Slashdot Mirror
AOL Blocking Spammers' Web Sites
Nuclear Elephant writes "According to this article, AOL has decided to take a fresh approach to fighting spam and is now blocking the spammer's web address. The philosophy is, if the customers can't visit spammers sites, spammers will not be able to make any money. On a side note, I suggested this concept about six months ago but nobody thought ISPs would adopt it. Now perhaps we can get a group like NANOG interested in sponsoring a blacklist for spammer addresses?"
I don't know, whether this is such a brilliant idea - if this gets widely adopted it can't be long before some idiot will get the idea of paying for a spam to "advertise" one of his competitors just to get HIS site blocked...
I see loads of abuse potential here... While AOL might be smart enough not to block sites like microsoft.com or ebay.com if they showed up in a spam, it could be a knock-out blow to relatively
small and medium (and hence little known) companies on the web.
-------------
From: baduser@aol.com
To: gooduser@aol.com
Subject: Look At My Porn
Come look at my naked (sister|mother|wife|daughter) on her web cam doing all kinds of nasty things.
http://www.sco.com
--------------
AOL , making DoS even easier.
Serious? Seriousness is well above my pay grade.
I've been doing this for the past year. Every so often I get a call from a user that needs to get to a sight that is associated with a spammer. For example, a local television station's site is hosted on the same machine as a spammer's site. I got calls from users wanting to visit that station's site so I had to unblock it. This is a never-ending job since spammers many time host their "web sites" on virus-infected broadband home PCs. Since I only have to work with 1000 or so users, it's not a big deal. If I had billions like AOL. Gads. I'd rather not think about it. And that's not taking into account those people that truly want to visit the spammer's sites. Who is AOL to deny them the ability to go to the websites they want.
There are just too many pitfalls in this. I don't think all large ISPs will go this route.
But why is the rum gone?
It would be better if instead of completely blocking the page, it re-directed to a page saying that this site is implicated in spamming, but with a link to the real page. Would mimimize impact to falsly accused sites.
that with the negative backlash, some legal, that has occured against blacklist maintainters of all sorts (causing the SPEWS mainttainers to go anon), the fine people at NANOG will be smart enough to leave it alone. Not to say that some motivated members might not do it, but NANOG ain'ta gonna touch it.
Wow, this means I can take down other people's web sites by putting them into a message and spamming AOL users with it. Cool!
I'll start with Microsoft, move on to SCO...
--G
One, two, three, even four errors in that email! No exclemation points, no use of the _word_ "u" (like "c u therr". I mean, come on you even capitalized the first letter, what kind of AOL user would do that?? Really, you should really look into improving your writing techneques.
The company I'm working for provides free web service ( http://www.skymail.fr ).
:
This kind of service frequently gets abused by spammers. Two they abuse it
1) they open an account, just to have a valid address in order to bypass basic spam filters. Then, they send their spam through other servers using this address as the sender.
2) they use scripts to send spam through the service, as any regular user would. This is extremely annoying.
For 1) we publish SPF for all domains we send mail from. Now, it's up to people to enable SPF on their mail servers.
For 2) we filter _all_ packets coming from China, Korea, Nigeria and addresses listed in Spews and Spamhaus databases. That's about 13000+ filtered networks. Thanks to OpenBSD packet filter, it's trivial to set up and it doesn't introduce any slowdown.
{{.sig}}
see loads of abuse potential here... While AOL might be smart enough not to block sites like microsoft.com or ebay.com if they showed up in a spam, it could be a knock-out blow to relatively small and medium (and hence little known) companies on the web.m ).
Yeah, definitely. It would be great if anyone a better anti-spam protocal was adopted by all companies. Hell, I'd even be happy with M$s idea (http://news.bbc.co.uk/2/hi/technology/3324883.st
If the idea of having a blocklist for spammer's websites gets accepted, how long will it take before other sites are added to this list? Websites defending unpopular political views? Websites with supposed DMCA-infringing material?
Note that AOL is in full control here: they define what is wrong, who is wrong and in which ways the website should be blocked.
Surely I should be able to visit any website I want?
Oh yea, lets all block websites so the idiots can't get spam sent to them. God forbid we taught them not to be idiots. Hell lets put them all on Linux, then they won't even be able to find the "Interweb explored" icon and we'll never have to deal with them again... or package forks with a microsoft logo and tell them to insert into a plug socket... either way we win..
