Slashdot Mirror
Analysis of Spam, and a Proposed Solution
2bot_or_not_2bot writes "Spam: The Phenomenon is a detailed analysis of spam: products, scams, viruses, obfuscation methods, etc. Failed, and doomed-to-fail, methods of blocking spam are described. A general solution is proposed that does not: invade privacy, perform wide censorship or blacklisting, or involve payment and cooperation with corporations (beyond the transport and storage of data)." Hmmm.
Spammers are not very hard to track down. The companies that use their 'services' are even easier to track down. Many if not most are in the US or EU.
I've done it myself a couple of times, and have explained the relevant legal code from spamlaws. I have yet to hear back from either the spammers or the authorities I have explained this to.
I would think if law enforcement would do what it is SUPPOSED to do, spamming would be vastly reduced.
This dude has a decent idea, I guess. I've found a method that has been foolproof for the past three years. I only give out my email address to people I directly know. I've had a Hotmail address that's been spam free since 2001, not even a drop in the bulk bucket. Once or twice a year I'll get a Hotmail Services thing, but that doesn't matter to me. I keep a junk address at Yahoo when filling out online forms, posting, etc. It works for me and it works for my friends. My ISP email address has _never_ received any spam.
I also reply below your current threshold.
You know, if government really focused on penalizing the bottom end product creator for spam, I'm sure it'd be minimized drastically. For example Viagra, made by Pfizer, if they penalized Pfizer for spam and not controlling the methods of their advertising, I'm sure many companies would think twice about their methods to deliver content.
Sure it would need some tweaking, but to go after Joe Blow unsuspecting user who's machine is probably loaded with trojans is moronic. Even a good enough trial lawyer for the most blatant spammer could probably convince a jury that the culprits machine was infected if they tried. It's obvious CAN-SPAM and other moronic laws aren't working so why not take it to the next level?
Pentagon Plane Crash of 2000
MoFscker
It should be self-evident that this solution is not workable. Anything that requires this massive type of retooling of the whole method of using e-mail is doomed to failure.
Any proposed solution cannot cause this type of massive interruption of normal e-mail usage.
Someone is WRONG on the Internet!
Next!
This article links to an interesting piece of Internet history: Richard Stallman ca. 1978 defending DEC's use of email to advertise, his words quoted from http://www.templetons.com/brad/spamreact.html
"Would a dating service for people on the net be "frowned upon" by DCA? I hope not. But even if it is, don't let that stop you from notifying me via net mail if you start one. "
The big difference between it and mail we have now is that only the notification of mail is sent, not the mail itself.
Options:
a) Notification contains no sender-modifiable content. No way to know if you want it or not. You say yes and wind up with spam from unknown server.
b) Notification winds up containing the entire spam as subject line, and the supposed server it's coming from doesn't exist.
c) Spammers break into millions of unsecured Windows boxes and run 'mail servers' on them.
Nice try, but no cigar.
I have 1 email address that I have used for many many years, far before spam was a problem. The problem is, my email address has passed beyond my control. You can still find it on the 'net in usenet archives, mailing list archives, and who knows what else. The point is, 10 years ago, we didn't think to conceil their addresses... they wanted to make them easy to find so that people could find *us*!
Even better, somehow, there's a database that matches names to email addresses. People other than me map to my email address, so I get "legitimate" spam.
Furthermore, not loading the images and not clicking on the links doesn't fix the problem entirely. I've checked, depending on which address they've spidered. Contact addresses for my web-design business that I shut down 3 years ago are still getting spam.
That I have to change an email address that I've had for nearly a decade... well.. it makes my blood boil.
Gentoo Sucks
I mean come on, if only .5% of the people (s)he sent out spam to call his cell phone and leave a nice voicemail, everyday, all day, he will start to know what it is like to be harassed and for it to cost him money out of his pocket and the grief that he caused so many...
The problem with that, of course, is that spammers will then try to make it look like the spam comes from someone else--like an anti-spam activist, say.
This solution looks just like HTML pages, served via HTTP when you give the notification address. It moves the problem of message duplication off of centralized mail servers; however, there's still all those notifications of messages being send to users to read a copy of the spam message.
Good lateral thinking, but I don't think it would ultimately stop spam. I'd love to see more details.
It would prevent a spammer from dumping a 100Kb email message into your inbox, but it wouldn't prevent him from dumping 100K of 1b "notification" messages in there, and it would be all the same to him. It would make it much harder to sort between the two.
And under the current system, the spammer doesn't know anything about the recipient (or even that the email address is valid) unless he does something stupid like reply or click on a web link. Under this system, the spammer would know which addresses were valid by watching which messages were picked up.
Personally, I'm convinced we'll see no solution to the spam problem until society stops tolerating the selfish behavior spammers represent.
There must be more to this proposal than you've related here. This sounds more like an off-the-cuff suggestion that the usually sound thinking of our qmail friend.
The thing about things we don't know is we often don't know we don't know them.
