Slashdot Mirror
Analysis of Spam, and a Proposed Solution
2bot_or_not_2bot writes "Spam: The Phenomenon is a detailed analysis of spam: products, scams, viruses, obfuscation methods, etc. Failed, and doomed-to-fail, methods of blocking spam are described. A general solution is proposed that does not: invade privacy, perform wide censorship or blacklisting, or involve payment and cooperation with corporations (beyond the transport and storage of data)." Hmmm.
We apply Islamic law.
They steal our time, money, and bandwidth.
We take their hands.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
I'm glad the author included so many examples of actual spam messages. I was beginning to wonder what spam looked like.
John.
The best way to stop SPAM is to find the person(s) that are sending and post their personal information on the web. Everything email address, phone numbers, cell phone numbers, home address, business address, dogs name... everything there is... and let vigilante justice take over from there...
.5% of the people (s)he sent out spam to call his cell phone and leave a nice voicemail, everyday, all day, he will start to know what it is like to be harassed and for it to cost him money out of his pocket and the grief that he caused so many...
I mean come on, if only
"The word "genius" isn't applicable in football. A genius is a guy like Norman Einstein," - Joe Theisman
There's a reason why the spam-fighters are so pessimistic about the possibilities. You can't match all of the below. (In particular, we want to manage our own mailservers, but won't let others because they are incompetent. We want to receive all non-spam email but also want no spam to get through filters. We don't want legislation and bureaucracy to get in the way. We don't want to pay per email because of our high volume mailing lists like lkml. etc etc.)
------
Your post advocates a
( ) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Doing the Right Thing should not be preempted by making a buck.
There's a boycott occurring for Microsoft's Caller ID for E-mail. They're asking for anyone developing a mail client, spam filter or mail transport agent to use a more open protocol, rather than a patented one.
The web page contains lots of images of SPAM that the author has received.
Here is the text of his proposal:
Test 1 2 3 4
John.
Here is another way of looking at it: Spammers exist because there are idiots out there who fall for "vicod1n" or "pen1s enl@rgement" or what have you. We should have users who are purchasing these products pay an additional "spam tax" on it, to compensate for the wasted bandwidth and so on. Sort of like "shipping and handling fee". Actually, it comes close to the Internet tax idea that Congress is punting about, but applied to spams.
i don't know about any IT people around here but the biggest problem that I've been facing is getting back control of Hi-jacked computers. The tools out there to fix the problem just don't cut it 3000 search bars, start page hijacking, related pop-ups, malware, programs that just wont un-install. Its bad enough that they install in the background but there should be a "law" to make programs uninstall-able. Also make them from hiding there presence.
Spammers are not very hard to track down. The companies that use their 'services' are even easier to track down. Many if not most are in the US or EU.
I've done it myself a couple of times, and have explained the relevant legal code from spamlaws. I have yet to hear back from either the spammers or the authorities I have explained this to.
I would think if law enforcement would do what it is SUPPOSED to do, spamming would be vastly reduced.
Counter Spam Measure: Negative Feedback.
Imagine if all or some very large contingent of email clients allowed you to
"retaliate" against spam messages. Highlight message, select "negative feedback"
option, a daemon is spun that traces back as far as possible the route of the
message and barrages it some fashion. By pings maybe? By directed replies? Imagine
it does this in some scheduled fashion so as to minimize the impact on your local
network. As 1 million disparate sources converge upon the last traceable source of
the route of the offending spammer, some network somewhere will start to feel the
load. Like the spokes of a wheel converging on the hub, the retaliation traffic will
thicken as it closes in on the source. The pain increases. ISPs inundated by
individuals expressing their right to freedom of speech, will feel suddenly inclined
to exercise their right to refuse service to someone.
The "negative feedback" could be dosed in a coordinated fashion if there were some
P2P means of establishing how many individuals had received a particular spam. If a
spammer hits only a hundred people, the dose of retaliatory traffic would have to be
increased to be felt. If the spam hit a million, it would require only a modest
retaliation to utterly swamp the source.
