University Capitulates, Switches Off Spam Filters

Heraklit writes "As reported on German news site Heise, the system administrators of the Technical University of Braunschweig have temporarily given up the fight against spam. Because of the legal obligation to deliver all mail and of the delay time exceeding critical 5 days(!), they decided to switch off all filter mechanisms. Before, the 20 servers dedicated to processing e-mail alone had been breaking down under a load of 100000 unprocessed mail messages, ca. 98% of which had been spam or viruses. ... A similar e-mail jam occurred recently at the IT central of the German Federal Government. Is this the beginning of the end of e-mail?" (The Fish may be useful.)

Comments

Question?

[untouchable]

Does anybody know the filtering methods they were using before they decided to toss everything to wind?

Re:Question?

[Nasarius]

Good question. I would think that 100,000 emails is really not a lot, even for 20 low-end PCs.

Re:Question?

[Donny Smith]

>Good question. I would think that 100,000 emails is really not a lot, even for 20 low-end PCs.

I'm sure that's not the point - it's easy to deliver 100K mails, but the problem is that you've got to manually check for false positives and un-mark them as good email.

Re:Question?

[dont_think_twice]

Does anybody know the filtering methods they were using before they decided to toss everything to wind?

They had a team of 20 monkeys that would read the emails and determine if they were spam. Unfortunately, the monkeys are easily distracted, so anytime they got spam about banannas, they would lose focus. This lead to the backlog.

What? you have never gotten bananna spam before?

Re:Question?

[Anonymous Coward]

What? you have never gotten bananna spam before?

Yes, but the emphasis wasn't so much the banana as it was where it was inserted.

Re:Question?

[dickiedoodles]

What? you have never gotten bananna spam before?

No but I often get asked if I'm satisfied with the size and/or performance of my ba|\|a|\|a

Re:Question?

[slashdot_commentator]

No one (sane) *manually* checks for false positives, just the end user. You do need manual personnel to follow up on end user inquiries, but it should be moot. If you have the right spamblocking service/setup, you're not going to get false positives...

Re:Question?

[AndroidCat]

Frequently for stuff that would keep bananas ripe for days without going mushy.

Re:Question?

[Seumas]

Simple problems have simple solutions.

You can increase the threshhold at which you declare spam to be spam. Allows for more misses, but reduces the false positives to, essentially, nothing.

Or, you can just tag likely spam with ***SPAM*** in the subject and let the user deal with it.

Or even better, you can direct likely spam into a specific IMAP folder on the server that the user's client can subscribe to and they can glance at their personal SPAM folder on the server whenever they want without having to download all the bodies.

As someone who personally uses postfix+procmail+spamassassin+razor and recieves 4,000 emails per day, I am currently filtering out 98% of the spam on the server and have had ZERO false positives in two years and 2.9million messages.

Statistically, you will eventually get some false positives - especially if you have a large userbase (as opposed to just one or two accounts). But if one out of every few million messages isn't acceptable, you can just use one of the previously suggested methods.

The worst you can do is nothing at all.

Re:Question?

[Monkelectric]

Surely it is Bayesian classification which brings my Athlon 1700 to a screeching halt (spam assassin) (takes about 1 second to classify an e-mail). There are FPGA and DSP based Bayesian classification systems, they should really look into them.

Re:Question?

[Pieroxy]

It looks to me that they were not delivering spam mails. Otherwise their obligation to deliver everything would have been fulfilled.

Hence, a difficulty for the end users to mark themselves the false positives....

Re:Question?

[techno-vampire]

Unless you don't care about false positives, you don't block spam at the server by sending it to /dev/nul. You put it in a special folder that the end user can check. That way, false positives can be received, and you can adjust your filters as needed. Presumably, their spam filters were getting so overloaded that they couldn't even do this much.

Re:Question?

[Anonymous Coward]

I am currently filtering out 98% of the spam on the server and have had ZERO false positives in two years and 2.9million messages.

The trouble with false positives is that you you don't know you have them. Unless you manually went through the 2.9 million messages categorized as spam and determined that they were, indeed, spam. In which case there's no point in having a mail filter system!

Moderation: -1, Idiot

Re:Question?

