Bill Gates Forecasts Victory Over Spam

nfk writes "BBC reports from the World Economic Forum at Davos, where Bill Gates said spam will be a thing of the past in two years' time, thanks to a three-pronged approach to the problem: filters, expensive computation for e-mail and the digital equivalent to stamps, paid if the receiver considers he is being spammed. He also expects to catch up with Google, although he praises the company and the IQ of its research team. Finally, he announces mind blowing developments for the next XBox generation and says that, in a decade from now, 'we will laugh at personal computing as we know it.' No need to wait, I do it every day." (We've mentioned Microsoft's sender's-option payment scheme before.)

Comments

Bill Gates forecasts victory over spam...

[JessLeah]

...by requiring all emails to use Microsoft's proprietary, heavily patented, closed-source "SMTP++" technology, which runs only under Windows... Thereby, of course, locking out all non-Windows users...

Don't laugh, it could happen!

Re:Bill Gates forecasts victory over spam...

[aTMsA]

Bill Gates will find that that approach is infeasible even for him.

E-Mail has an enormous and heterogeneous install base, and while outlook has a strong grip on the client market, that's not the only place where it counts. There are a lot of servers which use non-microsoft software, and making even a sizable majority of them swap will be a daunting task.

That said, for one time i hope Bill is right.

Re:Bill Gates forecasts victory over spam...

[commander salamander]

"nice elegant Sendmail"?? The same one whose configuation syntax is only slightly distinguishable from line noise?

I want some of what you're smoking.

Re:Bill Gates forecasts victory over spam...

[kinsoa]

> ...by requiring all emails to use Microsoft's proprietary, heavily patented, closed-source "SMTP++" technology,

I've heard the name will be "VisualSMTP.NET".

Re:Bill Gates forecasts victory over spam...

[phre4k]

What? No. Too many mail servers are running on *nix machines.

Yeah, but remember that ten years ago all webbrowsers were non-ms. You can't just rule it out that easily. I could imagine that many users would change their mail-provider if they would get rid of all that spam

Re:Bill Gates forecasts victory over spam...

[jazman]

I don't think that would bother most people. By "most people" I don't of course mean "most slashdotters." I mean all those who are already locked into Windows and don't mind, to whom the vast majority of spam is directed, and which most likely contains all the people who are actually dumb enough to respond to spam. Make spam infeasible for that group of people, and you make spam infeasible full stop.

Yeah, spam filters.

[Nucleon500]

I'm usually a fan of spam filters. But the key is that they must be trainable - a far cry from Outlook 2003's filter, which relies on a fixed spamminess table. For those of use with real mail clients, spam filtering is already here.

And I don't think micropayments will stop spam - wouldn't the spammers just use servers that didn't require that? And would email be as useful if you could only get mail from someone who bought into a particular micropayment system?

Re:Yeah, spam filters.

[aheath]

I suspect that any e-mail payment scheme will be less than succesful until there are multiple reciprocal micropayment systems.

I am more intrested in an approach that can rank the level of attention that I should pay to e-mail. I'd like to have a white list that allows me to set different priority levels based upon the sender. I'd like to give a higher priority to mail that has a valid signature. I'd also give a higher priority to mail from people in my address list.

By the way, which e-mail clients meet your criterion for a "real mail clients"?

I am still trying to figure out where I can purchase the Monty Python E-Mail Client.

Re:Yeah, spam filters.

[MBCook]

I USE Outlook 2k3 and have used it's spam filtering. It does work, cutting my spam down to 1/3 to 1/4 of it's volume, and it's simple to use.

That said, I didn't want that last 1/3 to 1/4 of spam, we all know that it can be a LOT better than that. I used Cloudmark's SpamNet, which was great untill they charged for it and turned their back on their community. So from there I went to SpamAssassian which was nice but still not perfect or right. Next I went to Popfile which I have fell in love with. Great UI, fantastic (98-99% correct) accuracy, and it's free (and always will be, stupid Cloundmark).

As for micropayments in the way Gate suggests, I don't like that. What is to keep someone from deciding they don't like me and charging me money? I DO like the idea of requiring a second or two of processing time per e-mail sent (especially if you could choose what it does, say Seti@Home or folding), but as soon as spammers found a way around it it becomes useless, and what would happen to mailing lists?

Re:Yeah, spam filters.

[meta-monkey]

Damn straight. I use Mail.app on my Macs. After a few weeks of training, these days I essentially receive no spam. About one message every two weeks will get through. Usually when that happens it reminds me to empty the 700 spam messages out of my junk folder. A quick scan assures me that, once again, no false positives.

For Mac users, spam is already a thing of the past.

Re:Yeah, spam filters.

[p2sam]

SpamAssassin uses a scoring system to determine the "spamminess" of a piece of mail. Each test in SA has a score assigned to it by some fancy GA algorithm. The way I do it is sort my incoming mail by the SA score and pay attention accordingly.

Re:Yeah, spam filters.

[jfengel]

And I don't think micropayments will stop spam - wouldn't the spammers just use servers that didn't require that?

It's your server at mailinator.that counts. It can refuse to accept email except from people (or other mail servers) who pay.

And would email be as useful if you could only get mail from someone who bought into a particular micropayment system?

The payments Microsoft is proposing aren't necessarily monetary. Sometimes it can be a hard computational problem, which takes you a few seconds to compute. Spam depends on the very low cost of email. If you have to buy 10 computers to send your spam, instead of just one, it's suddenly far less profitable. Whereas you yourself can easily afford a few seconds added to each of the few dozen emails you send each day, since almost every personal computer has free cycles.

Of course, that depends on spammers to use their own computers. If they're using yours, a problem which plagues Microsoft-based computers, you're still stuck.

Re:Yeah, spam filters.

[Nucleon500]

Real email clients? There are tons, but almost anything is better than Outlook and OE. Outlook's fixed wordlist amazed me - once you know the hammy words, its easy to bypass. Moreover, expecting that md5summing individual words will hide them shows a real commitment to security by obscurity. (Of course, I shouldn't be talking.) Also, the HTML output is ugly, the word wrap in quoted text is abominable, and the handling of attachments has historically been so bad that attachments are no longer useful, because everyone filters them. And although many of these problems are a quick fix, it hasn't been done. (See the recent URL-hiding story.)

I personally use KMail and POPFile. I hear Thunderbird is good, and its integrated spamfilter is cool. And I'm sure Emacs would suffice. My one gripe about KMail and POPFile is that they aren't well enough integrated. If mail gets misclassified, just dragging it to the right filter ought to train the spamfilter too. A POP proxy and web interface is cool, but there ought to be a command line interface for spam filters that mail clients could automatically invoke.