Just thinking out loud. Could this be made to work? No one's free speech is
curtailed, spam is dealt a serious blow.
fight fire with fire.
This dude has a decent idea, I guess. I've found a method that has been foolproof for the past three years. I only give out my email address to people I directly know. I've had a Hotmail address that's been spam free since 2001, not even a drop in the bulk bucket. Once or twice a year I'll get a Hotmail Services thing, but that doesn't matter to me. I keep a junk address at Yahoo when filling out online forms, posting, etc. It works for me and it works for my friends. My ISP email address has _never_ received any spam.
I also reply below your current threshold.
You know, if government really focused on penalizing the bottom end product creator for spam, I'm sure it'd be minimized drastically. For example Viagra, made by Pfizer, if they penalized Pfizer for spam and not controlling the methods of their advertising, I'm sure many companies would think twice about their methods to deliver content.
Sure it would need some tweaking, but to go after Joe Blow unsuspecting user who's machine is probably loaded with trojans is moronic. Even a good enough trial lawyer for the most blatant spammer could probably convince a jury that the culprits machine was infected if they tried. It's obvious CAN-SPAM and other moronic laws aren't working so why not take it to the next level?
Pentagon Plane Crash of 2000
MoFscker
It should be self-evident that this solution is not workable. Anything that requires this massive type of retooling of the whole method of using e-mail is doomed to failure.
Any proposed solution cannot cause this type of massive interruption of normal e-mail usage.
Someone is WRONG on the Internet!
Next!
Personally I rally liked D. J. Bernstein's (qmail, djbdns, daemontools) idea for a new mail protocol. The big difference between it and mail we have now is that only the notification of mail is sent, not the mail itself. The mail sits on the senders mailserver, waiting to be picked up, and if you want to retrieve it, your mail client does so from his server. Think about it - No more anonymous spam, since you KNOW where messages are coming from if you have to retreive them. Therefore, if spam is illegal, we can punish them... and there is no more faking of where its coming from.
The other cool concept to that is mailing lists vs bandwidth. In old mailing list styles, a message would go out to the list, bouncing back from all people whos boxes are gone or full- witha lot of traffic. In DJs new way, there is only notification of the message sent, and then only those who really want the message download it.
The more you think about it, the better of an idea it becomes. In the wold of terrifying ideas like "postage for emails" or "really super-mega-expensive domain names for mail only" Bernsteins has an elegance and practicality I haven't seen elsewhere.
I administer a mail server for a small ISP. The problem with filtering on the user's end is that my costs are consumed by the time the user deals with the spam. I don't think, as the article suggests, that spammers will slow down if their message is not being read, in fact they will just spew out ever more spam. If a 1/10 of 1% hit rate does not deter them, a smaller hit rate won't either.
I have to put some upper limit to the amount of storage I can give each person (right now I allow 100M, which I think is quite reasonable). But if a user goes on vacation and does not check their e-mail for a month, they could have their inbox filled with spam and viruses (not much difference these days, from a server admin point of view). This will preven legitamate messages from coming through. Therefore, I use the following technical measures to help reduce spam:
- RBLs: dnsbl.njabl.org, sbl.spamhaus.org, xbl.spamhaus.org, and dul.dnsbl.sorbs.net
- SPF:Sender (not adopted widely yet, but it does block a few messages a day even now)
- Blocking specific subject lines (during virus outbreaks this can help)
- Blocking mail "from" non-existant domains
I really have no choice, I cannot afford not to take these measures. I explain all of them to my clients, nobody has had a problem yet. These measures catch roughly 75% of spam and viruses, and as far as I know, no false positives.I have 1 email address that I have used for many many years, far before spam was a problem. The problem is, my email address has passed beyond my control. You can still find it on the 'net in usenet archives, mailing list archives, and who knows what else. The point is, 10 years ago, we didn't think to conceil their addresses... they wanted to make them easy to find so that people could find *us*!
Even better, somehow, there's a database that matches names to email addresses. People other than me map to my email address, so I get "legitimate" spam.
Furthermore, not loading the images and not clicking on the links doesn't fix the problem entirely. I've checked, depending on which address they've spidered. Contact addresses for my web-design business that I shut down 3 years ago are still getting spam.