[edunbar93]

More than likely they were using spamassassin, but with all the external checks still turned on. They recommend for large sites to turn these off because checking SPEWS, ORDB and Spamcop takes a few vital seconds per message, and when you're delivering more than about 20K messages per day you start getting a backlog.

I know that we used to do this and while it made spamassassin more effective, it's much faster to do it using a firewall or tcpserver rules. We have a single server delivering 50K+ messages per day and it's all we need. If the load were to double, we could still use the same machine.

It's worth noting that making these changes with spamassassin and qmail is really easy and would only take about ten or fifteen minutes per server if you know how.

Re:Question?

[andy landy]

I work at a UK university and we're introducing a new system to deal with spam. We've already got an in-house product, MailScanner which does the detection job pretty well, but our mail servers are quite loaded with junk.

We're about to offer a "delete at gateway" option, so our users don't have to filter their email and lessen the load on the mail servers at the same time. This service is optional, so our users can choose whether they want it, but we'll be strongly encouraging them to use it.

Additionally, they can set their spam threshold, so they can delete most spam, but review the borderline cases.

Re:Question?

[markxz]

Will the "delete at gateway" be able to delete the high scoring spam, with the medium level spam (+ false positives) going to the user for filtering?

Re:Question?

[macemoneta]

My sister-in-law is now receiving over 2400 spam a day, and no longer even has the time to scan for false positives. For folks like her, email is definitely broken. She has no choice but to rely on spam filtering to make the right choice, even though a false positive could cost her small business a serious amount of revenue. Even the local processing on her PC to sort/filter the emails is keeping her machine busy.

For many of us, the problem isn't that bad. But we need to recognize that many others are dealing with an onerous problem.

Re:Question?

[Jibber]

I don't know what kind of machine you are running but we have SA running on it's own machine, serving two mail servers. It handles over 300K messages a day with network tests enabled, and the standard scan time is sub 1 second.

If you are going to be running SA with any kind of volume you need to keep in mind...

1 - Run a local DNS caching server. dnscache works well, give it lot's of memory to play with

2 - Rsync and run as many of the RBL's locally as you can.

3 - Set the max number of children that SA is allowed to spawn, on our hardware that number is about 12.

4 - Lot's of memory! Depending on the number of max children, you might want 1 gig or even 2 gigs of memory

5 - Off load SA on to it's own dedicated machine, so if need be you can easily inject another server using hardware or dns round robin load sharing.

I don't know what kind of volume the Uni was handling but with 20 machines I think I could easily handle upwards of 20 million deliveries per day.

White listing + Auth tokens

[Anonymous Coward]

Just white list known good addresses. Hand out auth tokens (X-Not-Spam: md5 digest here) and white list those temporarily. And white list known good PGP keys.

Byebye, spam.

Byebye, email.

Don't forget the other problem...

[chrispyman]

If you don't filter out any of the spam, then some mail server somewhere is gonna have to store all that junk mail. Even with a quota system I'd expect that there'd be a whole bunch of people just "giving up" on e-mail.

Re:Don't forget the other problem...

[dealsites]

Yeah, you'd think even if you you had sorry filters in place, some filetering would be better than none. Giving up is just the wrong thing to do. Many people have had good success with Spam Assassin, even if you have to fine-tune it by hand it should help with the obvious and common spam emails. Some of the spam will always get though, but it shouldn't be too had to catch the majority of spam.

--
New deal processing engine online: http://www.dealsites.net/livedeals.html

Re:Don't forget the other problem...

[hammock]

Strip all attachments.
All of them. Don't process them, just ban them.
If you want to send a file, use ftp or send a link to a read-only http or smb/nfs share.

Using email server blacklists instead of filters on the spam will work a lot better too. Hopefully they aren't using a brain damaged email server like Exchange.

Re:Don't forget the other problem...

[Fweeky]

SpamAssassin's pretty heavyweight; a purer statistics based system like dspam is probably more suitable for large scale systems like this; you don't want a perl script chugging over every single email for seconds at a time. I wouldn't be suprised if they needed 20 mail servers if they were using SA...

Re:Don't forget the other problem...

[Anonymous Coward]

Thats why you use the spamd for Spam Assassain.. significantly alieviates the problems associated with running a perl interpreter for each email being processed

Re:Don't forget the other problem...