Spam filters, whitelists, computation, and even micropayments, as ways to prioritize mail, each have their costs. All can result in important messages being lost. Computation and micropayments both make it harder to communicate, which I don't think is a good idea. I think the best long-term solution is to make it impossible to hide where mail is coming from. Then, legislation against spam will be effective, and in countries without such legislation, overseas bandwidth providers can pressure ISPs to drop their spammers. Combined with better security to stop zombies and filters to catch thre rest, spam can be eradicated.

Re:Yeah, spam filters.

[meta-monkey]

Mail.app uses a Bayesian filter to filter out spam. That means it has to be trained. The training refers to the filter, not the user. When you get a spam email, you click a button that says "This message is junk." When you get an email marked as junk that is not junk, you click "this mail is not junk." That's the training period. Once the filter has identified the common themes in mail you think is junk (penis enlargement, URGENTLY REQUESTING YOUR HELP FOR AN IMMEDIATE FINANCIAL TRANSACTION, etc), you set the filter to active mode, where it automatically stuffs the junk mail into a junk folder, hiding it from you.

congrats

[CGP314]

Asked whether Microsoft missed the boat in the field of search technology, Mr Gates admitted that he had to take the blame for losing out to Google.

"We took an approach that I now realise was wrong," he said.

I may not like Bill Gates and the way his company acts, but I have to give credit to a man who can admit his mistakes. It's not an easy thing to do.

--
In London? Need a Physics Tutor?

American Weblog in London

Re:congrats

[SpaceLifeForm]

That would be those queries that return MS branded websites. Google returns more Linux oriented websites when you're feeling lucky.

Out of the mouths of billionaires

[ScottSpeaks!]

"What is holding things back right now is software," Mr Gates said

So kindly get out of the way, and let the rest of us fix it.

Re:Out of the mouths of billionaires

[randyest]

That's an interesting comment, but at the risk of getting modded down, I have to ask:

In what ways do Bill and/or Microsoft impede yours (or anyone's) ability to improve software?

I'm not trolling here, I'm seriously cusious. Thanks in advance for your reply.

Re:Out of the mouths of billionaires

[aTMsA]

I realize you're trying to be funny, but the sad reality is that whatever the solution is(if there is one), it will only work if there's enough mail clients and servers that apply it, and the matter of fact is that Microsoft holds the keys to a very large client base. While they alone can't do it, they must certainly be part of the solution for it to work. So while we may despise Microsoft, the fact is on this issue they both are on our side, and we WANT them here.

Re:Out of the mouths of billionaires

[interiot]

MS has 95% of users hooked on an ancient browser, which means my web-based applications must continue to use old old techniques.

Re:Out of the mouths of billionaires

[cmacb]

"I realize you're trying to be funny, but the sad reality is that whatever the solution is(if there is one), it will only work if there's enough mail clients and servers that apply it, and the matter of fact is that Microsoft holds the keys to a very large client base."

That sounds like a false premiss.

Current Baysian (sp?) filtering works just fine without a lot of users. In fact, now that so many mail programs are using this technique the spammers have adapted to it by including words in their messages to get through the filtering.

Furthermore, they are including large lists of words which will eventually cause your filtering mechanism to filter out legitimate mail. By the time MS has its filtering system ready the entire concept will have been used up IMHO.

I've had good luck with Mailblocks.com. No training needed. The only way spam gets through is if the spammer takes the time to visit a web page, squint at a graphic and type in a word. The few small time spammers that have done this in my case have then been explicitly blocked.

I predict MS will scrap all their anti spam work and start over before 2006. Maybe they will come up with something good. But everything being said by Bill Gates at this point is just marketing hype, not valid design concepts (for which he is not qualified).

Re:Out of the mouths of billionaires

[ottffssent]

Well, for starters, ol' Bill owns patents and copyrights and the source code to a lot of the world's most frequently-compromised software, and doesn't have a sterling history in the patching department himself. So not only is Microsoft enormously contributing to the problem, it's deliberately standing in the way of solutions.

Re:Out of the mouths of billionaires

[ScottSpeaks!]

In what ways do Bill and/or Microsoft impede yours (or anyone's) ability to improve software?

First, understand that it was a silly request, on par with asking [insert political party here] to get out of government and let the [insert another party here] fix everything. I don't seriously expect it to happen, and yeah, there'd be bad side effects. But to answer your legitimate question:

One of the most obvious ways they impede us is by denying us access to the source code for their software. I can't (for example) fix the security holes in IE, because it's closed-source.

Another way is by requiring - by dint of their command of the marketplace - that software to be written for - and deployed on - their operating system. If I need (for example) a real-time, never-gonna-crash platform for my better mousetrap to work, and all that's out there in sufficient numbers is Windows, I'm stuck.

Another is by keeping competing products from reaching their intended market. I might develop a superlative word processor, but when MS Office is included "free" (i.e. bundled and included in the price) with so many PC purchases, I have little chance of successfully marketing it. Like happened to Netscape, or BeOS.

Sure, it's theoretically possible to get around all of these obstacles MS presents to innovation. And one could argue that some of them aren't necessarily MS's fault. But it would be so much easier for others to improve upon what we have now if Microsoft were to (as I kiddingly put it) "get out of the way". Release the code, shut the doors, and retire. If you really want revolutionary advances in software, that'd do it.

If Gates says that the software is holding us back, and it's mostly his software, doesn't that suggest that maybe he's part of the problem?

Neat

[Dark Lord Seth]

Next thing you know Bill will show the world Microsoft Cold Fusion Reactors, the Microsoft Space Agency, Microsoft Manual of Women and Microsoft Anti-Hangover Tablets! Go Bill!

A bit hypocritical

[bangular]

seeing at Hotmail sends me spam. Altough I know they don't consider it spam seeing as it's Microsoft. They also don't consider their pop ups "pop ups" persay...

catch up with google?

[jeffskyrunner]

He expects to catch up with google? this looks more like a huge wish then a prediction

Re:catch up with google?

[geekoid]

Really, how many hired goons would you need to beat up the google employees?
Hell, it would be cheaper then inovating?(and easier then spelling)

Obligatory quote:

Bill Gates: Mr. Simpson?

Homer: You don't look so rich.

Bill Gates: Don't let the haircut fool you, I am exceedingly wealthy. Your Internet ad was brought to my attention, but I can't figure out what, if anything, Compu-global-hyper-meganet does, so rather than risk competing with you, I've decided simply to buy you out.