That I have to change an email address that I've had for nearly a decade... well.. it makes my blood boil.
Gentoo Sucks
My spam folder is full of mail with all sorts of crap random words.
The one or two which have gotten through look like they could have been written by a Perl guru.
Government of the people, by corporate executives, for corporate profits.
Uh, I think this guy just invented signed email.
See that "Preview" button?
Post your email address and I'll forward my spam messages to you. That'll train your bayesian filter.
Government of the people, by corporate executives, for corporate profits.
While I'm pretty strongly of the opinion that a PKI system with a trust network and signed content is ultimately going to be the only effective long-term way to deal with spam, this isn't great.
It's essentially just a PKI system, but requires effort on the part of the individuals to manually set up a trusted transmission channel for authentication data for each person, breaks security if an email is exposed, does not provide strong authentication benefits, and seems to be open to forgery containing data from an original email. It still requires the installation of software.
Instead of transmitting each "set of formulas" via a trusted channel, one could hand over an RSA pubkey, and instead of some weird proprietary embedding of secrets, one could simply sign the email. This provides all the benefits of the proposed system, operates in a regular manner, is strong against compromise of a client machine or of sent email, and there are, to some degree, systems in place to handle signing.
I would advise against this solution. It provides no benefits that a conventional email signing system lacks, and has some serious weaknesses.
May we never see th
Seriously? Go to a syn-syn/ack-ack system.
The sending SMTP box says to the receiver "I've got a message for you" Receiver caches the message, hands the source box a 32 digit random number and says I'll call back in 30 seconds by your FQDN. It does so. Receiver says "did you send me a message with the serial 'x'"? If yes, then the source in the header wasn't spoofed, and the message goes through, if not, the message gets dropped.
Almost all spam these days comes from spoofed sources. But if in this case it's still spam, it's a lot easier to track the source immediately and deal with it. Take away the ability to hide, and like mold in the sunlight, most of it will vanish without further effort.
This 'article' dismisses laws outright. Sure, bad laws, like in the USA, haven't worked. But look at europe! Successful laws, minimal spam.
It never ceases to amaze me what crap articles get accepted while quality ones get rejected.
Each item in the following list was suggested by the words or actions of people who presented themselves to the IETF or elsewhere as having discovered the FUSSP. Some of the items may seem obscure to those who have not dealt with the IETF.
Prevent email address forgery. Publish SPF records for y
That way you can use different addresses for mailing lists, orkut, random recipients, each Slashdot posting, etc., and blacklist addresses that get abused and/or only whitelist addresses you've sent people. There are some risks - the subdomain version occasionally gets hit by dictionary attacks, so you might receive 10 million messages on an occasional really bad day (this mainly happens if your subdomain doesn't run its own SMTP server that can milter it.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The problem with your solution, is that I have never given out my email other than a hand select few whom I trust. However, I am now receiving spam by the handful daily (though overthecounter anti-spam software has been next to perfect for filtering it out).
The problem is, that my email is somewhat generic with my first initial, last name, plus a numeric conditioner. This email was assigned by the provider. Unfortunately, many spammers, once they realize how emails are formatted for an ISP, can easily run through a list formatting it with the most common names and values. They will no doubtedly waste some emails to addresses that don't exist, but they also hit a large number of valid addresses without the use of a list.
So you must have a fairly unique address or creative provider. That, and somewhat lucky that your address hasn't gotten out yet. But it will, eventually.
It's dangerously bad. If email messages accurately identified where they came from, and if spammers didn't maliciously forge addresses of people they want to harass, and if spammers didn't usually abuse free email systems and free web pages or forge purely bogus sender addresses (usually also at free email systems), then that would be a fine idea. Many spammers also frequently put other people's valid URLs in their mail to fake legitimacy, e.g. URLs from E-Bay's news site or the Better Business Bureau or various anti-virus companies, in addition to having their own URL for the suckers to click.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
This is simple and requires no changes to a mail client to function, but one small change would make things easier. The solution does not need to happen all at once to be effective, and does not change any of the current protocols for email (POP,IMAP, SMTP).
