Slashdot Mirror
AOL Tests Sender Permitted From / E-mail Caller ID
securitas writes "ZDNet reports that AOL is testing Sender Permitted From (SPF), 'an antispam filter intended to accurately trace the origin of e-mail messages.' AOL is performing the widescale SPF test with its 33 million subscribers worldwide. The system works by letting recipients use the SPF record to cross-check DNS data associated with AOL's IP addresses and confirm that the message originated from AOL's servers. The system is one of three competing e-mail authentication protocols. The other IP-identifying protocols are the Designated Mailers Protocol (DMP) and Reverse Mail Exchange (RME/RMX). All systems alter the DNS database to let e-mail servers publish the IP addresses that they use to send e-mail."
So what? Microsoft is working on a new secret email technology and they need people to test it. They are paying people for it too! Send this email message to 10 people and receive a check for $50.00 from Microsoft. My friend Tom did it and it really works!
Ruby on Rails Screencast
I don't know anyone respectable who uses AOL so I won't ever be able to find out how this works...
Small potatoes make the steak look bigger.
Do we really want the kind of split-down-the-middle stance on formats that we have to deal with when it comes to DVD burning, VHS vs Betamax, anything like that? No, it only ends up being harmful for everyone in the long run.
I'm reminded of what Microsoft did with IE. All these different DOM objects that aren't part of any standard, which no one can really use because it's not browser-compatible.
Using muscle to force the Internet into a standard isn't going to work. We need something that *is* a standard, rather than *pushing* a standard upon people.
When are companies going to learn?
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
I've had trouble with spammers doing small runs with my domain name on AOL. Since I've set up SPF, I haven't had a single bounce from AOL-bound spam. It might just be luck, but as far as I can tell, SPF is helping.
Here's a nice way. Before someone can send some mail, he has to get some exponent from mersenne.org which needs double-checking, run the primality test and report the low order 64 bits of the final S_{P-2} value, called a residue. If that value matches the value that mersenne.org expects, then the mail goes through.
Nice deterrent for spam, and as a side-effect one more Mersenne exponent has been double-checked.
For once I might actually approve of something AOL does. OK I didn't RTFA but it sure looks a lot like whitelist filtering. Here's hoping that others pick up on this idea if it works out! (my dialup had 530 spams in the last month... thank you, Bayes!)
C|N>K
Seriously. Are you people really getting so much spam every day that the "delete" button just doesn't do it for you?
In short, yes.
Sure I'm libertarian like many other nerds, but I can't think of a good reason to fake email. I want my whitelists to work. A technical solution is always better, though.
-I am an elective eunuch.
Now that this is being backed by AOL, a massively-used service, SPF will be pushed into the forefront, hopefully becoming a more universal standard and dealing a major blow against spam.
This may just be what we've been waiting for.
This is not a whitelist filter.
It's not any kind of a filter.
It just means that AOL has published SPF records for its mail servers in their DNS entries. Any mail server speaking SPF, receiving mail from AOL.COM, will check the SPF record.
If the SPF record (which will contain the IP addresses of AOL's mail servers) doesn't match the originating IP address of the mail message (as in, a spoofed header) the message is invalid. Then it can be either dropped or bounced or whatever.
If the SPF record matches the initiating IP address (as in the case of a message legitimately sent by the mail server) it's clear and goes through.
I suspect that as the big commercial guys get more and more aggressive in breaking email standards in the name of combating spam, the internet will split into different incompatible email groups: the old-fashioned types (which include many university departments still) who use a text console and a program like pine or elm, and the AOL/Hotmail/Yahoo crowd. To some extent it's already happening: I can barely read some messages sent from MS Outlook, they're formatted so badly, and as a result I'm less likely to reply to them.
The biggest weakness of this system is that it doesn't protect against some user's system sitting on a broadband DSL/Modem line that has a Trojan Horse used to e-mail the spam. AOL's system probably would only encourage more viruses/worm designed to make computers email relays.