--- [Insert intresting Sig here]
- it were proven that the owners of the website commsioned the spam
- it were bulk UCE
- UCE were considered illegal in the jurisdiction of the website owners
Even if it was morally justfied, I can see legal problems in many jurisdictions for ISP's censoring the Internet. Of course, AOL are not an ISP but an online service provider -- they don't actually say they will give any user any Internet access at all -- so they might get away with it.Joe Llywelyn Griffith Blakesley
[This post is in the public domain (copyright-free) unless otherwise stated]
These are the same concerns people are having with FFB (Filters that Fight Back) which are capable of creating massive DoS's against a spammer, but don't really affect anyone else. I think blocking is certainly a step in the right direction, as it conserves bandwidth rather than consume it. AOL will definitely have to keep on their toes to make sure a legitimate website isn't blocked. Some of this can be automated, though - every time it thinks about blocking a website, crawl the site and perform the same type of language classification on it that you would a spam. The website should be even spammier than the email in most cases, or at least provide enough information to classify it as a spammy website. If it doesn't, throw up a red flag and let someone manually review it (or just drop it completely). The great thing about this function is that it not only blocks the spammer's method of contact, but it also makes it much more difficult for a spammer to move around. It's easy to use a different IP to send the spams, but to change your website every day or two is a bit more time consuming, and hopefully will exhaust spammers.
I've got mixed feelings about that.
First of all, are all spammers bad? I mean, there ARE some people that buy crap advertised in spam. And is it all bad, or a ripoff? There was an link on Fark a week ago to an article about some guy that actually looks forwards to receiving spam, and had bought a lot of things from spam mails. Weird things, like a carpet cleaner, but things.
On the other hand, do people want AOL to shelter them from the web, from the real world? I can't mail some friends on another ISP because their ISP has blacklisted Roadrunner Email. We already have a government 'sheltering' us from things, such as the real truth behind assassinations, aliens, and the disappearance of Elvis.
Finally, the more things AOL blocks, the more reason for people to take the red pill, wake up to the monopoly, and get on a real ISP. Then those stupid CDs will stop showing up in my mailbox.
I want to see the web, the whole web, the whole glorious ugly sex-ridden spam-filled seething mass of crap, and naught else.
I have commented several toimes about a need for providers of internet services to take more care of their customers
AOL is a family ISP - most techies wouldn't use it as it doesn't provide what we want, but all those kids surfing on it deserve to be protected from the people who target them with spam
It's been demonstrated over and over that there are enough people out there willing to buy from spammers to make it a highly profitable industry, but that most of those profits come from taking payment by fraud and never supplying the goods
I would not use an ISP that did this, but the marvel of free will means I don't have to. For AOL's target market (largely clueless and wanting an all-in-one service to supply services and protect them) this is the right action.
One final recommendation to AOL
Please supply the latest Windows service pack and the latest Internet Explorer update patches on your CDs and make them a prerequisite to going online. Microsoft would love you to do this, techies would love it too and it would close down a lot of spam relays by closing the holes.
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
-- most local TV stations have investigative reporters who report on consumer fraud, etc. Seems like in this situation they would have jumped at the chance to expose the spammer and switch hosts. It could have been a major coup for them and your other customers handled that way... perhaps. You might have picked up some more traffic your way too, free TV advertising as the ISP that cares, etc....
zogger
Now, if only my webhost would have a way to prevent people from forging email to appears as if it originated from my domain... ...great fun for someone who makes his money selling art and shirts through his website, nobody on AOL will be able to visit my site because some spammer forger email.
Machine9dotNet
At least to some extent, they've been rejecting mail that contains urls believed to be connected with spam. This can be mail from domains that aren't otherwise blocked by their filters. I forget the exact text I saw in their bounce message. A user at ISP where I work NOC had complained of not being able to send mail to an aol address. I could see she was trying to forward a spamish mail she had received to her aol-using friend (gee, what are friends for, if not to share spam); my recollection months later is fuzzy, but it was clear from the body of the rejected mail and the aol bounce did specifically mention that it was rejected on the basis of the url contained in the mail.
But the idea is to force the spammers out of business by taking away the small fraction of customers that they get from sending out their spam. If you just have an intermediate page saying this website is involved in spam, all you're doing is putting one more mouse click between the customer and the website. Remember, these are people that *want* to visit the spammers site that are being blocked.
IMHO, even though it is all for a good cause, once you start blocking websites "for the good of the internet" it's a slippery slope to full-on censorship.
On this last condition I disagree. Don't confuse legality with morality.
- First they ignore you, then they laugh at you, then ???, then profit.
Why not build this capability into browsers? Follow the cookies handling model.
Make it optional, stick it in "preferences", stock it with an initial list of spam sites, and give the user the ability to add additional sites, delete sites, and select/deselect the block.
-- Slashdot: When Public Access TV Says "No"
Instead of simply blocking the connection, AOL could redirect the visitor to a special error page, explaining that the page was blocked for spam reasons and offering an override if the user really wants to see it.
After reading through a page explaining that it is a spam site and that the user might be tracked and harrassed further by those companies for giving them a visit, I'm sure most of them would not click through.
Those masochists looking forward to buying spam and actively supporting these scum could just click "Yes, I really want to see this page" and everyone would be happy. Right?