The idea: multiple, sender/use specific addresses on the client side. Basically instead of having one address with your ISP, you would have the ability to create up to 50 aliases to your account. Not that these are not 50 accounts, all of your mail still winds up in the main mail account at your ISP.
Lets say you have bob.smith@myisp.com as your email address. The goal here is that you would NEVER give out that address. Instead, you log in to your ISP's web site and create addresses that you then give out. These addresses can be set to expire after a set date, or only be removed manually.
So you like to pay your bills on-line, create an address bobsbilling@myisp.com and use that on all the registration forms for your utilites, credit cards, etc.
bobs-shopping: use it to register for any on-line shopping sites
bobs-long-ebay-address, sendmailtobob, tossaway32341, etc....
You create an address that you give only to your family/friends, you create an address for each mailing list, create an address that you put in the public LDAP systems and other person-search sites, create an address for sweepstakes/contests, etc.
If you start to get spam on an address (you can easily check the headers to see which address the spam was sent to), you simply change the address and tell the few people/sites that used that address about the new one. The more addresses you have, the fewer places you need to notify of any changes.
The only disadvantage is the initial changeover does take some time/effort. Once created, the addresses mostly just sit there and don't require any maintenance or routine changing.
The advantages: little to no spam; abliity to easily identify WHERE the spammer acquired your address when you do get any; spam does not take up any bandwidth or storage space on the recieving mail server once an address is deleted after getting spammed; no resource intensive and complicated filter software required on the server.
How well does it work? With about 35 addresses out there (may are web site specific), I receive only about 6 spam messages a month. Each and every one of those is sent to a public administrator address like webmaster, hostmaster or the like, not too bad considering I recieve such email for about 10 domains.
In the last year or so since I've started doing this I have only had to disable a single address due to spam, and since it was for a single web site, it took less that five minutes to effect the changeover to a new address.
To those who say that this is too much of a hassle or takes too much effort, I ask this: would you rather have to spend 30 minutes a year maintaining and changing email addresses and informing senders of the new address, or spend 5 minutes a day updating your spam filters and double-cheking the positive results for false hits?
As I stated, this does not require and changes to the mail clients, but if there were one change it would be nice: when you reply to a message the client should automatically use the address that the initial message was sent to instead of attempting to use the actual account address.
Article X: The powers not delegated... by the Constitution...are reserved...to the people
Interactive filtering of SpAm by targets/users is best.
... maybe a couple other protocol/apps to provide identification and routing within TCP/IP packets for login, email, web-surf, VoIP, ... so many check, verify, route, ....
...), a group of addresses (job change, organization name update, ...), or all addresses (global list update/upload, reduce complexity, dropout, ...).
....
...) added to a user-AEL, or enough URL information to link back to an online business/interest website to track resent online banking, trading/investing, purchases, subscriptions, ... print invoices, or ....
I think; maybe, valid personal email should be the focus.
We want our email, but we do NOT want sPaM.
Currently we use USRID/AccID, DNS, DHCP, ARP-RARP,
I agree, with others, the W3C (someone) will need to add some RFCs on check/verify local "Lookup" user approved filter for email.
As Relates to SpaM/Email:
1. Subscribers, customers, users of an email service must be required to define an "Approved Email List (AEL)". Email client applications should require a user-action (right-click-select option, maybe) to generate a UDP/TCP update-message to add an addressor's email to the user-AEL resident on the email/profile server. To delete any addressors from a user-AEL should require a few extra steps of accessing the user-account web-page and specifically selecting one address (we change friends, someone moves,
2. Email service providers must provide to users a web-app/text-upload process for managing a user-AEL. (1) Either upload formatted text (with total content overwrite option) user-AEL as part of the user account/profile definition, or (2) on the email service domain's open/manage email account website a web-app that allows easy addition/deletion to the user-AEL.
