.mail Domain To Eliminate Spam?

steve.m writes "The BBC are reporting on a new batch of top level domain names being submitted to ICANN for approval. By far the most interesting proposal is for a .mail TLD to register legitimate mail servers. Could this eventually be the end of spam ?" *yawn* The same old discussion, with no implementation in sight.

Comments

Obligatory spam solution rejection form

[tcopeland]

This article advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work.
(One or more of the following may apply to your particular idea, and it may
have other flaws which used to vary from state to state before a bad federal
law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential
employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever been
shown practical
( ) Any scheme based on opt-out is unacceptable
(x) SMTP headers should not be the subject of legislation
( ) Blacklists suck
(x) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.

Re:Obligatory spam solution rejection form

[DR SoB]

Summary:

People won't bother patching their SMTP server's, hence you will keep getting SPAM.

Re:Obligatory spam solution rejection form

[OECD]

Requires immediate total cooperation from everybody at once

Does it? Couldn't it be a "soft whitelist" until widely adopted? E.g., Everything coming from .mail gets a bonus in my e-mail filtering.

Re:Obligatory spam solution rejection form

[lukewarmfusion]

That's awesome. Parent post ROCKS.

This is another article describing another "attempt" at ending spam. They can be identified with the obligatory "Could this be the end of spam?" question.

By the way, the answer to that question is always "NO."

Re:Obligatory spam solution rejection form

[Anonymous Coward]

So I spoof a from header and get an automatic bonus? Thanks, I never thought of that before!!!

Sincerely,
spam

Re:Obligatory spam solution rejection form

[spellraiser]

Um - call be crazy, but it seems to me that the linked article does not actually propose any solution/technology to fight spam. It's about possible new top level domain names, and it only briefly mentions the fact that some anti-spammers want to use .mail to store mail server information. Whee ...

Personally, I don't think anti-spammers' interest in .mail is the main story here. It's certainly not the only one...

Re:Obligatory spam solution rejection form

[Dot.Com.CEO]

I absolutely LOVE the way that you analyse, evaluate and eventually reject a position in THREE lines. Congratulations, I can't wait to read your treatise of such subjects as quantum mechanics, nanotechnology and the Ben and Jerry relationship.

Re:Obligatory spam solution rejection form

[SwissCheese]

No, all this would do is minimize false positives of those senders who happen to be from the .mail domain. It would do nothing to increase the accuracy of identifiying real spam.

Re:Obligatory spam solution rejection form

[lukewarmfusion]

Wow, why don't I reinvent the wheel every time I have a thought? Have you read any one else's post? Do they analyze and justify each sentence that they make, or do they rely on the reader's ability to take their points in the context of the general discussion?

If I were to discuss quantum mechanics, would I be required to give a full intro-through-expert writeup before I was able to express my own opinions or thoughts?

No? Then go back to your cave, troll.

Re:Obligatory spam solution rejection form

[Anonymous Coward]

Your post was hilarious, but it suggests the existence of some sort of end-all be-all SPAM solution that has yet to be found (perhaps you were going to suggest it but accidentally hit "Submit" too early).

Either that or your post is trying to hint that the successful elimination of SPAM will involve a multiple stage strategy, adopted over a period of time by increasing numbers of people, until it reaches a critical point where it becomes too expensive not to use systems that don't reject spam. And so, single ideas in a vacuum could not ever be expected to defeat SPAM.

Either that or you're just a cynical bastard who's much better at criticizing than constructing.

So which box should I check?

( ) Parent poster should always hit the "Preview" button before posting ( ) Parent poster is a bright guy who urges us to think more carefully about so-called instant SPAM solutions ( ) Parent poster is too jaded and cynical to actually help except with comic relief

Re:Obligatory spam solution rejection form

[Dot.Com.CEO]

You, sir, are suffering of an extreme lack of humor, an apparent inability to take criticism and an obvious crassness in your expression. I suggest yoga, reading a good book and sex, not necessarily in that order.

Nearing 500 messages, it's the first time I'm called a troll, by the way.

Re:Obligatory spam solution rejection form

[lukewarmfusion]

Sorry if I missed the humor in your post... I have been dealing with some seriously humor-less responses lately and it seemed yours might just be another. My point, though, is still valid. Your post was not a criticism; it was an attack on my efforts to agree with the sentiment that such a proposal is generally worthless.

Interesting blog, by the way. It seems we may agree on at least a few levels..

Re:Obligatory spam solution rejection form

[airrage]

Too bad +5 is as high as the meter will go. This was a lucid, irreverant, intelligent comment. The part I liked most was (in the 'Specifically, your plan fails to account for' section, "Requires immediate total cooperation from everybody at once".

You know we could all move the Earth from it's current orbit if we all jumped up at the same time. Okay, China you've got 1/6th the population, don't screw this up again!

Great post. Parent should go SHoF (Slashdot Hall of Fame).

Peace out.

Re:Obligatory spam solution rejection form

[spottedkangaroo]

Will you make a web page of that ... so that I can actually go there and click the radio buttons and get my plaintext filled out form to post as a comment?

I'm being totally serious.

Re:Obligatory spam solution rejection form

[ameoba]

How long would it be before one of the 'alternative' DNS providers starts selling .mail domains? If need be, they'd use adware to add their DNS servers to your lookups.

Re:Obligatory spam solution rejection form

[Beardydog]

Nope.

Re:Obligatory spam solution rejection form

[kalidasa]

Where's the original to this? And who wrote it?

Re:Obligatory spam solution rejection form

[tcopeland]

That's a good question - I'm not sure. I Googled around a bit trying to find a place where I could just link to the original, but came up dry...

Re:Obligatory spam solution rejection form

[Tomun]

It appeared in a slashdot comment here
and its also at Cory Doctorow's site here.

My guess is that Cory wrote it.

Re:Obligatory spam solution rejection form

[scrytch]

How about a little credit, like a link?

Re:Obligatory spam solution rejection form

[tcopeland]

Cool! As I said in my other post, I Googled around but couldn't find the original.

Re:Obligatory spam solution rejection form

[firewood]

(x) Sorry dude, but I don't think it would work.

Due to the exponential growth of the "tragedy of the commons" with respect to email, email will soon become so unusable that even a solution which "won't work" will work better than email as it exists today.

The only solution which makes sense from an economic point-of-view must attack the ( ) Sending email should be free premise for unsigned non-whitelisted email (except to maybe police tip-lines and rape crisis centers, et. al. who want to get anonymous email). Once someone figures out a protocol which does this half-decently and which can overlay the existing system of internet protocols and email addresses, normal Darwinian competition among mail agents and transports will push current insecure SMTP into a fringe niche (which smart providers should then charge extra for the use of, to help pay the network costs of carrying the garbage).

Re:Obligatory spam solution rejection form

[Tony Hoyle]

I have a great relationship with Ben and Jerrys

The give me some, I eat it.
Wash, rinse, repeat.

Re:Obligatory spam solution rejection form

[Anonymous Coward]

I only get spam about once every 3 weeks so when I read about legislation being passed or all these people using email filters I wonder what they are doing with their email address that I am not. I've bought online with 6+ companies, used it on my resume and registered other services with the same .com address for 4 years and I only started getting spam when I used it on usenet.

Re:Obligatory spam solution rejection form

[wkcole]

I think you need to read the proposal more carefully and to look at the less formally worded materials at Spamhaus regarding the plan for use of the TLD. It is inaccurate to look at this as a means of fighting spam, much less a FUSSP because it is in fact a way to address the issues of legitimate mail getting caught by various imperfect approaches to spam detection.

Because it is designed to provide a sort of 'bus lane' for mail servers whose operators are willing to meet the rather stringent conditions and the hefty price of a domain in the TLD to get their mail servers into the TLD, it does not require universal acceptance. It also has literally NOTHING to do with SMTP headers , is designed to be useless as a pure whitelist (eliminating the related objections,) does not depend on spammer honesty, is totally unrelated to the lack of a central controlling authority for email, and is significantly resistant to 'joe jobs' and identity theft for the entities with .mail domains because any mail not coming from their .mail machines would be readily repudiable.

In short, your comment might have deserved the 'funny' moderation if you were the first person to come up with a checklist response, but all you have really shown is that you did not bother to dig any deeper than the rather misleading /. blurb.

Re:Obligatory spam solution rejection form

[gotem]

I suggest yoga, reading a good book and sex, not necessarily in that order.
now if you could do all 3 at the same time you'll feel a lot better

Re:Obligatory spam solution rejection form

[tcopeland]

> all you have really shown is that you
> did not bother to dig any deeper than
> the rather misleading /. blurb.

Touche!

$2K per domain, eh? Whew. A bit steep.

Re:Obligatory spam solution rejection form

[JuggleGeek]

Couldn't it be a "soft whitelist" until widely adopted? E.g., Everything coming from .mail gets a bonus in my e-mail filtering.

Sure, go ahead. Whitelist everything from *.mail domains. The spammers have never lied to you before, and they won't start forging the From field now...

Re:Obligatory spam solution rejection form

[JuggleGeek]

It's been posted many times for several years, I believe, in news.admin.net-abuse.email.

Re:Obligatory spam solution rejection form

[Anonymous Coward]

$2K per domain, eh? Whew. A bit steep.

Hey, I LIKE this!

"Hey spammer, you just spent $2K on a domain, spammed, lost the domain, how about ponying up another $2K for the ANTI-SPAM cause?!"

har har har - they say spammers are stupid, is there a chance a spammer would actually try and get a .mail domain to spam with?

Heck - better tell them, "just give the $$$ directkly to the anti-spam groups and cut out the middle man dude!"

Re:Obligatory spam solution rejection form

[capojim1]

I've seen your post before about the impossibility of stopping spam. I defy you to break the following sollution.

Here's "THE" solution for spamming:

This requires a new feature to be added to mail servers and clients to implement this functionality, but it should be relatively straightforward and is 100% backwards compatible with non-conforming servers and clients.

Basically how it should work is if johnny@aol.com sends me a message at andy@att.com, the mail server at aol.com (the sending server) will store a list of recently sent emails.

All it stores is the sender email address (johnny@aol.com) and a unique id for the email, maybe a CRC number (see explanation at the very end) derived from the message contents and all attachments.

When the receiving mail server (that's Andy's server at ATT) gets the message, it contacts the server at aol.com (derived from the 'from' field) and queries to see if a message from such a person was actually sent.

It sends the email address (johnny@aol.com) together with its own generated CRC number.

The sending server (which was aol.com) now checks its list of recently sent email and either returns a yes or no based on the test to see if the address/CRC pair is on the list.

A time check will be done in this process, maybe to a 60th of a second, then the spammers will be stopped.)

Once the user (Andy) downloads the message and removes it from the server the receiving server (Andy's at ATT) sends a message to the originating server (Johnny's AOL) that it's ok to remove the message record from the recently sent email list.

This method makes it impossible to spoof the "from" field--- (I am sure all you who read this are more than familiar with the spoofing done by spammers).

If spammers can't spoof the "from" field they lose their anonymous/fake cover.

It's possible to trace them back to the originating ISP and that ISP will have records of whom that account belongs to or will simply shut down the account if it's a free mail service.

Basically spam can be traced back to its source (and maybe even viruses).

Of course, not all servers will implement such functionality right away.

The end user can set up their mail client to simply filter email from servers that don't support this feature into a special folder that will contain "unverified" email, but this folder will get less and less email as this feature gets implemented more and more.

If the server does support this feature, and the sender is not verified, you KNOW its spam.

If AOL, Hotmail, Yahoo implemented this feature, and you have a client that supports this feature, you KNOW you won't get spam from any of those servers anymore.

------------
CRC

Short for cyclic redundancy check, a common technique for detecting data transmission errors.

Transmitted messages are divided into predetermined lengths that are divided by a fixed divisor.

According to the calculation, the remainder number is appended onto and sent with the message.

When the message is received, the computer recalculates the remainder and compares it to the transmitted remainder. If the numbers do not match, an error is detected.

Re:Obligatory spam solution rejection form

[macjohn]

Could we get this on a web form so we can just check the boxes and send it to whoever we want?

With a little imagination, we could cover a lot more kinds of rejection.

maybe they should create .spam TLD

[Numeric]

that way email users are guaranteed that all spam will be filtered!

Re:maybe they should create .spam TLD

[Anonymous Coward]

Um.. I don't think it'd work as spammers don't care how they get to you, even if they have to spoof addresses.

Re:maybe they should create .spam TLD

[Anonymous Coward]

um.. you are an idiot.

Re:maybe they should create .spam TLD

[jwdb]

I'm sure they'll get on it right after implementing the evil bit.

Jw

Re:maybe they should create .spam TLD

[Anonymous Coward]

You can't. I have a patent on that idea.

And I have one on .scam as well, but I have licencedto some Nigerian friends using a really good EULA :-)

in site?

[Anonymous Coward]

"in site"? Whose office are they talking about? And why would an implementation be site-specific?

Sigh...

Only a way to extract more money from people

[Anonymous Coward]

Give me a break, now on top of my .com .net and .org domain, I need to buy a .mail name to send mail??? I don't think so.

Re:Only a way to extract more money from people

[tanguyr]

at least you own all those doamin names:

say i have abracadabra.com and you have abracadabra.net - which one of us gets abracadabra.mail? Or are we talking abracadabra.com.mail and abracadabra.org.mail?

Re:Only a way to extract more money from people

[matthewp]

tanguyr wrote:

say i have abracadabra.com and you have abracadabra.net - which one of us gets abracadabra.mail? Or are we talking abracadabra.com.mail and abracadabra.org.mail?

According to the proposal, you'd get abracadabra.com.mail:

The names registered will be of the form "key.mail" where "key" is of the form "sld.tld" and where "tld" is an ICANN top-level-domain with certain attributes and where "sld" is a second-level-domain which is already registered in "tld". The registrant of the "key" domain must be the same as for "key.sTLD"

http://www.icann.org/tlds/stld-apps-19mar04/mail.h tm

Re:Only a way to extract more money from people

[Anonymous Coward]

Worse, why should I have to pay to register yet MORE domains just so I can send email? I run my own email servers. I run my own webservers. I have a non-commercial use for them and it already costs me a lot of money. I do not wan to double my domain costs by registering .mail for every domain.

Further, how exactly are they certified to be legit mail servers without spam just because they end in .mail? And how does that prevent spammers from spamming through trojans on people's systems or just registering lots of accounts at legit servers and spamming through them like they already do?

This is a stupid solution.

Re:Only a way to extract more money from people

[AKnightCowboy]

say i have abracadabra.com and you have abracadabra.net - which one of us gets abracadabra.mail? Or are we talking abracadabra.com.mail and abracadabra.org.mail?

Or if everyone just implemented SMTP-SPF this would all be irrelevent.

Re:Only a way to extract more money from people

[Anonymous Coward]

Not at all. If everyone just implemented SMTP-SPF every spammer would have SMTP-SPF in their DNS.

SPF is a validation that the sender is who he says he is. This proposal seems to be that too, but also that spammers won't be able to get the .mail TLD.

At least that's what I read here.

no solution in sight

[all your mwbassguy a]

im sorry, folks, but the only thing that i see ever working is micropayments.

Re:no solution in sight

[Anonymous Coward]

Watch it, cowboy. That goes against
everything slashdot internet freedom nuts
stand for.

Furthermore, if I had to pay for email,
I'd use another protocol immediately.
I'm not gonna pay .03 cents to send
my buddy bad jokes.

Also, who'd get the payments?

Re:no solution in sight

[tanguyr]

im sorry, folks, but the only thing that i see ever working is micropayments.

• SPF
  
• server side filtering
  
• forced castration/neutering of people who buy spam promoted products
  

it will take some time, but it will eventually work.

Re:no solution in sight

[gid13]

I still think that's a terrible idea. Aside from the cost to legitimate users, there's also the fact that snail mail spam survives, and at a much higher cost per attempt. This means the e-mail spam people can probably afford their much worse success to attempt ratio.

Re:no solution in sight

[Anonymous Coward]

Micropayments require setting up both a billing system and a payment system.

My ISP would need to track out-going email and bill me accordingly.
My ISP would need to credit my account for in-bound email.
ISP's would need some inter-ISP accounting system to keep track of debits and credits between ISP's.

Sorry, I don't see this happening. Dishonest spammers will ignore the system and dishonest ISP's will shutdown before the payments are due.

Re:no solution in sight

[squiggleslash]

I don't get spam. The solution I use is relatively simple and Yahoo! are now offering a commercial service that does something similar.

Micropayments will not work because they require an upgrade of the network infrastructure, together with the creation of some form of money transfer network. International tax laws would be the final nail in the coffin.

The main reason why we still have spam is that current systems are based on the notion we need to punish spammers and anyone remotely connected to them, such as customers of the same ISP, rather than cut them off. The problem with email is not that there's no incentive not to contact you, it's that there's no way of controlling who receives your contact information in the first place and who they pass it on to. Solutions that work will focus in on this.

Re:no solution in sight

[awol]

Junk snail mail is not spam. Spam exists, precisely because the marginal cost of one more recipient is zero (or indistinguishable from zero). Whilst it is true that junk mail still exists it is considerably less of an issue than spam, not the least of which is because (a) the centralised server [insert your postal service of choice] will respect a "no junk mail" sign and (b) the services offered in the junk have to have legit contact details within jurisdiction for the cost to be even remotely effective, hence they can be drawn to account for unethical action.

Re:no solution in sight

[hey]

Yeah, micropayments to Microsoft. That would be
fantastic! Hey if micropayments are good what about maxipayments. Let me send my credit card number to Microsoft right now!

Re:no solution in sight

[gfxguy]

Actually, there should be a reciprocal payment - the receiver gets the money.

So, in other words, if you email me, and I respond, we're even. If you email me, and I don't bother to respond because it's spam or something, then I keep your $0.05 or whatever it is.

A businesses internal email system will not charge for internal mail, only when accepting from outside. It will also keep people from using business email accounts for personal use.

The problem, as with most solutions, is that dishonest people can still hijack honest accounts, and instead of simply causing accounts to be shut down, the person who really "owns" the mail server will be charged a potentially huge sum of money.

On the hand, it gives incentives for people to lock down their servers.

In the utopian version of this, you pretty much break even.

Re:no solution in sight

[Anonymous Coward]

That's just EVIL!

I mean, you plan to hurt those people in such a terrible way, and you're not even going to do it to the spammers, too!

Help control the spammer population. Have your spammer spayed or neutered today!

Re:no solution in sight

[Otter]

SPF

Like IT people aren't pale enough already -- they need some sun (the one in the sky, not more servers!), not SPF! And castration may be a bit superfluous...

Re:no solution in sight

[brokenin2]

Really, the .mail TLD is the exact same thing as SPF. They're just trying to make it seem like a much bigger idea, and they're taking away control from the people that actually own the domains. (Maybe they'll give it back, but who knows).

Re:no solution in sight

[Anonymous Coward]

im sorry, folks, but the only thing that i see ever working is micropayments.

Not quite. The only thing I see working is a retiring of IPv4 and SMTP. When everything is using IPv6 introduce a new SMTP protocol that verifies ip addresses as being valid for sending mail from a specified server and detects/rejects forged headers.

Re:no solution in sight

[aml666]

Has anyone proposed micropayments for mail from people not on your "approved" list and free mail to those that are?

Re:no solution in sight

[tanguyr]

Really, the .mail TLD is the exact same thing as SPF. They're just trying to make it seem like a much bigger idea, and they're taking away control from the people that actually own the domains. (Maybe they'll give it back, but who knows).

It's like SPFPro: all the features of FreeSPF but you have to pay...

Re:no solution in sight

[dkoziol]

Isn't that the point with micropayments. Your buddy is suppose to have the option of declining or refunding the micropayment; but for spammers, bulk emailing would be cost-prohibitive since they most would accept the micropayment.

Re:no solution in sight

[Anonymous Coward]

Your post advocates a

(x) technical (x) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work.
(One or more of the following may apply to your particular idea, and it may
have other flaws which used to vary from state to state before a bad federal
law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(x) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
(x) Microsoft will not put up with it
( ) The police will not put up with it
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential
employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
(x) Unpopularity of weird new taxes
(x) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
(x) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever been
shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(x) Sending email should be free
(x) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.

Re:no solution in sight

[Linsaran]

That might work, but personally I think it would be more effective if we castrated the spammers. Sure they're not always easy to track down, but once you get a couple, the word'll spread and spam should die down. I mean it worked for the RIAA when they sued kazaa users. The statistical likelyhood of you being singled out for a lawsuit by them was worse than the chance you'd win the lottery, but still it stopped a lot of file sharers. Sure most spammers would likely get away with spamming. But how many of them do you think would give it up if they found out a few of their fellow spammers got castrated.

Re:no solution in sight

[hey]

I agree, .mail was "invented" by somebody who has a really shallow understanding of the Internet. They understand TLDs but that's about it. SPF is way better.

Re:no solution in sight

[Anne Thwacks]

How about server side castration?