I didn't know they were filtering spamvertized sites but I know they block some mails based on content, specifically URLs they may contain; some emails to AOL got rejected because of this, and their smtp returns
reason: 554-: (HVU:B1) The URL contained in your email to AOL members has generated a high volume of complaints.
The URL in question was http://someplace.(can't remember).solmedia.com which doesn't sound like a spamgang operation to me..
have you been defaced today?
So, does this include sites that have 'dynamic' IP addresses as well? Currently they consider a lot of web hosts as having dynamic IP addresses, and force them to have to get on a whitelist (which I might add, is nearlly impossible). Does this mean now, not only will AOL users not be able to sign up for anything that requires an e-mail on my site, but that they'll now not be able to view it at all?
I sure hope it's just spammers they've blacklisted, rather than a comibnation of a blacklist, and whitelist. I can certainly see the possibility of this being even more of a problem than one would think.
We have problems with being on spam filts at my church. Aparently some other costomers on the hosts server are spammers and mail from the server is blocked from several local isps. If they use those dumb blacklists I would imagine these same isp's would block our websites too.
People say my sig is the best thing about me.
AOL is not an ISP, it is a Web Provider !
re-directed to a page saying that this site is implicated in spamming, but with a link to the real page
:)
A notice like "we know who you are, pervert, and we're going to tell your mom" will surely help to reduce even more the number of clicks.
Anyway, excellent idea ripnet, even without my modest contibution.
The problem with spam-filtering schemes is what about people like this to whom there is no unwanted email?
It's really not fair to those customers. This is why filtering has to be controlled by the user and nobody else should make the decisions.
http://slashdot.org/comments.pl?sid=97313&cid=8317 030
All a spammer has to do is send spam on the behalf of companies that are not their customers and there would be no way to know which merchants should be prosecuted. Spammers muddy the water as much as possible - that is their entire means of survival.
Dan East
Better known as 318230.
Why is it that the companies selling these products are even allowed to continue to operate anyway? Most of them seem to be pharmaceutical suppliers and are based in the US. Further they often sell what are classed as Schedule 4 drugs in Australia (must be sold by a licensed pharmacist by doctor prescription only). Does not the US FDA have similoar powers to shut these operators down? If we could stop the shady operators from selling this stuff (and I can't see how they operate legally) there would be no spam.
Let's all just block AOL. Eliminating all of the stupid users that "support" the spammers. That should solve the problem (and many others), quite fast.
I've already had one of my competaters complain about me (unjustly) and now I'm blocked and I can't send email to aol customers. This is the first major step in isolating aol customers from non aol parts of the internet, watch how this turns out they will start "filtering" in a big way now.
"It's so convenient to have a system where everyone is a criminal" - A. Hitler
I run my own mail server, and I've had tremendous problems with spam, all originating from, you guessed it, AOL. Maybe they should clean up their own act?
Many have already noted the comments where a DDOS may be launched via sending out spam in order to deliberately draw the attention of IP blocking filters, but at the same time, it is also worth noting that many web servers have multiple domains on one IP address using both virtual directories and virtual domains. In fact, almost every ISP does this, in order to give their users a place to oput Mom and Dad's pictures with the kids, etc.
So, if implemented uninteliigently, filtering by ISPs would simply p/o their own customers. All script-kiddie John has to do is get an account on say, Earthlink, put his little target V-iagra content there and then use an SMTP mailer to draw the attention of Earthlink's own IP blocker after his mails rattle along the 'net.
Sure, they'd clean it up pretty quick, and then unblock, but do you really think that Mr. and Mrs. Non-Techie User are going to be so understanding while their fabulous portraits of their kids are intermittently available as this little war plays itself over and over again? I think not. Grandma is even less technical than them and just can't understand why her AOL dialup can't open the web site where they were just yesterday.
That said, the spam content IP blocking idea has merit, but it's not going to be as simple as merely blocking an IP address. It's probably going to have to be quite smart, smarter than both spammers AND script-kiddies in order to work and thus be accepted. I say the technology merits study but is not ready for prime-time.
This is real funny. I've been trying to install some new sendmail milter programs on my mail server in an attempt to cut down on the amount of spam I receive. As a result, I've been taking a closer look at my mail logs.
I'm getting a lot of mail addressed to accounts that don't exist from systems with names like omr-m14.mx.aol.com. Are these legitimate MTAs or open relays?
If AOL wants to cut down on SPAM, they should start with what gets sent by their servers.
On a side note, I suggested this concept about six months ago but nobody thought ISPs would adopt it.
Somehow it doesn't surprise me... People tend to underestimate by an order of magnitue the rate of adoption/success of out of the box ideas.
That would be great if people were to actually read and understand the intermediate page. However, most of the people browsing the World Wide Web won't take the time to read the explanation. They're just going to click the 'click here' link.
Perhaps slap one of those 'text in image' verifications and have the text read 'I love spam'?
-- Stu
/. ID under 2,000. I feel old now.