Of course if all non-business accounts were prevented from hosting an SMTP server that would help solve that problem, but I don't think that would go over very well with the Slashdot crowd. I'm not even sure where I stand on that issue.
Ok, I give up, why you?
What will work is a certification that is revolkable. The concept is embodied in public key encryption and certification.
Basically - all we need to do is this. We have a trusted institution like a bank or your local government office issue a digital ID to everyone who wishes to participate... purely voluntary.
Next - those who wish to participate use an email client that refuses to accept anything from anyone who does not have a valid certificate.
Next - we set up a black hole list and the email clients refuse emails from anyone in the blackhole list.
Next - we make this list available to the issuing authorities and if they re-issue we blackhole that authority.
By doing this we create a beuracratic nightmare for our wanna be spammers and everyone else is pretty much free to go on as they have.
I for one will NOT join an opt in list because there are far to many people who have legitimate reasons to contact me. Yet the spammers? well - there are not that many of them... they are really a fringe group actually.
It works well with them for two primary reasons:
1) It is easy to do. You can go to the SPF site and they have a wizard to fill out so you know exactly how to change your DNS, and
2) You can change things over gradually. After you've changed the DNS, you start by aloowing everyone, and then as more people join the system, you implement the protocol slowly.
That last point is particularly good, since the PHB types freak if their email isn't exactly the way that they're used to... and they also freak when implementing new technologies. You can assure them that nothing is changing at first, and that all changes will be made gradually and in steps.
The SPF guys understand that that's necessary, and even have a PHB Executive Summary page.
libertarianswag.com
Don't forget to publish SPF records for your domain if you have the ability to do so. If you have already done so, please register your domain via the validator.
Prevent email address forgery. Publish SPF records for y
I think the problem is larger than the few annoying emails people get everyday. There's two things to consider.
1) Cummatively, spam is not just a headache but can be resource draining. Getting 10 or so a day for ten days if I don't check email leads to 100 emails. It would be one thing if it affected me but I'm not the only one that uses my mail server or ISP. It bogs down the mail server that I use whether it's my work email or my personal one. At work, my company has to dedicate resources to fight spam which costs companies money. My only effective choice right now is to abandon my email address every year so I don't get spam for a while.
2) Spam is not discrimating. Offers that are sexual in nature may be innocuous to me, but for parents that's another matter. They want their kids to learn email but can't do much to protect them from this content besides not use email.
Well, there's spam egg sausage and spam, that's not got much spam in it.
If anyone could force a change to the current email system (unfortunately), it's AOL. If AOL said that beginning 00:00 next Sunday, mail from hosts without valid SPF records would be rejected, major ISPs and corporations would fall immediately into line. Those running their own SMTP servers would either make SPF records or be forced to use their ISP's smarthost.
Call (206) 338-5780 COLLECT for information about a genuine BA, BS, MA, MS, MBA, or Ph.D.
I would guess my public address gets a hundred spams a day. This would average out to about one every fifteen minutes. I am sitting at my computer all day. Suppose I had the mail client set so an incoming mail has the effect of distracting me, as by say a beep. The effect would be that I am always being distracted from my work. Experimentation shows that even noticing the email counter incrementing distracts me.
I use my inbox as my project list. Everytime I go to my inbox, I would have to delete spam to clean up the inbox, so I could mentally process the project list.
So to me it is worth the $30/year I pay spamcop to filter 99% of the spam out. Thus, I am someone whom spam is costing money.
Um, I thought Bill was going to take care of spam for us?
The _only_ thing I see working that the spam scum will simply never get around is going with whitelisting email address' (much like what Apple's Mail does -- it's not junk if they're in your Address book) -- and authenticating said From: lines with RMX type DNS lookups.
Email!certainly!is!not!what!it!used!to!be
I'd love to bang! a spammer some time -- right up side the head.
The idea behind Internet Mail 2000 is obviously correct. Why waste time on DNS-based approaches when we COULD be developing the Solution?
This presents a problem to those of us who have unreasonably short penises.
Seriously. Are you people really getting so much spam every day that the "delete" button just doesn't do it for you?