Re:no solution in sight

[NoMercy]

Ironic really, since micropayments are one of the technologies which just won't work :)

if it takes 5 seconds of CPU work to send an email, you can forget ever recieveing another newsletter and up will go ISP charges since you can't easilly do micropayments on the client machine unless you can get everyone to agree to a way to pre-pay these things, which would require everyone signing up to some probably expensive service from verisign.

SPF is the best solution ive seen thus far, all it requires is people to only send emails via valid email relays, the only people who don't can be sorted out using SMTP AUTH and TLS so they can login to there ISP from anywhere in the world to send the emails.

Re:no solution in sight

[dannycim]

Re. your solution, try www.spamgourmet.net, as many throw-away addresses as you like and no need for any configuration whatsoever.

Re:no solution in sight

[Anonymous Coward]

yeah, it's been posted here on /. in every conversation i think

Re:no solution in sight

[squiggleslash]

I don't see how that would help, given the address auto-destructs after being used a number of times. This makes use of the system with an entity long term pretty difficult.

There's no need to turn off an email address until and unless a spammer gets it. You can't determine that on the basis of how many emails have been received.

Re:no solution in sight

[The FooMiester]

I see micropayments not working either. But I don't care. If micropayments are implimented, I stop emailing people on those systems where they are required. If that means running a server, then so be it.

SMTP is not broken. There is a lack of accountability on the internet. The protocol is designed in such a way that it is evident where the message entered the system. Yet abuse complaints often go unanswered.

People need to be accountable for their machines, just like in the past.

Re:no solution in sight

[Anonymous Coward]

I just had a thought -- perhaps spam haters are being done in by Darwinism. I hate spam, so I never buy penis enlargers. I'm less likely to mate and produce spam-hating offspring. Each breeding cycle only reenforces this sad trait, until spam haters are inbred yokels with millimeter penises. And they'll have to compete with spam lovers and Ron Jeremy sized cocks.

Doomed! We're doomed!

Re:no solution in sight

[JuggleGeek]

im sorry, folks, but the only thing that i see ever working is micropayments.

Then you haven't through things through.

In order to use micropayments, in order to even start *trying* to implement micropayments, then you have to be able to say, for sure, who sent the email in question. Currently, spammers fake domains all the time. (Well, not *all* the time - but I'd guess that over 90% of spam has forged information in the "From" line.)

Spammers forge my domain. I'm not going to pay you just because you receive spam purporting to be from whitis.com, and I can't stop them from sending the forgery.

So you have to find a way to verify the sender. SPF looks like the best bet, so far, IMO, though I don't think it's perfect.

Until you can verify the sender, you can't bill anyone. Once you can verify the sender, and *every* legitimate mail server (both on the sending and receiving end) has implemented the system, then you can start billing.

And you already know that spammers will continue to try to screw up the system. They aren't simply going to pay a micropayment for every email sent, they are going to try to fake the info or use a hacked machine to send it, so that someone else, someone innocent, ends up paying their bill.

Of course, someone has to handle the money, do the billing, chase down the deadbeats, and on and on and on... Microsoft wants that job, but I don't think many of the SlashDot crowd are going to be interested in giving MS a penny an email. And nobody is likely to do it out of the goodness of their hearts - their will be too many expenses to do that.

Then, of course, you have other problems - assuming you get that far. How does an end-user say "This is spam"? (Every email client has to be updated to handle that?) How do legitimate mass-mail services (discussion lists, newsletters, NYTimes daily news reports, SlashDot Headlines, and those sort of things) handle paying for every mail they send? And why should they have to?

If you can't see major problems with the micro-payment theory, then you just aren't paying attention.

How?

[FalconZero]

I might have missed something, but how would changing the TLD prevent spam?
* I could still sign up for bogus accounts with www.hotmail.mail
* I can still have a poorly configured box that relays spam to www.myisp.mail

Changing the name will not fix this unless the roots of the problem are addressed, unless
it was intended that only servers with a .mail TLD be able to send mail to each other?

"That which we call a rose by any other name would smell as sweet" - William Shakespeare

Re:How?

[Anonymous Coward]

You're stupid. The idea is to only accept mail from .mail TLDs because they have been verified.

Re:How?

[SnappleMaster]

Yeah, the article is bogus. There would have to be something extra and surely someone can design a mail system that works and doesn't require every single mail server in the world to be named foo.bar.mail.

Re:How?

[Anonymous Coward]

okay. what about sending? what's supposed stop a hijacked computer from sending spam using a locally configured .mail smtp account?

Re:How?

[SnappleMaster]

You're stupid too. Headers can be forged.

Re:How?

[a_n_d_e_r_s]

Yes, only those with a .mail domain name may send email and thus someone can not hi-jack a broadband computer with a virus and start to pump out spam.

All ISP then have to force all customers to send email through their own .mail-servers.

Re:How?

[FalconZero]

>>You're stupid. The idea is to only accept mail from .mail TLDs because they have been verified.

Just a few points :
1. Who would verify the requests (worldwide)?
2. How do you REALLY verify an account is never going to be abused?
3. Where do you draw the line? Is a company of 20 allowed email? How about 4? How about just me?
4. How do you persuade EVERYONE who currently uses email to change?
5. How much do you think it would cost to make the switch globally?

Re:How?

[Anonymous Coward]

You're even stupider too. Reverse DNS can check for forged headers.

Re:How?

[SnappleMaster]

Reverse DNS? I assume you mean PTR queries. Bullshit.

Re:How?

[Anonymous Coward]

EXACTLY.

As long as SMTP exists, the ability to FORGE HEADERS will exist. SMTP is a broken relic of a former, friendlier (and sadly, long gone) era. SMTP needs to be completely replaced.

And we'd better be the ones to do it...if we don't, Microsoft will.

And that's not a joke.

Re:How?

[npsimons]

You're stupid. The idea is to only accept mail from .mail TLDs because they have been verified.

Ooh, nice riposte there. Where'd you learn that, kindergarden? How about this: I'M NOT GOING TO WASTE MONEY ON ANOTHER FUCKING DOMAIN NAME JUST BECUSE A BUNCH OF ASSHOLES (SPAMMERS) SEE FIT TO ABUSE THE NETWORK. Furthermore, this stupid plan wouldn't work anyways.

Re:How?

[thogard]

Thats great but how about the 10% or so of the ISPs out there that are so clueless they can't get email to work properly?

Re:How?

[thogard]

.mail would need to work like a reverse dns for that to work or do some sort of nasty forward parsing. Either way if a spamer can buy into the game, they will till they get turned off and if the entry fee is too high it will make it useless for smaller operations. Remember there are spamers who routinely shell out for t1 install fees for lines they will only use for a week.

Re:How?

[Anonymous Coward]

>1. Who would verify the requests (worldwide)?

Since Spamhaus in UK seems to be involved, they would probably do it. Since I use and trust them to bounce stuff that's crap, I'd trust them to let in the good stuff.

>2. How do you REALLY verify an account is never going to be abused?

It's not that hard to see who's spamming. That's the basis for several blocklists.

>3. Where do you draw the line? Is a company of 20 allowed email? How about 4? How about just me?

The proposal seems to say anyone who's not a spammer.

>4. How do you persuade EVERYONE who currently uses email to change?

Does not look like any change is required. It's just a validation check.

>5. How much do you think it would cost to make the switch globally?

Not much. Modify a Sendmail release to do it, most of the globe is now "switched" :-)p

Re:How?

[NKJensen]

1. Who would verify the requests (worldwide)?
Your mail server would. Just turn on DNS checking, it's built in to most servers already.

2. How do you REALLY verify an account is never going to be abused?
I won't. But I would reduce the number of possible abusers very much. RBL's would be very much more efficient with this change.

3. Where do you draw the line? Is a company of 20 allowed email? How about 4? How about just me?
Anyone who would register a .mail name.

4. How do you persuade EVERYONE who currently uses email to change?
Oh, I see - you think that EVERYONE should change? Not so. Users don't see any change. Mail servers need to be registered. Mail servers may optionally check that connecting servers are registered using the DNS check mentioned above.

5. How much do you think it would cost to make the switch globally?
Peanuts compared to the cost of spam.

Silly silly silly

[grub]

A huge amount (if not the majority) of spam comes from open relays and compromised machines which this silly idea doesn't address. A ground-up overhaul of the mail system (with authentication) is what's needed, not another level of bureaucratic nonsense.

Re:Silly silly silly

[Clinoti]

Indeed, unless the root (no pun) system is taken to the measure and redeveloped this solution is not something that I would want implemented or would want to live with. I gather that in all the time it takes to develop this system, mailboxes will now have spam from all the open-relays, and bundles of spam from the new systems that are online with their open relays due to admins just throwing the boxes online just for some measure of compliance.

It's just now that some ISP's are starting to manage their own open relays, and now to suggest that we give them another system to manage/muddle while the never got it right the first time just reeks of a mess waiting to happen. And I have to purchase a new domain name?

For email to really work we need to continue with the Keys or other authentication methods, like in the old Heinlein books; or now the emerging technology of telephone number authentication before the call is allowed to be routed. If the lowest level of technology can figure this out, why not the top?

Re:Silly silly silly

[Stonent1]

A huge amount (if not the majority) of spam comes from open relays and compromised machines which this silly idea doesn't address. A ground-up overhaul of the mail system (with authentication) is what's needed, not another level of bureaucratic nonsense.

My people are being Spammed Senator! I was not elected admin to watch my people suffer and mail servers die while you discuss this Spam invasion in a committee!

Re:Silly silly silly

[Stallmanite]

If a celebrity has a public phone number the celebrity will get swamped with calls. People don't seem to think this requires a ground-up overhaul of the phone system.

Spam only really bothers people with public addresses. It is not a huge issue for those who take basic precautions.

Re:Silly silly silly

[Anonymous Coward]

Spam only really bothers people with public addresses. It is not a huge issue for those who take basic precautions.

If your address is in someone's Outlook address book then it can be spammed/trojaned/virused. Lots of programs harvest that way.

Re:Silly silly silly

[pkey]

How would Businesses be reachable via email under your fabulous no-one-has-a-public-email-address spam solution?

Or to use the same (rather silly) metaphor, the Wal-Mart down the street has a public phone number. Does this mean Wal-Mart's phone is constantly ringing?

I am not a celebrity, in real life or on the Internet. Would you like me to forward my spam to you? I guarantee that I get more spam than Bob Barker gets phone calls.

Re:Silly silly silly

[aggieben]

A ground-up overhaul of the mail system...

The mail system works just fine. It's people that are broken. As deadmongrel suggested earlier, the *only* way to really stop spam is to change the existing situation in which it is economically worthwhile to spam. If it were not worthwhile, no one would do it, except script kiddies striking revenge on their 8th grade english teachers.

The beauty of the existing email system is it's simplicity, low cost, and lack of regulation or central authority. Redesigning would be exhorbitantly costly and I have no doubt whatsoever that the resulting system would be inanely complicated and bueaucratic.

Re:Silly silly silly

[Rallion]

Erm, I doubt spammers would find much profit only sending mail to business contact addresses.

Personally, I get NO spam at all. I do get plenty of useful email, however, inclusing stuff from some mailing lists.

Re:Silly silly silly

[pkey]

You are familiar with the concept of "salesmen", yes? It is very necessary for salesmen to be easily reachable. A public email address makes them easily reachable. Would you like to suggest to the salesmen where I work that they should not have public email addresses? Would you like for me to redirect the spam filtered out of the mailboxes of the salesmen to you? These are business contact addresses, by the way.

Do you figure the spiders that crawl the web and harvest email addresses are intelligent enough to be able to tell the business addresses from the personal ones?

I think it's terrific that you "get NO spam at all". I also think that the idea that getting rid of publicly-available email addresses is a solution to the problem of spam deserves Fark's [assinine] tag.

Re:Silly silly silly

[scrytch]

> A huge amount (if not the majority) of spam comes from open relays and compromised machines ...
> A ground-up overhaul of the mail system (with authentication) is what's needed

Sounds to me like a ground-up overhaul of security is what's needed, or else it'll punch holes in any new system you built, ground up or no. SMTP has survived this long. You want to invent a new transfer system, feel free, go get yourself a well known port for it from IANA and get everyone using it. Stick a persistent message store on Jabber if you want a good running start.

Meanwhile, the rest of us would prefer to entertain solutions that can be implemented to fix what exists while you go off and blaze new trails.

Re:Silly silly silly

[Lost Race]

Open relays are hardly a problem any more -- 99% of them have been shut down already, and the few remaining ones will be gone soon enough. If the .mail idea works like I think it does (I can only speculate based on the extremely scant info in TFA) then it would indeed take care of the compromised machines problem, because those compromised machines would not have reverse DNS in the .mail TLD. That's not to say it sounds like a good idea -- who would be responsible for administering the TLD? What qualifications would be necessary to obtain a .mail domain? How would spammers be kept out?

So what, exactly, is your idea of a ground-up overhaul? Please, write up an RFC and a reference implementation. If it works, people will start using it right away (alongside good old SMTP) because they desperately need a spam-free alternative.

Re:Silly silly silly

[Anonymous Coward]

It does seem to address "the compromised machines problem" and it looks as if to get a .mail domain places will have to go though quite an "exam" first. ("full body cavity search, hard and deep!").

I like the idea that someone (Spamhaus) who knows who spammers are (ROKSO - *spit*) would be helping do this. I really like the idea of a "walled off" place on the internet where scummy spammers like Alan Ralsky (search for his name and address in /. and send him some catalogs!) would knock on the door and hear, "beat it you spamming ahole".

Ok..

[hookedup]

I'm not really into the idea of splitting up the entire net into all these tlds. I dont want my mail server being so easily identified as such.

Re:Ok..

[tanguyr]

well, if you use it to receive mail, your mail server is already identified by an MX record...

Re:Ok..

[Anonymous Coward]

No it is not!

You don't need a mx record on your domain, to recieve mail. You just have to listen on port 25.

If a domain has no mx, it will default to the domain name, and try port 25.

But if you don't have a mx record you can't have a backup mailserver.

Re:Ok..

[tanguyr]

mod parent up, he's 100% correct.

Uses for the domains

[brejc8]

Uses for the new domains: .asia - Asian pr0n companies .cat - Feline pr0n companies .jobs - Jobs in the pr0n companies .mail - Pr0n spam companies .mobi - Pr0n to your mobile companies .post - Pr0n through your post companies .tel - Sex chatline companies .travel - Sex tourism companies .xxx - Unknown

Re:Uses for the domains

[grub]

.jobs - Jobs in the pr0n companies

I'm going to squat on steve.jobs!

Re:Uses for the domains

[cetan]

Grug, I don't think Steve really wants to see your nasty ass in his face every day... :)

Re:Uses for the domains

[Trigun]

Then you can set up a dyndns style server and allow people to register "ihate.steve.jobs", "Ireceivedanalfrom.steve.jobs" and "allmymoneywentto.steve.jobs"

Re:Uses for the domains

[Anonymous Coward]

.xxx - Probably illegal if you a minor or if you are an adult in the state of Utah.

Re:Uses for the domains

[Anonymous Coward]

I dunny.. I've been called a "teabagger" enough by the $699SCOTroll..

Re:Uses for the domains

[Xconnect]

...and .uk for pr0n from UK... and .us for pr0n from US... and... oh wait...

This will work!

[joeszilagyi]

Since it's impossible and illegal to fake your domain name registration info, there is no way any .mail named mail server would be used for illicit purposes. Anyone mailing you from server.cheapest-viagra-online.mail.cn must clearly be a legitimate mail server of a pharmaceuticals corporation and should be whitelisted.

Re:This will work!

[WaterTroll]

Ok, so average user has his outlook express configured to a .mail service. His computer his hijacked by spyware and it's sending tons of spam using the .mail account settings found in outlook express. I don't see a solution, or am I pisssing the point?

Re:This will work!

[Anonymous Coward]

er, missing the point :P

Re:This will work!

[vwjeff]

You are not missing the point at all. As we have all seen the past few months, spammers will do anything to get their messages out. I believe the only way to stop spammers is to stop their revenue flow. Charging a small fee for using e-mail may be the only way to stop spammers. Again they may find a way around this system.

If all else fails we always have the mafia. Everyone should pool their money together and hire hitmen.

Re:This will work!

[Anonymous Coward]

You wrote:

>Since it's impossible and illegal to fake your domain name registration info

Hah! Don't make me laugh.... spammers do it all the time, and with registrars like 'joker.com', and 'gandi.com' and other spam friendly registrars, it's a simple matter of initially registering your domain with 'real' contact info, then sometime later, changing your contact info to 'fake' and 'bogus' one later, is the norm with spammers. Registrars have no effective means of confirming address changes, because they confirm your request using your 'older' entry, without first validating your new (and bogus one).

Just do a 'whois' lookup on some spamvertized domain sometime and see for yourself. MOST are bogus.

Of course if you have a lot of time on your hands, and empeccable record keeping, you can file a bogus whois complaint, and they have 2 weeks to contact them (spammer), but most domains are throw-aways anyway, and they don't give a hairy rats ass if they loose it.

This USED to be a very effecftive way of identifying spammers, but not anymore, especially with foreign registrars popping up in China and other spam friendly places. But if the assignments of domains are very carefully controlled, I can see it MIGHT help, but I have my doubts.

Re:This will work!

[Anonymous Coward]

Since it's impossible and illegal to fake your domain name registration info

Hah! Don't make me laugh.... spammers do it all the time

Look up sarcasm. Here, I'll help.

Re:This will work!

[firewood]

Ok, so average user has his outlook express configured to a .mail service. His computer his hijacked by spyware and it's sending tons of spam using the .mail account settings found in outlook express. I don't see a solution, or am I pisssing the point?

Make getting his computer hijacked a criminal offense with appropriate fines (say, per email sent). When costs start appearing to anyone in the chain of internet abuse (even if not to the most guilty) the problem will lessen to some degree.

Re:This will work!

[Anonymous Coward]

The assumption here is that they will pay for it. What if they somehow figure out a way to get OTHER people to pay for it? Or as you say a way to spoof the thing into thinking they HAVE paid for it. Or even worse yet they get a 'good deal' from someone willing to sell the service cheaper....

Re:This will work!

[Anonymous Coward]

So in countries with currency export limitations you wouldn't be able to send emails to other countries? What is a "small fee" in EEUU or Africa?

Re:This will work!

[Anonymous Coward]

Pissing I think.

This does not look like a domain anyone who gives unlimited email access to users would or should get. If a user spams or "installs" Sobig Virus Q, one would lose the domain.

May work well for places that SMTP AUTH or better yet, meter a single account's ability to send each hour/day/etc.

Why would I want to register under so many TLDs?

[some2]

I have not been a fan of new TLDs for some time, as it seems to promote confusion. I consider it to be more inefficient to have companyname.info, companyname.com, companyname.net, companyname.org, companyname.mail, etc.... than to just have a simple single domain name (or the three majors, org net and com), with subdomains to break out the company functions (support, sales, mail, www, ftp). It seems much more confusing to me to have companyname.mail than mail.companyname.com, and besides that, why would we possibly want to justify the cost to register our domain under several TLDs, when .com has always been enough?

Force a .mail TLD?

[scumbucket]

Can this organization force a .mail designation on a site? If not, what's keeping somebody from designating a domain for porn sites to sex.mail, or a spammer naming his domain iminnocent.org?

I'm curious...

[Dot.Com.CEO]

If it's such a stupid / boring idea (which it properly is), why the hell is it in the front page of slashdot?

Re:I'm curious...

[sik0fewl]

Uhh.. do you really have to ask yourself that question?

Re:I'm curious...

[swb]

So the slashbots can have something to rail against.

What's amusing/irconic about the spam debate is that any possible solution is always shot down for technical/philosophical/OSS reasons. I have yet to see a solution advocated that gets more than 25% support.

I'm personally in favor of an RICO organized-crime investigation of the spamming "industry" and its related businesses; I think if real people started going to jail for long terms, including colluding executives from "legitimate" businesses such as ISPs, banks, and other businesses supporting spammers, we'd see a real reduction in spam. It wouldn't go away completely, but it would certainly be reduced.

Re:I'm curious...

[Dot.Com.CEO]

I wasn't aware I was asking *myself*.

Re:I'm curious...

[Anonymous Coward]

You must be new here. Stories first appear at the top of the page and gradually move down as more stories are added. Eventually, all stories move to the right side and then half of them are simply forgotten while the other half get posted back to the top of the list, and the cycle continues.....

Re:I'm curious...

[Dot.Com.CEO]

You assume something as the basis for your thesis that is not necessarily true: that spamming is a crime. It is not. It might be obnoxious, it might even advocate illegal services or products but mass mailing is not an illegal activity, obnoxious as it is. The only realistic solution is for us geeks to install spam blockers, bayesian if possible, to as many friends' computers as possible, thus rendering mass mailings ineffective.

Interestingly enough, more and more spam seem to sieve through my spam-filters. I guess we need something better? Or is spamassassin not the dog's bollocks any longer?

Re:I'm curious...

[s20451]

What's amusing/irconic about the spam debate is that any possible solution is always shot down for technical/philosophical/OSS reasons. I have yet to see a solution advocated that gets more than 25% support.