Sorry to burst everyone's bubble but spam-free ISP has become a virtual oxymoron. When you have leased lines, colo and hosting services spam happens. If it's one of our customers they certainly do have some 'splaining to do when we get a spam complaint implicating them and we will axe accounts for ToS violations. Typically, a spammer may be a customer of a customer of a customer. Whack a spammer today and whack another one tomorrow, but the spam just keeps on coming. And it's a constant chore for the admins getting IPs removed from various hair trigger blacklists. And no, we will not pay the $50 blackmail donation to charity that sorbs demands for removal of that one IP that got snagged once (and only once) by their spamtrap addy.
You also need to flood the sites with bogus orders for their product and queries for information.
Use your head, can't you, use your head,
You're on earth, there's no cure for that - S. Beckett
most ISPs use transparent HTTP proxies these days, which should make it easy to block on the basis of a URL, not an IP address.
The height of strange lack of clue was last week when a South American ISP applied spam filtering to their outgoing email. Everyone still got the spam, but with added headers saying exactly how spammy is was. (Gee, thanks! :^)
One line blog. I hear that they're called Twitters now.
Doesn't anyone else remeber a few years back when AOL decided that anyone running a mailserver program through a cable or DSL modem must either be a spammer or somone infected with a spambot, so they just blocked all mail revieved from any broadband user. I took me weeks to figure out how to get around that, and now I no longer can run my own mail server. I have to route it through roadrunners mail service where they get to filter whatever they like. This created a big hassle for a lot of people, for what. Show of hands; How many people still get spam? This is censorship, and AOL has already proven that they don't care who it creates problems for or if it works.
It doesn't take a lot of foresight to imagine the day when the political interests can persuade AOL to block other "undesirable" sites. Technically, it's not censorship because AOL has supposedly done it voluntarily; just like Clear Channel has "voluntarily" removed Howard Stern from their radion stations.
---Technology will liberate us if it doesn't enslave us first.
Thats stupid, you cant just go around blocking your customers from sites for their own good! at the very least give a customer the option to turn off blocking for their account if they ask, but put it on by default. The entire point of the internet is lost if you block anything - unless you're specifically blocking something for a technical reason. IMHO any ISP that doesnt allow blocking disabled on a specific account is probably just being very very lazy and not giving you your moneys worth,
This comment does not represent the views or opinions of the user.
AOL recently identified me as a spammer and blocked all future email from me to my friend in Paris, following a fairly rapid exchange of emails between us concerning tickets for a newly announced gig that I knew she would love to go to, but were not visible to her for some reason. Presumably because the emails all centred around 'tickets', AOL severed our communications. She is the onl AOL customer I contact by email, and then infrequently. If this is a measure of their accuracy in identifying spammers, God help us all
The idea is the web site hoster is doing the spaming. The way this works in the real world is the idot that is tring to sell something talks to some spamers who convince them that its an op-in list and pays like $5000 to send his crafted message out. Of course the "demo" shows about one hit in 30 so its got to be good right? The real world is the spamer takes the cash from some moron and then may spam a different product. by that time the person paying is out of the loop an the rest of us pay.
The only solution to spamers is jail or a clue by 4 to the brain.
This idea will work. It seems like a good idea.. except
.. we sort of expect them to be a custom online service that happens to nowadays use the internet heavily.... I suppose that's somewhat acceptable. But if joe average dialup ISP starts fucking with my packets.... watch out
I do not want my ISP to decide what web pages I am allowed to view. They are not there to control my internet access. Ideally we want ISPs to simply re-sell INTERNET connections, period.. or we enter a slippery slope.
If AOL does it.. well.. aol is not *exactly* and ISP
"Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety."
~Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the
governor, November 11, 1755
The problem with AOL is they make it too easy to get their customer's email addresses. If you have an AOL account, you have access to seeing everybody else's screenname which is a great security risk. When I had an AOL account, I had more spam then I've ever had with any other account.
Howard Stern had few problems with Clear Channel Radio about his raunchy material until he started criticizing President Bush.
If Clear Channel Radio was in the internet business, most likely they would use their website censorship power to block Howard Stern's site, any webcasts he would make, anything critical of them, or their political allies - the Bushes, in the name of 'decency', as well as blocking the spam sites.
Censorship of any kind is a very slippery slope. At the very least, AOL should make the website censorship voluntary and have an off switch.
Unless blocked sites were to be regulated by a non-commercial entity, it is inherintly biased.
I believe we need to fix things so that
A: people who want spam can receive it without bugging the rest of us and
B: we need to eliminate fake headers.
The first item could be accomplished by adding a bulk mail preferences line to SMTP i.e.
the second one can be accomplished via SPF or a similar scheme.
