the people who are making use of most of the bandwidth of the internet simply pay taxes to support its infrastructure?

Yes it does (but the money should go to the telecomm companies that maintain the backbone, not the government). But bandwidth tax is not what you want, is it? Does this mean there should be a tax on file sharing or web surfing? I'm sure it only takes a few music files, flash animations, or a streaming video clip to equal a ton of spam. What you are talking about is usage pricing - charging the sender (or initiator) of a data transfer on a per-megabyte basis. This would not solve the problem, the cost of spam to the infrastructure is not that great on a per-spam basis.

Sure, taxes are blunt, but they are also relatively simple.

Hmmm... I'm not so sure about that. Where do you levy the tax? It would have to be at the sender's end so spam can't get on the network without paying the tax. How do you create a governmentally-recognized exhaustive list of internet gateways. If I get a domain name and set up a neighbor wireless LAN or server in my home, do I need to inform the government and start collecting taxes?

I could also see people setting up hundreds of inviting email addresses to harvest all the spam micro-payments.

A very good point and a very good idea! This would further ruin the economics of spam and drive spammers out of business. Dummy addresses would kill the response rate that spammers depend on (no click-throughs, no referal commissions, no revenues for spammers). I love it!

I don't think charging for spam, whether in a tax or in micropayments will ever stop it.

I agree,but micropayments will provide 4 advantages. 1) Recipient-controlled micropayments (in the $0.25 to $2.00 range) will cut the volume of spam, which is a good thing. 2) But the real advantage is that micropayments will compensate the recipient for having to deal with spam. 3) Micropayments also cope with the international dimension of spam -- it does not matter where you, you still have to pay to reach the recipient. 4) Micropayment can also help support the infrastruture because I would assume that the micropayment network provider would take a modest cut of the micropayment (say a 10% with a $0.01 minimum?).

national do-not-spam list

If it is anything like the national do-not-call list, it would contain too many exceptions to be useful (like exempting charities, political groups, and businesses that have a pre-existing relationship with you). If Congress wouldn't cut out those sources of spam telephone calls, I doubt they will cut out those sources of spam emails.

Re:Bouncing is moronic. Stop it.

[Linux_ho]

Here's my retort: you're an incompetent admin if you can't manage (or manage to set up) a mail network without sending abusive bounces.

Or maybe you have a software package which can determine spam vs. non-spam with none, zero, NEVER hitting a false positive, and you are confident enough in its security that you're willing to install it on your mail relay. Of course, such a program is demonstrably impossible; one person's spam is another persons vital marketing data/subscribed mailing list/penis growth miracle.

But just for the sake of demonstrating your incredible skillz as an e-mail super-guru, let's say you had this all worked out, and you silently discard all spam that your software identifies with no bounces. Congratulations! You have eliminated .000005% of the joe-job problem! You now have only to get your magical software installed on every other mail server in the world, and convince all us incompetent admins that it will never, ever, silently discard a real message. Good luck, I hope your campaign is successful. But maybe you should get some practice explaining your idea, because I'm still just guessing as to what the hell you are talking about.

Re:Bouncing is moronic. Stop it.

[droleary]

You now have only to get your magical software installed on every other mail server in the world, and convince all us incompetent admins that it will never, ever, silently discard a real message.

What the hell are you talking about? Detection of spam, or any other non-delivery issues, is a separate issue from the response. A joe-job happens when a server accepts a message it cannot deliver and it then bounces to a forged From header. My initial solution stands: if you do detection before fully accepting the message it allows you to respond with a proper error. I'm not sure why you find that so difficult to see.

Congratulations! You have eliminated .000005% of the joe-job problem!

No, I have eliminated 100% of my abusive messages. If you can't show me the same courtesy, if you continue to send abusive bounces, you might just find yourself unable to connect at all in the future. So stop being an ass and fix your server so we can all deal with the spammers themselves instead of infighting.

Re:Bouncing is moronic. Stop it.

[droleary]

Are you suggesting we never bounce any messages, including legitimate mail that has a typo in the username, or mail accounts that are no longer valid?

I'm not suggesting, I'm precisely stating what I want. You want to put up a dumb relay? You had better make it totally stupid. Yes, that would mean you don't bounce things because the system downstream has a problem. Make them be the ones that have to deal with their own delivery problems.

People generally like to be notified if they make a typo in the address when they are sending a time-critical message.

But your bounces don't do that. They notify the From address. What if there was a typo there, too? The only way you can properly notify the actual sender is a server error.

Not to mention that bounces are required by RFCs

Wrong. Did you not even read my initial message? What your dumb server really should do is set the Return-Path to either null or the postmaster of the system you're relaying to. Again, if you cannot reasonably return a server error on non-delivery, you can not reasonably bounce a message either. A dumb relay should be dumb, and not pretend it is smart enough to do more than shuffle things inward.

You're calling me an incompetent admin?

No, I'm just pointing out that's what you're demonstrating. Stop defending outdated, lazy behavior and fix your systems.

Re:Bouncing is moronic. Stop it.