Homer: I reluctantly accept your proposal!
Bill Gates: Well everyone always does. Buy 'em out, boys!

[Gates' lackeys trash the room.]
Homer: Hey, what the hell's going on!

Bill Gates: Oh, I didn't get rich by writing a lot of checks!

Re:catch up with google?

[Erratio]

More like a huge waste of resources. Rather than working with the great ideas that Google has rather worked out (like most IT companies) and maybe actually contributing something to the future of computers, they'll come up with their own proprietary clone with their own quirks and features and then try to compete with Google, and the cycle will continue with whatever new innovations are released. His statement about Google shows that Microsoft is really just out to compete with the world. Competition is of course a good thing, but that's with new things, not reinventing the wheel just so you can say your's is rounder.

Re:catch up with google?

[mingot]

So all of the OSS projects that are attempting to replicate microsoft functionality should just pack it in and fold?

You know building a better mousetrap starts with the basics and if another company or project has the basics down pat you pretty much have to re-invent that wheel before you can innovate. It's why being able to read MS file formats has always been pretty high on the list of features that have to be working for all of the MS Office knock-offs (until they get the basics down pat and begin to really innovate).

Re:Call Me Now!

[scrytch]

Bill Gates also forecasted that 640KB should be "enough for anybody".

For the millionth time, no he did not. He denies it, and no one has ever dug up a source for this quote.

Will "e-stamps" eradicate spam...

[killbill!]

... or merely free e-mail services?

But ultimately, Mr Gates predicted, spam would be killed through the electronic equivalent of a stamp, also known as "payment at risk".

This would force the sender of an e-mail to pay up when an e-mail was rejected as spam, but would not deter senders of real e-mail because they could be confident that their mail would be accepted.

"Microsoft is pursuing all three approaches, and spam will soon be a thing of the past," Mr Gates asserted.

I'm going to create several hotmail accounts, send hundreds of e-mails between them, and then reject them as "spam".

Three Pronged Response to Spam

[mykepredko]

Rather than using a three pronged approach using filters, expensive computation and digital stamps to combat spammers, how about a simple tool that has three prongs?

myke

no more spam?

[rivaldufus]

Are they shutting down hotmail in a couple of years, or what?

Not filters

[AndroidCat]

In the "filters, expensive computation for e-mail and the digital equivalent to stamps" bit, his first solution is actually a puzzle/challenge-response system rather than filters.

From this article:

One, which he called human interaction, would send a puzzle back to the sender. The puzzle would be designed so that only a human could solve it. The e-mail would be accepted only if the puzzle were solved.

None of his solutions are very new or stunning. All of these have been subjected to the Hash of Death on Slashdot before. I'd say step one should be to fix all those trojaned boxes acting as spammer proxies. Can you and your associates arrange that for me, Mr. Gates?

Re:Not filters

[Kyouryuu]

I think a "puzzle" would be more like the randomly-generated authorization codes that we frequently see when we sign up for free services in order to verify that a human signed up and not a bot.

For example, if you sent an e-mail, you'd be hit back with some alphanumeric code to put into a box in order to verify the ongoing mail.

It would work in theory, until the criminal spammers figure out how to read the incoming code and enter it automatically. I have a feeling that it works on Geocities because, short of link farms, there's little virtue in signing up for a hundred Geocities accounts. But if a code blocks the way between the spammers and the people they harass, they'll no doubt dedicate their efforts towards breaking it.

For reasons like this, Gates is right to assume that a "puzzle" alone would not be the sole solution. We'd still need intelligent spam filtering on the client end that learns to classify spam by example. We would also need significant and prompt fixes to any exploits in the dominant operating system so as to prevent this new wave of Sobig virus-spam hybrids from proliferating any more than they already have.

It is also mandatory for that above reason that we diversify how we use the Internet, e-mail, and the computer in general. This need not necessarily mean "switch from Windows to Linux." It could be as basic as "use Mozilla instead of IE." By introducing variety, it becomes more difficult for spammers to lock onto a single exploitation.

It is unfortunate that our "representatives" in the federal government, instead of fighting spam, have instead gone out and legalized it. The fight against it is something we have to do ourselves because we clearly cannot rely on the government to institute any meaningful legislation.

Re:Not filters

[gmack]

The breakage problem has nothing to do with "a few non standard systems" NT updates were notorious for breaking popular non MS apps. It was bad enough that windows admins became afraid of patching their machines thinking the kiddy potential was the smaller risk.

Even XP SP 1 was known to prevent some of our office systems from booting.

The problem is alack of Q&A.

we will laugh at personal computing as we know it.

[leftie_hater]

And I'm sure we'll continue to laugh at Microsoft.

Re:fp

[Mod Me God]

You may have some latency issues on your connection to be worked out.

...the digital equivalent to stamps, paid if the receiver considers he is being spammed.

As much as Bill Gates and Microsoft get group-hated there are some good ideas and some possibilities for decent implementation here, such as this. It is the darker side of MS that holds them back; if they could make great software that was fully transparent (I'm sure most of the developers would be happy with this) they would be totally win-win, and Bill Gates seems pretty philantropic as an individual, I wonder what holds them back...

MS is not an average company in the pocket of suits, it is run by an intelligent guy (by far the best programmer, but a very intelligent all-rounder) who has some kind of vision. I see, not too far from now, a bright future with Gates and Torvalds hand-in-hand. [No, my name is not Morpheus].

Won't work I bet

[Ken Broadfoot]

If microsoft managed to find a way to make money off of spammers then "geeks" who don't currently spam now, may start doing so just to mess with them.

Sort of like trying to thwart the microsoft security initiative.

I am not saying it is right, but that it would happen.

However, spam is a problem. It is almost impossible to have a "permanent" address anymore and that sucks.

I would like to hear about solutions that don't involve paying microsoft anything.

--ken

--ken

Bill Gates Forecasts...

[Meneudo]

I don't really care if he says it. Many other professionals are saying it as well, I trust them. I could care less how much somebody predicts something, unless they have research to back it up and/or are some kind of spamologist. Bill obviously has no more legitimacy over anyone else. Yet this comes from a big figure and so it *must* be true. I say give credit where credit is due and respect the people who have been fighting against spam, instead of one person with a lot of money. If I had billions of dollars for screwing people over, would that make my opinion count any more than someone else's? No... Wait... corporate america...

surely charging for email delivery will stop spam

[rivaldufus]

I mean, I never get junk mail at home in my mailbox - I'm sure I would if the US post delivered for free.

what spam?