That's because the quickest way to look smart is to poke holes in someone else's idea. And the slashbots love to have themselves look smart and others look stupid.

The philosophical grounds are a catch-all for anly solutions that have technical merit, usually because such solutions are proposed by organizations that the slashbots hate.

Re:I'm curious...

[man_ls]

Technically, it is a crime now, with the new laws (CAN-SPAM Act) that were passed...

Re:I'm curious...

[Dot.Com.CEO]

I wasn't aware the CAN-SPAM act was valid in the EU or anywhere outside the US for that matter.

Re:I'm curious...

[IamGarageGuy 2]

Spamming may not be a crime by itself but the methods used by spammers (e.g. a virus that captures X number of boxes for relays) certainly is. It is time that these criminals get their day in court. I may not be the first to say that spamming is not illegal but their practices of preying on the Mom and Pop cable modem user is breaking many laws. These people are acting as criminals and should be treated as such. If they want to send all their spam without spoofed addresses and from identifiable domains, there is no reason they should not be allowed to (legally). With that method, I can whitelist their domain and those that don't whitelist can get their spam.

Re:I'm curious...

[Kishar]

You appear to have not read that particular piece of legislation.

HINT: It's not called "CAN"-spam for no reason.

Re:I'm curious...

[sckeener]

You can't stop it if you don't know about it.

Re:I'm curious...

[man_ls]

Well, I'm in the US, so it's valid for me.

Good point, however.

Re:I'm curious...

[Anonymous Coward]

Slashdot : Stupid news to troll, stuff that's boring

Re:I'm curious...

[sik0fewl]

Well, most people *do* ask themselves before asking someone else. I forgot that on slashdot most people don't think before they post.

Re:I'm curious...

[Dot.Com.CEO]

Legislating against something does not solve the problem, especially if there is a lot of money to be made, as is the case with spam. Ask yourself this question: are you receiving less spam since the CAN-SPAM act passed?

Re:I'm curious...

[lspd]

The only realistic solution is for us geeks to install spam blockers, bayesian if possible, to as many friends' computers as possible, thus rendering mass mailings ineffective.

This is like virus scanning.. It's reactive rather than proactive. I'd rather see GPG with trust calculations properly integrated into Windows email clients and actively promoted. Tell your friends that you only read untrusted email once a week and encourage them to sign everything they send. Hell, I'd have no problem with trusted computing if end-users can choose who gets to certify that an application is trusted. The idea works well for Linux distros. You stick to the software provided by your distro and you know that some checking was done to make certain the software will not hose your system.

Re:I'm curious...

[Steve B]

it might even advocate illegal services or products

Almost all spam contains some sort of fraudulent or otherwise illegal solicitation. It's long overdue for the Feds to send enough of them to PMITA prison for a few years to put the fear into the rest.

Re:I'm curious...

[Pig Hogger]

If it's such a stupid / boring idea (which it properly is), why the hell is it in the front page of slashdot?

Try one of the following:

• Because there is ONLY a front page to Slashdot
• Because it is a stupid/boring idea

Re:I'm curious...

[swb]

You assume something as the basis for your thesis that is not necessarily true: that spamming is a crime. It is not. It might be obnoxious, it might even advocate illegal services or products but mass mailing is not an illegal activity, obnoxious as it is.

If you start with the assumption that spamvertized products are, for all intents and purposes, illegal or fraudulent, then spamming is essentially part of a broader conspiracy to commit fraud. The spammer would have to go through some pretty hairy intellectual gymnastics to demonstrate that they were not direct benficiaries of and participants in illegal business practices. "I didn't know what email I was sending" is neither believable nor justifiable.

And that's just for the spammers who are simply doing bulk mailing, and not those who run the fraud business AND do the bulk mailing directly.

The reason I'd like to see a RICO prosecution is (a) the penalties are much higher, and more importantly (b) it may be possible to ensnare ISP or Banking executives who may be knowingly participating in these activities as well. The larger problem in attacking spam is the fact that otherwise legitimate and credible businesses are willing to shelter spammers and run interference for them. If those people were indictable as paritipants in a racketeering case, it should in theory have a chilling effect, which would deny spammers easy access to bandwidth, banking services and the other tools that they need to do their work on a large scale basis.

Re:I'm curious...

[Dot.Com.CEO]

If you start with the assumption that spamvertized products are, for all intents and purposes, illegal or fraudulent...

Can you offer LEGAL proof that ALL "spamvertised" products are illegal and / or fraudulent? Because THAT exactly is my point.

Re:I'm curious...

[swb]

Clearly it's not possible to consider all possible spams as illegal, especially for all possible definitions of "spam" and "illegal".

The overwhelming majority of spams I and everyone else I know gets either prima faciae fraudulent (impossible claims about penile enhancement), offering illegal services or products (cable descramblers, prescription drugs), or, and this is speculation on my part but probably not inaccurate, solicitations for goods/services which will never be delivered and are just attempts to grab personal information/credit card info.

And I'm not sure what your fixation on "legal spam" this is, either -- I think most people want to get rid of the vast majority of spam, and the vast majority is for fraudulent or otherwise illegal products and services, and law enforcement actions targeting fraud would be wasted on "legal spammers", which I think is a pretty tiny category.

Besides, most spam I get now is in violation of the CAN-SPAM act, which makes it prima faciae illegal even if it is trying to legitimately sell me something entirely above-board.

Re:I'm curious...

[alexborges]

At the very least its akin to grafitti in your front door.

Its antisocial behaviour, that is now, in some states in the US and elsewhere, also illegal.

It should be illegal in all democracies as well.

Re:I'm curious...

[Duhavid]

Legislation is not cast in stone. It can and should change to match the situation. And if what you are saying is correct, then should we drop *all* legislation? Like that which makes it illegal to murder? Rob? Granted legislation does not absolutely stop criminal activities, but I would argue it does deter most from commiting them. The problem here is enforcement.

Money makes it OK? I could make money from extracting your kidneys from your body. So, that is OK? But there are laws against that? Well, you just argued that legislation doesnt solve the problem. And there is money to be made by me. So, you should have to pay for a body guard to keep me from removing those valuable kidneys of yours. And I figure ways around the body guards, and you and your body guards find ways to foil me. How does this make sense?

The current legislation might or might not be a good thing ( my guess: isnt a good thing ). What does that have to do with the *idea*?

Send an email with a forged header, go to jail. Make some reasonable legislation that favors citizens real needs, and put some teeth in it. No, it wont solve the overseas stuff, but for the love of Mike, ya gotta start somewhere.

Re:I'm curious...

[Fjord]

FYI, there is more than just a front page to /.. There are articles that get posted that do not go on the front page, but are listed in their specific sections. Here is an example from Science. The front page has a listing of which sections have additional articles.

Re:I'm curious...

[Anonymous Coward]

Because spam is such a huge problem, that any idea that seems to have at least some merit is newsworthy?

Heck, I read the thing, seems okay. It won't stop spam as the /. subject says, it stops non-spam from getting bounced - and that DOES help me!*

jeff

*and yes, it _is_ all about ME!

hehe... comments CAN bite back...

[FortKnox]

*yawn* The same old discussion, with no implementation in site.

Sorta like making an improved moderation system on slashdot instead of ping-ponging votes around?

Re:hehe... comments CAN bite back...

[Fjord]

If you also cannot metamoderate, then you've been $rbtl'ed. I get mod points almost every freaking week. It's actually a little annoying, because you can't comment in stories you mod in (otherwise you revoke the points you've spent). So I'll have to decide whether I'm going to comment or mod for each story.

Re:hehe... comments CAN bite back...

[Lord Kano]

I metamoderate about twice per week, but no regular mod points...I dunno...

Re:hehe... comments CAN bite back...

[Anonymous Coward]

Hmm... I just recently started logging on and meta-moderating.
(Have an account in the 650000s but never used it).
Over the course of about 3-4 weeks, I metamoderated, and have now had mod points three times in that period. Never posted a comment under my name to get them either (as opposed to the
indications from the FAQ).

Re:Proper grammar??

[Robotech_Master]

Well, I'm sure it hasn't been implemented in a site yet either...

Two domain names

[nempo]

Great, now you're forced to own two domain names to be able to host your own email server, one .mail for *gasp* your mail and one .*** for everything else.
Why not create .ftp, .ssh and so on when you're at it.

Re:Two domain names

[genixia]

Why? You could run apache/sshd on your .mail mailserver if you were really that cheap.

Re:Two domain names

[0x0d0a]

Oh, you're one of those people that likes to stifle innovation and put upstanding companies like VeriSign out of business, eh?

Re:Two domain names

[Anonymous Coward]

Exactly! Next thing you know, people will be promoting open protocols and standards compliance! Fucking hippy communist anti-american dickwads!

Re:Two domain names

[Anonymous Coward]

Or we can just keep things simple and run mail daemons on our normal domains.

Everyone can then pretend all domains can potentially send mail by mentally adding a ".mail" to the end of every domain name. eg hotmail.com.mail

What a great idea...

[weave]

Yet another way for domain registrars to make a new killing off of providing a tiny record in a database somewhere.

Where can I sign up for my 100 year .mail domain?

Re:What a great idea...

[dasmegabyte]

Actually, domain registrars are getting paid to be a responsible party keeping people from squatting on domains they have no rights to and enforcing correct contact information.

They're just not doing it very well, because they make so LITTLE money off each domain it doesn't pay to do so. And who demanded $10 domain names?

Re:What a great idea...

[qualico]

Thats exactly it. How much are they going to charge for a .mail? Just look at the outrageous prices of .pro! What a joke!

Won't fly in the US, it's not PC

[FerretFrottage]

...you'll need to add the .femail domain as well to make everybody happy

site?

[SuperBanana]

The same old discussion, with no implementation in site

Hmm, the site spell chequer must bee down to.

Re:site?

[Anonymous Coward]

Actually, as a pun, it's kinda funny.

Re:site?

[Alizarin Erythrosin]

The same old discussion, with no implementation in site

Maybe it was Hemos's attempt at a bad pun ;-)

However,

[rasafras]

Will it cure cancer and AIDS before or after it eliminates spam?

Re:However,

[Sexy Commando]

[Insert Obligatory Duke Nukem Forever Joke Here]

IFFOR sponsored by .xxx

[brejc8]

Acording to ICANN the sponsor for .xxx is The International Foundation for Online Responsibility. It wopuld be a bit weird when the organisation's main source of funding will come from the pr0n industry.
IFFOR brought to you by nastygirls.xxx

Spam

[Iberian]

The only way to elimanate spam is to hold users accountable which is neat impossible with the anonmity the internet provides so unless you want to start registering your SSN and removing your foil hats just accept it as the small price for freedom.

Note to self

[Rosco P. Coltrane]

- Quick quick, register hot.mail ASAP!!
- Wait for Microsoft to contact me, tell them I take cash and checks

Re:Note to self

[Anonymous Coward]

- Get sued for being a tool.

Re:Note to self

[Anonymous Coward]

Just make sure you tell them that hot.mail is a site that is somehow related to porn and has nothing to do with hotmail.com. That way you'll be ok legally.

Re:Note to self

[Anonymous Coward]

- Post on website - Get linked by Slashdot - Accept donations to fight the good fight - Take MS's money and Xbox - Sell MS's legal documentation on ebay

Re:Note to self

[Imperator]

If they're as good at renewing hot.mail as the rest of their domains, you'll be able to do that 3 or 4 times.

Re:Note to self

[FroMan]

mikerowesoft.com

Re:Note to self

[Anonymous Coward]

>Just make sure you tell them that hot.mail is a site that is somehow related to porn and has nothing to do with hotmail.com. That way you'll be ok legally.

Or spices. Spices are hot.

Or hot-tubs... or something hot...

hot-dogs...

PizzaHot...

Re:Note to self

[Anonymous Coward]

- Quick quick, register hot.mail ASAP!!
- Wait for Microsoft to contact me, tell them I take cash and checks

Damn, I had the same idea, but then read further and saw you can't get hot.mail, you can only get hotmail.com.mail AND only if you already own hotmail.com ! DRATS, now I have to call back the salesman at the yaught place and tell him NOT to cash my check.

Hope in site

[American AC in Paris]

The same old discussion, with no implementation in site.

Eye, fore won, think their is hope two bee had.

Prefix, not suffix, you dumbasses

[ari_j]

Now I have to get mycompany.mail to handle mail and mycompany.com for my other uses, and people will get confused because mycompany.mail and mycompany.com are not necessarily the same mycompany. Moreover, there'll be no way to tell if I am from mycompany.com when I give an address of me@mycompany.mail. Yes, you can MX mycompany.mail to handle for mycompany.com, but you could register hiscompany.mail and people might get confused and send mail to him@hiscompany.mail instead of him@hiscompany.com, totally messing with him.

This is why you're supposed to have a mail.yourcompany.com subdomain to handle mail for yourcompany.com - there's only ambiguity if mail.yourcompany.com gets hijacked or your DNS provider gets bribed into giving it to a friend for a can of Coke (that bastard).

I think the appropriate solution to spam is to hunt down everyone who buys the stuff and kill them off. When people stopped buying pet rocks, they went off the market. Kill the demand, because spammers are lowlife who will risk death to supply it if the demand is there.

Re:Prefix, not suffix, you dumbasses

[dasmegabyte]

That's an excellent theory you have. Eugenics as an anti spam tool.

Re:Prefix, not suffix, you dumbasses

[joeytmann]

ummm mail.mycompany.com wouldn't necessarily be the name of a subdomain...it, most of the time, would be be the host itself in the mycompany.com domain. Using a .mail tld could work, but the rules for getting one and making sure records are kept up would have to be strict to say the least. There shouldn't be any confusion on the email address for each domain, they still would be him@hiscompany.com. The only thing that needs to change it the MX record for hiscompany.com which would be host.hiscompany.mail. Think of the .mail TLD more of a ICANN run DNS Blackhole, except the servers there are ones you can accept from, not deny....anything else would get denied. In most of the MTA's(sendmail, exim, and other spam filtering tools) they have the ability to check outside servers(relays.ordb.org for ex) if they are open-relays or not. Its the mail admins choice to use these. I don't think it would be hard to use the .mail the same way and implement a whitelist of people not in the .mail TLD, but that is their choice and would have to be maintained like the whitelists now. Oh well....let the flaming begin.... joey

Re:Prefix, not suffix, you dumbasses

[ari_j]

How would a .mail TLD make it any harder to send spam? Just fake a .mail TLD or get a real one. Hell, I might have to register spam.mail (I call dibs on it, so none of you bastards go register it ahead of me, got it?) and start spamming just to make a point. :P

Re:Prefix, not suffix, you dumbasses

[DA-MAN]

How would a .mail TLD make it any harder to send spam? Just fake a .mail TLD or get a real one. Hell, I might have to register spam.mail (I call dibs on it, so none of you bastards go register it ahead of me, got it?) and start spamming just to make a point. :P

I'd guess that it'd probably be more like a drivers license type scheme. Verify who you are, run a quick few simple tests (open relay, known sploits, etc.) and revocation of users known to fuck things up for the rest, IE spammers.

This will suck if that is how it is envisioned. But really all it takes is earthlink, msn, yahoo and aol all saying they will block all mail from non .mail approved hosts starting X/Y/Z.

Personally I think SPF is the way...

the end of spam?

[Anonymous Coward]

Nah. Hormel wouldnt like that.

Not sure how .mail will work

[El Cubano]

It's pretty light on details, but it seems that the two most logical applications are problematic:

1) When you register foo.{com,net,biz,org,*} you also got foo.mail as a bonus. But if one person rgisters foo.com and also gets foo.mail, what happens to the person who later registers foo.net.

2) As a possible solution to point 1, when you register foo.com you also get foo.com.mail. This just seems ugly.

Also, will it cost me another $15-$45/year to get the benefit of this new domian? What of people who choose to not porticipate?

I still fail to see what the problem is with just doing a reverse lookup on the domain's MX. It utilizes existing infrastructure and isn't as ugly as throwing in another TLD to the mix.

Re:Not sure how .mail will work

[Anonymous Coward]

The problem with doing a reverse on the domains's MX is that their outgoing and incoming mail servers may not be the same machine. If you have a lot of outbound mail (big organization), it makes sense to dedicate a machine or two (or ten) to just being your outbound mail relay, and not let them accept inbound mail connections (and vice versa for your inbound mail). If you refuse mail from sites that send mail from IPs other than their MX, you break that.

Re:Not sure how .mail will work

[87C751]

In another article on this proposal, the foo.com.mail structure was explicitly mentioned. The plan seems to be similar to SPF or RMX, but using the .mail TLD instead of requiring additions to DNS entries. So when you get 'HELO example.com', you hit example.com.mail and get a list of IPs authorized to send mail from example.com. This does not mean that you will be sending your mail from example.com.mail.

Domains can be had for less than $15 a year, and in any case, that's not much to pay to help insure that your email is accepted. (.mail... it's everywhere you want to be) People who choose not to participate may have problems sending mail in the future. What do you want to bet that registrars will be offering .mail domains bundled with the conventional TLD?

And this plan does not hinge on convincing your ISP to enable reverse DNS. It doesn't even require a DNS entry for the MX. But it would make a healthy dent in the ability to forge mail origins from offshore servers. (granted, this doesn't do anything against zombies, but that's a different kettle of fish)

Re:Not sure how .mail will work

[SSpade]

It'll cost you over $2000 a year to get a .mail domain, so it's unlikely that individual users will want to play.

Re:Not sure how .mail will work

[Midnight Thunder]

Either way its just going to make things more complex. To use a real world analogy, if I live at '55 Infinite Loop', I expect to get my mail there. I don't expect to have to set up another building in '403 Mail Avenue' or '55 Infinite Loop-Mail Avenue'. So, back on the internet, if my site is site.com then I am at site.com, therefore me@site.com

Some people just don't think things through. The issue is not with the domains, but with the mail protocol and open relays. Heck, I could still leave my mail site wide open and this would not solve anything.

This sounds more like some guys from Verisign trying to hatch another way of charging people for something that works and that they don't have to pay for the moment.

Re:Not sure how .mail will work

[Anonymous Coward]

"I still fail to see what the problem is with just doing a reverse lookup on the domain's MX. It utilizes existing infrastructure and isn't as ugly as throwing in another TLD to the mix."

What do you hope to accomplish by using the MX for anything? It's only good for deliveries TO a particular domain. I use a load balancer to distribute traffic to a farm of mail servers. When they initiate outbound connections, however, they do so from their own IP, not from the virtual IP (which is what is listed as the MX). In addition, many ISPs have relay mail servers that are distinct from their inbound mail servers. No, MX is not the way to authenticate connections from remote mail servers...

Re:Not sure how .mail will work

[Anonymous Coward]

Correct. But it does not look as if it's designed for individual users, probably more for corp emailers who send mucho mail and don't like bounces if their emails look "spammy". Since I don't spam or send "spammy" looking HTML laden emails, I never have any trouble getting emails though, but if you read the press on filtering spam, you'll see this is a major PITA for companies. Idea works for me. I DO want a trusted place I requested info from to be able to send to me without my SA scoring it a 10 and moving it into a box I check every 6 months.

I also like that spammers would lose $2000 every time they spammed with this. Don't belive the "spammers are getting rich" BS, most just make a few bucks to buy some chronic for the weekend.

Thumbs up so far.

How about you add this to it:

[AlphaWolf_HK]

1. If the IP address of the sender doesn't resolve to a .mail domain, discard it.

2. If any server on the .mail domain is used for spam, the name shall be terminated.

3. Set up a strict set of rules that define what is spam and what isn't, and all who are registered with a .mail domain must follow these rules, lest they be terminated as well.

Re:How about you add this to it:

[Lord Kano]

3. Set up a strict set of rules that define what is spam and what isn't, and all who are registered with a .mail domain must follow these rules, lest they be terminated as well.

How do you prove it when someone forges headers and makes it look like you've spammed?

How do you get "unterminated"?

I nearly had a stroke when I got my first piece of spam back in 1995, but since then I've begun to take it less seriously. I'm not paying $80 per month for access, so it's not that big a deal to take 10 seconds to delete the spam.

Re:How about you add this to it:

[Anonymous Coward]

Uh......... yeah!

Isn't this exactly what is sez at: http://www.icann.org/tlds/stld-apps-19mar04/mail.h tm?

If it is - hell, I like it!!!!!

FUSSP

[McDutchie]

This is, indeed, yet another Final Ultimate Solution to the Spam Problem.

Re:FUSSP

[Anonymous Coward]

That list isn't complete. What's missing is:

"... you posted the FUSSP to /., and got modded '+5 Insightful'"

new .x

[maxbang]

how about a .stupid for ideas like this? maybe even a .pointlessdiscussions or .useless? i'll be the first to sign up for .stupid and .useless. You'll be able to find my blog on them.

Re:new .x

[alexatrit]

You could make a fair living selling redirected DNS for the following "useless" or "stupid" domains.

http://joe.is.stupid
http://joe.is.usel ess

There are enough people that buy similar services now. No doubt there'd be more idiots, given the availability of idiotic products.