3. New/Unknown email addressors, those not identified in an addressee user-AEL, with a datagram over 128-bytes (standardized size more/less for one name and an email address) are terminated, not delivered, bit-bucket, not replied/forwarded,
4. New/Unknown email addressors, those not identified in an addressee user-AEL, with a datagram under 128-bytes are delivered to the email addressee. This will allow the email addressee their option to decide; if the email addressor should be added to their user-AEL. This will allow an addressor to provide enough information to be potentially (as family, friend, business, hobby,
5. Incoming email are checked for valid local email accounts (NOT, then terminate). Incoming email having a valid local address are then checked by comparing the addresses with the user-AEL with the specific email address (userid@domain.___) of origin (MATCH NOT, then terminate). Repeat email terminations/rejects from same "@domain.___" could be blacklisted as a sPam@domain.___ unless recognized by a local user-AEL.
I'll stop counting here, because I think the rest can be surmised and counting gets boring. This process could be close to transparent for email users, except for the managing of an email account user-AEL. It would reduce spAM and potentially malicious/viral email in obvious ways by limiting allowed payloads/datagrams from unknown (un-validated/vouched for) sources in any email. Vouched for addressors (causing problems) on a user-AEL could be more traceable. The processing/handling overhead of such a systems would (I expect) be about the same as the present process and would significantly reduce email-server storage space requirements. Email is un-trustable, but required tool in the business world, and increasingly burdensome of our personal time.
The spAm-cans could only dump to email users that included them in their user-AEL. Over time it would reduce the spam-flood and/or spam-DDOS on the internet, because few (maybe none) would ever see spam-stuff and SPAM would prove a financi
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I imagine the problem is upgrading all those servers, or coming up with a transitionary system that allows both to exist (via trusted gateways?).
True, but if Sendmail and all of the other big mail packages got together and agreed on a date to have the upgrades available and working and then released the update packages on/by that date, you could have this auth as a switch to turn on at each SMTP server. Then when the implementation date passes, a lot of the big sites like AOL, Hotmail, etc. get it going, and if your company/ISP doesn't do so as well, you can't send mail to those folks anymore.
I remember the days when open relays were the norm and then there was the big push to close them. Our company got on the RBL and couldn't send mail. That got our ass in gear to fix it right away, and nobody died. This would be much the same, methinks.
I have a similar situation, an address I've had a good 15 years and it's so swamped with spam I'm regretfully coming to the conclusion it's not worth having anymore. But, if I only had control of the mail server...
I've got a much simpler method of stopping spam, and my analysis of the spam I receive tells me it would kill the vast majority of it. The author of the article almost mentions it, but discards it, wrongfully I think. He says
But he's wrong. I don't think I've ever once gotten a legitimate email in HTML. Trouble is it's no good to download the damn things before I can see that they're HTML, for it to be an effective remedy it needs to be implemented on the server. I think if email clients quit interpreting HTML (which they never should have done to begin with) or servers started simply refusing to accept messages in HTML, SPAM would, if not totally die, be dealt an incredibly powerful blow.=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Step 1: Salt the spammer's email databases with guaranteed bogus email addresses that no legitimate email sender has ever seen. This is currently trivially implemented as follows. In your website's robots.txt file, list several files that robots must not examine -- these are your honeypot. Then, fill those files with HTML that contains your bogus email addresses. Spammers will, quite reliably, disobey the robots.txt file, use it to discover HTML files that are not linked to from anywhere else in the world, and add your bogus mail addresses to their database.
Step 2: Implement greylisting + honeypot-based RBL. When email arrives that is not whitelisted, see if it comes from an IP address that is "temporarily" blacklisted in your RBL. If it is, you can reject it right now. Otherwise, see if the target address is in your honeypot database. If it is, add the sender's IP address to your RBL and fail immediately. Otherwise, engage the now-classic greylisting algorithm (see http://www.greylisting.org/) to "tempfail" the email. The point of the temporary failure is to give the spammer time to use the same IP address to send the same spam to an address that *is* in your honeypot database, so you can then proceed to reject the retry of the spam to a legitimate email address).
- requires no per-user work, such as "training" of filters.
- requires no changes to any software, except MTAs (and only a handful of them handle most of the world's software). no new laws.