[ejaw5]

not to serve as an inviation for any, but I don't get spam in my primary email address, and maybe just a few in my free web-based email that go to the "bulk folder" ...which is far from what the media and everyone proclaims how bad spam is. If you're haphazardly posting your email address in public forums, websites, contests, etc etc then you probably get spammed a lot. Just be careful who/where you give out your email address, and if you do get any spam, don't load the images (or any HTML content for that matter), and certainly don't click on the "remove from list" link.

Re:what spam?

[JaredOfEuropa]

Just be careful

I'd prefer a world where I didn't have to be careful with my email address. I want to post it on a website so that people can just click it and send me a mail, without bots harvesting the adress and crapflooding my inbox. I want to put it in my .sig on sites such as this one, and Usenet.

I applaud any effort that will reduce spam and send the spammers to jail. Perhaps some day, we can have spam-free email again like in the good old days...

The Story of 640K

[KalvinB]

That quote is in context about the first 8088 or 8086 chip. The manufactures we debating how much of the 1MB addressable memory should be allocated for what.

*at the time* 640K should have been enough for anybody so they went with that and dedicated the other 384KB for other things.

And this has been addressed on Slashdot before. But the existance of facts has never stopped anybody from perpetuating myths if they think it proves a point they'd like to make.

The WHOLE story

A whole two second search on Google cleared that up.

Ben

no no no...

[plams]

...there must be some hidden agenda here. My theory is that Microsoft patented certain penis enlargement techniques and want to get rid of the competition.

Re:xbox n stuff

[Judg3]

Although, compared to other consoles it is quite powerful, its still fairly weak. It lacks the possibility for upgrades (such as the processor or memory) and by today's standards 800mhz is hardly anything (i think thats what the clock speed is off the top of my head).

Eh? Ps2 uses a 300Mhz CPU, and the Gamecube uses a ~500Mhz CPU. Neither of those platforms have upgradeable RAM or CPUs either.

So tell me again how the hardware is weak compared to the others?

Lots of filtering available for UNIX

[bigberk]

There's lots of great filtering technologies available out there, and the best ones are non-commercial in nature. Microsoft or Yahoo have not helped my spam situation; but spamprobe, bogofilter, spamassassin, and spambayes definitely have helped me, in very real terms: > 99% accuracy, with (generally) zero false positives depending on the quality of configuration.

Now an appeal to you folks out there who use these filters I've mentioned with similar good results (w.r.t. accuracy): we no longer see spam thanks to our filters. How about taking it one step further? Join the WPBL project and help us centrally collect IP addresses of spammers. It's an automated system to determine real-time spam sources using reliable, trusted data contributors. We are currently tracking over 15,000 IPs.

Re:xbox n stuff

[mingot]

Let me prefix all of this by saying that I'm a GameCube fanboi and have no particular love for the XBox...

Although, compared to other consoles it is quite powerful, its still fairly weak.

When it comes to hardware specs it is not weak. It's marginally better than both the GC and PS2. It lacks the possibility for upgrades (such as the processor or memory) and by today's standards 800mhz is hardly anything (i think thats what the clock speed is off the top of my head).

You make two point here and I'll address them both. As for being upgradable, that's true, and a GOOD thing. By having a locked specification game companines can QA a game on a single system and never have to worry about this driver or that driver for some new piece of hardware causing trouble for them. The second a user can upgrade a game console is the second they become useless to a large majority of the people who own them. Mom and Pop with a 10 year old son to no want to install patches, see blue screens of death (or kernel panics), or any of the other nonsense that comes along a full blown PC. They want an appliance, a black box if you will, that has a hole to put media in and "just works."

As for the processor speed... The GC and PS2 both have processors running at lower speeds. Not that it makes much of an argument for anything as the GC has a PowerPC and the PS2 has an "Emotion Engine." Not sure what that is, but as long as it plays the games it's not really a concern.

Another thing i think is 'less noble' about the xbox, is the fact that most of the important components in the machine aren't even made by microsoft (nvidia i believe).

This is fairly common now and will be the norm in the future. ATI and NVidia invest millions (billions?) into GPU design. Why should MS/Sony/Nintendo do the same when they can buy off the shelf parts that will likely do a better job and pass the savings on to the consumer so they can buy more games?

I don't believe console gaming will catch up to pc gaming any time soon.

I don't believe PC gaming will catch up to console gaming any time soon.

SPAM could be solved much faster...

[Pig Hogger]

... if Microsoft would drop dead tomorrow morning.

No more:

• Insecure OSes that can be trojaned by viral spam-relaying malware
• Stupid non-standard e-mail clients that will automatically display tracking web-bugs that confirm dictionnary-attacked e-mail addresses.
• Stupid lame e-mail delivery agents that can be cracked from outside.
• Internetworking standards that are denatured beyond usefulness.
• Crappy web-browsers that install all sorts of malware on user computers.

Re:xbox n stuff

[Gmalloy]

I don't know who modded this up and what they were smoking, but...

Trying to say that an 800mhz processor in a console is going to hold it back is totally asinine. So far we've seen just the first generation of games, developers have not yet come close to utilizing all that the xbox has to offer in terms of hardware. This year you'll see the new games that just start to unleash the potential this system has to offer (HALO 2 and Fable among others...).

Now if you wanted to bash the xbox, you mention:

- it weighs about a metric ton
- doesn't fit in my stero rack nicely
- is the loudest piece of equipment i own
- doesn't do progressive scan dvd playback
- last product to market

However, having the fastest processor in a console, and the only integrated hard drive and ethernet card give it great potential and make it somewhat of an innovation. It may be handy to note that the gamecube runs at (?) 400mhz, and the PS2 runs at 200mhz(?), but it has little to do with the quality of the games 3rd party developers can produce.

fact that most of the important components in the machine aren't even made by microsoft (nvidia i believe)

Yea its a real shame they outsourced the gpu to one of the premier graphics chips companies in the world...

//rant

but what about typos?

[holy_smoke]

"...stamps, paid if the receiver considers he is being spammed"

What if I accidently type in "joe@yahoo.com" instead of "joel@yahoo.com" and joe decides I am spamming him? Should I be required to pay up becuase of a mistake? Who's going to enforce payment (really)?

I fear that if we make email more difficult to use then it begins to lose its appeal (think instand messaging alternatives).

Re:but what about typos?

[rock_climbing_guy]

Actually, knowing MS, you'd probably get a bill like this:

joel@yahoo.com mail rejection: 3 cents
electronic mail anti-spam service fee: five dollars
universal service fee: one dollar

You total: $6.03

Please pay to the Microsoft Corp., ....