Re:new .x

[dasmegabyte]

+1, .Insightful

Re:new .x

[Anonymous Coward]

Mind throwing in .redundant while you're at it?

Then we could have a site named redundant.redundant [.redundant...]

I'd probably just link it to slashdot for laughs ;)

Re:Why would I want to register under so many TLDs

[Anonymous Coward]

but not selling 30 or more domain names to each company makes much less money for the registrars..

the whole thing is driven by greed, and it is EXACTLY what the creators of the internet said would happen as soon as greedy asshats got their hands on it.

anyone want to start Internet 1.5? create a wrapper protocol to run a real internet on top of the current mess?

no end in site

[Anonymous Coward]

Sight, anyone?

What am I missing?

[i8a4re]

After reading this article and the one a few days ago about AOL and spam, I came up with this idea

I despise spam as much as most of you. My company is actually about to start a spam campaign against my recommendations. The day they start I will quit. Slashdot, here is my idea on blocking spam. What am I missing?

We all know what IP addresses belong to which countries. At work, we only deal with customers that carry professional certifications within the US. Of our client base, less than 1% of 1% of these customers and potential customers live outside the US or Canada. Therefore, I have blocked most networks outside of the US and Canada. The only exception is .mil. This has reduced my spam problem considerably. Add to this a Bayesian filter and my spam problem is essentially eliminated. This got me thinking...

ISPs should filter e-mail according to the user's requests. When you sign up for an account, by default, you can only receive e-mail originating/relaying from the US. Now, the user can go to their email configuration and pick which countries they wish to receive e-mail from. Most users only receive email from within the US and one or two other countries. If they only receive email from a few people outside the US, then just whitelist those address. If they want, Mexico, for instance opened, then let the user check the box next to allow e-mail from Mexico. Once this is setup, let the user decide if the e-mail failing to meet these conditions should be blocked or just moved to a separate folder for review. Another possibility is that if an e-mail originates from a blocked country and the spam filter thinks it's legitimate or just doesn't get a high spam score, send an NDR that says "Your e-mail looks like spam, but this could be a false positive. In order to deliver your email, please visit this site....." On that site, put one of the many methods to verify a human is actually visiting that site and then deal with the email accordingly.

For most users, the only noticeable impact would be less spam. This would also force spammers to send and/or relay from within the US. Now if they are operating from within the US, we have an IP address within the US's jurisdiction. Granted these may be zombie machines, so if your e-mail server does a reverse lookup before allowing e-mail, these would be denied. Also, we need to get ISPs to block most ports by default. If you want a port opened, you simply request it from your ISP. Add a clause like "by opening these ports, you are taking responsibility for any traffic on these ports. If we find your computer is sending viruses or spam or DOSing, then your service will be terminated." Again, most users would never notice a difference. Those that do notice can have the ports opened.

So now, for the average user, they would only receive e-mail originating or relaying from the US from a registered e-mail server. Now we can track this back to an ISP and shut down the account, seek legal action against the ISP for supporting spam, or black list that ISP. Since the spammer would have to have an MX record, you can get the registration info. This is probably bogus, so if we force registrars to verify the identity of the person, then we could actually track this back to a person. The spammer could probably falsify this too, but every step you add slows them down.

The spammer is going to now have to purchase an account with an ISP in the US and a registrar. Both of these entities should require a method of traceable payment. This means no cash. Now, we should have a means of finding who wrote the check or who the credit card belongs to. We now either have the spammer, the spammer's company (which should lead back to the spammer), or the spammer has now committed fraud. If he commits fraud, we now have the FBI after him and potential of longer jail sentences.

Not that I have to solicit criticism here on slashdot, but I'll ask anyways. What am I missing and why wouldn't this work?

Re:What am I missing?

[alexatrit]

Unfortunately, a new business customer could come from any country. Some business' relay on foreign servers to provide secondary/tertiary MX. US businesses with offices overseas will have overseas IPs unless you use VPN. If your company makes a point not to deal with foreign nations, at the IP layer, your plan may work for you.

Re:What am I missing?

[Anonymous Coward]

So much spam originates from trojaned broadband boxes within the USA. Your technique will not do much to prevent spam from that source.

Re:What am I missing?

[i8a4re]

That is why all e-mail servers should check to see if the sending IP address has an MX record.

Re:What am I missing?

[JonnyCalcutta]

It won't work because most people, and especially companies, do not want to put a limit on who can email them. Simple as that.

I guess if you do what you suggest it will _feel_ successful because you will simply never know about the opportunities you have missed.

Speaking as a mail admin for a publicly listed company, I know my ass would be on the line if it turned out I was blocking legitimate mail from potential clients/employees/investors. Especially if I was doing it in as wholesale a manner as you suggested. As a mail admin its my responsibility to ensure the delivery of legitimate mail - stopping unwanted mail is merely a secondary courtesy.

Re:What am I missing?

[PhxBlue]

Can you give us some more information about how to contact your company? Maybe a few hundred thousand E-mails in their president's inbox would discourage the company from attempting such a technically-stupid tactic.

Re:What am I missing?

[dasunt]

Also, we need to get ISPs to block most ports by default. If you want a port opened, you simply request it from your ISP.

Not that I have to solicit criticism here on slashdot, but I'll ask anyways. What am I missing and why wouldn't this work?

My major fear is as soon as most ISPs switch to a system like this, opening up additional ports will only be possible for an additional cost, or for a more expensive plan.

"You want port 22 opened? That will be an additional $7.95 a month."

Re:What am I missing?

[bechthros]

That's almost exactly what happened to me when me+roommates first ordered a cable line. Since we were stupid enough to tell them we'd be using more than one machine on the line they automatically put us down for the "home networking package", where the cable modem is built right into a router that comes with - according to the tech - *every* port blocked except 80. No ftp, no P2P, no nuthin. Not even smtp clients, webmail only. Unless, of course, you wanted to place an order for "business services".

That was about when I told him to cancel our order, take his equipment and leave the premises. Took seven more visits by the same company before our internet actually worked (but that's another story)

Re:What am I missing?

[Skapare]

First of all, IP addresses don't have MX records.

OK, so maybe what you really meant was to see if the domain name on the right side of the @-sign in the sender's email address has an MX record. That's really not useful because most spam uses forged addresses that do, and it's actually valid for a domain name not to have one if it has an A record pointing to the appropriate mail server.

What you want to know is whether the mail really comes from a server it should come from, and SPF is available to do that. If the mail comes from a designated server, you can apply less spam testing, or possibly accept it with no testing at all. However, if the mail comes from somewhere else, you can apply more tests, or maybe even refuse it. But regardless of how you want to do it based on that information, please do not ever send a bounce message back for any reason unless the sending IP address is confirmed as valid for sending mail as from that email address.

Re:What am I missing?

[Eil]

I'll take a crack.

Therefore, I have blocked most networks outside of the US and Canada. The only exception is .mil. .mil is for the U.S. military. It is not a network "outside of the US and Canada." Consider also unblocking .gov and .edu since spam rarely flows from those TLDs.

Add to this a Bayesian filter and my spam problem is essentially eliminated.

Won't be for long. Combine the fact that more spammers are using compromised Windows machines within the U.S. with the blurb below for why.

ISPs should filter e-mail according to the user's requests.

They often do, to varying degrees. It's been proven that filtering based on content is good in that it significantly reduces the amount of spam, but filters are becoming less and less effective literally by the day as spammers get better and better at bypassing them.

When you sign up for an account, by default, you can only receive e-mail originating/relaying from the US. ... On that site, put one of the many methods to verify a human is actually visiting that site and then deal with the email accordingly.

The biggest problem: You're relying on the intelligence of the user. I mean to say, most of them don't have it. While your process works fine for skilled thinkers and the technically adept, Joe Sixpack can't and won't go through a complicated setup procedure and is even less likely to worry much about a verification response. In order for email to be truly useful to majority of the human population, it needs to be as easy to set up as entering a single login name and password and as easy to use as clicking on 'Send' and 'Get Mail' buttons. Nothing more. It's going to be up to the technologically literate such as you and I to do the hard work of figuring out and implementing a reliable, working solution so that Joe can continue to receive pictures of kittens from his grandmother.

For most users, the only noticeable impact would be less spam.

No. The noticeable impact would be that they have a much more complex setup procedure, mysteriously can't receive emails from certain friends and family in other counties, and get these occasional weird messages that say something about lunchmeat and fake plus signs. If you tell Joe that most spam comes from outside countries and that he should block all mail not originating in the U.S., enough Joes will eventually do it until a large portion of the U.S. can't communicate with other countries. You have just electronically isolated the U.S. from the rest of the world. Good for you. Additionally, the spam would return to normal levels due to compromised machines within the U.S.

This would also force spammers to send and/or relay from within the US. Now if they are operating from within the US, we have an IP address within the US's jurisdiction.

History and experience have shown that legislation is not enough to stop greed.

Granted these may be zombie machines, so if your e-mail server does a reverse lookup before allowing e-mail, these would be denied.

This is closer to the mark. I'm not about to say that I can prove it's a workable solution, but I've been thinking about it for awhile and have come to the conclusion that public key authentication (i.e. being able to prove that you are who you say you are when asked) is going to be the main solution for stopping, or at the very least, working around spam in the future. More on that below.

Also, we need to get ISPs to block most ports by default. If you want a port opened, you simply request it from your ISP.

No, that is unacceptable. If I pay money to access the internet, I want the whole internet, inbound and out. I want my machine to *participate* on the global computing network, not just be another random IP that receives a bit of commercialized content every so often. If I want my machine protected from the ne

spamgourmet

[eatmadust]

The only service that has been able to stop my spam: www.spamgourmet.com (or www.xoxy.net if you're too lazy to type more). Actually, I think spamgourmet gets recommended on almost every /.-spam-post!

More useless TLDs for the ever so geeky geek

[aardwolf204]

Ohh! TLDs! Lets see how much useless crap we can come up with!:

.spam - everything thats spam
.sex - all those pr0n sites
.troll - because you know they'll stay in their own domain
.h4x - let them h4x0r to themselves
.blog - now we can exclude these from searches!
.trek - for everything except Enterprise NX-01
.estaog - another great tld for your hosts file
.net - just give it to M$'s marketing team already
. - one step closer to having www./.


Yay! More TLDs! Thats just what we need. I cant wait to exclude all these new TLDs from my Google searches just to find that there's nothing left on the net but www.BringBackThePorn.com

Did I miss any?

Re:More useless TLDs for the ever so geeky geek

[squiggleslash]

Just to be pedantic and a smartalec and get accused of taking a joke far too seriously ;-)

. - one step closer to having www./.

Whisper it quietly, but there already is a dot at the top level. Every domain name ends in ".". By omitting the dot you're giving your resolver permission to search for the domain within your search path (though few will unless it contains no dots at all.)

This usually bites people on the rear when they're entering names into one of BIND's configuration files, you'll do something like:

@ SOA example.com
www CNAME www1.virtualhosting.example.net

and then find that www.example.com resolves to... www1.virtualhosting.example.net.example.com.

So what you actually want is for a new TLD "/" to be created...

Re:More useless TLDs for the ever so geeky geek

[SmackCrackandPot]

.illegal - Anything that your mother wouldn't approve of.

Re:More useless TLDs for the ever so geeky geek

[nukem1999]

Technically, if . was a TLD, the address would be http:///...

Re:More useless TLDs for the ever so geeky geek

[JoeBaldwin]

Also: .troll - Actually, the new Slashdot domain .goatse - Scaring children with more efficiency than ever before .newbie - Put everybody who has been on the web for less than a year in this domain. Then get every machine in the world to firewall it off. PROFIT! .microsoft - See .newbie, but replace "everybody who has been on the web for less than a year" with "everybody who uses Windows or another equally bug ridden script-kiddie attractive mess, the stupid bumfucks". .phbbait - new home of ZDNet.

Re:More useless TLDs for the ever so geeky geek

[Anonymous Coward]

how about .preview, biyatch?

Re:More useless TLDs for the ever so geeky geek

[aardwolf204]

considering the trailing "." at the end of the TLD (ok I knew this one, . is the parent of all TLDs) the address would be:

HTTP:///. or you could just ommit the . and have it HTTP:///

Technically, if . was a TLD, the address would be http:///...

You've got two extra dots in there, what are you trying to do, go up one level?! -snicker-

Now if we can get unicode domains why cant we let all ascii and ansi characters (255) be domain names. I want the smiley face domain name (alt-135?).

Re:Why would I want to register under so many TLDs

[unfortunateson]

And what about the cases where .gov is a different organization than .com, such as "whitehouse" (to use a bad example) or "PDF" (.com is a process development consultant, .org is the Parkinsons Disease Foundation, .net is another consultant, .biz is a forms processing product PDFTyper...).

Who gets .mail in those cases?

no end in sight is right

[quelrods]

This is just like most solutions proposed, if EVERYONE adopted it, then it would work, otherwise it's futile. Though, if you run your own mailserver, you could decide to only accept messages from .mail's but i don't see aol.mail, yahoo.mail, and friends being up anytime soon.

change to SMTP over SSL

[Muerte23]

Why not change so that SMTP servers ONLY accept connections over SSL? And then only accept certificates that are signed either by a central authority or by people whose certificates are signed by those people...

Then you could have a distributed revocation authority where people could send copies of spams (still over the SSL network to eliminate fake spam for DDoS purposes). You don't want to get your certificate revoked, so maintain your server!

This makes the system more or less secure, and puts the burden onto mail server admins. You want your regular users to be able to send mail? Then don't let random people send spam.

Individual servers could then implement whatever authentication they liked for their users to be able to send. Maybe a C/R system or authenticated logins. Whatever.

Muerte

ps. i keep posting this idea. ha!

Re:change to SMTP over SSL

[Just Some Guy]

And then only accept certificates that are signed either by a central authority...

Because I can't think of one single entity that I'd trust to manage such a thing at a global level. Verisign? ICANN? Hah!

...or by people whose certificates are signed by those people.

Verisign signs J. Random Spamfriend's certificate. JRS signs a spammer's certificate. See the problem? Maintaining a global PKI with near-real-time revocation is a non-trivial problem.

Re:change to SMTP over SSL

[Muerte23]

Well, I think it's probably impossible to actually eliminate every single last piece of spam.

As for infringing people's rights - you as a spammer have no rights to use my SMTP. As an ISP I would provide mail services for my paying customers. If one of my customers wants to run their own SMTP server, I can threaten them with their life, then sign their cert. If they spam, their cert gets revoked and my cert takes a "reputation hit". Or something like that. My honest users can send email to whoever they like.

But it's absolutely ridiculous to continue with the notion that anybody anywhere can run an open SMTP relay and expect the rest of the world to be responsible to blacklist them when they start spamming.

And there doesn't have to be necessarily one cert authority. Just an angreement on who constitutes root authority.

I think it would scale reasonably well. If each email contains the signature chain, then the server only has to have a copy of the public keys of the root authorites in order to verify the chain of trust. The sub-signers can attatch their keys to the email.

And who says we have to get rid of normal SMTP? If you wanna have some vanilla server that doesn't use SSL, there's no stopping you. You just can't send email to someone who only accepts trusted SSL connections.

The key here is the idea is that you can sign sub-keys. This removes the absolute control from the central authority, but puts the responsiblity on the server admins. And a very mini-PKI gets sent along with each email. Or available upon request from the originating server. Or something like that.

Sure you would still get spam at first as unwise people sign bogus certs, but then these get revoked and eventually it settles down.

Muerte

Re:change to SMTP over SSL

[Just Some Guy]

If they spam, their cert gets revoked and my cert takes a "reputation hit".

I understand what you're saying, but unless you've designed a PKI before, you can't imagine how much unintentional hand-waving that statement carries. There are basically two ways to manage revocation lists: a central server pushes the information to clients, or clients poll the master servers. There are some very significant drawbacks to either approach, and are beyond what I care to go into in a Slashdot post.

And there doesn't have to be necessarily one cert authority. Just an angreement on who constitutes root authority.

That's exactly the situation we're in now with current SSL certs. Basically, how do we get together and decide which giant entity is going to be the One True Root? It's sort of a Douglas Adams paradox: I wouldn't trust any organization that wants to be the central registrar.

I'm not saying that this is an inherently bad idea, but there are some very real technical and social obstacles that I believe you're glossing over.

Re:change to SMTP over SSL

[Muerte23]

Thanks for the honest appraisal. It's nice to get feedback instead of flaming.

Ho, i haven't designed a PKI before (obviously), I was just trying to put up an idea.

Hell, Joe Schmoe could be the root authority. he signs keys for MIT, AOL, Earthlink, icrosoft, Apple, UC Berkeley, the federal government, etc. Then they sign whoever the heck they want and he puts his key up on a bunch of web pages for verification.

Maybe I used SSL in the wrong sense. I mostly just meant that every email accepted by a server from another server would be signed by a tree of trust.

Sure it would add some size to each email, but it would have nested series of signatures with the root auth being the top. And a URL in each sig where the full public key could be downloaded if it wasn't cached locally.

As for revocation, I guess it would have to be some sort of a nightly thing where you poll your regional (?) copy of the master server. Or something. Like DNS i guess. And if the keys expired every year (or so), the revocation database might be kept at a reasonable size.

And if your users didn't care about _receiving_ spam, you wouldn't have to poll for revocation at all!

So a 0-minute compromised key would be able to generate spam, sure. But for not much longer than a day, and the resulting punishment would remind the upstream key signers to be more diligent in the future.

Muerte

ps. i don't know if i clicked the right link i'm not trying to reply directly to my own comment. :)

Re:change to SMTP over SSL

[RAMMS EIN]

This is quite similar to what I and others have been suggesting: use PGP. The sender encrypts a digest of the message with his private key, you decrypt with their alleged public key. If it matches with the digest you calculate, you know that:

1. The message is what the sender sent
2. The sender has the private key

Form here, you can go two ways. You can switch the whole world over to using PGP and implement networks of trust, revoking keys used for spamming, etc, etc. Or you can apply the solution to yourself only, require everyone to use PGP for mailing you, and reject all unsigned mail, assuming it's spam.

A few more ideas are accepting unsigned mail from known good addresses (so that your contacts don't have to start using PGP all of a sudden), and setting up a contact form on a web page to allow random people to contact you.

Personally, I don't get a lot of spam. Since I registered my domain, I use a new address for each organization I deal with. If I start getting spam on one of these addresses, I simply block that address, and as a bonus I know who gave me away. Unfortunately, I made a few posts on mailing lists with my real email address, which accounts for the few pieces of spam per week I do get.

Re:change to SMTP over SSL

[Just Some Guy]

Thanks for the honest appraisal. It's nice to get feedback instead of flaming.

You bet. I disagree with your idea, but that's not a person indictment. :)

Hell, Joe Schmoe could be the root authority.

The problem is, what happens when Joe Schmoe becomes glacially unresponsive or starts making heinous new policies to abuse his position of power? Once the system is entrenched, it may not be easy to simply switch the root to a new entity. For example, I don't know of anyone who doesn't dislike Verisign, but we still accept their authority because the cost of switching is more than we want to pay, or than we can expect others to pay.

Have you looked at the SPF anti-forgery protocol? Basically, it's a way to reject all mail that can't be proven to originate from the claimed sender. I am a big fan of this approach since it forcers spammers to use their own domain names for sending, and even though they're able to buy new ones at will, suddenly they're forced to eat operating expenses that they didn't have before SPF (assuming it catches on). It's not perfect, but it's certainly a start.

You know, your proposal is similar to a DNS blackhole list in reverse, where known-good domains are whitelisted instead of having known-bad domains blacklisted. You could implement such a system today, if you wanted, where you would register "good" mailservers and return "spam positive" answers for all queries for servers not listed in your database. Make your clients use SPF so that spammers can't forge email as coming from one of your whitelist entries and voila!, your own personal web of trust with you as the root.

Business Plan

[genixia]

1. Sell 'spamless' .mail domains for big $$$ to fortune 500 companies.
2. Sell 'spamless' .mail domains for smaller $$$ to established companies.
3. Sell 'spamless' .mail domains for $9.99 per annum to any Tom, Dick or Harry with the cash.
4. ???
5. Profit.

Does anyone think that this wouldn't happen?

Re:Business Plan

[Patrik_AKA_RedX]

6. Wait 6 months.
7. sell bypass program to spammers.
8. ???
9. More profit!

Re:Business Plan

[dasmegabyte]

Dude, if steps 1, 2 and 3 make money, you don't need an intermediary "???" step to attain Profit.

We call this alternate model "Business." It's not so popular on /., but I understand it's pretty big elsewhere.

Good luck

[deadmongrel]

although this might *seem* a good idea its not going to work. Good luck implementing this outside the united states. Most of the spammers forge email headers. would it be impossible to forge the email servers on your "soft whitelist"? Again the only real solution to spam is to stop buying from it. once the morons who support spammers financially stop the cash flow spam will stop. Again we still would have probles with worms sending spoofed emails.

Re:Good luck

[afidel]

um, we have this cool tool called reverse DNS that allows us to confirm that the machine we are talking to does indeed have a legitimate entry under the DNS name they are purporting to send mail from.