[MntlChaos]

Filter on custom header Content-Type. multipart/mixed implies a message with attachments

Re:Don't forget the other problem...

[WuphonsReach]

Strip all attachments.
All of them. Don't process them, just ban them.
If you want to send a file, use ftp or send a link to a read-only http or smb/nfs share.

Love to... but not gonna happen with our users.

We settled on blocking all executable attachments (VBS, EXE, SCR, etc.).

You know, the extensions that 99.999% of users have no business reason to be sending to each other, but which are used by the viruses/worms to spread. Blocking those put a good damper on the amount of virus/worm mails that were getting through and was cheap CPU-wise.

Re:Don't forget the other problem...

[Dekortage]

Strip all attachments?!? You're kidding, right? In a university or business setting, that is NOT a viable option for most people. They're still figuring out how to right-click under Windows and make things print correctly to the printer down the hall; forget teaching all of them how about FTP, SMB, NFS or some other file serving method.

And you've got to be kidding about blacklists being better than filters... talk about false positives, sheesh! Maybe the best blacklists are better than the worst filters, but that doesn't say much. Simple control lists (black or white) are not a long-term viable solution; if they were, none of us would ever get spam, would we? You really need something that makes your email trustworthy, like Zoemail.

Finally

[Anonymous Coward]

"they decided to switch off all filter mechanisms"

Finally, I can get my "male enhancement" emails again.

I wonder...

[BeneathTheVeil]

what sort of awful sound the servers made as soon as the filters were turned off? ...I imagine it would be akin to someone who 'just' made it in a mad dash to the bathroom.

Re:I wonder...

[Drooling Iguana]

Have you seen Ghostbusters? Remember when the environmentalist guy shut down their containment unit?

Same thing.

Spam And Viruses

[FiberOpPraise]

Perhaps just disabling spam filters and leaving virus blocks in place would be a less drastic approach. Detecting spam is non-trivial, but detecting viruses is not. They are easily found and the email should be blocked. This is implemented by my ISP (Road Runner NYC). Emails containing viruses are replaced by a text message warning that a virus was sent to the email address.

Re:Spam And Viruses

[slamb]

Emails containing viruses are replaced by a text message warning that a virus was sent to the email address.

And that warning is so useful. Who do you send it to?

• The recipients? They don't care.
• The "senders"? They don't care. (The From: address is forged!)

These messages are a waste of everyone's time. I get hundreds of worms daily...but I never see them, because they're easy to filter. What I do see are these damned "helpful" messages that "I" sent someone a virus. Those are much harder to filter.

Much better way: reject viruses in the SMTP transaction. The SMTP client is then responsible for notifying the sender. If that client is a virus or worm, it will do nothing; no one is bothered. If it's a false positive, the sender will get the bounce. Reliable, unobstrusive.

If you want to filter email politely, you must follow these rules. People who don't cause the rest of us constant headaches. The worst thing is that they don't even realize it.

Re:Spam And Viruses

[tomstdenis]

Oh common, the 100s of daily "message has virus" emails I get are very useful. It makes me keep my Gentoo box win32 virus free!

I once confronted a sysop about this and they told me "if we don't email them back people won't know the message was rejected". Apparently the idea of checking while reading the message never crossed his mind.

As another poster suggested I just filter out all "warning" emails as junk which helps.

Tom

Re:Spam And Viruses

[Burning1]

Permanant Failure (5xx SMTP) codes are not safe either.

There are many cases where email is relayed before being sent to a system that does virus scanning. (Consider what happens when you use sendmail aliases and virtual domain entries that contain somthing on the order of "user: user@someotherhost.com".)

Your SMTP 5xx error will cause the relaying server to generate a bounce. The bounce will go to the person listed by the forged "To" headers, and will even include a copy of the Virus.

The proper way to deal with email worms is to quietly delete them.

Re:Spam And Viruses

[slamb]

Permanant Failure (5xx SMTP) codes are not safe either. There are many cases where email is relayed before being sent to a system that does virus scanning. (Consider what happens when you use sendmail aliases and virtual domain entries that contain somthing on the order of "user: user@someotherhost.com".)