Re:but what about typos?

[bluGill]

For a micropayment, the cost to a single mistake would be small enough that you wouldn't care. It costs me about 30 cents to mail a letter, if once in a while I had to pay 2 cents because someone mistook my email, I can afford it. A spammer cannot however afford all the recipents of his spam charging 2 cents because it adds up

Unfortunatly I don't know if it is worth the effort to hit the charge sender button. Means I have to sign up for a lot of things, for little appearent gain.

The bigger problem with this though is real mailing lists. Its easy enough to sign up for the countrpane newsletter on a lot of accounts (script), and then (again scripted) when a newsletter arrives hit the charge button.

Second or two of processing time

[Safety Cap]

That would not work, as the spammers would just set up their own sendmail servers and pump out spam to their heart's content.

Effective countermeasures to spam include better spam filters (like Popfile, as you mentioned), and ensuring that all routers drop invalid packets: packets with impossible (from a subnet stance) source or destination addresses. The latter will prevent most forged headers.

Micropayments cannot work unless SMTP is redefined. Switching over the installed base (it has to be all-or-nothing, or it doesn't work because you can't have a micropay server talk to one that is not, or the whole scenario breaks down) will be problematic at best.

Re:Second or two of processing time

[Ed Avis]

Micropayments don't have to change SMTP at all. The client can discard or bounce the message if it doesn't have appropriate payment. In fact, this is probably the better way to do things since it puts control of what to receive in the hands of the recipient, not the sender or some mail server (which is what caused the spam problem in the first place).

Re:Second or two of processing time

[Zeinfeld]

Micropayments don't have to change SMTP at all.

Bill did not suggest Micropayments. He suggested great big honking huge penalty payments to be paid by spammers. Completely different issue.

I have spent a lot of time trying to get micropayments to work and it is a really hard problem. Applied to email it would raise costs to levels that would eliminate many of the current uses of the net. Nobody could ever afford to run a mailing list like cipherpunks as a hobby.

Penalty payments is another issue, that can be done through well known commercial mechanisms, TrustE is already doing it, so is Ironport.

Re:Second or two of processing time

[esj at harvee]

camram project has successfully used hashcash for stamp generation and message acceptance. We find that about 15 to 20 seconds computation is about the right amount to seriously bankrupt spammers. (paper on this coming soon)

zombies are a problem but the nice thing about proof of work puzzles such as hashcash is that they make the zombie machines get hot which is noticeable by normal users. They also run real slow. Again something to draw the users attention to a problem. in any case, the numbers are real close. There's still more spam than the number stamps generated by the number of known zombies. Since the upper bound for spam is set by the number of zombies, this is a serious incentive to kill zombies.

Mailing lists are problematic but if one uses a second type of stamp based on signatures, then the problem goes away. In the meantime, using hybrid system, you do not require anything special of mailing lists and you are no worse off than you are with typical content filters.

www.camram.org

Re:Second or two of processing time

[Ed Avis]

I envisage that the amount of computation could be variable by the client, and it would be one of several factors weighed. For example with Spamassassin you might see something like


HTML.........1.0 points.....Message contains HTML
HASH_CASH....-3.5 points....Hash cash payment of 35 computrons
Total score: -2.5 points ==> not spam


As usual, the Spamassassin developers would look at their corpus of spam and ham and derive the right weighting for different amounts of hash cash postage. Users could tweak it themselves if they wanted.

Re:Second or two of processing time

[esj at harvee]

problem is that the number of bits of collision found is a probabilistic event. You always have at least the number you requested but sometimes you can have as much as 10 or 15 bits more because that is just what you stumbled across in search for the collision. It's always safest to say whether or not it passed the minimum number of bits collision threshold and not that it has a certain number of bits collision.

I suggest you try this using the hashcash executable. Run the process for about a week and log the number of collision bits found versus number of times it was found. Its quite illuminating.

Re:Second or two of processing time

[Ed Avis]

Hmm, so the 'amount' of hash cash postage is probabilistic, but then so is the determination of what is spam and what isn't. It is unlikely that a spammer would run the hash cash code and get very good luck to hit long collisions by accident, so the length of collision found is a reasonable indicator of the computing time put in.

Correct me if I'm wrong - but surely a collision of 6 bits could not take any less time to find than one of 5 bits, and quite likely would take longer. So, a longer collision should be treated as better, though the probabilistic weighting you give to this might have to be carefully chosen.

Re:Second or two of processing time

[esj at harvee]

obviously, we need to have a longer conversation. Feel free to contact me directly via the link on the contact section of the camram web site.

This is true of all proof of work systems. You could get really lucky and meet the criteria for "done" on the first try. On average however you will take the target amount of time. Which means sometimes it will take longer and sometimes it will take shorter to reach "done".

Now on average, every time you increase the cost of a stamp by a bit, you double the average cost. So if a 22 bit stamp takes 15 seconds on average, a 23 bit stamp will take 30 seconds on average. Now it's also possible to encounter a 26 or 32 bit stamp in the search for a lower value one. There's no magic or exploitation involved, it's just how sha1 and the search for the right completion work. Think dumb-F'n-luck. which is why I choose to use the desired number as a predicate and use a simple go/no go. Other interpretations are possible but less predictable.

Seriously, contact me directly and I highly recommend playing with the hashcash code from hashcash.org and really get a good feel for what it means to generate stamps. There's nothing like hands-on experience at this point.

---eric

Re:wild

[spektr]

So in a couple of years I'll get to spend half my day solving puzzles?

You won't. Your computer will have to. Example from RFC-4821:

R: 220 BBN-UNIX.ARPA Puzzling Mail Transfer Service Ready
S: HELO USC-ISIF.ARPA
R: 250 BBN-UNIX.ARPA

S: MAIL FROM:<Smith@USC-ISIF.ARPA>
R: 503 Polite people solve a puzzle first

S: ASKME
R: 366 Why did the chicken cross the road?
S: ANSWER To deliver the mail!
R: 250 OK

S: MAIL FROM:<Smith@USC-ISIF.ARPA>
R: 250 OK
...

A credit card for email?

[prozac79]

Does this mean you would need to provide a valid credit card number to set up an email account? That's done already if you go through an ISP, but what about all those free, web-based email servers? Or what about people who have set up their own email server on a PC? How would you go about tracking down these people and billing them?

There is one thing we have all learned from the spammers and that is that they are smart. They have just as many smart programmers working for them as we have fighting against them. They know how to avoid detection. Spam and identity theft go hand and hand. So if they were financially responsible, whose to say they wouldn't just fork over a stolen credit card number and have Joe Sixpack pick up the tab?