Coding Blog
There's at least two serious problems with such unilateral approaches by any "authority" rather than the recipient. What's spam to you may be ham to me and vice versa. Additionally, it opens a rather insidious door: if someone rather than you is the gatekeeper of your mail, then there is always the possibility that they can be influenced (usually by monetary means) to let mail through that you'd consider spam (User: "Why am I getting these unwanted ads? This is spam" Authority: "Oh? We'd never have thought our users would consider such an upstanding member of the business community a spammer." User: "That's not the point. I don't want this mail". Authority: "Tough. Read the terms of your contract with us. We get to decide." ...) This is =not= a good idea in my book.
Of course, if we'd get people properly educated about the use and effectiveness of Bayesian Content Filtering, such actions by "authorities" would be totally irrelevant since BCF can solve the problem without such negative consequences.
Agreed, this is a clear conflict of interest. Even though I could legally and technically block HTTP traffic between spammer websites and our university network, I wouldn't feel comfortable doing so, precisely because those most likely to complain about it would not be the spammers (or those unfortunate enough to share their web server with a spammer), but rather my own colleagues. And, they would complain to me, rather than to the spammer's ISP.
I'm all for public blacklists, and I keep using those to protect my own mailboxes from inbound junk. If somebody wants to send me mail, I'm justified in asking that person not to pay money to (or otherwise support) the ISP of a spammer. Likewise if they want to access my web pages, though I haven't implemented a blacklist check for those yet.
However, when I prevent my friends and colleagues from viewing somebody else's website just because that website shares hardware with a spammer, things are getting real tricky, because I'm interfering with traffic that doesn't necessarily benefit the spammer or his ISP anyway, and the only ones hurt by it are my friends and colleagues. This is clearly not desirable.
I admit that it makes a little more sense for AOL to do this, given their millions of users who supposedly don't know what's in their own best interest, but I wouldn't want to be a customer of such a company, nor would I want to work for it.
It's really not hard to tell which sites are which in a spam run. It's easy to tell which sites are under the direct control of the spammers and which sites simply being used for image harvesting. It's really quite easy. As a person that actually investigates spam I know that what wins in the end is information. Archives of news.admin.net-abuse.* are invaluable to the fight. There's nothing like comparing your own spam to thousands of others' around the world. If you come across a spam that is simply questionable then you simply don't blacklist it. You log it of course because odds are it does belong to a spammer. You'll eventually have the proof you need to justify it. I do this all the time with my personal blacklist of domains and netblocks. I'm well over 15,000 entries strong so it must work. :)
And what was AOL's reaction when you complained? You did submit a complaint, right?
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
In Russia most ISPs, including the largest hosting providers, routinly close websites belonging to spammers (repeat offenders) for a few years already. So far this has not been abused, suggesting, it might work equally well on the American and even global scale too.
Future Wiki -- If you don't think about the future, you cannot have one.
What about Joe-jobs? What about innocent advertisers? What about them? They're collateral damage. So sorry, flowers to the family, but the war takes priority.
I'd like to preface what I'm about to say with how "Once upon a time" I despised AOL as a provider of Internet Services, not necessarily for personal reasons but based on the type of clientele they were bringing to the Internet in their early days as an ISP. Over the last couple years the economic climate has forced them to change in a lot of interesting ways to make their customers happy (redacting pop-up advertising, political and technological inroads to fighting spam, etc). In doing so they have (perhaps unwittingly) become better "'net neighbors". I'm happy they have done this, for whatever the reason, and the enemy of my enemy, and all that, etc.
Notwithstanding there are some obvious potential problems with this idea. Not that they can't be ironed out. The idea itself is wonderful because instead of taking money directly out of the spammers' pocket(s), their source of income is being strained even thinner than it already is, such as from filtering.
Technologically it seems problemistic, if the blocking is done on an URL basis it's easy enough for the spammer to morph each URL so filtering becomes difficult (and in many cases they do already). If the filtering is done on an IP basis then there are many interesting problems that appear, namely round-robin DNS switching by the spammer, virtual hosting spam content on free web hosting providers, like Yahoo! and geocities. Blocking access to all of Yahoo! and Geocities would make a lot of their customers unhappy.
Also, at times it's necessary for some customers to have access to the spammers' systems. I like to nmap the spammers' web servers now and then to see if I can help out with a free "security audit" that they indirectly agreed to when they spammed me. An AOL customer that does research on spam, engages in anti-spam activities, maintains their own filtering, etc, all of this type of research or activity could be stifled by filtering. In this manner the article is correct about the filtering being paternalistic--however all they should need to do to address this is allow their customers (forgive the expression) to opt-out of the service completely.
Perhaps rather than dealing with each individual spam, on an incident-by-incident basis they should adopt SOME of the methodologies that SPEWS used. One of the positive benefits of SPEWS was that it only made blocking possible (note that I did not say performed any blocking itself) of providers that refused to deal with their spamming customers. Soul-sucking ROKSO-listed spam hosters like UUnet, C&W, XO, Cogent and Chinanet would start to reconsider their spam-support and pink contract services if more providers started to take filtering on an all out basis (not just HTTP, not just SMTP, DENY traffic -- refuse to share the Internet completely). In this way the purveyor's of spam could enjoy their own private Intranet, all while their legitimate customers could be moved to NSPs or ISPs that refused to take dirty money and were good net neighbors.