Re:Good luck

[dipipanone]

There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order

This message has been brought to you by Well-scrubbed Geeks for a Free America.

Re:Good luck

[paradizelost]

Umm, i dunno about you, but i've gotten a lot of email with no point, i.e. lots of random words filling the email message. These sell nothing, yet i still recieve over 50/day. This is a good way to stop that kind of spamming. It's one thing when its an ad for v14gra, but when it's not even an ad, what the hell is it for????

Re:Good luck

[golgotha007]

i don't like this form of validation. I have many business customers running mail servers using business DSL from various ISP's. These IPS's do not allow for custom reverse entries on their DNS servers.

This form of validation would cripple thousands of businesses.

Re:Good luck

[Jahf]

Unfortunately that doesn't do much good when almost no one uses that feature.

My domain gets NAILED by people who forged spam with as from it. I ended up doing the Bad Thing where I now simply filter out any MAILER-DAEMON-like address before it gets to my system. Only local daemon messages get to me.

I'm not kidding when I say I was getting 100+ bounced messages every single day because of other sites rejecting the SPAM that was forged with my address.

I guarrantee that I haven't got any DNS entries for IPs that are hosted overseas. Which means every single mail server that has been passing this SPAM -or- bouncing it has not been checking to see that the DNS is proper on the originator -or- the method is so sorely lacking as to be useless.

it's the difference between theory and practice ... and in this case practice breaks the theory.

Re:Good luck

[aridhol]

I think it's there to poison Bayesian filters. If you mark those as spam, it gives you a higher chance of falsley marking real mail as spam; eventually you'll probably give up on the filter.

Re:Good luck

[drinkypoo]

Those customers should get better business DSL. Even pacific bell would delegate control of your reverse DNS, and they would also take changes via e-mail (slow to respond, but they still made them.)

Barring that, they can get hosting (DSL has crappy upstream anyway) for their mail cheaply enough I'm sure, especially if it's just for sending, and get validation via cryptographic means between them and their relay. If services like this do not exist today they will soon enough, and given the global nature of the internet, for any but business-level communications (such as legitimate mass mailings) it will be reasonable to relay mail through servers located anywhere in the world.

Re:Good luck

[hazem]

I think they're trying to muck up statistics based filtering by sending junk in addition to spam.

Re:Good luck

[garcia]

you shouldn't be required to have the 4th octet delegation for mail. There is ABSOLUTELY no reason that reverse is required to host a mail server.

Re:Good luck

[rvega]

I agree with you on this. I manage the IT infrastructure for the four European branch offices of an American company, and I take advantage of the cheap, fast DSL lines in these offices to route outgoing SMTP mail, instead of routing it over expensive, slow WAN lines back to corporate headquarters in California to be distributed out our "official" pipe. So far so good. Unfortunately, many of our European customers have subscribed to blacklists banning the dynamic IP ranges given out by many ISPs, like Deutsche Telekom. There goes my great solution.

At the same time I was going through all this frustration, my colleagues back in in California actually configured our incoming mail server to use just the kind of dynamic-IP blacklist that was giving me a headache! Not too funny. Well, they've removed the blacklist now, which is good.

Still, I do wonder what the incentive is for the ISPs to use dynamic addresses. Are they oversubscribing their IP ranges? That seems stupid. Otherwise, why not give all customers their own, single, static address? Some of them are reserving this for a higher-cost "business DSL" service, but it would be up to the customers to put pressure on them to remedy this situation.

Deutsche Telekom, for example, makes it very expensive to get a static IP address. My ISP in the Netherlands, on the other hand, XS4ALL (an outstanding outfit, IMHO) on the other hand, provides me with a static IP address for my business-class connection at work, but also for my entry-level connection at home. Customers should flock to the savvy XS4ALLs of the world and force the change.

Maybe I'm too hard on Telekom and their likes. Maybe they have a good reason. I'd like to hear it.

Re:Good luck

[leerpm]

Maybe I'm too hard on Telekom and their likes. Maybe they have a good reason. I'd like to hear it.

There is a good reason. They actually don't have that many static addresses to hand out. The registries just will not give them enough (because then the registry would run out!). So they have to keep their prices sufficiently high enough so thaty they can actually handle the customer demand for static adddresses. This will be fixed once IPv6 is rolled out, until that time though, you can expect it will become even harder for most organizations to get static addresses.

Re:Good luck

[drinkypoo]

On the contrary, it would provide a potentially verifiable trail. I think it would be a good idea to require matching forward and reverse for mail servers.

Re:Good luck

[Shakrai]

There is a good reason. They actually don't have that many static addresses to hand out. The registries just will not give them enough (because then the registry would run out!). So they have to keep their prices sufficiently high enough so thaty they can actually handle the customer demand for static adddresses. This will be fixed once IPv6 is rolled out, until that time though, you can expect it will become even harder for most organizations to get static addresses.

I don't buy that excuse. Cable and DSL are always on. That means the customer always has an IP address. Even if the customer turns their PC off chances are the IP address is still reserved for some time (DHCP doesn't instantly time-out ya know?).

I think it has more to do with blocking servers and preventing people from using their home DSL account to host a Counterstrike server.

As a random side note I've held the same (supposedly dynamic) IP address on Roadrunner for seven months now. Explain to me the value of them using dynamic addresses again?

Re:Good luck

[Anonymous Coward]

No, you just need the SMTP server to give the .mail hostname it thinks it is, then do a forward DNS on that hostname to make sure it resolves to that IP.

Re:Good luck

[negacao]

Uhm, what part of DNS aren't you understanding?

If mail comes from XXY.NET, IP 1.1.1.1, you do a reverse lookup on 1.1.1.1, and find XXY.NET; irregardless of the connection.

If your servers aren't configured correctly, you might just get back the DNS name from your *GASP* DSL ISP.

E.g. quit bitching about the method when it's your own damn fault it don't work.

Re:Good luck

[FedeTXF]

I never saw one of those, but I think statistical filters are quite good at stopping spam right now. they are the best toos so far and the only that lasted more than 1 week after spammers detected its existence. It's a great idea with a good and not so good implementations. It's also not a deifnitive solution, but makes life in hell a bit easier.

Re:Good luck

[His Shadow]

"There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now." Yoink!

Re:Good luck

[aggieben]

and all it takes is for a spammer to find ONE open relay that doesn't do reverse lookups. There are more than enough of them out there.

Re:Good luck

[afidel]

Sorry but my ISP, I, and many others disagree with you. We have the right to block email from any source we wish and many have decided that spam is enough of a problem that it justifies this step.

Re:Good luck

[kaden]

But as the recent article about the guy who loved buying from spammers proved, Spammers have an effective business model because they only need a tiny percentage of their victims to bite before the spammers make a profit. You can convince 99% of people to boycott spam, but spammers still win because of that 1% who don't care.

I know this is impossible for any number of reasons, but wouldn't the solution be to make it illegal to buy from spammers? I imagine the huge bulk of their sales are to people in the US/Canada/Europe, where such a law could be enforced (were it not unconstitutional and whatnot).

Re:Good luck

[afidel]

That's why I subscribe to a couple RBL's that ban almost exclusivly based on open relays.

Re:Good luck

[eparusel]

1) They don't have to worry about clueless users causing IP address conflicts as much.

2) If they change something around, they don't have to contact you to change your IP.

Re:Good luck

[pjt33]

That's already possible. I haven't noticed that spam is dead.

Re:Good luck

[Alan]

Well, as I understand if it your DSL provider doesn't let you set up reverse DNS you'll get blah.blah.dsl.com instead of xxx.net regardless of your server set up, because reverse DNS has to be delegated from them to your servers. Not all DSL providers do that, and not everyone has DSL providers in their area that'll do that.

Re:Good luck

[Xenna]

In your situation I would probably have used a colo server as a mail hub for my 4 branches. Of course you don't want colo service from xs4all cause they suck at that (and at some other things as wel).

I think most Dutch ISP's - even the bad ones - hand out static IP's for DSL lines. Dynamic IP's for DSL suck (geez I sound like 14 year old here ;-)

Xenna (A satisfied xs4all DSL user)

Re:Good luck

[Shados]

It works a little like fitness centers and stuff... A lot of ISPs not only oversubscribe their IP range, they even oversubscribe their bandwith and the like... When I worked as a tech support monkey, we were quickly told that a -huge- (enough to make anyone on slashdot say "WTF?!") fraction of the subscribers barely use their internet access...

hell, I even remember a customers who had called to get his connection setup...he was paying extra for the "super speed super bandwith" package that was almost 100$ (canadian, mind you) a month, for 3 years and never even had a network adaptor of any kind to use it until then... And its a common story... And cable to some extent yes...but a lot of xDSL, on pppoe, are definately not always on, even if the physical link is always there.

And its pretty close to instant...in huge ISP, have 2 connections (a dialup or whatsnot?) at the same time...disconnect from PPPOE, and wait about 5 seconds, then ping your old IP of your xDSL...Chances are good it has already been reasigned... Messed me up once when our company's router had reseted without me knowing, and tried to access the router from outside by IP, and ended up on the -exact same router model, but from a different person-, cuz the IP had been reasigned...how long did it take me to realise why my password wasn't working...I felt so dumb.

For your roadrunner...yes, many cables ISPs are like that...and rarely change the IPs...you have a point. Might as well give you a static. Though the fact that a huge portion of their customers dont use their connection at all, is still a fact.

Re:Good luck

[SillyNickName4me]

> Sorry but my ISP, I, and many others disagree with you. We have the right to block email from any source we wish and many have decided that spam is enough of a problem that it justifies this step.

Except for the fact that your proposed solution solves very little and causes major inconvenience.

In other words, it is a bad solution.

Why?

Now you know that whatever the mailserver suggests its hostname is, actually resolves to its IP.
It fails to verify in any way if that machien should actually be deliverign mail, and if the mail it delivers should be delivered by that specific server.

So, you ensure that people match the configured hostname with the one from a reverse lookup, and they can still spam you just as easily.

The one thing that does help is adding a specific record type for outgoing smtp servers to the DNS spec and verifying machines against that.

That verification can be done by taking the ip of the conencting server and comparing it to the forward lookups of any outgoign mailservers as reported by dns.

This actually addresses part of the header forging and does make it a lot more difficult to send spam, unlike what you suggest.

Re:Good luck

[EpsCylonB]

I don't buy that excuse. Cable and DSL are always on. That means the customer always has an IP address. Even if the customer turns their PC off chances are the IP address is still reserved for some time (DHCP doesn't instantly time-out ya know?).

It's only 30 minutes or so before it does, so if a home user turns their compy off at night then they will have a new ip every day.

Re:Good luck

[golgotha007]

Uhm, what part of DNS aren't you understanding?

obviously more than yourself.

you see, just because you have reverse entries in your own DNS servers doesn't mean that you're authoritative for those IP addresses.

you might want to check out ARIN for more information on this.

p.s. if you want to prevent yourself looking like an ass in the future, try this:
if you're not 100 percent sure about a particular subject, send in a probe before you send in the missles.

Re:Good luck

[MaineCoon]

I can unplug my DSL modem for 2 minutes from Verizon, and get a new IP address. Not all providers are as generous in their DHCP timeouts, and Verizon isn't one of the small providers.

- MaineCoon

Re:Good luck

[asdfghjklqwertyuiop]

There is ABSOLUTELY no reason that reverse is required to host a mail server.

Every host on your networks should have reverse DNS entries... that's just the competent way to run a network.

Re:Good luck

[asdfghjklqwertyuiop]

The ISP doesn't have to delegate anything. They could just make the change to their reverse lookup zone on your behalf either by responding to email requests or providing a web interface to do it.

Re:Good luck

[asdfghjklqwertyuiop]

you see, just because you have reverse entries in your own DNS servers doesn't mean that you're authoritative for those IP addresses.

If your ISP has delegated a reverse lookup zone to your DNS servers, then yes you are authoritative. That's literrally what the word authoritative means.

Re:Good luck

[Tassach]

I think it has more to do with blocking servers and preventing people from using their home DSL account to host a Counterstrike server.

If that's the purpose, then it's horribly ineffective. It's trivial to set up a dynamic DNS solution which is virtually transparent to the outside world. It's not a perfect solution, but for a low-traffic domain, it's satisfactory.

In my setup, I have a cron job on my Linux box which runs zoneclient every 10 minutes. Zoneclient queries my router for it's external IP address, and if it has changed since the last check, it tells my DNS provider to update the appropriate A records. 10 minutes is a pretty arbitrary number, it's good enough for my purposes. I could crank the cron job up to run 1/min without any trouble, but that seems like overkill to me, since I usually only wind up getting a new address once or twice a month. Dynamic DNS probably isn't good enough for a serious production server; but it's adequate for a private mail server, especially if you have an external store-and-forward backup server to hold your mail temporarily. For a game server used by you and your friends, this setup works perfectly.

Re:Good luck

[biz0r]

I setup/run and code for the 2nd largest DSL provider in Houston TX (not saying much, SWB is a monopoly over here), and I can say that DHCP is often an absolute necessity on cheap DSL accounts. Why? Because your average Joe's head would explode trying to configure his network. That or quickly cancel and go to another ISP that wasn't such a PITA to configure.

And no...we do NOT oversubscribe our IP address ranges. That would be lunacy, as 90% of the residential users out there have a router or leave their PC on constantly. I can't count on there being a certain percentage that won't be utilizing their connection...there needs to be an IP for each.

Re:Good luck

[Tassach]

If your ISP has delegated a reverse lookup zone to your DNS servers

That's a pretty big "if". While it's true, it's going to be irrelevant to someone who doen't have their own a static IP block. If your ISP isn't going to give you a static IP, they sure as hell aren't going to delegate reverse lookups.

Re:Good luck

[McNally]

As a random side note I've held the same (supposedly dynamic) IP address on Roadrunner for seven months now. Explain to me the value of them using dynamic addresses again?

I work for a small ISP on an island off the coast of Alaska. We're about to make some major changes to our network, changing our own service provider and moving to a new block of addresses at the same time. Without DHCP there would be no hope of making the transition smoothly because coordinating an address change with thousands of customers, many of them technologically challenged, would totally overwhelm our staff. Thanks to DHCP we can get nearly everyone using the new address block with no effort on the customer's part and only a brief interruption in service for most folks and save our energy to concentrate on the small business and advanced home-use customers who have elected to pay extra for a static address.

Re:Good luck

[Shakrai]

I setup/run and code for the 2nd largest DSL provider in Houston TX (not saying much, SWB is a monopoly over here), and I can say that DHCP is often an absolute necessity on cheap DSL accounts. Why? Because your average Joe's head would explode trying to configure his network. That or quickly cancel and go to another ISP that wasn't such a PITA to configure.

I was the system admin for a small WISP in Upstate New York. I used DHCP for the same reason -- we didn't want to reconfigure CPE everytime we readdressed our network. But I used a Linux box as the DHCP server and assigned each customer a static IP in the dhcpd.conf file.

Not only did this give our customers a fixed IP (why not if they are going to have an IP 24/7 anyway) but it made bandwidth accounting/management much easier.

Re:Good luck

[Shakrai]

And no...we do NOT oversubscribe our IP address ranges. That would be lunacy, as 90% of the residential users out there have a router or leave their PC on constantly. I can't count on there being a certain percentage that won't be utilizing their connection...there needs to be an IP for each.

I missed this when I originally replied to your comment. Thank you for pointing that out. I don't think anyone in their right mind would oversubscribe address ranges on a always-on broadband solution. It obviously makes sense in a dialup environment but why the hell would you do it in a broadband one?

As an aside I remember an old small town ISP around here that gave each dialup customer their own fixed IP. They had v.34+ USR Couriers on each analog phone line and were (in my experience) ten times more reliable and faster (on downloads and uploads) overall then any v.90 ISP I ever used back in my dialup days. I loved them. Then Earthlink bought them out and killed everything that made them cool (including the local game servers). Bah!

Re:Good luck

[NoMercy]

The value is simple, it costs less to implement for large numbers of customers... I pay a little bit more for a guarantied static IP, or 8, and it works a treat :)

Re:Good luck

[scrytch]

um, we have this cool tool called reverse DNS that allows us to confirm that the machine we are talking to does indeed have a legitimate entry under the DNS name they are purporting to send mail from.

My RDNS can say "mail.slashdot.org" if I want it to. Your automated tools good at parsing WHOIS output yet?

Re:Good luck

[Kent Recal]

Why exactly is this modded insightful?

1) What the heck are you talking about?

2) An ISP doesn't often "change something around" that forces them to re-assign your ip addresses. Just as your phone company doesn't often "change something around" that forces them to assign you a new phone number.

*cough* Have you been causing your ISP "IP address conflicts" lately? ;-)

Re:Good luck

[timftbf]

Nonsense. This was true in the days of dial-up - the expectation was that you'd have one dynamic address for each modem in your modem pool. I worked for the only UK ISP to offer a static IP address with a useful hostname and working reverse DNS to *every* dial-up user as a matter of principle through the mid-to-late 90s, and the hostmasters did have a hard time justifying each new block of addresses to RIPE.

The expectation with DSL or cable is that all of your customers are connected all of the time. Go to RIPE with *real* subscriber numbers, and you will have no difficulty getting a corresponding block of IP addresses. RIPE do not have a shortage, they get new /8s from IANA as and when they need them. IPv4 will run out, but not tomorrow. It's going to be something that requires lots of new addresses all at once, like mobile phones all acquiring an IP address, that prompts the move into v6.

The "good reason" they won't do it is market segmentation. If you can make static IP addresses, user-defined (or even any) reverse DNS, the permission to run servers etc "business" or "premium" services, you can screw customers out of a whole bunch of extra cash. As long as all the broadband providers loosely agree on what's a "business" feature and what's a "residential" feature, geeks are stuffed :(

Regards,
Tim.

Re:Good luck

[Solosoft]

Most of the time Cable providers have a "semi" static IP address. Ive had mine for months and months. Also some ISP's use the MAC address of your Network card connected to the Cable modem (I know Rogers does this in canada since your MAC address is actually in your rdns).

DSL uses PPPoE (well over here it does) and your IP does change often. Whenever you disconnect it changes.

:)

Re:Good luck

[Yottabyte84]

Then you verify that the forward DNS and the reverse DNS match....

Re:Good luck

[Anonymous Coward]

There are a couple I can think of off the top of my head:

1) not having to mess with re-configuring systems for customer churn. When you came up, you got a generic IP, and they didn't have to configure anything special for you. If everyone gets static IPs, they have to keep track of which IPs are allocated/free, and build some whole system around assigning them. DHCP handles that for them.

2) It also allows them to make sure you have the "right" nameservers and default gateway, which makes their Tier 1 folk happier.

Re:Good luck

[lucifuge31337]

1) They don't have to worry about clueless users causing IP address conflicts as much.

2) If they change something around, they don't have to contact you to change your IP.

Its called a static DHCP lease.

Many business class DSL services offer static IPs this way already, and have been doing so for years.

Re:Good luck

[Anonymous Coward]

It is easier to change the behavior of a few legitimate business then it is to change the behavior of a teaming horde of morons.

Re:Good luck

[scrytch]

> Then you verify that the forward DNS and the reverse DNS match....

And you blow away loads of legit mail when you drop mail that fails this test. Best you can do usually is flag it.

SPF could nip this trick in the bud, though it is specific to mail. I suppose nothing stops SPF from being generalized with the existing service resolution hack though (e.g. looking up TXT records for _XMPP_.slashdot.org or _IRC_.slashdot.org for example).

Re:Good luck

[jafiwam]

Reverse DNS confusion ensues.

Many, many mail admins are using reverse DNS as a means to block spam already. It is highly effective as the goobers that don't do it are either virus-zombies or goobers that shouldn't be sending mail to my server anyway. Anybody that is serious about email can do the reverse pretty easily.

However there are also many many people in this thread that do not understand it, or understand how it works with email or spam blocking.

Reverse DNS checking for email has two options:

a) check that reverse DNS exists (i.e. that when one is done a response comes back)

b) check that revesse DNS matches up with an particluar hostname and the hostname with that IP address. I.e. if mail comes from mail.yourisp.com from 127.0.0.1, then the reverse for 127.0.0.1 is a zone 1.0.0.127.in-addr.arpa that holds the hostname "mail.yourisp.com".

MOST email admins DO NOT USE option B. They use option A. That means any crap-wildcard reverse DNS the ISP chooses to put in will work just fine. They do not care if the reverse is correct or not, just that it is there. This is for speed reasons (all those lookups take time, CPU time and bandwidth), as well as NATing reasons, you can't name a single IP both www.companyname.com and mail.companyname.com in reverse.... so matching the reverse DNS cannot be used as a criteria for sending mail. It would quickly be shut off as it is an admin's nightmare.

So, most of the time, you just need your ISP to get a reverse DNS entry to say something like "ip-address.modempool.ispname.com" or whatever. No delegation required, no upkeep required, permenent for anybody using that IP.

So before complaining about "i want to run a mail server I have the right to send mail without reverse DNS" be sure you know what is happening with the filtering.