Where does the money go?

[lithiumfox]

force the sender of an e-mail to pay up when an e-mail was rejected as spam I mean, if the mail is rejected, and they are charged a penny for each email sent, when we talk about millions of spam emails, thats a good chunk of change. So will Microsoft be getting this money, or will the consumer getting it for all the trouble they have been through. I doubt we will get anything.

SPAM is our friend

[pipingguy]

What REALLY pisses me off is that the *real*, legitimate penis enlargement comapanies are being painted with this broad brush.

Don't bomb me - the above is a joke.

Finally, a use for "grid computing" - spam keys

[Animats]

Spam key generation is an ideal application for "grid computing" - very distributed, compute-intensive, moderate data traffic, tolerant of failure. Spammers are already used to capturing the machines of others and using them for their own purposes. Effectively, they already have a "grid".

If it takes some massive computation to generate a key to send an e-mail, spammers will just have their captured zombies do it. All on Windows home machines, of course, where most users won't notice.

For the "legal" spammers (as legalized by the CAN-SPAM act), there's another alternative - unloading the task onto customers. Sharman Networks could make all tke Kazaa clients do it. Legally - read the Kazaa EULA.

Stop spam, how?

[miffo.swe]

Until it is illegal to send someone email i cant really fathom how you could stop spam? If sending email becomes hard or expensive some bozo will reinvent email and people will flock there instead.

A ban against email while regular IRL spam is allowed is also pretty inconsistent. Maybe if we put some pressure on the companies SENDING the spam we could get some results. Just plain boycott any company that sends spam and the problem will stop pretty fast. Why not start a list with the worst offenders (companies, not the spammers).

Without companies giving the spammers money the problem wouldnt exist.

Cure the illness not the symptoms!

Re:And he can use his 640K of ram to ensure it!

[kamapuaa]

You might find this - Bill Gates never made such a claim.

Microsoft's plan: Take down the Internet!

[Snarfangel]

That would kill the problem at its source.

More seriously, you could probably remove a good portion of the spam short of this draconian step, but it would probably require:

1. Verification of the return address given in e-mail.
2. E-mail being held on the originator's side until requested by the recipient.

For example, you send an e-mail. The recipient's server then sends a one-time key back to the return address on the email. The originating server then includes this key and a link to the body of the message in the e-mail header and sends it back. The link sits on the recipient's mail server until that person either reads the message by clicking on the link to download it, or deletes the link thus removing the key.

The nice thing about leaving the message on the originating server is that spammers would have to give valid return information, and they have to store the spam on their server until someone requests it. There would be higher up-front bandwidth and data storage costs from the verification process, especially for the more prolific spammers, but it would probably lower the overall bandwidth required since header info is usually much smaller than the message itself, and deleting it prevents the larger message from being transmitted. It would also probably slow the spread of many e-mail viruses (and make them far easier to track), because a really prolific one would fill up the originating server with a bunch of garbage while waiting for a response, and they wouldn't be able to mask the return address by giving a phony one.

So what's wrong with...

[MeerCat]

My idea for reducing spam by at least getting rid of a whole load of joe-jobbing would be to let people announce how to verify emails from them (I've received something like 50,000 bounces as a result of some spammer sending mails from hijacked machines claiming to be from [random-word]@schmerg.com).

I own all email sent from schmerg.com, so I add a (new type of) DNS record of my public key, and then every email that I send I add a header "X-WonderSchemeEncyrptedChecksum" with the value of the SHA-1 checksum of that message's body as sent, encrypted with my corresponding private key.

If your mail system doesn't know about this, nothing changes, but if you DO know about the scheme, then whenever you receive an email you do a DNS lookup on the sender's domain. If that domain has no key listed, then you're none the wiser, but if they DO have a key listed (and here my domain schmerg.com does) then you can safely reject any emails that don't have the new header, or where decrypting the checksum fails to match the body.

This way an organisation can still add their crappy sigs or whatever, and then sign all their email, and spammers will learn not to use that domain in their From address.

Big ISPs and people like HotMail can sign all the email their users send thru their system, and we start to reduce the ability of spammers to have false From addresses. If you want to send email claiming to be from a domain protecting itself in this way, you have to send it thru that domain at some point (or know the private key yourself).

It's nowhere near a complete solution to spam, but it makes life harder for spammers (and phishers and the rest), and it rewards those willing to make the effort without punishing those who don't.

To get round various implementation issues you'd probably want to add multiple keys to your DNS record and then describe which one you were using for each email (so you can rotate keys, or use different keys for different locations, and phase out old keys regularly if you're Hotmail.com or similar), but DNS propagation, caching and lookup is a given on today's internet.

If you can't be bothered checking the identity of the sender you don't have to, but if you want to (and you can afford the DNS lookup and the cycles to checksum the message etc.), then you can.

--
Tim

Re:Google isn't the be all and end all.

[Ageless]

Maybe I missed something but I searched Google for "sheena stuntwoman" and the first link I got was her resume with links to tons of pictures and BIO.

http://www.google.com/search?hl=en&ie=UTF-8&oe=U TF -8&q=sheena+stuntwoman&spell=1

http://www.v10stunts.com/gloria_fontenot_resume. ht m

and if your email addr gets hijacked?

[josepha48]

Who pays if someone starts sending email using my email address? I have already had this happen and as such I have had to change my email address. But what if you work for a company and the company uses bobm@floobla.com? Then someone starts sending email as bobm@floobla.com. Who pays for phoney reply-to addresses?

The real and only solution is email sending authorization. If you are going to get your pop mail you must send USER and PASS commands. These need to be part of the SMTP somehow. Then they need to be adopted by ISP's across the GLOBE. Then they need to be required and any email that does not meet this does not get sent. Yes people will have to upgrade email programs, but it is a small price to pay!

spam fines

[Andy Smith]

But ultimately, Mr Gates predicted, spam would be killed through the electronic equivalent of a stamp, also known as "payment at risk".

This would force the sender of an e-mail to pay up when an e-mail was rejected as spam, but would not deter senders of real e-mail because they could be confident that their mail would be accepted.

I applaud any efforts to combat spam but there seems to be a problem with these payments.

Aren't most spammers criminals? In future, if legislation continues as it has recently, won't all spammers be criminals? Therefore, doesn't it make sense that these criminals will find a way to avoid paying the fines?

On the other hand, with an up-front payment scheme, costing say a tenth of one pence per e-mail, that at least removes the option for criminal spammers to simply not pay. Of course they may pay using stolen credit cards or some other form of fraud, but that exposes them to an even greater wrath of the law and may lead to them being stopped a lot sooner than if all they had done was refuse to pay an ISP's e-mail fine.