They exist, but I do not agree that they are common. Not only do they have to have a rule like that, but they have to not be using virus scanning themselves.

So, yes, people can get bounces from virus emails from this method. But it's much, much rarer than the other way. And with the randomization these viruses do, no one in particular is targeted.

The proper way to deal with email worms is to quietly delete them.

That's a horrible idea. You will have false positives, and those will be important messages. This is why people think email software isn't reliable. It is...but administrators like you configure it in an unreliable way.

Re:Spam And Viruses

[RovingSlug]

If you want to filter email politely, you must follow these rules.

One small quibble about a final point in those rules:

I reject almost any MIME attachment that could be Windows malware. Even .zip files now. I politely ask them to arrange with me another way to send it. (Sending binaries through email isn't such a good idea anyway; it's indirect, and base64 bloats files 50%.)

It's indirect? What's a good way to transfer binary files that is both direct and secure? ... and archived with a personal note. One handy thing I do for large attachments is to upload them to a http server and send the link. But this is a pain in the ass for anything other than the biggest files. What are the good options otherwise?

Re:Spam And Viruses

[thogard]

Most viruses have a text line that start out:
TVqQAAMAAAAEAAA
since they are mime encoded .exe. Simple solution is to hunt for that tag when the message comes in and kill any message that has it. Should you have a real person sending an exe attachment, they will get the bounce if you reject it while the SMTP connection is still active and there is no siletnly lost real mail. A patch for sendmail can cope with a few hundred thousand messages an hour on pc class servers so its no big deal but I've got a faster hack when it matters.

Re:Spam And Viruses

[ezzzD55J]

base64 bloats 1/3, not 1/2.. i agree it's not great though. (Makes me wonder why newsgroups are so popular for leet file sharing.)

Re:Spam And Viruses

[Wastl]

Much better way: reject viruses in the SMTP transaction. The SMTP client is then responsible for notifying the sender. If that client is a virus or worm, it will do nothing; no one is bothered. If it's a false positive, the sender will get the bounce. Reliable, unobstrusive.

Two things:

• in many countries (e.g. Germany) you are actually obliged to deliver a message, regardless of whether its a Virus or not, or at least send the recepient a message that he received an email and can fetch it by some means.
• your proposal is short-sighted: most viruses are already relayed via several systems before they reach my mail server, so a bounce would be generated in any case; I suspect that this is true for most other systems as well.

The approach that we take is the following: We mark virus messages with a special header and deliver them in a dedicated folder in the user's mailbox. Most users simply delete all messages in this folder, but then it is their choice, we abide to all laws and do not generate bounce messages.

Sebastian

Re:Spam And Viruses

[Burning1]

Oh please, don't give me crap about my ability to do my job.

You are horribly mistaken about how common both SMTP virus scanning is, and how often the situation I described occurs. Email is relayed for anyone who has a forwarding address, many people who have changed ISPs, lots of people using custom email hosting, and a sizable percentage of the people who own custom domains.

Virus scanning is becoming common, but is not at all universal. Many email servers scan for viruses only during local delivery, and not when relaying.

Additionally, some systems use a form of relaying to deliver all email. This is the case for AMaViS in Postfix and "Sendmail Relay" configurations. Someone spitting out 5xx error codes with such a setup will guarantee "MAIL DELIVERY FAILURE" for all. : )

Old fashion viruses are becoming rare, and someone sending them is likely to find out one way or another. If what they sent is important, they will probably check to see if it arrived.

The proper response of course, is for venders to start identifying viruses differently than worms. If that were the case, we could send those "You've got virus" emails only in situations where the "From" address is correct. Some vendors do this.

With all that said, you sir, are hurting reliability of email. I delete several hundred mail delivery status notifications a day, because I no longer have the time or energy to see if they are genuine.

The sad fact is, email stopped being reliable the moment people began accidentally deleting valid email with their spam. People expect a little unreliability, and can handle it.

Re:Spam And Viruses

[jeremyp]

Slightly pedantic: the bounce message will go to the address in the forged reply-to header, or from header, or envelope sender.

I would question quietly deleting such mails. Most of the worm/virus ridden mails that I get come from people who have infected systems and where I am in their address book. They need to know they have an infected system.