[Linux_ho]

Yes, that would mean you don't bounce things because the system downstream has a problem. Make them be the ones that have to deal with their own delivery problems.

That's not how it works. If the user doesn't exist, the downstream server (which I don't necessarily have control over) returns a permanent failure (550), in which case my relay won't be able to deliver the message. This is from section 3.6 of RFC 821:

If a server-SMTP has accepted the task of relaying the mail and later finds that the forward-path is incorrect or that the mail cannot be delivered for whatever reason, then it must construct an "undeliverable mail" notification message and send it to the originator of the undeliverable mail (as indicated by the reverse-path).

So, tell me again how bounces are not required? Note use of the word "must" in that sentence. Also note that the bounce must be sent to the originator "as indicated by the reverse-path". The reverse-path is defined as the envelope sender, the addressed specified in the MAIL FROM command, in case you were wondering. Rewriting the reverse-path to either null or the downstream postmaster, as you suggest, is clearly a violation of the RFC. If everyone followed your suggestion, every time someone made a typo in a mail address, they would never be notified that their message wasn't delivered. That's the very definition of lost mail. You said in your original message that bouncing spam with a bad forward- and reverse-path "loses mail", which I still don't get, since the sender intended for it to be lost by not giving a correct from address. But you don't seem to be concerned about the behavior of non-spam, legitimate mail. Maybe I have wasted way too much time feeding a troll. My congratulations, you sounded pretty sincere. A masterful performance. Bye now.

Re:Bouncing is moronic. Stop it.

[droleary]

So, tell me again how bounces are not required? Note use of the word "must" in that sentence.

It doesn't say "you must send the message to an unrelated third party that you know damn well was forged". It just says a notification must be sent following a certain procedure. That procedure allows you to direct that notification inward where it belongs, which I have already noted is the only proper thing for a dumb server to do. Can the RFC be interpreted to allow you to be a jerk? Yes. Does that mean you have to be a jerk? No.

Rewriting the reverse-path to either null or the downstream postmaster, as you suggest, is clearly a violation of the RFC.

Since you're still reading 821, I don't know why I bother with you. All I know is that 2821 allows for exactly what I say, interpreting your dumb relay as a point of final delivery. It is allowed. You don't have do be a prick and bounce the joe-job, so don't do it.

If everyone followed your suggestion, every time someone made a typo in a mail address, they would never be notified that their message wasn't delivered. That's the very definition of lost mail.

Wow, you just don't get it, do you? If everyone followed my suggestion there wouldn't be dumb servers in this day and age and 550 errors would propagate freely and everyone who is supposed to would get them. Only what you do is "the very definition of lost mail."

You said in your original message that bouncing spam with a bad forward- and reverse-path "loses mail", which I still don't get, since the sender intended for it to be lost by not giving a correct from address. But you don't seem to be concerned about the behavior of non-spam, legitimate mail.

That is likely the quickest psychotic break I've ever seen. In one sentence you're saying the sender is intending a message to be lost and in the next you're talking about that as the legitimate use of mail. It's clear you're trying to see things not from the perspective of a responsible admin, but as a spammer. Way to out yourself, genius.

Re:Bouncing is moronic. Stop it.

[Linux_ho]

All I know is that 2821 allows for exactly what I say, interpreting your dumb relay as a point of final delivery.

Wow, it's all you know, and it's wrong. How tragic. Have another hit on the crack-pipe, Doc. May it ease your pain. 2821 still requires bouncing, by the way. See section 3.7, which is almost word-for-word what I quoted in my earlier message from 821. The biggest difference is that it capitalizes the word MUST, emphasizing my point.

Wow, you just don't get it, do you? If everyone followed my suggestion there wouldn't be dumb servers in this day and age and 550 errors would propagate freely and everyone who is supposed to would get them.

Hee hee, you crack me up. Where did you get the idea that 550 errors propagate?

Re:Bouncing is moronic. Stop it.

[droleary]

2821 still requires bouncing, by the way. See section 3.7, which is almost word-for-word what I quoted in my earlier message from 821.

For future reference, when someone informs you of an updated RFC which you hadn't bothered to read for the last 2 years, read the fucking thing. Not just the section that you think supports your point, but the whole thing including the sections that might be less supportive. In particular, I direct you to section 4.4 which supports the use of final delivery as a means to stop abusive bounces if you insist on running a dumb relay.

Where did you get the idea that 550 errors propagate?

On your systems they clearly don't, but we've already established you're a spam-friendly asshole. Here's the scenario if you're using a smart relay: after receiving all the data for a message and before you send a 250 OK, you do the relay service, which fails with a 550, which you can then return instead of a 250. Pretty simple, I think. Sorry you're too simple to see it.

Re:Bouncing is moronic. Stop it.

[Linux_ho]

In particular, I direct you to section 4.4 which supports the use of final delivery as a means to stop abusive bounces if you insist on running a dumb relay.