Really, now, junk mail is just not that pressing an issue to me. And I can't see why/how it's such a huge issue for anyone else.
Let me explain it to you.
Yes. I personally receive over 5000 spam messages a day. Thanks to the very clever spammers who are getting better at circumventing spam filters, I'm seriously considering moving to a white-list, and even that may not stem the tide. Part of the problem is with false-positives and the fact that people don't know how to write a proper subject line. Sometimes legitimate and very important messages have been contained in messages with subjects and other message body content that can resemble spam.
As a test I have set up e-mail addresses that I have never used or publicized in any way at a number of domains and providers. Guess what? Within days (sometimes hours) spam lands in those mailboxes, too, and based on the user/account names that I set up, I know it's not because of a simple dictionary attack.
Just because you don't personally experience it (consider yourself among the lucky few) doesn't mean that it's not a real problem. FYI, SPF is not (strictly speaking) from AOL. It's just being rolled out on a massive scale by AOL, which should be a good test of the technology.
I don't know if this is the right move, but something has to be done to eradicate this plague and its carriers.
SPF is incredibly broken because it allows ISPs to control who sends mail from where. We should be resisting SPF and all other similar proposals and backing public keys in DNS.
This actually is the case for my wife and I, who still pay for and use our older dialup ISP's email accounts for both professional and personal reasons, but have been connected to the internet 24/7 via cable for the past few years. We cannot send email out through out email provider's mail server unless we dial in and connect to them directly using one of their dialup lines. Thus, we use the mail server provided by our cable provider to send the mail for us. Of course, if ADSL was available in my building, I would simply subscribe to that via my ISP and it wouldn't be an issue, but it's not... so a system like this would seem to render my wife's and my email accounts unusable.
File under 'M' for 'Manic ranting'
It means that any system administrator can configure their mail transfer agent to bin any spam pretending to come from aol.com with a 100% success rate. And this goes for anyone else publishing an SPF record for your domain.
SPF is a proposed standard for a domain owner to tell mailers where mail From: that domain may originate. The domain owner publishes a DNS TXT record for their domain with (at the simplest) list of IP addresses. Participating mail transfer agents can then look this record up and make a policy decision on whether the mail is likely to be legitimate. The presence of an SPF record on a domain at present means that while you still can't be sure when you're handling spam, you can be sure when you have a piece of non-spam because the SPF record tells you so.
SPF is not a wholly original idea (e.g. up "designated mailer protocol"), and certainly not the simplest implementation but the important factor is that its proponent, Meng Wong, is an excellent lobbyer and spokesperson, as well as someone who as the nous to put forward a useful protocol (he founded pobox.com). It's currently at the point where lots of implementation are being written, with the canonical version being Meng's Perl modules. Currently I'm helping to finish the C implementation which will shortly be integrated into qmail and exim.
The tipping point (I hope) will be when a domain not publishing an SPF record or publishing a globaly permissive one will be considered "obviously" untrustworthy. Combining SPF authorisation with a more traditional "From: domain blacklist" will give spammers a very very hard time indeed forging mail. But AOL publishing a record (we hope) shows the way the wind is blowing: the rest of the world does seem to have to change their mail server configuration to keep mail flowing to AOL.
So go on, it's dead easy, publish a record for your domain now. Tell people where your mail comes from. Look, there's even a wizard to help you.
Question on this whole SPF thing.
I'm interested in it but have a slight issue with it at the moment that
I'd like to get resolved.
My domain is: mydomain.com
Customer A is traveling and is using his e-mail of joe@mydomain.com
However, I do IP filtering on my mail server (not SASL AUTH), for my
dial-up pools.
When Customer A is at hotel he must use their mail server to send mail
out, so his mail will be rejected because the hotel mail server isn't
listed in mydomain.com's SPF txt list.