It's true no man is an island, but if you take a bunch of dead guys and tie 'em together, they make a good raft.
Oh wow, you suggested it SIX MONTHS AGO! What a great idea you had, because nobody has ever done that before.
The same story was on Slashdot; go search for it and you'll find it. Several people pointed out something that the journalist missed: the guy interviewed is himself a spammer. And remember, the first rule of spam is:
He was just another lying scumbag criminal trying to get some free positive publicity. The reporter fell for it.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
All the spammer has to do is instruct is zombie army to infect all victims machines with some kind of anonymous proxy redirection thing-a-ma-jig ....
---- "Logoff! That cookie shit makes me nervous!" - A. Soprano
I even emailed Carl Hutzler, Director of Anti-spam at AOL, and he hasn't returned my emails or my calls. The same goes for the hundreds of thousands of spams we get from *.verizon.net, comcast.net, voyager.net, compaq.com, and others. Clearly people inside the business infrastructure have infected systems propagating spam on the weekends, using the corporate bandwidth to do it.
At this point, this is what I do:
So far, the more I block, the faster the spam comes in, and the more I block, ad nauseum.
Here is today's counts. At 5:30am, this was 164 hosts, and now it is 109 more than that.
Spam is definately getting worse, as more and more machines are hijacked for the purposes of propagating it, with these trojans.
The more I block, the more incoming spam we get.
With all the annoying warnings that users have learned to bypass without reading, will another warning really matter?
Really, it's just a game of motivation where the user is expected to press the right button to see the requested webpage as quickly as possible. "Check this box if you don't want to see this warning in the future."
Just like tagging e-mail as spam before passing it on to the recipient minimizes impact on legit mail? Impact? What impact?
I think AOL has made an unwise decision, not because of collateral damage to wrongly listed sites, but in a not-caring-what-the-users-want kind of way. If AOL had a million users asking for this feature, eager to send informed complaints to the blacklisted website operators to encourage them to kick out the spammers, then this may have some effect. AOL saying "Our customers will no longer have the freedom to read your advertising" isn't likely to be noticed by anybody with any influence here.
Some crackpot AOLer will sue them for blocking a site he wants to buy crap from. Then the Crap-Merchant will sue them under some Federal law or other. And win or lose, the attention it brings will bring out the politicians(shudder).
Since this only affects AOL members at this point, I say "Hooray for AOL!"
But how long until AOL blocks ALL of the traffic on their network - whether it originates from one of their members or from somewhere else - to these sites?
How will non-AOL members like it when they are blocked? First they will complain to their own ISP, and maybe AOL directly, then their ISP might complain to AOL, loudly, then here come the Feds to start "regulating" the internet. This is going to eventually lead to no good.
We all know that there are a lot of people, in the government and outside of it, that want to see stronger federal regulation of the internet. This will be the excuse they use to pass strict "Patriot Act" style regulation. "Hey, we just want to stop spam, and, uh, viruses too...yeah,
Flash is the Herpes of the Internet.
your.opinion >
Uh...
Isn't this what a subscription to the MAPS RBL via multihop BGP used to do back in '98? I used to use it before they started charging an arm and a leg, and it worked well. Protected the whole organization too, not just the mail servers configured for it.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
I'm not sure that relying on spammers to follow voluntary rules is workable. (Actually, I'm sure that it's not workable.)
how to invest, a novice's guide
Lets only talk about the financially motivated spammers, and assume the spam with virus/trojans is outside the scope here.
What if someone (I?) wrote a file scrape function that tested as != to a whitelist of people I know (or even == a blacklist), and then I launch as many requests as my CPU could handle for the file included in the spam. The file would be immediately dumped in /dev/null and a new request for the same file would kick off the next time the CPU was idle (this way I can still look at my p0rn unaffected). It's not really a DOS, because I'm in effect doing exactly what they wanted: Downloading the file they tagged in their HTML mail. If I shared this code with a few thousand of my closest friends :) wouldn't this negate the business model of .5% responding? Because a number approaching 99.95% might start eating bandwidth.
This same program would drop files as they reached a high percentage of 404 responses.
I'm learning C++ and know a little PHP/Perl, so this would be a good project between classes. I'm curious though, what the arguments would be against this.
John
AOL has become more informative recently, and I appreciate them letting us know where their servers are, but that doesn't solve the problem.
In my opinion, rejecting a legitimate bounce may actually be worse than rejecting ordinary legit mail, because in the latter case the sender will receive a message telling him his message didn't make it, and hopefully what can be done to solve the problem. Rejecting a legit bounce means someone will not be informed that their message was lost in transit.