Re:Spam And Viruses

[Vellmont]

I would question quietly deleting such mails. Most of the worm/virus ridden mails that I get come from people who have infected systems and where I am in their address book. They need to know they have an infected system.


I quarantine all the worms/viruses sent to my system. I look through the quarantine directory about once a week. On ONE occacion (out of a few hundred virus laden messages) I was able to determine who was sending the virus. The vast majority of the time the viruses don't leak any information about the system, and they come from dynamic IP addreses. Delivering the virus, or a "user X sent you a virus" message to the user is useless. I've never once had a false positive (and I believe the chance of false positives is about zero).

Delivering the virus laden email is just stupid. The reasons deleting it, or quarantining it far outweigh the reasons for delivering it. I'm pretty good about being able to track where a virus came from and I was only able to track down one virus origin. End users are going to have zero ability, and zero interest in doing do. They'll actually send out false "you've got a virus" reports to their friends (who don't actually have a virus, the from address was just forged).

Mirror

[karmatic]

Site's a little slow -
Akamai Mirror.

translation

[Anonymous Coward]

Spam wave?rrollt DOES Braunschweig

The system administrators at the computing centre of the technical Universit?Braunschweig kapituliert on Friday of yesterday before the effects of an unknown Spam load and the Spam and virus filters DO deactivated. After "quite controversially gef?ten service discussion" the responsible persons decided that their setting obligation, all enamels within f? To deliver days to the Empf?er, priority before the Sch?ingsschutz genius?. For the description of the situation the Admins submitted the following numbers:

"our server park of approx.. 20 systems alone for enamels is overloaded. A "basic load" of zun?st 30,000 rough enamels (Di) on approximately 100,000 enamels expanded (Fr). [... ] Per hour up to 10.000 enamels by the Spam and virus scanners are worked on and set. 98% of it are "unerw?chte" Mails (Spam, viruses) for which we nevertheless a legal setting obligation have."

W?end Mails within the Braunschweiger of computer network to be still normally set, m?en themselves external Mail Empfanger with the advice to manage, them should e-Mail-Anh?e after M?ichkeit only after R?sprache with the sender?nen and otherwise a local virus scanner use and this at least once t?ich update.

The University of Braunschweig is not threatened as only ones of the Spam oversupply: Already since past week the computing centre of the free Universit?Berlin blocks perforce all Mails with potenziell gef?lichen Attachments, and as reported the E-Mail supply of the Federal Government in the digital M sags?.

It d?te indisputablely its that the Admins of the?rfluteten computing centres does not act differently k?en, but a deichbruch as in the Braunschweiger IT landscape tr? surely not to the Abschwellen of the Spam wave, rather to their further growth with (hps/c't)

Re:translation

[Anonymous Coward]

MS Exchange servers. It's gotta be MS Exchange servers: no other SMTP server in the world could possibly require 20 servers to deal with only 100,000 emails an hour, even with only 1 GHz mail servers. Sendmail, Postfix, Qmail, all could handle 100,000 emails an hour on only 10 such machines, even running SpamAssassin and CRM114. Unless maybe they skimped on RAM and accepted vastly oversized mail messages, in which case they'd start swapping themselves to death at a lower than expected threshold.

I hope they find the idiot who selected their servers and software combinations and send them straight back to Redmond, in a box, along with the snipped off tie of the Microsoft person who sold them the bill of goods.

Re:translation

[theM_xl]

That's a translation? Into what language? :)

Re:translation

[pseudochaotic]

Why did you even bother posting that? It's almost incoherent.

all enamels within f? To deliver days to the Empf?er, priority before the Sch?ingsschutz genius?

I'll give you a dollar if you can tell me what that means.

Re:translation

[orin]

To quote the post directly above you ...

No, sendmail (Score:5, Informative)
by marnanel (98063) on Monday May 24, @12:04PM (#9234290)
(http://marnanel.org/)

7: They're using MS Exchange SMTP servers, which bog down incredibly under load, especially if you run any separate service such as spam processing.
Nah, it's sendmail:

$ dig -t MX tu-bs.de
[...]
tu-bs.de. 172738 IN MX 10 rzcomm5.rz.tu-bs.de.