You suggest running SASL AUTH as a work around for this, however in my
experience this creates MORE of a spam problem then not using SPF..
here's why:
On a mail server with over 40,000 users it's relitively easy for someone
with a password cracker to hammer away at common names like 'joe'
'jeffp', etc and try to get some passwords. Once they have a
username/password combo they can happily send e-mail out as that user
through MY mail server, and I can't do anything about them. Doing IP
filtering requires that they are on MY network to send mail through MY
server, thus allowing me to terminate/prosecute/etc the person.
Prevent email address forgery. Publish SPF records for y
We've been waiting for an anti-spam standard for years now. What do we have? Nothing.
It's about time someone with clout got up and started making decisions.
I have 4 blocklist on my email server, and still we get a ton of spam everyday. My users hate it, I hate but we have to deal with it whilst the IETF works out their political agenda.
PS. I've also been waiting for the Calendar Access Protocol for a while now. Years, where is it? We're on draft 11 now.
Sometimes design by commitee plain sucks; and we just have to admit that.
Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
Basically - all we need to do is this. We have a trusted institution like a bank or your local government office issue a digital ID to everyone who wishes to participate... purely voluntary.
1) Banks and government as "trusted"? This sounds like a wonderful way for both of them track every e-mail you send with no problem.
2) "Voluntary" will rapidly become mandatory.
No, for e-mail to remain useful and to ensure that those who need it can have privacy it is important that we develop technology that block the spammers while not further infringing on the privacy of users.
Unless of course the preceding message was a troll.
Three Squirrels
Before looking at SPF you may want to read what Claus Assmann, and Wietse Venema have to say on the subject.
If you don't know who these two people are, I seriously hope you're not someone who's making decisions affecting SMTP on the Internet.
The receiving mail server just asks the originating domain DNS for the list of allowable IP addresses for originating mail. Then it verified the e-mail it just received came from one of the allowable IP addresses.
The problems with Yahoo's Domainkeys, are as follows:
I think SPF is a far better better proposal for this kind of thing.
SPF support for most open source mail servers can be found at libspf2.
The recipient's MTA will check the sender's SPF record. You can auto-generate all the email accounts you'd like, only the domain name portion of the email address is authenticated in SPF.
In fact that was one of the arguments against SPF, people said that it did not go far enough and actually authenticate users.
Personally, as someone who has to administer an email server and whose domains are sometimes used in forgeries for spam ( last one was a few days ago ), I'm all for SPF.
Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
AOL has rate limiting implemented server-side. Try to send too many e-mails at one time and your AOL account gets nuked AUTOMATICALLY by a script. If you're getting spam with @aol.com as the origin, it's forged. This is EXACTLY why AOL is implenting SPF - they're probably sick of being associated with spam they are NOT The origin of!
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
Just stop sending them?
Ok, how about all you potential spammers send $6 to my home address:
123 Fake St.
Springfield, Il
12345
United States of America
and U will $ee many monies! No need to spam again!
Sincerely,
Prince Mobutu of the Nigerian Empire.
Someday, I'll have a real sig.
That's 3 hours 47 minutes. Yeah, I'd say the "delete" button doesn't just do it for me.
So junk mail is not that pressing an issue to you? Would you like to process mine? Pick out the 38 legitimate emails I did get yesterday.
And to get back on to[pic - the idea doesn't come from AOL - they're probably just the largest ISP to pick up implementing the draft idea.
Recycle PCs and build a wireless community network www.hillsborough.org.nz
My Popfile stats since I last reset it just before Christmas:
Inbox - 175
:(
Invoices - 57
Newsletters - 343
Spam - 20231
Accuracy of 98.73%
Yes, 97% of my email is spam
That's across about 5 ISP accounts and a few domains.
How is this any different?
You can work-around either by using VPN or something similar.
If you don't like the way your ISP handles it, complain or switch ISPs, just like you would now. ISPs aren't regulated. And if they were you'd be complaining about something else. Deal with it.
SPF should work very well for the time being, much more effective than any algorithm that looks at a message and tries to determine whether or not it's spam.
I notice that a number of people knocking SPF are looking at it breaking some sort of standard, or that it's an exclusive, it's-the-only-answer technology, ie it's being proposed as a silver bullet.