I'm going out on a limb here, but I think that actually, spam does not create enough customers of legitimate products.
What email harvesters do is convince poorly informed people and businesses that by buying their $499.00 mailing list of two million valid email addresses, they will rake in thousands upon thousands of dollars in profits.
It is those poor sods who send the millions of email, using the email autosender conveniently provided on the cd-rom, who are then blacklisted to hell and lose their $49/mo super gold premium windows 2003 10MB (Front-Page enabled no less) account and wonder with growing bitterness how the jerks at "MakeMegaBuxWithEmail.Com" could have flat out lied, LIED, to them...
Then they realize they can make $499/CD by just finding another sucker...
Of course, like all good pyramid scheme, the thing will implode under its own weight, but it has not yet run its course.
A solution? Of course. A study needs to be made showing the average Joe that paying for a list of email addresses is a snake-oil scheme to lift money from their wallet.
Then people can charge money for the "Don't Be Fooled By Email Scam Artists. Send $29 And I'Ll Show You How To Protect Yourself Today!!!" and spam will be a thing of the past.
(yeah, that's it...)
"Piter, too, is dead."
So in the glorious IM2000 future my computer will pull down gigabytes of spam from random trojaned PCs whose owners say "what?" when you accuse them of spamming...
It's dangerously bad. If email messages accurately identified where they came from, and if spammers didn't maliciously forge addresses of people they want to harass, and if spammers didn't usually abuse free email systems and free web pages or forge purely bogus sender addresses (usually also at free email systems), then that would be a fine idea. Many spammers also frequently put other people's valid URLs in their mail to fake legitimacy, e.g. URLs from E-Bay's news site or the Better Business Bureau or various anti-virus companies, in addition to having their own URL for the suckers to click.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Sounds like usenet to me... I remember reading his proposal some time ago and it does make a lot of sense. No more flooded mailbox while you are on vacation... And it's also a good way for the sender to control whether or not the mail has been read (as opposed to only received). And idiot family members who send the content of their new digital camera to all family members without downsampling the images will get a quite useful "Full outgoing mailbox" error message.
Non-Linux Penguins ?
I wish I could find a Perl module to auto dial these number and leave supper long messages with an electornic voice.
Even better, have it read the spammers own spam back to them over the phone, until their answering machine fills up. ^^
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The section on Colin Fashey's site, way down at the bottom, that reads "Basic operation:"
You have to authorize each sender? The sender computes a code to send you mail?
Right. Most people can't get the clock on their VCR to stop blinking. This ain't gonna happen.
-Charles
Learning HOW to think is more important than learning WHAT to think.
Your a and b options are not a complete list. In actuality, you would send a subset of the headers in the notification (the recipient could potentially pick which ones--possibly in the response to the EHLO replacement). One can certainly limit subjects in the initial notification to (for example) 50 characters, not enough to get a real message across but enough to recognize many legitimate kinds of email (for one thing, how many legitimate emails have subjects longer than 50 characters?). In regards c, it is hard to run a POP server on a desktop PC.
Another possibility is that the notification could be just that (no content whatsoever), with you downloading the headers separately (i.e. 3 steps: notification; headers; body and full headers). That would force the server to exist, but you don't have to download the rest of the message if you do not want to do so.
Also consider how this would work with RMX proposals (like SPF: http://spf.pobox.com ). If the email is not from a validated IP, then you can reject the initial notification.
It is also worth noting that a spam method that requires illegal acts (like virus infection) is dangerous for the spammer. It is not really practical when selling everyday items, only scam emails (already illegal) or really high margin items that allow the spammer to change locations often.
Criticizing anti-spam proposals for not completely solving the problem is missing the point. No one anti-spam method is going to eliminate spam. Each one is designed to make it harder to spam, ideally without impacting normal email. IM2000 does this, since it merely shifts from POPping from the recipient's server to the sender's server. This is harder for senders but easier for receivers in most cases. The exceptions are those where the sender does not maintain a persistent (i.e. always on) mail server (e.g. spammers). This is very rare with legitimate emails (if the sender does not have a persistent mail server, then they can't *receive* email; legitimate senders generally want to be able to receive emails in response).
All the technical solutions seem to be doomed because (thankfully) we don't (quite) live in a Microsoft monoculture so there are a bzillion of mail applications at every point of the emailing process and it's impossible to change them all in a complicated manner. But there's an easy change: sign emails with pgp or the like. Then restrict your attention to signed emails.
Sure, it doesn't solve any of the bandwidth or storage problems, but it would make filtering so much easier. If the spammers sign their emails to get through, you could at least find out who they are. (If they use certificates from shady certificate-granting authorities colluding with the spammers, you could simply reject those as well.) Having a digital signature would be an easy way to distinguish bona-fide communications from junk mail. It's cheap in every sense, it's proven technology, capabilities are already included in many mail readers and senders, and online mail services and Linux user setup could easily include pgp key generation in new account setup. What are we waiting for?