The only situation when I find it ok to reject bounces is when I want to get the attention of the remote postmaster: "You have a problem, please fix ASAP!"
AOL has such a problem (accepting billions of junk mail messages only to bounce them back to victims of address forgery), but do you think they will do something about it just because I decide to reject their bounces? If we can agree to put those mail servers on a public blacklist, I'll be happy to employ said blacklist, but only for the purpose of shouting in AOL's ears.
There is no one solution to spam. Both of my suggestions above improve the current mail system and make it more usable for people.
The voluntary rules system removes the spammer argument that making spam illegal violates their free speech and that the ISP should not be blocking their attempts to communicate with the end users based on the content of the e-mail. And they are right. Why should an ISP be burdened with determining what messages their end users should or should not get?
If an end user wishes to receive these messages they should be able to express their consent to do so.
Some spammers may continue to abuse the system but they will no longer have any excuses to do so and lawsuits against them will be that much stronger.
Coding Blog
Get me a blacklist and I will add it now!!! :). I'm no ISP but it would be nice for my work and if that trend caught on I can assure you the spammers would get pissed.
I didn't use the preview button, so get over it!!!!
Mike
Now perhaps we can get a group like NANOG interested in sponsoring a blacklist for spammer addresses?
That is such a bad idea. It's already bad enough that these stupid ORBs blacklists, and ones used by AOL, rr.com, and a bunch of ther major sites blacklist my IP *just because* it's on 24.0.0.0/8, they don't look at the fact I have a static IP, and say it's in their "broadband" block.
What, now they're going to start blocking my *websites* too just because I'm on a cable netblock?
Wow. What a novel idea, what happened to this free speech crap?
Free means no restrictions, ironic the FSF's GPL forces restrictions, isn't it? What's your definition of free?
Any censorship is bad.
If it starts with this where does it end ??
Hosts DOS YOU !
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
I agree on principle that this is the wrong way to do this but also offer a compromise;
;-p
Give people an informed choice. Tell them that the website they are attempting to access has been identified as a security risk/spam house/pron site/etc then let them decide if they want to continue.
It is just as open to abuse but it also seems like it would fail gracefully in the event that the site is not a problem or that as an individual you don't have a problem with it's content.
Go one step further and allow the browser or your account to keep a white list of bookmarks which pass you straight through to the site... just set a cookie or similar.
The end result is that you give people a community knowledge-based opinion about the content of a site, then you give them the choice of whether they want to go with the crowd or go their own way and you make it convenient for them to go their own way from then on.
Many tools already do this with filtering for Ads... just extend it to apply to entire sites and return the bookmark option page instead and if you are AOL you can hook it up to your community database of opinions... "mod this site up, it has 'original' pron... not just the same set of crappy old pics"
A fool throws a stone into a well and a thousand sages can not remove it.
Our Univeristy has been spammed by Pizza Shuttle /etc/password
a number of times. Some inside person gets a
copy of all of the accounts in
and then they get sent ads mentioning Pizza
Shuttles website. I suggested to NOC that we
null route the address used by that website
until Pizza Shuttle cuts it out. It wouldn't
be too hard for them to run an opt in list
instead. But the NOC guys didn't go for it.
If my ISP adopted this technique it would make no difference anyway. 90% of my spam is so badly formed I can't get to their host sites anyway.
Even from a spammer's point of view my spam is worthless.
--Richard
Unfortunately, this IS censorship. If you block a website that a person wants to go to because YOU don't like its content, that's simply censorship. There's a HUGE difference in blocking websites, because now, you are intentionally blocking customer initiated transactions...
Even though you'd have to be an idiot to buy from spammers, and their websites are wastes of space to 90% of the population, that doesn't make it a good thing to deny access.
One aspect I really like about this is that it hurts the people behind the spammers. Because if you do spam-vertize your site, people will get blocked from it *EVEN IF THEY DIDN'T GET THE SPAM!* You could potentially *LOSE* business by spamming!
Obviously, this could be abused by spammers to hurt their competitors, but the upside is REALLY attractive to me. Maybe AOL could make it block sites slightly less than half the time, so that spamming for your competitor would help them, but spamming your own site is now half as effective as before -- still worth doing.
If you open your mind too wide, people will throw trash in it.
Up until recently, the EFF has been doing a decent job protecting consumers. But after reading this, it seems that the EFF has fallen off the deep end. Getting into bed with spammers is inexcusable. Spam doesn't reach the level of fraud? Really? Fake Viagra? Fake Vicoden? Other fake prescription drugs? Counterfeit or pirated software? Not fraud?
We had a problem some years ago with judges handing out slap on the wrist sentences, letting repeat criminals walk in just a couple of years for crimes as serious as murder. After enough controversy, and enough people getting killed by paroled and probationary criminals, we ended up with sentencing guidelines for judges, and three strikes laws. Now it seems that the EFF has bedded down with fraudsters and hucksters, and decided to fight for slap-on-the-wrist penalties, instead of sentences of a few years to try to slow down spam.