WTF? Section 4.4 specifies behavior regarding trace headers, and says nothing about relaying behavior, or error propagation except for info about the return-path header and how to make sure it allows gatewaying into other systems such as NNTP. All of which is designed to make sure bounces are successfully returned to the sender if the mail is undeliverable.

Here's the scenario if you're using a smart relay: after receiving all the data for a message and before you send a 250 OK, you do the relay service, which fails with a 550, which you can then return instead of a 250. Pretty simple, I think. Sorry you're too simple to see it.

Most MTA software doesn't do what you just described. Systems following SMTP RFCs do not propagate 550 errors. You're talking about an SMTP proxy, not a relay MTA. Proxys are not described in RFC 2821. And they never rewrite the return path, as you suggested in an earlier message. They also do nothing to prevent bounces, since most spammers use an open relay to send their mail, or a cracked Windows box which they have configured to act as an open relay. If the stupid proxy returns a 550, the open relay or cracked Windows box will generate a bounce message anyway.

I'll say it again, since we've already gone over this and you didn't get it last time. EVEN IF MY RELAY RETURNS A 550, THE SPAMMER'S RELAY WILL GENERATE A BOUNCE TO THE REVERSE-PATH. Maybe you can talk the spammers into using proxy servers (though it would dramatically slow down their spam-blast software), or better yet using a null address for the reverse-path. I don't think you'll have much luck, but your energies would be better spent focused in the direction of the spammers who are causing the problem, not mail administrators who are already doing everything they can with the tools they have available.

I see you have marked me as a Slashdot "foe". Seems like an ungrateful thing to do to someone who has spent so much time educating you about how e-mail works in the real world. You obviously have never been responsible for running a large mail system.

This will be my last post, since I've made a number of key points multiple times, it's obvious you're not getting it, and I just don't have any more time to waste explaining why your scheme is both completely ineffective and does not accurately describe the behavior of MTA software. I originally quoted 821 because most of it is copied word-for-word into 2821, and it has a shorter, less complex explanation for many things that still accurately reflect the behavior of real mail systems today.

Get some experience with real MTA software and take a look at how it ACTUALLY works before you go spouting off about how you THINK it should work based on your misunderstanding of the RFCs.

Re:Bouncing is moronic. Stop it.

[droleary]

WTF? Section 4.4 specifies behavior regarding trace headers, and says nothing about relaying behavior, or error propagation except for info about the return-path header and how to make sure it allows gatewaying into other systems such as NNTP.

Do you have ADD or something? There are two discussions going on and you seem unable to focus on one at at time. The first is regarding your dumb relaying server and the second is what a smarter server could do.

All of which is designed to make sure bounces are successfully returned to the sender if the mail is undeliverable.

This has become tiresome. How many times do I have do point out that you are not returning anything to the sender with your crappy bounces. You are misdirecting message to a third party: whoever got forged into the From header. I'm done trying to explain that point to you. Take your medication before reading and responding already!

Most MTA software doesn't do what you just described.

Holy fuck, that's why the thread started in the first place! Most servers are lazy outdated pieces of shit. The were constructed in a time when the Internet was a happy academic playground. My whole complaint is that RFCs allow them to better address attempted abuse.

Systems following SMTP RFCs do not propagate 550 errors.

They are not prevented from doing so, either. Just because you have a "reference" implementation in sendmail (or whatever) that is easy to install doesn't make it the last word on what a server can do. Just admit you're a lazy admin and stop trying to hide behind a manufactured understanding of RFCs.

EVEN IF MY RELAY RETURNS A 550, THE SPAMMER'S RELAY WILL GENERATE A BOUNCE TO THE REVERSE-PATH.

What a shitty excuse. Just because there might be some other crap server in the chain is no reason you can't keep your own house clean. If I get garbage from a server, I can block it; wouldn't you prefer I block the spammer's relay than your server?

I don't think you'll have much luck, but your energies would be better spent focused in the direction of the spammers who are causing the problem, not mail administrators who are already doing everything they can with the tools they have available.

Oh, please. Admins are doing far less than is allowed. They're mostly just lazy fucks who install something off the shelf to handle mail without too many hassles.

I see you have marked me as a Slashdot "foe". Seems like an ungrateful thing to do to someone who has spent so much time educating you about how e-mail works in the real world. You obviously have never been responsible for running a large mail system.

On the contrary, I have obviously been more responsible in my mail administration than you have. I know "how e-mail works in the real world"; it doesn't work. It's bloody teetering on the brink of destruction. If your not going to take some responsibility in cleaning it up, if you're going to twist RFCs to favor spammers, damn straight you're a foe.

Get some experience with real MTA software and take a look at how it ACTUALLY works before you go spouting off about how you THINK it should work based on your misunderstanding of the RFCs.

You still fail to get that the whole point is that how things "ACTUALLY work" is broken. How very sad for you and your users.

Re:Bouncing is moronic. Stop it.

[Linux_ho]

Oh, of COURSE. Any RESPONSIBLE admin running a large mail system would refuse any existing MTA software and write his own experimental system. Because there JUST MIGHT still be a spammer out there that doesn't use open relays. Big, hairy, fucking troll.