- no false positives. to get blacklisted you *must* have transmitted email to an address that could only have been obtained by illegally harvesting a website.
- even compromised home systems are not terribly harmed. if a spammer takes over your home computer and uses it, well, the IP blacklist need not be permanent, just long enough to cover a single spam run -- a few days is probably plenty. if the spammer is blasting out runs from your home computer continously, well then you have worse problems than finding yourself unable to send email to GrandMa.
- not easy to defeat. right now, anti-spammers must work very hard to locate the "real" email amidst all that spam -- and never, ever mistakenly reject a "real" email. greylisting plus honeypot RBL inverts the equation. the spammer must make sure that not a single "bogus" email address is anywhere in his database! spammers are ingenious, but developing absolutely perfect lists of legitimate email databases is something they have no experience with so far.
- no restriction of free speech. total whacko strangers who aren't spammers can still send you email -- it may just get delayed for an hour or so (a fact which is totally true already).
- nobody makes any money off it. you don't have to pay anybody, except for the effort involved in setup and maintenance (a fraction of the total time wastes on spam currently).
- computationally cheap. most MTAs are already looking up IP addresses and target addresses in databases. cost of this scheme should not greatly slow down most MTAs. especially compared to content-examination schemes such as Bayesian filters.
- no judgement calls in blacklisting. no third party has to decide what is spam and what is not. the rbl in this scheme is totally generated from absolutely bogus email addresses -- the only way you can get in the rbl is to flat-out declare yourself a scumbag by sending to one of those illegally obtained addresses.
No scheme is perfect, but greylisting combined with an RBL that is derived solely from bogus email addresses is pretty damn good.The section on Colin Fashey's site, way down at the bottom, that reads "Basic operation:"
You have to authorize each sender? The sender computes a code to send you mail?
Right. Most people can't get the clock on their VCR to stop blinking. This ain't gonna happen.
-Charles
Learning HOW to think is more important than learning WHAT to think.
Unsolicited Commando
Everyone says that filtering all the spam in the world isn't going to help if we can't stop users from clicking on it. They're right. So if we can't stop them from clicking, why not do the reverse--flood the SPAMMER'S inbox with false positives of our own?? Basically UC is a little program that goes to companies that spam's websites and fills out their sign up forms with real looking but randomly generated info. At SOME point, there is an opportunity cost to checking up on these false positives. For example, if it costs $0.02 to check up on a false positive, and the companies make $10 for each order they sell from spamming, then we need is a distributed network to put in more than 500 false responses for each positive response they receive. If you've got a distributed network of 1000+ computers, and you put in a false positive every 30 seconds, then in 1 hr that's enough 120,000 false positives or enough to cover for 240 real responses. The beauty of this is that there is no longer any profit for the business using the spammer. It hits them where it hurts most.
But this method requires a large distributed network to work! It could, but nobody seems to know about it! Right now it's just some guy's pet project--if this thing got a serious team and some serious PR, it could really take the spamming world by storm! (Of course you'd have to watch out for abuses--targetting innocent businesses networks--but we already have large blacklists a la spamcop and under an open framework I think it'd be safe enough to use.)
For god's sake people, if we got a large enough network, it could really work!
Have you overtrained your filter? That tends to weaken its usefulness after awhile. If so, remove the training DB and retrain it from scratch.
All the technical solutions seem to be doomed because (thankfully) we don't (quite) live in a Microsoft monoculture so there are a bzillion of mail applications at every point of the emailing process and it's impossible to change them all in a complicated manner. But there's an easy change: sign emails with pgp or the like. Then restrict your attention to signed emails.
Sure, it doesn't solve any of the bandwidth or storage problems, but it would make filtering so much easier. If the spammers sign their emails to get through, you could at least find out who they are. (If they use certificates from shady certificate-granting authorities colluding with the spammers, you could simply reject those as well.) Having a digital signature would be an easy way to distinguish bona-fide communications from junk mail. It's cheap in every sense, it's proven technology, capabilities are already included in many mail readers and senders, and online mail services and Linux user setup could easily include pgp key generation in new account setup. What are we waiting for?