Many ISPs do not bother to set reverse unless there is a reason to... so a lot of times the "not important to the ISP" ip addresses don't get it. That's a pretty good way to filter mail, as if the ISP doesnt know there might be mail coming from it... you probably don't want to get that mail.

Learn more here:
http://www.dnsstuff.com/info/revdns.htm

Re:Good luck

[ckaminski]

That is utter crap. For an always-on connection, there is *NO* reason not to give the end-user a static IP address, other than to wring more money out of the user, prevent them from running "services", and to make network remapping easier. For dial-up, this argument can make sense. Not DSL, not Cable.

Re:Good luck

[anarxia]

You are right DCHP is an essential part for average Joe accounts. The problem is that many providers: overcharge static IPs, force you to buy a business plan to get a static IP or they only sell them in blocks.

For small not-for-profit low-traffic sites ISP policies are a bit of problem.

Re:Good luck

[asdfghjklqwertyuiop]

That's a pretty big "if". While it's true, it's going to be irrelevant to someone who doen't have their own a static IP block. If your ISP isn't going to give you a static IP, they sure as hell aren't going to delegate reverse lookups.

Of course not. But if you don't have a static IP address then you aren't going to be running a mail server... at least not without the help of another mail server to act as a smart host and be an MX host for local domains.

Re:Good luck

[negacao]

*shrug* I assumed you were trolling; anybody who says they have clients for whom they set up mail servers should probably know something about becoming the authoritive NS for the clients IP(s).

Re:Good luck

[poot_rootbeer]

we have this cool tool called reverse DNS that allows us to confirm that the machine we are talking to does indeed have a legitimate entry under the DNS name they are purporting to send mail from.

But what if THAT server doesn't do a reverse DNS lookup on the mail server IT received the message from? Still could have been forged at some earlier point.

Besides which, an IP address can be mapped to multiple DNS names, and vice versa. DNS is not a reliable authentication service.

Re:Good luck

[pauljlucas]

always on. That means the customer always has an IP address.

Uhm, no. Most ISPs that use dynamic IP addresses use PPPoE. If you're idle for about 10 minutes, your connection gets torn down and your IP address gets reclaimed. When you go active again, you reinitiate a PPP session. Because it's over Ethernet (as opposed to being over a 56K modem where PPP was historically used), the reconnect is really fast (about 3-5 seconds).

So no, the customer does not always have an IP address.

Re:Good luck

[poot_rootbeer]

There goes my great solution.

Maybe your solution wasn't so great, after all.

why not give all customers their own, single, static address?

They used to do this in the dorms at college. Do you have any idea how difficult it is to get a non-techie to configure the IP, DNS, gateway, etc. for their machine? Telling a user to just check off the DHCP checkbox reduces support requirements drastically.

My ISP tends to assign me the same IP I had already had more often than not when I go to renew the IP lease. DHCP is used not so much as an address randomization service, but as a centralized provisioning and tracking system.

Re:Good luck

[Anonymous Coward]

I can unplug my DSL modem for 2 minutes from Verizon, and get a new IP address. Not all providers are as generous in their DHCP timeouts, and Verizon isn't one of the small providers.

In all likelyhood, your DSL modem is probably asking for a new address rather than renewing the old one (perhaps it forgets the old address when it loses power). Still, most ISPs would return your old address. Perhaps Verizon has their own custom DHCP server that isn't smart enough to give your old address back.

Re:Good luck

[JofCoRe]

It probably also comes down to ease of administration. To give someone a static IP address, you have to find an address that's not in use, and assign it to the person, and make sure it gets put into a "used" list so that it doesn't get used by someone else. To do a dynamic IP address, you just assign a pool of IP addresses, and you don't have to fuck w/it until you run out of IP's in the pool, and then all you have to do is add more to the pool. (and if you're paying attention, you should notice that your customers are outnumbering your IP addresses in your dynamic pool before it becomes a problem... at least that would be the preferred method I imagine :)

I would imagine that the extra work involved w/a static IP (even though it doesn't seem like much, i'm sure it adds up when you have 1000's of customers) is why they like to go dynamic. Just easier administration...

Re:Good luck

[Anonymous Coward]

I don't buy that excuse. Cable and DSL are always on. That means the customer always has an IP address.

Read up on Network Address Translation (NAT). While all those "always on" connections may have IP addresses, that doesn't mean they have externally visible, constant, routable IP addresses. That's usually what people really mean when they say "static" IP address. The number of externally visible connections in simultaneous use for an ISP is much lower than the number of subscribers.

(For that matter, "always on" connections aren't, necessarily. My DSL has a glaringly obvious lag when you first try to send a frame after a while. While the modem may not disconnect from the DSLAM, there's certainly some sort of resource reservation and reassignment going on under the hood when they detect an idle connection. Sure, you don't "dial", but the net effect is the same.)

Re:Good luck

[Anonymous Coward]

"cripple"? I can find no place in the proposal where this is something mandatory.

Looks to be a nice way of flagging email that won't be spam. Other emails (at least 20% based on my spam/not-spam stats) are not spam either, but those I'll just have to run past my normal set of checks.

I see nothing bad here, in fact quite a bit of good.... ..but then, I read the draft! :)

Re:Good luck

[Tassach]

But if you don't have a static IP address then you aren't going to be running a mail server... at least not without the help of another mail server to act as a smart host and be an MX host for local domains.

Funny, I *do* run a mail server without a static IP address. My current setup has a static backup, but previously my backup mail server was also on a dynamic IP.

Re:Good luck

[not2advanced]

One major thought on this. What about web servers, in datacentres, which use server side languages such as PHP, ASP and Perl to send e-mails out, and SMTP relaying for authenticated users? Admittedly, they could probably be routed via a datacentre-provided SMTP server, e.g. he.mail for he.net, but 1. they'd probably charge more for the services, and 2. they may object. That, and the mass-reconfiguration of many many web servers, every control panel system there is out there... and a major headache for every single webserver provider out there, speaking from experience. On the plus side, spam could be stomped on rapidly by the datacentres from rogue servers, by blocking all mail from a specific server until it was resolved - but I have a feeling they'd charge you to unblock it too, which again would cause problems if it was a rogue user or a rogue script installed by an idiotic user.

Just my 2p.

Re:Good luck

[asdfghjklqwertyuiop]

Funny, I *do* run a mail server without a static IP address. My current setup has a static backup, but previously my backup mail server was also on a dynamic IP.

Yeah you can run a mail server without properly set up DNS, but you're going to run into problems with other mail servers possibly not wanting to accept mail from you. And it is no fault of theirs. Unless your mail server's hostname is dhcp1-2-3-4.isp.net then you're not following RFC 1123. Having matched forward and reverse DNS records is just the right way to set up a network.

As other people in this thread have mentioned, not doing this is a likely indicator that the incoming message is spam coming from someone's broadband-connected windows machine.

Re:Good luck

[afidel]

Umm, mail almost never goes through more than two SMTP servers anymore, the sending and recieving servers. And if it is, it must be setup to only recieve mail from authorized mail servers or else it's what's known as an open relay. We have block lists for those =) As far as multiple servers for one IP, all I have to say is quit being a NAT using cheapskate, the Internet is supposed to be end-to-end. NAT is fine for clients but servers need to be uniquely identifiable.

Re:Good luck

[kinzillah]

Actually, its whatever the timeout is set to. In fact, you can request a lease time, and as long as nothing says the DHCP server isn't allowed to give it to you, you'll get it.

Re:Good luck

[eparusel]

1) User is told to enter certain static IP... User mistypes, and conflicts with another computer. Yes, it's happened before... *gasp*

2) Yes, actually it's happened to me. Twice.
Rogers Cable and Shaw cable performed a "switch" of sorts, with Shaw handling the west of Canada and Rogers handling the east. When the switchover was made, I got a completely different ip, on a differently masked subnet...

-- Another example, a residential 10mbit provider (fibre to buildings in downtown Vancouver)
changed all subscribers to a different netblock overnight about a year ago...

Would you want to have to contact every single one of your subscribers to tell them to change their IP? Please.

Re:Good luck

[dave420]

That's not entirely true... Lots of DSL operators use PPPoE to synthesize the more familiar "dial-up" experience for their users. Horrible. Anyway - they're not always-on services, so they could oversubscribe their IP range substantially.

Re:Good luck

[mpe]

Still, I do wonder what the incentive is for the ISPs to use dynamic addresses. Are they oversubscribing their IP ranges? That seems stupid.

It makes sense to a dialup ISP, where you can assign one IP to each "modem".

Otherwise, why not give all customers their own, single, static address? Some of them are reserving this for a higher-cost "business DSL" service, but it would be up to the customers to put pressure on them to remedy this situation.

With a DSL (cable modem) setup you need at least one IP address per customer. Otherwise the result will be unhappy customers (and potential lawsuits for breach of contract).
It's most likely a wetware issue.

Re:Good luck

[rvega]

Maybe your solution wasn't so great, after all.

Oh, but it was, from a technical perspective. It's just being obstructed by the actions of idiot spammers who have led too many sysadmins to make the IMHO stupid decision to blacklist ALL dynamic IP addresses just because some spammers use them.

In any case, as I forgot to write in my original post, I found an easy way around the problem: Forward my outgoing email first to my ISP's SMTP server, which isn't blacklisted. I've been able to do this in three of my four affected offices. If I can do it, it seems that spammers should be able to do it, too. So, the blacklisting might help with virus-infected zombie machines, but overall I find it a half-assed, inelegent solution. Not that I have a better suggestion...

Do you have any idea how difficult it is to get a non-techie to configure the IP, DNS, gateway, etc. for their machine?

Yes, it's (part of) what I do for a living. But as you've probably read by now in the posts of other readers (and which you would have known already were you a professional sysadmin) DHCP can be configured to always give the same user the same IP address. This solves both problems.

Re:Good luck

[Tassach]

but you're going to run into problems with other mail servers possibly not wanting to accept mail from you.

Very true, which is why my outgoing mail is relayed via my ISP's mail server. I'll agree that static IP would make my life easier, but what I have works well enough.

Re:Good luck

[alexpage]

Hey, you could have put the IP addresses of the local DSL lines in your DNS SPF records, because everybody uses SPF, right? *sigh*

Parent: The best info on the .mail domain

[Anonymous Coward]

The parent contains the best information I have found so far about the .mail domain. Someone has modded it down. Someone mod it up pronto so other users can see it.

Site?

[Anonymous Coward]

The same old discussion, with no implementation in site.

No implementation in sight, either.

Proofread, dumbass.

micropayments to who?

[fullmetal55]

Seriously who gets the money? I don't think the EU will support giving MS or any american organization the money. personally, I think the best place to send the money would be to the UN, have the proceeds go to Unicef or something. But like that'll happen. I don't see micropayments working. besides, what happens when the spammers steal credit card numbers and have people pay for their own spam?

Re:micropayments to who?

[gfxguy]

The receiver gets the money. If you write me, and I respond, we're even. Normal email users would, more or less, break even.

Re:micropayments to who?

[joggle]

That certainly could solve the problem of chain letters.

Re:micropayments to who?

[fullmetal55]

And who administers this process for free? whenever money is transfered there's a cost. Its got to be transfered through something, be it a credit card, etc. it will end up costing more than just the micropayment for an e-mail transfer. nobody would do that free of charge. where does the money go if the e-mail address is non existant? not to mention the logistics of a large corporation to have people getting the money in and the money out... thats a cost, because CEOs aren't going to want to deal with making sure they're paid up... so thats more people, more money... its adding up to a huge cost. it also opens up new levels of fraud. someone says "Send me an e-mail and I'll e-mail you steps on how to become rich!" only he never responds. do you bitch at him through his only contact info? e-mail? he'll just ignore it and collect more and more money.

Re:micropayments to who?

[JuggleGeek]

The receiver gets the money. If you write me, and I respond, we're even. Normal email users would, more or less, break even.

Without getting into who does the administration (apparently for free) or the chances of forgery (incredibly high), I'd like to point out that I receive a lot of emails from discussion lists, newsletters, etc. If those places are required to pay per email, either they pass the cost on to me (and I pay the costs) or they quit sending. SlashDot, for instance, sends a *lot* more outbound email to willing recipients than they receive from those same people.

Re:micropayments to who?

[gfxguy]

Emails like that should be sent with the sender requesting a delivery receipt. If the person doesn't respond, they'd get eliminated from the list.

I admit there is going to be administration costs, maybe a penny an email gets siphoned off for that. It should also be possible to set the price. For example, slashdot could require two cents to recieve email from me, and require me to ask for only one from them. That way they break even. The sending mail system should be able to verify - how much does this user want for this email? If it's greater than X, then don't send it.

In utopia, we wouldn't have to do anything like this, and the net would just be free (and there'd be no spammers), but since we're not living there the only solution people will understand is the financial impact it has on their wallets.

You can create all the filters and fake email addresses you want - it's not a solution, and I'd rather pay an extra dollar or so a month to not have to keep track of five/ten/twenty email accounts. The five minutes it takes to create a new email account to order a product online is not worth my time over a $0.05 charge.

Also, w.r.t. mailing lists, if it's really that important, people should be willing to donate $1.00/year to cover the cost of receiving the list. This would be better achieved using web based tools, anyway, except for the spammers on free sites.

So I'm not saying this is going to happen, I really doubt it will and I doubt people would be willing to adopt it, but then if people aren't willing to accept paying for email then they are either going to have to accept spam, or they are going to have to accept all the extra work they need to put into avoiding spam.

Look at some of the technical solutions people have come up with and ask yourself if it was worth not having to pay what would amount to a couple of dollars for a "normal" user per year. And the technical solutions are not 100% effective.

Then you have the issue of forgery. Yes, that's bad, but how do people forge emails? If some ISP is not locking down their servers, they are going to be hit with a big financial penalty (or be blacklisted). These ISPs (and users who don't lock down their own boxes) won't learn until they are attacked financially.

I support new TLDs

[mackman]

.biz was the best thing I've seen for reducing the amount of spam in my inbox. I've filtered thousands of spam and have received zero legitimate emails from .biz addresses. Lets add more stupid TLDs so we can identify spam more easily!

Re:I support new TLDs

[Anonymous Coward]

Good point, filtering on .biz works great!

But this looks like the opposite, if a .mail checks out (read the proposal), let it in because it's not going to be spam.

I sure know what I plan to do with .xxx !! :->

1.5? sure...

[The Queen]

Who's going to fund THAT one? As long as any endevour requires man-hours, and those man-hours are not 100% voluntary, you WILL have marketing and greed seep in.

I agree with the parent post, there are WAY too many TLDs as it is, and the overlap is insane. Why didn't we stick to .com for business, .net for networks, .edu for schools and .org for non-profits? Why should any corporation be allowed to register a .org???

Re:1.5? sure...

[Anonymous Coward]

>> Why should any corporation be allowed to register a .org???

Incorporation is simply a way of creating a particular type of business entity. It has nothing to do with the profit or non-profit intent of the organization.

Re:1.5? sure...

[pjt33]

Individuals? They're not corporations, networks, schools or NPOs. And you can't just dump the existing country TLDs, because too many people have domains in them.

Re:1.5? sure...

[tony_gardner]

You mean like the for-profit corporation registered at slashdot.org?

quagmire?

[L0rax23]

I still don't understand why the quagmire approach hasn't gotten more widely used. Anyone?

o)

Spam???

[spazoid12]

Could this eventually be the end of spam?

Of course! Because, a TLD is so incredibly different than a domain. Luckily, open relays won't even be a problem!

Phew!

What about duplicate names?

[The Tithe]

So, even if this does go through and we do get a .mail TLD that is for only registerd mail servers. What happens when both companies/people owning the domains x.com and x.net suddenly want to get their x.mail domain to send mail. Who gets it? Maybe they're assuming people will opt for x.com.mail and x.net.mail. But that seems really annoying.

Re:What about duplicate names?

[Anonymous Coward]

There is no "opt" according to the spec, that's just the way it is. the x.com gets x.com.mail and the x.net gets his .mail.

Not annoying since its not used for websites or email addresses, just server-to-server chatter.

Not a bad plan IMO. Maybe some Chinese email will make it to me if it comes from "checked out" companies. I personally refuse all email from Chinese IP space. Ain't worth my time.

Except that

[phorm]

1) You could do this for "resolves to a valid domain" and cut off a lot of the P2P infect spamdrones. Puts more load on your server though

2) You could terminate normal domains used for spam. But when they're profitable, the ISP/registrar doesn't seem to bother

3) See #2. There are lots of ISPs with rules than they know are broken, but the dollars keep the spammers in

And also
4) As somebody who doesn't run a spam-friendly server, has never had issues with (sending) spam, you now want me to register .mail domain on top of my regular one? What if somebody steals that domain... should the .mail not match my normal domain? Seriously, what could be done with .mail that can't be done with a normal domain... they're just letters that resolve to an IP address.

Lemme get this straight...

[OneFix at Work]

You want every little mom & pop company running a 10 year old mail server to register a new domain and reconfigure their box overnight???

Exactly when is this supposed to happen???

For right now, the best solution is to...

1) Block IPs that are causing problems...this can acutally be automated...I'm working on a script at our site that passes all spam identified by spamassassin as a level 20 or higher into a blocklist for our MTA.

2) SpamAssassin...run SA as a service for all users and give them info on how to tailor it to their own preferences...

3) ClamAV...this catches some of the really nasty stuff...the ones that use exploits to "phone home" or run code on the user's machine...

These ARE and will be the only way to stop spam into the forseeable future. The only real way to stop it all would be a redesign of the protocol from the ground-up and that is just not going to happen...SMTP is already too entrenched into the backbone of the internet...it just won't happen...

Re:Lemme get this straight...

[Anonymous Coward]

1) Block IPs that are causing problems...this can acutally be automated...I'm working on a script at our site that passes all spam identified by spamassassin as a level 20 or higher into a blocklist for our MTA.

Yes, but you then create a problem. What if a spammer (with a major ISP account) relays mail through the major ISP's email servers. You can block the IP addresses, but then you cut off all the legitimate customers that use that ISP. The major ISP will eventually cut off the spammer, but that takes time.

Re:Lemme get this straight...

[JuggleGeek]

You want every little mom & pop company running a 10 year old mail server to register a new domain and reconfigure their box overnight???

Exactly when is this supposed to happen???

Between 12:01 AM and 6:00 AM, GMT, on April 1st 2004. That gives us a week to get the word out. If each of us emails 5,000 people, and each of those email another 5,000 people, and...

The only real way to stop it all would be a redesign of the protocol from the ground-up and that is just not going to happen...SMTP is already too entrenched into the backbone of the internet...it just won't happen...

There, we disagree. I think it's inevitable. I doubt it'll happen soon, but SMTP as currently implemented has too many problems. Sooner or later, either it gets redesigned or replaced. Soon? I doubt it. But it's just a matter of time.

Re:Lemme get this straight...

[OneFix at Work]

I don't usually respond to ACs, but this is the reason for only using messages designated as level 20 or higher...the assumption is that a really nasty spammer isn't going to be using a really reliable ISP, because they are (1) too expensive for spam and (2) will be quickly thrown off the network.

Re:Why would I want to register under so many TLDs

[Anonymous Coward]

Good point. All this is really doing is turning things arround from one domain with multiple servers/subdomains ([mail|ftp|www|etc].somedomain.com) to having multiple domains, each with a specific purpose (mail.somedomain.mail, ftp.somedomain.ftp, etc.). In the end, ftp.somedomain.[com|ftp|mail|org] are all going to get pointed to my ftp server, in order to avoid confusion for my users.

The only winners here will be the domain registrars, since companies of any size will have to register more domains as defensive measures to keep from getting spoofed (think of the fun if you owned microsoft.mail)

You want a new goddamned standard?

[Dracolytch]

Here's the goddamned standard... Make it ultra-easy so it's simple to hit critical mass where everyone uses it.

For your domain, put out a text file. In that text file, put the IP addresses or range of your server.

Name the file: mailservers.txt

For example... I would have (for DracoSoftware.com) a page called mailservers.txt. It would contain:

206.67.56.202

If I had a range, it could be either individual IPs:
206.67.56.202 206.67.56.203 206.67.56.204

OR, a range delimited by a dash:

206.67.56.202-206.67.56.204

Once we get sites to publish their legit mail servers, the rest is easy... Setting up servers who do DNS-like caching at your local ISP is easy. Your individual e-mail program can then do WHATEVER IT WANTS with the e-mail... Whitelist/blacklist/take into consideration for baysian filtering... whatever. The important thing is to get the legit mail servers published.

If a mail comes from legit mail-server... Easy.
If a mail spoofs a publicized server... easy.
If a mail comes from an unknown server, mark it as suspicious.

If people want, I'll start posting names of domains that were cool enough to create a mailservers.txt file.

Ready??? GO!

~D

Re:You want a new goddamned standard?

[jagilbertvt]

um, legit mailservers for your domain are already advertised via mx entries in the nslookup (how else would mail get sent to you?).

Re:You want a new goddamned standard?

[dasmegabyte]

So...your proposed spam solution is an MX record???

What's your solution to pop up ads...the off switch?

Re:You want a new goddamned standard?