No

[A nonymous Coward]

SMTP# you silly man.

Re:No

[JessLeah]

Woman.

End spam - Open Source

[NewToNix]

First, on an old computer I had that was just sitting around growing dust, I set up my own "in house" email server using qmail , on GNU/Linux/Mandrake. It was dead easy to do.

I pluged it into my router and opened ports 25 & 110 for it.

Then I added Fetchmail .

And then the neatest thing since sliced bread; TMDA.

4 months now - zero spam, zero lost valid emails.

I didn't have to give up any existing (POP3) accounts, and gained as many as I want to create, because I now have my own email server.

This is easy and cures spam, period.

I'm on DSL, with dynamicly assigned IP, so I use a free DNS service no-ip.com.

This really is simple to do, all were RPM's and I mostly just took whatever default was offered.

I really am New To Nix, so if I could do this, then anyone can.

And it was free.

I am so happy - 40 - 50 spam emails a day, went to ZERO spam. And I still have and use my same email address! Plus some special occasion ones I create as needed (timed experation for usenet, etc.).

And the disclaimer - I have nothing to do with any program mentioned in this post, other then being a happy user of same.

NewToNix (668737)

Re:surely charging for email delivery will stop sp

[interiot]

Granted, you do get some spam in your snail-mailbox. But basically, it's seems like a given right now that the amount of spam that an email-box is recieving will double every year or two. There's no reason for spammers to not keep spraying more and more shit onto the internet, since it's free. I have a couple spam emails that are very likely from the same spam author (SpamAssassin hits the same thing in them every time) that get sent to me EVERY SINGLE DAY. If companies had to pay for stamps for online messages, they'd simply decide it wasn't worth it to spend that much money on advertising (or they'd at least choose a more effective / less annoying way to blow their money, eg "sign up for a bank account, get a free shotgun!").

How to solve the spam problem

[steveha]

Problem: email is cheap, almost free, so a 0.00001% response rate on spam is still enough to make money.

Solution: make email cost something.

How?

Government? No no no no no. We want full control over our own email. Government should only be used to solve problems that only government can solve, and email doesn't rise to that level.

So, the solution:

A new protocol to replace SMTP. Someone sends you an email, and your server replies with the amount of the micropayment required for the email to go through. Then they can pay or decline. Most people would leve this set to a low amount (five cents sounds good to me), but famous people might set the bar higher to reduce the amount of email they get. The server has a "white list" of people you won't charge for email; this will use digital signatures, not an easily-forged header field.

Your email client has three toolbar buttons: refund the fee for this message and add the sender to the white list, refund the fee for this message, and delete message without refunding the fee.

We would have to run this in parallel with SMTP for a while, but it will be hugely popular. People using this will find no penis enlargement (excuse me, "pen1s en.la.rg.em.en.t") emails in their new inbox, even as their SMTP inbox gets worse and worse with spam. The word-of-mouth on this would be incredible: "I only check my spambox every other day or so, if you want to get in touch with me quickly you will need to use the new email format."

Quick numbers:

Let's assume some wild numbers (I have done no research, I just made these up). Suppose a typical spam run sends out 100,000 pieces of spam, and 30 people are dumb enough to bite (sounds high, but let's assume it) and each of those people sends $30 (hoping to "get bigger now"). That's $900, which is a clear profit if you are simply blasting emails over SMTP. But if the average person charges five cents to receive an email, it would cost 5,000 dollars to send out that spam run, for a net loss of $4,100. This is why spam would no longer work.

Note that you might receive ads in your inbox, but they would be ads where the sender is confident that the ad is worth five cents. If someone sent me a coupon good for $20 off something I actually want to buy, I'd even refund the five cents.

steveha

Re:How to solve the spam problem

[samalone]

Suppose that each spammer in your example above had to endure a 3 sec latency before the SMTP session would begin. That would add a net 300,000 seconds to their delivery time (using your numbers of 100,000 emails).

Yes, but there's nothing to require the spammer to wait for the first connection to finish before starting another one.

Couldn't a spammer get around that simply by using a multithreaded process to send the spam? At any given time most threads would be idle waiting for an SMTP connection, but they wouldn't be using any CPU time. The spammer might have to do some tuning to find the right number of threads to use, but it seems to me that properly tuned, the overall throughput would be the same as it is now.

--Stuart

Lets make a FAQ

[dasunt]

SPAM-Solution FAQ v.01

Congratulations, you have an EMAIL SPAM Solution.

Now, before you release it to the world, why don't you consider these points:

1. Not all mass-mailings are spam. Will your solution break high-volume mailing lists?
2. Not all computer generated mails are spam. Will your solution break order status updates from web businesses? What happens if the business does not use the same domain for emailing? support@customers.example.com instead of store.example.com?
3. Speaking of which, will your solution break messages sent from computers without an external email server? What happens if the cronjob on gateway.example.com wants to send bob@example.com an email?
4. Spamming is worldwide. Will your solution include a spammer in, say, South Africa?
5. A spammer can use more then one machine in order to send email. Does your solution still work if the spammer is controlling 10 machines? 100 machines? 1000 machines?
6. Inversely, will your solution bog down my cellphone's anemic processor when I check my mail? Or will it cause my ISP to purchase faster hardware and pass the price on to me?
7. Finally, if I forge the address someone_i_hate@example.com on all my spam, will your solution bury their server in spam or not?

(c) 2004 by Jesse Meyer ( dasunt [a] hotmail [.] guess ).
Permission to redistribute is freely granted as long as this disclaimer is included.

PS: Feel free to suggest other points, I'll add them to the list.

It has to be said - Gates misquote

[dbIII]

640,000 spam emails is enough for anyone.

And how, exactly?

[JRHelgeson]

How can Bill Gates/M$ forecast the death of spam, when they can't even predict when their products will be 'secure', much less their product launch dates...

Reminds me of an old joke...

[Flyboy Connor]

...about the wedding night of Bill and Melinda Gates. She was very disappointed because all Bill did was sit on the edge of the bed and tell her how good it would be when she would finally get it.

Microsoft has always been good on promises. The fact is that spam is getting worse and worse. Microsoft at the moment does absolutely nothing about it. I had to let go of my hotmail address because I got so much spam in it that the mailbox would overflow twice a day. I have tried several freemail providers and hotmail is absolutely the worst in every respect, certainly regarding spam.