It's not. SPF just provides one more bit of helpful information -- which IPs email from the sender's domain should really be coming from.
While someone could use SPF in a pure binary decision system that breaks SMTP, it's going to be an incomplete solution. Just like blacklists, whitelists, and bayesian filtering are also incomplete solutions.
However, you start using these things in combination and magic happens.
Example: I use ASSP for server-side spam filtering. ASSP uses bayesian filtering, but also whitelists people you email and uses blacklists.
The blacklist implementation is interesting, however, as when it determines an IP is blacklisted it simply starts off with a higher spam probability in the bayesian stage -- it's not truly blacklisted, just more suspicious.
You could do the same thing with SPF, initially giving a lower spam probability to mailservers with SPF, and when there's more infrastructure using SPF, switching to penalizing non-SPF servers.
Nice thing about this approach: it doesn't require everyone to convert their infrastructure, but it does incentivise legitimate servers to do so without penalty. It doesn't break any standards. Legitimate mail still gets through, but spam suffers.
Stop thinking that all spam solutions have to be single silver bullets. Anti-spam tools can be additive.
One more tool against spam == a good thing.
The spam problem is real, but it doesn't affect everybody.
It is easy to deal with using standard smtp protocol, but the larger ISPs don't seem to wish to implement the existing methods (smtp-auth plus block all emails not originating at an IP that matches an mx record. If you want to run your own mail server, you better get a (sub)domain. simple blacklists and filters).
There is a drive to monetize email as well, and the arguments for this usually begin with "smtp is broken".
Whitelists are a social-engineering product, as this then limits the number of people contacting people for the first time by email, and will greatly shrink the communities formed on the internet to people your company does work with, people you have met and exchanged email addresses with, and people on subscribed mailing lists. This slows the flow of ideas, and it makes it more possible to track who is comunicating with who.
Most of the proposed "anti-spam" tech also includes something in the lines of a centralized database, often in the form of your whitelist being maintained on your ISP's server. This allows easy mapping of the social network, which, IMHO, is not necessarily a good thing.
Many people think that changes such as these are necessary to "save the internet" because they've bought into the idea that the internet is somhow under threat by the very people who built it, and they are ignorant of the fact that it is mostly these "internet saving" ideas that threaten the usefulness of the network, and are more intended to make the internet more like other media (centrally controlled, corporately censored) and less of the decentralized (publishing/communiocation/colaboration) forum that it is today.
New: 2911 Total: 8639
That is from the last 6 weeks. Less than 1% are real messages (domain renewals).
Really, now, junk mail is just not that pressing an issue to me
Oh really, matrophe@sdf.lonestar.org, it's not? I wonder why that is, matrophe@sdf.lonestar.org. Let me tell you something, matrophe@sdf.lonestar.org, sometimes spam starts and you don't know how. It goes like this, matrophe@sdf.lonestar.org: One day you'll check your mail and there will be a single spam e-mail, not addressed to you matrophe@sdf.lonestar.org. Then a week later, it's a couple a day, matrophe@sdf.lonestar.org. And it keeps growing, matrophe@sdf.lonestar.org, until you get a filter like popfile or you just stop using the address matrophe@sdf.lonestar.org.
I hope this cleared it up for you, matrophe@sdf.lonestar.org.
I've read the article and I can't figure out what the test is. Does this mean that AOL is publishing SPF records (in which case it's old news) or does it mean that AOL is going to start rejecting incoming mail which fails the SPF tests?
This is no solution. It stops the load of sending the bodies of spams, but the annoyance of spams still remains.
It also introduces a lot of problems. Unless you just immediately fetch, it tells the sender where you were (IP address) and when at the time you fetch the mail. If the sender's server is down you may not be able to fetch it at all. Response times get slower, again unless we just use this to implement the old pre-send system, in which case we don't get its benefits.
A mixed system (pre-send small mail, post-fetch large or questionable mail) can have some of the benefits but still faces problems. And spam still comes.