[El Cubano]

Here's the goddamned standard... Make it ultra-easy so it's simple to hit critical mass where everyone uses it.

Take a look at this: Sender Policy Framework.

There is even a wizard that walks you through the creation of the appropriate TXT records for your DNS zone file.

Re:You want a new goddamned standard?

[mattdm]

This ("this" being SPF -- see other comments) is basically a *reverse* MX. MX says where mail should go; this says where it's okay for mail to come from.

Re:You want a new goddamned standard?

[Dracolytch]

Basically a reverse MX record... Who said the answer had to be hard?

~D

Re:You want a new goddamned standard?

[GigsVT]

Which means that people who can't connect to any server other than their ISPs on port 25 due to firewalling will never be able to send mail that originates from an address other than the one their ISP gave them.

The ISPs will love it, it's a perfect customer lock-in tactic. You don't want to switch ISPs, because you sure as hell can't take your email address with you, or use one that isn't associated with your ISP!

Re:You want a new goddamned standard?

[Dracolytch]

Looks good to me. My new standard is now obsolete. ;)

~D

Re:You want a new goddamned standard?

[beakburke]

There are two solutions to this. 1. Webmail. (Yeah it sucks, but it is a workaround) 2. Use SMTP over SSL on the alternate port, if your sending domain offers it. Firewalling port 25 is an ugly, desperate hack that Large ISPs use to keep their network from being blacklisted. If your ISP adopts SPF records though it shouldn't need to block outgoing port 25, as it has a method for others to avoid spam generated by its customers.

Re:You want a new goddamned standard?

[Anonymous Coward]

But is it (SPF) a reverse MX for the connecting IP address, the envelope from or the header From: address?

I think the grandparent is talking more about a reverse MX record for the sending IP address, not the domain names used in the from address (which btw is why people are bitching about SPF, because the from's were never designed to be linked to each other or to the sending IP in the design of SMTP and that is why SPF breaks forwarding)

AOL may have a few good ideas.

[stecoop]

*** FLAME SHEILD ON ***

I almost like the way AOL uses keywords instead of name.whatever - AOL it would be just "name". For example you wouldn't use www.slashdot.org it would be keyword slashdot. Does the WWW. and .org add much value?

*** FLAME SHIELD OFF **

Flame shields were used during the transmission of this message. Any flame attempt directed at this message about AOL having on OK idea bounces off me and sticks on you.

Re:AOL may have a few good ideas.

[Frizzle Fry]

This is also the same way it usually works on a corporate intranet. A given webpage will just be at http://somename .

Values

[Safety Cap]

~ before a bad federal law was passed.

The law is neither evil nor good, therefore it is a misnomer to state that it is a "bad" law.

I believe the word you are looking for is "poor," as in "it is a poor law."

Re:Values

[geoffspear]

Laws don't have or need to have any money, so calling any law "poor" is, as you put it, a "misnomer". Please use a completely unambiguous word if you're going to be incorrectly pedantic. Here's a tip: you're going to have to make up an entirely new word, because you won't find one in English.

Re:Values

[hazem]

When I tell a client that their motherboard has "gone bad", I'm not commenting on the morality of their motherboard. Rather, I'm saying that it no longer functions as expected, or that its functioning has negative consequences.

"bad" might not be the best word for describing a law, but "good vs bad" is not always the same as "good vs evil".

Re:Values

[telbij]

Please use a completely unambiguous word if you're going to be incorrectly pedantic.

Pedantic is an unambiguous, but I think your assessment of the poster is still a 'misnomer' in that it doesn't fully capture the essence of the post. I was thinking something along the lines of 'ignominious troll', but that's just me.

Re:Values

[Tassach]

No, the words you are both looking for is "effective" and "ineffective".

Anyhow, I have to disagree with you that laws are neither good nor evil; and a law's intent has no bearing on how effective it is. "Jim Crow" laws are some of the canonical examples of laws with evil intent. These laws were very effective in acheiving their desired results, even if that results was evil. Contriwise, some of the best-intentioned laws fail to achieve any positive result.

Had the same idea.

[ccozan]

I had the same idea in this slashdot comment .

Costin

No need.

[mindstrm]

There is absolutely no need for this whatsoever. There are a zillion ways to pull off this kind of mail system without introducing a new TLD...

A better requirement, though probably almost impossible to pull off due to negligence in the past, is to make sure that domains are registered to true, legal entities, and yank them if they are not.

You miscounted

[Groo Wanderer]

Sorry to be so petty, but your basis for arguement is wrong. His arguement is on *2* lines, the last is his sig. If I wanted to be petty, I could say that his arguement is 1 line, with a line of quotes for context, and a line for a sig. Since I am above that I won't be that silly.

-Charlie

(Yes, for the slow, this was sarcasm)

Already been proposed

[Anonymous Coward]

check our smtpnic.org

Same idea, just not with a TLD

In SIGHT

[baudbarf]

"no implementation in sight", not "no implementation in SITE"!!

Re:In SIGHT

[Anonymous Coward]

How insiteful.

so um...

[hyperstation]

what happens when the spammers buy a few hundred lookalike .mail domains?

Re:so um...

[Anonymous Coward]

Look at the price per domain!

Look at what happens if a spammer spams using it!

I think you just made their case for them bud!

Re:Why would I want to register under so many TLDs

[zeath]

Simple. A completely unrelated spam conglomerate, so they can send legitimate and important-looking spam.

Why they think it's a good idea to give more options for cybersquatting or general domain masquerading is what confuses me out of all of this.

Not to necessarily throw the snowball down the hill, but once we start getting all of these TLDs added, more strict measures are probably going to be put in place to keep people from abusing the abundant choices in all of these new domains. (mikerowesoft.mail, mikerowesoft.jobs, mikerowesoft.xxx?) I'm not sure what we might see in the future as a result of this, but trademark requirements or ICANN-sanctioned domain auctions are two that come to mind.

Technical issue

[LordKazan]

type http://www.slashdot.org. into your address bar - WITH the trailing period

the "." is a special-character and delimits parts of the address - so if they were to perform an $sections = explode($url, '.') {PHP function reference} with $url="www.slashdot.org" or $url="www.slashdot.org." they would get $sections = array ("www", "slashdot", "org") or $sections = array("www", "slashdot", "org", "") - and they discard empty strings for tidiness

so you'd have to suddently patch every DNS server in existance at the same time for "." to be it's own TLD

Re:Proper grammar??

[theguywhosaid]

*yawn* The same old discussion, with no implementation in site.

you dont need proper grammar when punning it up

in sight intead of in site

[vnguyen6]

I'm no English literature buff but I think it's in sight instead of in site.

Re:Why would I want to register under so many TLDs

[Teun]

I have not been a fan of new TLDs for some time, as it seems to promote confusion. I consider it to be more inefficient to have companyname.info, companyname.com, companyname.net, companyname.org, companyname.mail,

You missed Halliburton.mil, Halliburton.gov

The English Language. Live it. Speak it. Learn it.

[Minwee]

"The same old discussion, with no implementation in site."

Site (n)
Etymology: Middle English, place, position, from Middle French or Latin; Middle French, from Latin situs, from sinere to leave, allow
1 a : the spatial location of an actual or planned structure or set of structures (as a building, town, or monuments) b : a space of ground occupied or to be occupied by a building
2 a : the place, scene, or point of something b : one or more Internet addresses at which an individual or organization provides information to others often including links to other locations where related information may be found

Sight (n)
Etymology: Middle English, from Old English gesiht faculty or act of sight, thing seen; akin to Old High German gisiht sight, Old English sEon to see
[... other definitions elided...]
6 a : a perception of an object by or as if by the eye "never lost sight of the objective" b : the range of vision "was nowhere in sight"

If this works.......

[Groo Wanderer]

I am pretty sure that the brainchildren who think that a .mail TLD will stop spam are the ones behind the .xxx/.sex domains. It doesn't take a leap of logic to think that if the first harebrained scheme works, the second is sure to get them laid. Rock on, do good, and move out of your parents basement.

-Charlie

How the .mail domain will work

[jjo]

It's apparent that the knee-jerk rejections of .mail are coming from people who haven't bothered to actually read the .mail proposal, or else who conclude that any anti-spam initiative that will not cause an immediate, total, worldwide cessation of spam is not even worth considering. All the .mail domain proposes is a more reliable locus for distributing whitelist information. It is expressly not intended to be user-visible, but rather to be solely for the purpose of automatic sender validation by mail receivers.

Whitelists work. Do they eliminate all spam? No. Are they part of a framework for reducing spam? Yes. Snide remarks about the futility of any possible approach to the spam problem may be amusing, but they obscure the fact that real (not perfect, but real) progress is possible. A .mail domain can be part of the solution.

Re:Obligatory spam detection kit web site

[Uninvited Guest]

This article advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam.

I'd love to see a web site with this format, devoted to all the proposed solutions to SPAM. Call it the Baloney Detection Kit for Spam.
Or, the "Spam That's Really Baloney Detection Kit..."
Or, the "Spam Proposal Detection Kit for Spam..."

Fine! You think of a good name.

Nothing at all.

[Moderation abuser]

On you go. There aren't that many people outside the US. There can't be more than what? A couple of million on the strip of land round the edge of the map.

Re:Nothing at all.

[i8a4re]

I think you missed the whole part about letting the users decide where they receive e-mail from. The majority of users in the US receive e-mail from only one or two other countries. For instance, my mother only uses e-mail to keep in touch with my uncle, my aunt, my brother and me. She hasn't ever, nor probably ever will care about an e-mail coming from China.

Re:Nothing at all.

[pjt33]

What about an e-mail coming from a Trojan running on a machine in Kansas?

(BTW grandparent didn't miss the point - they were commenting on great-grandparent's blanket statement "Most users only receive email from within the US and one or two other countries", which should have been expressed "Most users only receive email from within their own country and one or two other countries").

I don't think it will work...

[DroopyStonx]

If you go blocking every domain that's not "trusted", then what will happen to people who send mail through their personal domains?

ICANN won't know whether to trust my personal/private domain.com, unless they're going based off NAME and who owns it (spammers are most likely to be associated by name). So does that mean I won't be able to send email to most people I know for fear that their ISPs will go blacklist anything that's not trusted?

It would work perfectly if everything was a commercial/licensed business, but that's not the case for quite a large chunk of these personal domains.

.mail and costs

[martin]

oh great, so now I have to register ANOTHER domain to keep company going.

$30 here, $30 there, have thet any idea how much all this cruft is costing us, AND making for the registrars btw. Its a license to print money - outrageous...

Dictionary.com?

[Anonymous Coward]

bad adj. worse, (wurs) worst (wurst) Not achieving an adequate standard; poor: a bad concert.

Re:Dictionary.com?

[Anonymous Coward]

Boy ,the grammar freedom fighters are out in full force today.

"I didn't think we were alone, because there are other people in the world" Slick Willy Clinton

Re:Dictionary.com?

[geoffspear]

We're "usage" freedom fighters, not "grammar" freedom fighters, thank you very much.

Re:Why would I want to register under so many TLDs

[AviLazar]

Only if it utilizes software like Qmodem and Qmodem Pro :) -A

Thank you

[macguiguru]

Thanks for pointing that out!

Of course!

[djkitsch]

Because only non-spammers have legitimate companies and domains. Right.

Re:Of course!

[mindstrm]

I didn't say it would fix spam, I just said what was proposed could be done equally well without resorting to new TLDs

Why, on the other hand, is this *good*?

[0x0d0a]

What specifically do you find *good* about this?

It seems to me on a quick skim to have all the same flaws that SPF does. Additionally, the cynic in me can't help but think that this is rather likely to have been pushed by domain name registrars, as it means that they can charge money per registration.

Ultimately, I've yet to see a long-term-workable antispam solution proposed that doesn't involve the use of PKI and a trust system of some sort (probably transparent). Yes, it's a pain to roll out, but it's going to have to be done eventually.

Re:Why, on the other hand, is this *good*?

[Eric S. Smith]

Ultimately, I've yet to see a long-term-workable antispam solution proposed that doesn't involve the use of PKI and a trust system of some sort (probably transparent).

What does this buy me that widely-adopted SPF plus DNS blacklisting doesn't, from a spam-prevention perspective?

In fact, if a trusted PKI signing authority turns evil and starts issuing certs to spammers (or just refusing to revoke spammer certificates), wouldn't you be slighly worse off than you would be with SPF + DNSBL?

Re:Why, on the other hand, is this *good*?

[0x0d0a]

What does this buy me that widely-adopted SPF plus DNS blacklisting doesn't, from a spam-prevention perspective?

* A secure transport. A lot of these systems depend upon DNS for data transport currently, without adding any kind of security to said system. DNS is attackable.

* Flexibility. If someone needs to make a cert associated with two email addresses, such a system could support this.

* Decentralization. I'm comfortable with the statement that a PKI and trust system could be implemented without relying on a single potentially evil (*cough* VeriSign) source.

* Major side security benefits. PKI has major security benefits -- you roll it out and it's also easy to do end-to-end encryption of your email. Businesses need email encryption yesterday, anyway.

* Separation of entity from email address. Suppose I am Linus Torvalds and have a home address and a (new) work address. Many people trust Linus Torvalds -- he isn't going to run out and start spamming. The problem is that his *work* identity is totally different from the POV of SPF or similar systems. With PKI and trust, Linus could trust his work address's cert with his home address's cert (or possibly even just resue the cert, depending upon the system).

* Entity-level trust. I can trust a single person without having to say "if it comes from this organization's mail server, it must be good". SPF might let me know that an email came from the right mail server from the domain, but doesn't let me know that the email isn't forged -- if someone manages to compromise a single computer at IBM, my only option with most non-PKI systems is to distrust all email from the IBM domain, since they can send email "from" anyone. Entity-level trust is important to allow breaks (and any system *will* break -- if you compromise someone's system, it's hard for others to tell you from that person) to be isolated -- if my machine gets taken over and people forge email from me, the only person that email stops coming from as a couple people start marking the email as spam is me. My coworker in the next cubicle is unaffected.

* Traditional blacklisting doesn't scale to the internet. Binary "I trust" or "I don't trust" systems are just don't make sense on something the size of the Internet. Trust networks are a fuzzy form of whitelisting. As you build up associations with people, you build up trust (and yes, establishing a new trusted identity is going to be a pain at first). The reason traditional binary blacklisting doesn't work is that you have to start out whitelisted by default.

In fact, if a trusted PKI signing authority turns evil and starts issuing certs to spammers (or just refusing to revoke spammer certificates), wouldn't you be slighly worse off than you would be with SPF + DNSBL?

No. Binary trust probably wouldn't work at such a scale, for exactly the reason you just cited -- getting something to slip through the cracks is too easy. You need to have A trust signing authority B and email sender C, etc. Then just make the trust system really easy to use, tying that "spam" button in mozilla to the trust network.

It's just that if all email is signed and it takes a bit of doing to obtain a cert and ensure that enough people trust it, you can reasonably have a trust value assigned to any of the signing authorities as well, and have trust levels backpropagate.

Again, such a system is a pain in the ass to roll out. I just haven't seen anything else that handles this.

Needs the blessing of a standards body...

[jackbird]

I hope they had the foresight to make it compatible with RFC 3514.

Feh!

[dacarr]

Being that TLDs can be named pretty arbitrarily due to the flexibility of DNS, I fail to see how a .mail domain would filter spam. It's as if the article misses the point entirely. Think of it, I can have a TLD of "hoardsofdeadpankamikazebonsaikittenseatingspam", and if a spammer wants to spam it, he'll spam it.

In short, the only thing a TLD has to do with DNS is in a MX record - and even that's arbitrary.

My Solution To Spam

[JavaSavant]

My Solution To Spam

Follow the money folks. You have to make it more expensive for spammers to conduct business. As long as their ROI is as high as it is, what would deter any profiteering individual from using UCE?

Creating a new Protocol

[tjhanley]

SMTP is to open.... when it was made no one ever thought spam could happen. It was just like 12 guys at universities mailing each other. imagine one thing is for sure you'd know the jokes were fresh back then.

Re:Proper grammar??

[Darth RadaR]

I'd give you an "Insiteful" if I had mod points. :)

Re:Why would I want to register under so many TLDs

[IGnatius T Foobar]

I have not been a fan of new TLDs for some time, as it seems to promote confusion.

I think that a large number of TLD's are exactly what we need. Two reasons:

1. When it was just .com .net .org, brand-happy organizations registered all three, just to make sure nobody else got them. That's a little harder to do when there are, say, thirty different TLD's. There should be 100 or more! Discourage people from registering in every possible TLD.

2. Perhaps if there are lots of different TLD's for lots of different purposes, Joe Sixpak (damn I hate that guy, not only does he buy from spammers, but he buys from even less reputable companies like Microsoft and Wal-Mart) might finally start looking things up properly instead of just assuming "The site I'm looking for is at $BRAND + '.com'"

Holy cow, someone with their head screwed on right

[0x0d0a]

Okay, I'm dubious about the legal stuff you want to do. There are a *lot* of implications of doing something like that, including privacy issues.

However, you have one point absolutely dead-on accurate. If you want to do any kind of server-side filtering, if there is any proposal to do so, *users* should have the ability to set this filter. Server-side filtering (as opposed to client-side) has a lot of benefits -- it means that clients don't have to be maintained, that users can easily switch clients, server-to-client bandwidth is saved, etc. However, it's *tremendously* frusterating when a server operator chooses to block something that a user specifically knows he needs.

Even if a good antispam system is put in place, it makes a *lot* of sense to let users have some kind of protocol, some set of extensions to SMTP, that let them alter server-side filtering associated with their mailbox. Maybe even expose a series of complex presets that the server can provide (SpamAssassin, block Asian-originating email, etc), and let the client enable them on his account. Provide an idiot-proof GUI to interoperate with this, and you're gold.

The main issues would be added server complexity and processing load.

reverse DNS sometimes costs extra

[bigpat]

I am not a spammer, but I am trying to keep a small company going, which has multiple domains running on one server. Many of these proposed solutions are very poorly documented and seem to just raise the bar for the little guy and do nothing to reduce spam.

Solutions that expect so called "legitamite" companies to have IT departments and multiple servers and multiple T1s will just end up raising the barriers to entry for small business. Spammers, these days, don't follow the rules.

Re:reverse DNS sometimes costs extra

[Trejkaz]

Maybe a separate database of which IPs are valid senders for a given DNS name would be the way to go. You could probably hide the data inside DNS itself anyway. Then as long as you have an entry, people can't spoof *your* domain. But you still have the problem that any old joe with a random domain can send you spam.

Antispam idea rejection addition request

[0x0d0a]

and the following philosophical objections may also apply:
(x) Countermeasures should not be a profit center for a single corporation.


After VeriSign, I'd like less corporate involvement in the Internet's structure, thank you. It sounds good, people promise to do the right thing, and in the end, everything is sacrificed in the name of short-term profits. I do not want a .mail registrar with a razor blade to the Internet's wrist and demands from stockholders.

Re:Antispam idea rejection addition request

[Le Marteau]

After VeriSign, I'd like less corporate involvement in the Internet's structure, thank you.

You're welcome! I agree. I always feel better when the government gets involved. In fact, I wish the government was in charge of more important things. I'm sick of depending on Con-Agra to grow food - I'd like to see the government responsible for that. Cars, too. My Chrysler PT Cruiser sucks - the government could do much better. My shoes, too, suck mightily. Instead of Rockport making shoes, I'm sure government issue would be MUCH more comfortable.

Re:Antispam idea rejection addition request

[Anonymous Coward]

Uh... VeriSign runs .com .net and others. .org - meaning Slashdot.org - is "run" by Afilas, plenty of skeletons in that registry's closet.

You can't escape that the current Net is "run" by in-it-for-the-money companies.

Why someone has not stepped up and created on "open-source" non-profit registry, now that's the question.

What's even more interesting...

[Gudlyf]

...is that Steve Jobs will have his own TLD! ;-)

My Surefire Way to Combat Spam

[CleverFox]

Today I implemented a surefire way to combat spam at least until my way becomes popular :). We have a domain which I will call @ourcompany.com. Whenever anyone signs up for a mailing list or fills out any kind of Internet form, they use firstname_lastname-indicator@vmail.ourcompany.com. If suzy_smith wanted to sign up for the infotech newsletter, she would use the address suzy_smith-infotech@vmail.ourcompany.com. The qmail alias .qmail-vmail-suzy_smith-default picks up the email and forwards it to suzy_smith@ourcompany.com. If infotech sells the list to a spammer, we simply blacklist the infotech address or create an infotech alias that points to /dev/null. For the surefire no spam solution we block all Internet mail to suzy_smith@ourcompany.com and only allow email sent using the @vmail.ourcompany.com aliases. I expect to increase our blocking rate to 100% for users that care. And it is self administrating once I make a web form where they can block any alias that they are getting spam at. Oh, and when you get a message in your Notes/Outlook inbox, the To: address shows the full original To: address as suzy_smith-infotech@vmail.ourcompany.com so you know infotech is filthy dirty company that sold your address.

Can anyone find any holes in this?

*yawn* The same old discussion....

[zarniwhoop]

with no implementation in sight.? so why bother posting it on the front page?

in addition...