Keeping Congress and the Judiciary informed and educated on technology issues is a good thing. Protecting, defending, and lobbying for non-penalties, and lobbying against jail sentences for professional spammers is outrageous.
The EFF has made a serious mistake in lobbying to protect spammers. They need to fix this now.
Even if it's just a spammer website, that doesn't mean I'd want AOL blocking it (if i USED AOL). I'd still want a user level option not to block the website. Not convinced? Remember how the web filters (proposed for public libraries), and some "child safe" web filters took out all kinds of stuff that shouldn't have been filtered.
I'm more concerned about some titan corporation unilaterally deciding which websites i can't visit than about getting some spam.
There is a third option: Mark the website as a spammer in search results. At that point the user can rationally choose whether or not to divulge personal information, but isn't outright forbidden from accessing it.
"Forgive us our trespasses, as we forgive those who trespass against us." -Jesus Christ The Lord's Prayer
It will take no time until spammers will send lots of spam pointing to a fake web-site which name will be resolved to the same IP addresses as www.AOL.com or/and just pointing to www.aol.com
And in fact, having www.aol.com in that blacklist will be very reasonale - they are still sending lots of CDs to everyone making themselves as the biggest spammer in USA.
Less is more !
"There was an link on Fark a week ago to an article about some guy that actually looks forwards to receiving spam, and had bought a lot of things from spam mails."
Go back and read the discussion. That guy was a scammer. He may or may not have actually bought stuff from spam, but he was *definitely* involved in a MLM like scam on his web site. He also had sent spam in the past.
The fact that people sometimes buy things advertised in spam does not validate what spammers do. Spam is like making a collect phone call that always goes through to pitch their wares. Regardless of whether the product does what it says or not, this is not how I want to be contacted. If you really want to receive such things, get yourself an 800 line.
That said, there are legitimate reasons why people might like reading advertising in their email. Those people should be able to do so. This can be done now, although it puts some burden on the senders to continually validate themselves to the receiving ISP (for the big ones like Yahoo, they accept mailing list traffic but struggle over it being solicited vs. unsolicited; sign up for a yahoo mail account and label a legitimate mail as junk and see what happens).
Does present an interesting idea though. What about a spam friendly email server that allows people to receive as much spam as they want? It could support VRFY, publish an email directory, allow posting to *all* addresses on the server at once, etc. Maybe I'll pitch that at work.
"Now, if only my webhost would have a way to prevent people from forging email to appears as if it originated from my domain"
Not that it affects this situation (it's not the email address that triggers the blocking, but the links in the email), but your host does have a way to prevent domain forging (joe jobs): publishing SPF records ( http://spf.pobox.com ) for your domain. Didn't I see that AOL was thinking about using SPF records to check incoming mail? It was one of the big ones.
Have you tried setting up SPF records ( http://spf.pobox.com ) for your domain? I thought I saw that AOL was going to start using SPF records to block prior to receipt (rather than after, as bounces--that server is a bounce sender as posted in other posts). SPF records would catch if your domain is being joe jobbed.
http://www.buymystupidshit.com/unsubscribe.asp?
Instead of blocking websites, which could lead to abuse, why not just sue the company that the spammers are advertising? That way, it'll become too expensive to have spammers spam or the company will leave the spammer out high and dry to protect themselves.
Windows is as solid as quicksand.
You can't shut us down! The Internet is about the free exchange and sale of other people's ideas!
I don't want a corp. deciding what I can and
cannot see!
I'm already filtering ads at the TCP level with the hosts file at someonewhocares.org/hosts, as I'm sure are many others. Best thing in the world!
-S
Privoxy (GPL) software does this one better than AOL's solution. You can put in sites that you want blocked, and if you navigate into the blocked site by mistake, it throws up a web page saying Privoxy is blocking it, but gives a link to go there anyway overiding Privoxy. Surfer's rights are not being denied here by the timely method of offering a choice! The AOL method seems to be a method aimed at content control which I wholly disagree with.
Anyone can set their reverse lookup to return an aol.com name. That doesn't mean it is actually an AOL host.
The thing about spammers is that no matter how many proxies, zombie machines, foreign servers and fake addresses they hide behind - at SOME point, there has to be a contact between spam victim and spammer for spam to be an effective money-maker. Spammers try to sell you things - things which require monetary transactions to complete. That's where they are vulnerable. Find out the businesses that profit from spam and go after them. They can't hide forever, especially if they want to sell you something.
Men believe what they want. - Caesar
if microsoft prevented mozilla browsers from running on their operating systems what would be the result? ... there's obvious potentential for legal recourse since they're preventing a large number of people from being able to patronize these people
yeah
Yep, it's that damn Y2K virus now showing up on posts *about* AOL again...;-)