But Gates flashes a big smile and says Microsoft solves the spam problem! Yes, it will be gone Real Soon Now. Don't worry but trust Microsoft! Have we ever let you down?

Vanquish

[ashot]

There is already a program that does this actually, a little bit of a nuisance, but you can try it out: www.vanquish.com

Another 640k quote...

[davburns]

There are problems with all of these solutions.

The biggest problem that they all break the simple model that makes email work. Users can pass an "email address" by any means (inband or out of band) they want, and then they can exchange messages. Any kind of payment system will require a security relationship between the email-exchanging parties. Security realationships are expensive, and tend to scale as O(N^2).

Increasing the cost (CPU or money) would still let "rich" spammers spam, but would shut down mailing lists, and make a big extra barrier for people to freely email each other. (And no, whitelisting the mailing lists won't work -- because the spammers would just forge mail from those mailing lists.) Getting rid of the "poor" spammers would be nice (no more herbal viagra...) but would encorage big companies to spam (and they would claim that this is legitimate.) Consider this, as well: much spam these days is delivered by zombies -- is it really costing the spammer anything if his network of zombies has to do a little more CPU intensive work?

If you require a micropayment with each email, that means you either have an extra step to take with each email (insert smartcard, type pin, or whatever) or your MUA does that for you. The previous is enough difficulty to kick many non-technical users off the 'net. The later would imply that malmalware or a social engineer can steal all your email money.

There are lots of ways to help reduce spam (currenly more than 50% of email is spam.) Filters help a lot, and the ASRG is working on new barriers to spammers. If CAN-SPAM were enforced, it would make a large dent in the amount of spam (and make the rest easier to filter.) I think that has to be the magic bullet for spam, if there is going to be one. Filters and other barriers may slow spammers down, but if there is no penalty for trying, they'll keep coming until they find a way to circumvent the filters, the payment schemes, etc. The magic bullet canot be filtering alone -- I'm pretty sure that well-written spam would require a turing test to distinguish from ordinary email.

Mind the source

[Pseudonymus Bosch]

"We believe that OS/2 is the platform for the 90's" - Bill Gates.

Microsoft will accomplish this...

[adrianbaugh]

by introducing its all-new Secure Proprietary Advanced Mail protocol. Oh, wait...

Baysian...

[adriantam]

Did Bill means his team is going to *invent* Baysian spam filtering? I am used to this in Mozilla for a long time.

Lots of stuff is wrong with Yahoo's DomainKeys

[wayne]

Congratulations. You have just described how Yahoo's DomainKeys idea works, with the exception that DomainKeys also checks the headers.

The problem with your idea, and Yahoo's Domainkeys, are as follows:

• You complain about bounces, but this system does not verify the envelope from, and therefor will not prevent all those bounces.
• A spammer who can get an account on your system (think Yahoo here), can send email to another account they control. They then have an email with your signed hash on it, which they can resend all they want.
• Mailing lists, some email forwarding services, and other systems will add information to both the body and headers of a message. MicroSoft Exchange servers store emails in an internal format and recreate the heasers when they forward it on. *poof*, you now have an invalid hash.
• Hashing and then using public key encryption to sign the emails is fairly expensive. The keys that you would look up in DNS are going to be fairly large. All-in-all, this is a fairly expensive proposal, and it doesn't really solve any problems.

I think a far better better proposal for what you want to do is Sender Permitted From (SPF). It has been mentioned quite a few times on /. and elsewhere.

Re:Lots of stuff is wrong with Yahoo's DomainKeys

[MeerCat]

You complain about bounces, but this system does not verify the envelope from, and therefor will not prevent all those bounces.

Yeah, but it would give people a reason to reject the email properly as being invalid rather than bouncing it. This in turn would turn the spammers away from using my domain, so in the end I stop getting bounces (the bounces aren't really the problem, it's the fact my domain name is being maligned).

A spammer who can get an account on your system (think Yahoo here), can send email to another account they control. They then have an email with your signed hash on it, which they can resend all they want.

Ah yes, very good. Hadn't thought of that, had I... I did think about checksuming headers too of course that's always problematic and would ultimately suffer from the same. Back to thinkign some more...

Mailing lists, some email forwarding services, and other systems will add information to both the body and headers of a message. MicroSoft Exchange servers store emails in an internal format and recreate the heasers when they forward it on. *poof*, you now have an invalid hash.

I knew some systems did, but figured they'd just not use the system, and then (over time) as people start to adopt the system en-masse then such systems would be under pressure to change the way they work (change "from" and re-sign or drop those shitty sigs etc.) or find people avoiding them.

Hashing and then using public key encryption to sign the emails is fairly expensive. The keys that you would look up in DNS are going to be fairly large. All-in-all, this is a fairly expensive proposal, and it doesn't really solve any problems.

It is, but like I say, if you're willing to use it you get the benefits but it doesn't hurt you if you choose not to. And I doubt overall that it's that expensive compared to all the other costs of spam and filtering: DNS lookups are cheap especially as large organisations proxy and cache DNS lookups.

I think #2 is the killer, but I appreciate your other points.

I also thought about reverse-MX schemes (and seem to remember looking at SPF and seeing they'd thought about it even more) but wondered how I'd cope given that my IP may change frequently and DNS propoagtes more slowly, but I can't predict what IP I'll get next from the DHCP server, and similar problems.

Thanks

--
T

What's funny

[einhverfr]

Is that every one of Bill's solutions have been done FIRST in the Open Source community. The BBC mentioned two concepts that I remember:

1: Filters (Since when does Outlook or OE have Bayesian filtering capabilities?)

2: Causing spammers to pay a certain price. This is also being done for example, by requiring every subsequent attempt to send an email to a non-existant address forceing a cumulative delay in responding to the next attempt from the same host (this has been discussed on the Qmail lists quite a bit).

MS EXchange, IIRC, doesn't even check to see if there is an MX record for the originating domain! Sendmail even does that. How many hotmail messages do we get from xdtty@weftre.wdt (obviously nonexistant domains). Obviously Hotmail doesn't check either (when I pointed this out to them, I also pointed out that Sendmail DOES check these things)

Bill should mean "We want to be the first proprietary vendor to copy the methods of the Open Source solutions to the Spam Problem." It would have been more accurate.

Note that the above solutions are SMTP compatible and require no protocol extensions. They would have the effect of rendering SPAM less effective, and harvesting email addresses more costly.

Re:What's funny

[Ben Hutchings]

Here's your Bayesian filtering for Outlook. Microsoft is also distributing a Bayesian filter with Outlook 2003, but get this - it's pre-trained and can't learn any more!