I have a partial solution that hits one item on the list ("Extreme stupidity on the part of people who do business with spammers"), but I still think it's worth a try. It's called "Spammers are Scammers." We create a TV/radio/print/web advertising campaign to drive home the point that all spammers are scammers, selling fake products, stealing credit card numbers, lying about taking you off their lists, etc. Anyone who buys anything from them is humorously but mercilessly mocked as an idiot. The ads would be created cheaply with volunteer labor and contributions, and run as free public service spots. The goal is to make it common knowledge that buying from spammers is stupid, the same way Smokey the Bear taught generations about preventing forest fires.
Yes, I know this isn't a 100% solution. However, it requires no new laws, technology, taxes, blacklists, whitelists, or anything else. It's 100% voluntary and could be run in an Open Source way. Yes, it smears all spammers with the same brush, but is any spammer going to step forward to sue? I doubt it. If it only convinced one spam-responder in five to not respond, it would be a huge hit on the spam industry.
Q: What does the "B." in Benoit B. Mandelbrot stand for? A: Benoit B. Mandelbrot
It did? Apple's Mail.app uses a Bayesian filter, right? Salting messages with random words haven't thwarted its filter at all. I might see a couple or three spam every week, but considering that's out of hundreds filtered per week with no false positives, I can live with that.
He also makes the following curious claim:
Is this really a problem? I'd say this is one of Bayesian filtering's advantages.
So far, Bayesian filtering has worked wonderfully for me. I don't see that it's been defeated -- or will ever likely be truly defeated -- at all.
Okay folks... move along... nothing to see here...
Does the author really think that I'm going to exchange formulae with everyone I want to exchange e-mail with? Even if the client software made it as easy as "pairing" bluetooth devices... ugh!
Every time I see one of these doomed-to-fail spam stopping schemes, I become more and more convinced that the only way that this problem is ever going to get solved, permanently, is with certificate-signed e-mail. Basically, e-mail client software would cryptographically sign each sender's outgoing mail and the receiver's software could check that their cert was signed by a trusted certificate authority. Most software can already do this; all you need to do is go get a certificate.
Ultimately, it would probably be left up to the individual receiver as to which certificate authorities they wanted to trust (ie, PGP's "web of trust"). But, for the most part, I think most people would default to trusting a handful of "big" cert authorities. On the face of it, there is some loss of privacy, but the loss of privacy would be in proportion to the clout of the CA that signed your certificate.... which, in turn, would be in proportion to how reliably you wanted your e-mail to be delivered. So, the sender would still get to pick how much privacy they sacrificed.
But I just see no other way to stop spam than this. Certificates would add a high degree of confidence that the sender could be reached (either by the receiver or by law enforcement)... and "reachability" is the first step towards accountability. Now, for the cases where someone managed to get an certificate with bogus contact info... well, that's what certificate-revocation lists are for. Basically, it's not really different from the IP blacklists that we're using now, except it would (hopefully) be a lot harder to obtain a new certificate than it is to obtain a new IP.
Here's what I use:
Sneak Email
Don't fear spam from shopping online ever again.
The original disposable email service. Regain power over your inbox from commercial forces, and catch them spamming.
Fully user supported and operating free of exploitable commercial ties. No debt, no operating loss, fully self sustaining... a virtual vault for your email address.
Now with version 2.0 free and premium services.
Quick start: three easy steps to total spam control.
1. Create an account: Providing a username, a password, and an email address you wish hidden from spammers.
2. Every time you need to give out your email address to somebody you don't trust, log in to Sneakemail and create a new Sneakemail address.
3. Give this Sneakemail address to them instead.
Mail sent to this Sneakemail address is rerouted to your real address, and when you reply it is rerouted back to the sender. Your real address is never seen. If you receive unwanted mail through this Sneakemail address, such as spam, you can take control by either filtering incoming mail using the Sneakemail filters, disabling the Sneakemail address itself, or disposing of it permanently. You also now know where a spammer got your address.
You now know all you need to know to protect your inbox from the internet by using Sneakemail.
About.com had a write-up a month ago.