The idea behind Internet Mail 2000 [cr.yp.to] is obviously correct. Why waste time on DNS-based approaches when we COULD be developing the Solution?
Because it's not backward compatible.
SPF is a simple and backward compatible solution to email forgeries. People who don't use it are still able to use email, while people who use it are protected against forgeries.
Everyone and their brother are reinvented email theses days without realising that you need to improve the existing email system. It's not possible to throw away the existing system.
I get about 500 spams a week. It gets old, very old. Especially when I use a web interface to check mail while on the road.
I'm very enthusiastic about anything new. The other guys (earthlink, etc) have had absolutely no luck in implementing a real spam solution. I suspect that more money was spent on marketing 'spamblocker' than was spent developing it.
Let's be happy one of the big ISPs have the resources and dedication to, at least, try to slow the spam down. Something has to be done.
Just look how many years it took for these other dolts in the industry to even block port 25 traffic to any SMTP server. So very frustrating to think about.
I don't understand... why can't all email servers just check forward/reverse MX record lookups to help deminish spam. I know that will not end it, but it would drastically help from spoofing email... which is all that AOL's initiative seems to be doing (i.e. not killing it, just preventing their servers from being spoofed).
Oh, yeah, and have the email servers not accepting relays, and patch the damn home user windows boxes. Instead of AOL blocking ADSL, they just need to block windows '95-ME, 2000 pro, and XP. They are all home systems, not servers. Network packets can show OS footprints, so this is doable.
Just more media hype, I'll beleive it when I see it. AOL just has to rebutt microsoft (MSN) from stealing more AOL users with their latest news about anti-spam pledge from Gate's.
Well, in the near-term, SPF won't do anything to slow the quantity of spam. Regardless of what the most die-hard rabid supporters would like everyone to believe.
SPF is an attempt to stop the practice of domain-forging or "joe-jobbing". Which, for a business domain is important. Right now, anyone can pretend to be joe@mycompany.com and either tarnish our company's name, or simply make life extremely difficult for us when our ISP cuts us off for spamming (when we didn't do it).
However, it is likely to have some beneficial side-effects like making domain-based whitelisting/blacklisting more effective. It raises the bar one more notch for a spammer (now they have to either find a non-protected domain to forge, route their spam through authorized servers for a domain where it's likely to be noticed and blocked, or register throw-away domains to push their product).
(And SPF is very similar to what AOL already requires if you want to have your domain whitelisted with them. You're required to list the IP addresses that send outbound e-mail for your domain, anything else gets dumped in the bit-bucket or at least is likely to get tagged as spam by the filters.)
Wolde you bothe eate your cake, and have your cake?
Not true.
AOL's SPF records 'whitelist' their own servers whilst saying nothing about the rest of the net.
This means that mail sent from @aol.com addresses via AOL's servers can be treated as authentic by spam filters, whilst any mail sent by other means is treated exactly the same as before (ie maybe forged, maybe not).
j268wrcnct@valser.es
Hey! that's me! I had a really urgent financial offer for you if you'd help me move some money out of Nigeria!
I really don't think this is going to go very far - primarily because it seems to me that a spammer from say bigisp.com can say he is ANY OTHER CUSTOMER from bigisp.com.
Suppose we have joesixpack as an example - and he has a laptop. At home he connects via his ISP and sends an email to his mom. The letter is received because the from address is valid in his ISP's SPF list. Then he goes to work and tries to send her another email. This time the email will get rejected. So he tries to send it through his ISP's mail server. Since he is not connected to his ISP's system, the email is rejected.
This means that joesixpack has to somehow LOG IN to a server and go through an authentication.
-------
This sort of comes to the nub of the problem. Authentication. If Joesixpack is a good guy - he should be able to send email to anyone - and if he is not a good guy we will find out fairly quicky and we can fine him or pull his priviliges.
The issue is not much different than driving a car actually. It needs to be dealt with in the same way as traffic infractions... perhaps through the police.