[rbird76]

junk mailers pay for their use of the mail system - theoretically, they may even pay for some of other users' mail through their rates. Contrast with spam, where the evil bast@*d^H^H^H^H^H^H^H^H^H^H^Hspammers don't pay for any of the bandwidth they use other than what they pay for their spamming computer (and the real lowlifes don't even pay that - they use viruses, etc. to zombie others into paying for and sending their spam). In addition, junk mail that lies can be subject to mail fraud, which can involve time in the federal prison system and a roommate/significant other named Bubba; presumably spam is subject to wire fraud stautes if it lies, but the spammers are harder to catch (I don't know if any spammers have been successfully prosecuted for this).

Junk mailers pay to send their messages. Spammers steal (bandwidth, time, cycles) from others to send theirs.

Re:in addition...

[JuggleGeek]

Contrast with spam, where the evil bast@*d^H^H^H^H^H^H^H^H^H^H^Hspammers don't pay...

BTW, it's OK to call spammers "evil bastards" on /. Everyone will know what you're talking about.

Good grief people (was Re:Values)

[Aumaden]

Oh come on people! If you're going to argue over the meaning of words, at least look them up first!

bad
1 a : failing to reach an acceptable standard
3 : inadequate or unsuited to a purpose

poor
2 a : less than adequate
4 a : inferior in quality or value

Yes, but also, what about freedom?

[Crag]

As you say, managing trust hierarchically is non-trivial on this scale.

Even if that weren't the case, I'm not comfortable with the idea that only certain entities have the power to decide who may or may not use a protocol publicly. The policy would have to be enforced to be useful, and enforcement would be a huge impingement on people's rights.

If you give certs away, there's no trust.
If you restrict them there's no freedom.

lose-lose situation.

Best TLD ever

[Anonymous Coward]

I think someone should submit .mofo as a TLD. how cool would that be? A little to cool if you ask me.

How about a .spam ?

[Rai]

If it's true that people want to receive spam (like spammers often say), why not force them to use their own TLD. Everyone who "wants" to read spam can, and the rest of us can effectively block it.

I guess that makes too much sense to work. :)

Bring back Public Flogging

[AwesomeJT]

Start catching these folks and hand them over to the ISPs they waste their bandwidth or end users that get scammed. Creating The Running Man for spammers. If you can get out alive, you can go free -- but the folks you spammed have chainsaws and whips. Of course, the major TV networks will jump on this. Forget Survior. Have a nice day.

Re:.PORN

[AwesomeJT]

Already suggested -- it's called .xxx -- but it might not make it. I gets suggested few years.

spam is a global problem

[bshroyer]

Get off your frickin' high horse. Just because the parent poster happened to be posting from the US doesn't mean the solution only applies there. For the VAST majority of email users in ANY country, the only (legitimate) email they receive is from the same country. Those of you in academia or business, you world travelers, or residents of Belgium are exceptions. The parent poster deals with the exceptions. Blocking, by default, all email originating outisde your local jurisdication is a valid solution for the vast majority of global email users.

For the rest of us, simply pretending that Russia, Korea, Belize and the Netherlands don't exist is a good start.

Moronic

[nagora]

So instead of all the problems we have at the moment because there is so little room in the name spaces at the moment someone thinks its a good idea to have just one TLD ('cause who's either going to want to do without email or have a second level domain within .mail that doesn't match the second level name in their existing .com/.org.whatever space)?

Just bloody stupid.

TWW

Conflict with Open-RSC

[Anonymous Coward]

This could be interesting - I'm sure at least some of the newly proposed TLDs are already in use and registered with Open-RSC

This could result in a battle between the 'official' and 'open' DNS databases.

Re:My god!

[Anonymous Coward]

*yawn* The same old discussion, with no implementation in sight.

Wow, Hemos. I would have expected that kind of cynical remark from Michael but not from you. These people are actually working towards a solution and all you have to offer in the way of help is a smart-ass remark?

No, SPF lite

[mdfst13]

No, it is like SPF lite. It has *fewer* features than SPF and is less flexible. And you have to pay.

All the .mail TLD provides is a reverse MX record that maps a .mail domain to an IP. SPF allows you to specify what kinds of machines can send email for your domain. You can specify an IP address as a valid sender (the equivalent of a .mail TLD). You can also say that anyone with an MX record in your domain is a valid sender (a reasonable default), etc.

Re:Why would I want to register under so many TLDs

[LoneGunner]

One thing that would work, but still require everyone to switch to the new system in a reasonable time is if you used the .mail tld only for reverse lookups. Everyones email address would stay the same, smtp would not change, and mx records would not change. Only the allow and deny processes of the smpt server would change. If the ip reverse lookup has a .mail tld then allow traffic through, if not then block it with a special error code.

This would make it so only the servers that register their information can send out email, it would help stop virus propagation, becuase they would have to relay through a .mail server to get sent out. If too much spam or viruses are sent out then the server gets blacklisted untill it is fixed. Most companies keep a close watch on virus emails and spam that individuals are sending through their server and block those that they need to. And those that don't deserve to be blacklisted.

Spam companies would have to register for a .mail tld to send out from their own servers, which means they are now easily traceable, less likely to use illegal tactics, and easier to block.

While it's not a perfect solution, it is better than the current situation. And would only require one registration process per company.

The only downside is for those that cannot controll their own reverse lookup information. It would cause a lot of problems for smaller companies with uncooperative isp's.

.maill or .org

[filesiteguy]

...and I've been advocating that .org address be used to identify porn sites. That hasn't worked either.

Spamming is a crime in about half of Europe

[Animats]

Austria, Denmark, Finland, Germany, Greece, Hungary, Italy, Norway, Poland, Slovenia, Spain all require "opt-in" for mail. (List from CAUCE Europe.

The US legalized "legitimate" spam with the CAN-SPAM act. Bulk mail with forged headers is a criminal offense. Bulk mail using stolen resources is a felony. The FTC is very soft on spamcrime. There have been no FTC actions under the CAN-SPAM act whatsoever.

Wait until Kerry is in. We may have some progress under the next administration.

Re:Spamming is a crime in about half of Europe

[Anonymous Coward]

SPAM is not a crome in Europe. It falls under anti-competitive behaviour.

Re:Spamming is a crime in about half of Europe

[Anonymous Coward]

SPAM is not a crome in Europe.

Correct. But then I never claimed it is a crome. As I said, spamming is a crime in Europe.

Re:HEMOS DOESN'T KNOW "SITE" FROM "SIGHT." FUCKHEA

[Anonymous Coward]

John F Kerry was educated in Europe.

That might explain why he doesn't know if he supported the Iraq war or not.

Here we go again

[Jesus IS the Devil]

This is just another get-rich-quick scheme by businesses to extract more money from unsuspecting domain name whores. They want you to pay money for thin air basically.

I don't get how another new domain will curb spam. People want to send emails at the same domain as the web sites.

And what about open relays, mom-and-pop websites that won't want to go through the trouble, hacked servers, spoofed email addresses? This "new" method solves none of these things.

The .porn/.xxx domains didn't work, and neither will this. Don't get suckered into paying more money on a pipe dream.

Why TLD?

[AnotherBlackHat]

By far the most interesting proposal is for a .mail TLD to register legitimate mail servers.

If this really was a good idea, then there's no reason you couldn't do it under a second or even lower tier domain.

I'd certainly trust randomdomain.approved-mailservers.spamhaus.org a lot more than randomdomain.mail

They should have spent the $45,000 fee on something useful - like legos.

-- this is not a .sig

Re:Why TLD?

[Anonymous Coward]

The .mail FAQ at Spamhaus gets into this. I think it's more than just Spamhaus behind this, but I too would certainly trust "randomdomain.approved-mailservers.spamhaus.org"!!

MX

[genericacct]

That only identifies your incoming mail server(s). While some small- to mid-sized organizations have one server doing double-duty, bigger folks have a slew of incoming-only and outoing-only mailservers.

This is what SPF is meant to provide: "reverse MX" of sorts. It's a decent idea, but suffers from the need to be evangelized and heavily adopted to make an impact.

Typical

[TwistedGreen]

Wow, what a brain-dead idea. Sounds like it was designed by management committee.

Instead of starting with core infrastructure, they start with... registering domain names. Yeah.

.mail TLD

[tsaler]

Maybe I'm out of my mind (I probably am), but I actually think, by and large, this might be a good idea. Restrict e-mail only to .mail and probably .edu too. There don't seem to be many spam creations coming from .edu, at least not ending up in my junk mail directory that is.

Re:.mail TLD

[Anonymous Coward]

...and not from .mil or .gov either. But this system goes beyond just the "naming" it seems since any spammer can forge these. It's idea is to "lock" the .mail domain to the mail server that is sending the mail. Not a bad idea since it will also prevent the forgery. But I could be out of my mind too and have misread the application.

Re:Why would I want to register under so many TLDs

[gnu-generation-one]

"I consider it to be more inefficient to have companyname.info, companyname.com, companyname.net, companyname.org, companyname.mail, etc"

How about companyname.shop.fr and companyname.restaurant.uk?

If you're going to use trademarks, may as well use them properly -- unique in their own region, and line of business...

What happened to UUCP?

[elwing]

UUCP used to work pretty well...

you can only upload mail going out to known servers, and it's *really* hard to add authentication to a server to.

Actually, considering I installed exim with SMTP_AUTH in about 5 minutes the other day - why can't other people - it's useable between mail servers.

Spammers aren't invulnerable...

[Amon CMB]

The thing about spammers is that no matter how many proxies, zombie machines, foreign servers and fake addresses they hide behind - at SOME point, there has to be a contact between spam victim and spammer for spam to be an effective money-maker. Spammers try to sell you things - things which require monetary transactions to complete. That's where they are vulnerable. Find out the businesses that profit from spam and go after them. They can't hide forever, especially if they want to sell you something.

Your company's spam plans

[Skapare]

Will you be telling us just who this company is, at least once they do the spam run? We'd like to hear your whole story. If they end up not taking your advice and you move on, that's the time to reveal what kind of scumbags they are, and just who they are.

At least drop a hint.

.mail Domain to eliminate spam?

[alexborges]

NO...

Stupid idea...

Would the techies at those companies please get their head out of their ass?

Well do something about it...

[Awptimus Prime]

*yawn* The same old discussion, with no implementation in sight. ... Meanwhile, being sarcastic and making witty remarks about the lack of progress does so much for the cause.

Long-Term Cyclic Effects

[SlipJig]

I wonder about the long-term effects of anti-spam strategies that rely on eliminating the market or profitability for spammers. It seems to me that this may result in spam levels oscillating between prevalence and rarity. Lemme explain.

Let's assume we implement some Bayesian filtering on a widespread basis. Let's then assume that most spammers go out of business, and that the amount of spam sent drops drastically. Sounds great! But after a year or two (or five) of this, it seems to me things will be ripe for new spam action. Some spammer will get a message past the filters, which ironically may be less effective due to the lower incidence of spam. Users who haven't seen a spam message in a year will open it, and all of a sudden this particular spammer is immensely profitable. Other spammers see his success and jump on the bandwagon, and pretty soon we're back where we were before.

Of course this is all conjecture, but I do wonder if we need a better fix, one that can guarantee results long-term.

Micropayments won't work

[Don Tworry]

Micropayments won't work. As soon as you start charging for email messages spammers will figure out a way to avoid the charges by getting legitimate Mail servers to send their email (hey, I mean they do that already). Then legit businesses will get their bill the next month and say 'Hey wait a minute, I didn't send all those emails'

Micropayments would just make more of a mess.

The Ultimate Solution

[etLux]

This has all become far too complex, with the usual confusion of more TLD's, where a much simpler solution is warranted and readily apparent.

I propose a single new top level domain that will solve the problem:

.evilcrap

Re:Why would I want to register under so many TLDs

[rainman_bc]

Screw 1.5... Why not just jump to Internet 2? www.internet2.org

Re: Dynamic IPs

[Canthros]

I'm pretty sure it's a service issue. If you only hand out static IPs (or primarily hand out static IPs), you're going to subject to a lot of support calls about why so-and-so's machine can't connect because they mistyped their IP address, or because somebody else mistyped their address so that the address you're looking for is already in use by the wrong person, and so on. Lots of paperwork to track allocation and all that nonsense.

Alternatively, they can click a couple of radio buttons on the same Windows dialog and everything is smooth sailing. Making static IPs an additional expense also discourages a number of twits who don't actually need one, I'd guess, and enables them to oversub things if they think it's a viable proposal (IME, a 'dynamic' IP assigned to you by the cable company is only going to change if there are major network changes, which would probably require a change in static IPs as well). It also would probably allow them to keep the folks who are going to run a webserver out of their basement from tying up the bandwidth of everyone else with the misfortune of being on the same circuit.

Possible way of suppressing speach?

[Angry Pixie]

From the article:
One proposal for the .mail domain has been put forward by anti-spam workers who want to use it for storing information about legitimate e-mail servers.

Putting aside the obvious problem of faked headers, etc, how would such a system be implemented? My ISP doesn't allow me to run an SMTP server. This pisses me off. But open relays exist somewhere...

Could .mail be used eventually to silence people who legitimately run their own SMTP servers, forcing people to either give up their privacy by using their ISP's service (in the age of Carnivore), or pay an entry fee for the privilege to send e-mail idependently of one's ISP - which the registration fee for a .mail domain could essentially do if ISPs and servers all over the Internet reject any email not originating from a .mail or other pre-approved source.

Maybe it's extreme. I'm shooting from the hip here, but it's enough I can't run my own SMTP!!

Re:Possible way of suppressing speach?

[Anonymous Coward]

well I for one hope it supresses "frea speach" - but the free speech of spammers who freely pound me every damn second.

i looks like it will allow non-spammers to freely speak without their emails getting nailed by lame-assed "spam filters" that can do more harm than good.

"Carnivore"? Just get a mailserver in Europe or hell, Canada. Or if you have secrets, use encrypted email, or encrypted IM.

. mail for mail servers (Was Re: Only a way to...)

[keirre23hu]

Maybe I missed it, but I thought the idea was to have .mail on tyhe mail server. One of you is abracadabra.mail the other one is whateverelse.mail.... you know MX records do not have to be from the same domain as the mail server sits in.... I have my mail for domain1.com, domain2.com, domain3.net, and domain4.us all routed through mail.domain2.com. as an aside, I think forcing all email addresses to be .mail is ridiculous, but I dont think this is what the proposal is suggesting.

Re: Dynamic IPs

[bendelo]

If you enabled DCHP, then the DCHP server can assign the same IP address to a particular MAC address each time. Thus it would have a 'static' IP address.

Re:Why would I want to register under so many TLDs

[Lost Race]

What mess? You can fix the DNS problem by creating your own root zone, or by using one of the existing alternatives. No wrapper protocol needed.

The big routers all seem to be playing by the original internet rules, so as far as I can tell the Internet is working fine. There are some problems out near the leaf nodes (mostly involving Comcast and their ilk) but you're not going to fix that with a wrapper protocol.

Obligitory Simpsons Quote

[Anonymous Coward]

"That which we call a rose by any other name would smell as sweet" - William Shakespeare

"Not if you called them Stenchblossoms." - Bart Simpson

I brought this up the other day...

[_ph1ux_]

See my post here - which also references an even earlier post of mine on the subject of a .mail (or .po) TLD for validated mail delivery....

"-.mail (or .po or something for mail systems - maybe requiring some sort of adherence to installation of non-relaying systems based on agreed standards... or something to that effect)"

I knew I should have had Darl patent this for me when I had the chance!

Re:. mail for mail servers (Was Re: Only a way to.

[Anonymous Coward]

Not the way I read it. It looks as if it only applies to what ones email server is called. In fact, it seems to say one cannot have .mail email addresses. It's less a true domain and more of a trusted email path.

Looks okay, have to see how it works in practice, heck I hate to lose any emails from online-chicks just cuz they're talking dirty to me! :-)

Spoofing.

[rice_burners_suck]

I'll tell you why this ain't never gonna be the end of spam: Spoofing.

Any idiot with access to a computer can spoof a domain name.

Re:Spoofing.

[Anonymous Coward]

yeah, but any idiot could have read the link, and have seen they have a system that stops spoofing.

Whats the problem?

[Anonymous Coward]

Sounds like a fine idea to me l-image@verizon.net

MOD up, someone actually read the proposal...

[Anonymous Coward]

...but he'll also have to be banned from future /. postings as this sort of thing just cannot be allowed!

It's so much funnier to post some form that has everything backwards - and /. is all about the funny not the facts these days damit!!!!!

sure fire solution to spam

[capojim1]

Here's "THE" solution for spamming:

This requires a new feature to be added to mail servers and clients to implement this functionality, but it should be relatively straightforward and is 100% backwards compatible with non-conforming servers and clients.

Basically how it should work is if johnny@aol.com sends me a message at andy@att.com, the mail server at aol.com (the sending server) will store a list of recently sent emails.

All it stores is the sender email address (johnny@aol.com) and a unique id for the email, maybe a CRC number (see explanation at the very end) derived from the message contents and all attachments.

When the receiving mail server (that's Andy's server at ATT) gets the message, it contacts the server at aol.com (derived from the 'from' field) and queries to see if a message from such a person was actually sent.

It sends the email address (johnny@aol.com) together with its own generated CRC number.

The sending server (which was aol.com) now checks its list of recently sent email and either returns a yes or no based on the test to see if the address/CRC pair is on the list.

I'm sure a time-stamp check will be done in this process, maybe to a 60th of a second, then the spammers will be stopped.)

Once the user (Andy) downloads the message and removes it from the server the receiving server (Andy's at ATT) sends a message to the originating server (Johnny's AOL) that it's ok to remove the message record from the recently sent email list.

This method makes it impossible to spoof the "from" field--- (I am sure all you who read this are more than familiar with the spoofing done by spammers).

If spammers can't spoof the "from" field they lose their anonymous/fake cover.

It's possible to trace them back to the originating ISP and that ISP will have records of whom that account belongs to or will simply shut down the account if it's a free mail service.

Basically spam can be traced back to its source (and maybe even viruses).

Of course, not all servers will implement such functionality right away.

The end user can set up their mail client to simply filter email from servers that don't support this feature into a special folder that will contain "unverified" email, but this folder will get less and less email as this feature gets implemented more and more.

If the server does support this feature, and the sender is not verified, you KNOW its spam.

If AOL, Hotmail, Yahoo implemented this feature, and you have a client that supports this feature, you KNOW you won't get spam from any of those servers anymore.

------------
CRC

Short for cyclic redundancy check, a common technique for detecting data transmission errors.

Transmitted messages are divided into predetermined lengths that are divided by a fixed divisor.

According to the calculation, the remainder number is appended onto and sent with the message.

When the message is received, the computer recalculates the remainder and compares it to the transmitted remainder. If the numbers do not match, an error is detected.

Re:How? (This way)

[NKJensen]

They'll be out of biz about 14 days after "check that every mail server which claims to be company.mail matches the IP it is using" day.

Many of the other posters didn't realize that it is only the mail servers which should be changed. Clients won't feel a thing other than all the hijacked computers suddenly being useless for spamming purposes.

Spammers, these days, don't follow the rules.

[iamcf13]

Spammers, these days, don't follow the rules.

Then change the rules, making it virtually impossible for you to see the spam they send. I wrote and use a program (see sig) that funnels all the spam I get into two files for easy perusal and deletion.

The thing to do is to only allow bonafide mailservers (via DNS MX), POP-before-SMTP, and IP black/whitelists to (deny) access a mailserver. Doing that will stop the hardcore pro spammers (who will have their spamservers IP blacklisted). POP-before-SMTP will stop rampant 'relay rape'. Any spammers that make it past the connection stage can have their spam 'delivered' (silently routed to the bit bucket) or rejected based on the content of it -- say using the techniques my program uses to dectect and archive (likely) spam.

Archiving the spam prevents the loss of 'false positive messages' from people sending me real email but don't know about my email policy. The rest of the spam I get is the real thing and is treated as such: Selfishly Promoted Advertising Messages.

Re:Spammers, these days, don't follow the rules.

[iamcf13]

Archiving the spam prevents the loss of 'false positive messages' from people sending me real email but don't know about my email policy. The rest of the spam I get is the real thing and is treated as such: Selfishly Promoted Advertising Messages.

Should have read:

Archiving the spam prevents the loss of 'false positive messages' from people sending me real email but don't know about my email policy. The rest of the spam I get is the real thing and is treated as such: Senselessly Promulgated Advertising Messages.

which is exactly why

[SteelRat]

there should be somekind of centralized authority.

people keep suggesting trusted models without a strong distributed trust model.

Just as the posters have mentioned over and over again, it'll eventually come down to people either adopting a centralized and distributed from there trust model (akin to dns perhaps or opensrs).

That will work for about 5 min until the spammers start cracking boxes and sending cubic fucktonnes of spam through there like is already happening.

or the "let's pay for email" model could be adopted which would also solve nothing except for having large costs associated with breakins and aformentioned cubic fucktonnes.

good luck, folks. someone huge will have to do it first in any case.