One way to implement something that will work is via issuing a certifiation. At the time joesixpack signs up with his ISP - the ISP could act as a CA and certify him as a good guy. They can record his identiy just as they recorded that he paid his bill. At this time they could install a cert for JoeSixpack into his email client - AND - bond it to his machine. There are many ways to bond it - including using a dongle or smartcard. But a practical way would simply bond it to the hard drive. I'm sure ways can be invented so that certs cannot be simply pulled from one machine and stuck into another.
If Joe later abuses his cert - then his ISP can blacklist it and refuse to issue another. Also - the ISP's can trade blacklist information just as banks and businesses trade credit information.
The mail clients can be modified to send the cert and the MTA's could check for and eventually reject any unsigned mail.
As for the ISP's being a trusted CA? Well - we have to trust some people somewhere. The question would really boil down to which ISP's trust which other ISP's and they could cooperatively run their own blacklist.
With a system like this - I would think that an ISP that is shady would find their email services would be in jeopardy of being refused and that should serve to keep the ISP's in line to.
------------
I also think the spamd solution in OpenBSD has a lot of merit. Spamd does not block email. Instead - if the sender is blacklisted - spamd accepts it very very slowly. This creates an incentive for the owner of the mail server sending out the spam to deal with it. With spamd in wide spread usage the problem comes under control in a number of ways.
(1) suzy spammer will find if she runs a spam server that it can't spew very fast - because her IP address and/or domain will end up in the RBL rather quickly and the moment this happens. Receiving MTA's slow to a crawl.
(2) If Suzy spammer tries to send through her ISP's account - the same thing happens but now the ISP has to deal with the problem. No ISP's will want to have a significant number of their IP addresses in an RBL. Since this will pose a significant admin problem - the ISP has a huge incentive to give Suzy spammer the boot.
(3) We have some bad ISP's and these people will find their errant ways are causing themselves grief.
(4) It might encourage ISP's to actually issue static IP's which many of us want anyways. Note we would NOT have nearly the spam problem if static IP addresses were issued.
Seriously. Are you people really getting so much spam every day that the "delete" button just doesn't do it for you?
Yes.
Not to mention that your argument is, of course, the oldest and dumbest of the "doh, I don't wanna see the problem, nanana" kind.
I mean, why should we do something about rape? Nobody I know got raped, so it can't be a huge problem. And seriously, are you being raped so often that just dealing with it doesn't do it for you?
Really, now. Rape is just not thatpressing an issue to me. I can't see why/how it's such a huge issue for anyone else.
Well, sucker, it is. You might be living under a rock or in a box, but essentially everyone dealing with it day-to-day agrees that at least half of the SMTP traffic worldwide is spam. It is a huge problem. If it isn't for you: Be happy, and please step aside while the rest of us go and solve it.
Assorted stuff I do sometimes: Lemuria.org
People assume IM2000 would stop spam because:
1] You don't get a message unless you want to retrieve it
2] The sender has to store the mail not the receiver, so the sender has to pay to store a bajillion messages
This doesn't work because:
1] By seeing the notification, you're already annoyed and have wasted your time.
2] The sender need only store ONE copy of the mail on a customised MTA, not millions - so as long as he has a custom server, he can still spam and use only a few hundre kb of disk space per message type.
3] Retrieval of email would become extremely slow for anyone with large attachments or similar. Connectivity problems would be noticeable to the end user
I've been using a single email address for almost 10 years. I've had 7 or 8 ISPs in that time and I've used this address with all of them. In fact, I've never used many of the email addresses that came with the Internet service I've purchased. I currently use this email address with T-Mobile on my Sidekick, with Optimum Online when sending from home and with whatever tier 2 providers my place of business has used for their multiple T-1s.
If SPF takes off, it looks like I'm going to have to switch to an email address on a domain I own just so that I can code an SPF record that will allow me to do exactly what I've been doing since late 1994 -- sending email from various devices. With luck, I'll be able to automate the process of adding a new SMTP server for when I stay in a hotel and use their IP services.
I hardly call this a step forward.
I have discovered a truly marvelous sig, unfortunately the sig limit is too small to contain i