$ telnet rzcomm5.rz.tu-bs.de smtp
Trying 134.169.9.40...
Connected to rzcomm5.rz.tu-bs.de.
Escape character is '^]'.
220 rzcomm5.rz.tu-bs.de ESMTP Sendmail 8.11.1/8.11.1; Mon, 24 May 2004 04:00:51 +0200 (METDST)

Probably a better alternative...

[Milo of Kroton]

...is to inform the students how to install their own software, like Spam Assassin. That would distribute the processing to the people who actually would use it.

Re:Probably a better alternative...

[n4KdR4zr]

What about some kind of seti@home like distributed filtering system on campus? There'd be privacy/security issues I guess, but with masking the recpients address, a whitelist system to bypass the filter, encryption, a well designed client,etc intercepting other people's mail might become hard enough to deter all but the most determined which would be fine by me if my inbox was clean -- let's face it email isn't really all that private to begin with.

It's done.

[jrockway]

> Is this the end of email?

Yes. When one university decides to stop filtering SPAM the entire world's infrastructure has effectively been shut down. Oh wait... no.

My UIC account gets NO spam (because I don't give it to anyone :), so I think that responibility is the key to keeping email working. Adding some numbers (*sigh*) helps guard against random address guessing.

Anyway I don't see anyone stopping you from using your own SPAM filter. Let's not blow this out of proportion, please.

Re:It's done.

[Dizzle]

Since you give it to no one, do you have an empty inbox all the time?

Re:It's done.

[shadow_slicer]

"Adding some numbers (*sigh*) helps guard against random address guessing."

Exactly! That's why I require all my users to use multi-case letters, symbols and numbers as their email address. I also require them to change the address every couple of weeks to a value different than any previous value (in case some spammer has managed to brute force it, or the user has leaked it). This has practically eliminated spam and reduced the mail server's storage usage by 99.9% (though the mail server still has to work really hard sending all those 550's).

Re:It's done.

[TheLink]

WHOOSH...

Have you had your coffee today?

blacklists

[sumdumass]

Maybe they should just blacklist the most common spam and virus adresses by subnet then filter on a lower percentage. It would seem that if they got rid of china or some other area like what happend recently with spain, it would send a message to those networks to stop things and bear some of the weight.

Re:blacklists

[LordLucless]

They can't do that. As the synopsis says, they are legally obliged to deliver all legitimate mail; if they just blacklist a whole subnet then they run the chance of blocking real mail. They just can't afford that.

Re:blacklists

[AtomicBomb]

It is a common misunderstanding. While most web server these spams are pointing to may be located overseas, most of spams are originated from US. Mostly likely from hijacked fast cable/DSL connected home machines.

You may think it is okay to block email from China or even the whole Asia because you don't know some Asians in person, but please check again where your RAM, mobo, anime etc come from... A lot of companies and university have collaborations overseas as well...

We don't really have much options left... Basically, you will have to blacklist all the high boardband provider's IP range (rr, earthlink etc)... Sorry, geeks, your email server will no longer work... It is not really an ideal solution. The other idea is kind of similar to secured DNS, ie, mail server retrieves "good IPs" from a central server. Email originated elsewhere are assigned with very low priority or filtered out altogether.

Everyone needs to be registered with their mail server with the governing body (similar to the domain name idea), say for $100 per IP. It is not that expensive if you really need that... But, prohibitive for spammer... Yes, it makes home run email server more expensive... But, you cannot get a domain name for free anyway. Why should we expect email server to be free? It may be the solution to get the economy of spamming right again.

Re:blacklists

[1u3hr]

It would seem that if they got rid of china

As someone who lives in China I get more than a little tired of being filtered out because of the continent I live in. (Especially since the vast majority of spam I get is selling products from America, regardless of what server they're sending them through.) And in this particular case, being a university it's very likely that they have a sizeable number of students from China, and many staff with academic links.

Re:blacklists

[1010011010]

Call your elected representatives! Get them to outlaw spam!

Re:blacklists

[Dimensio]

As someone who lives in China I get more than a little tired of being filtered out because of the continent I live in.

Then bitch at the Chinese ISPs who allowed the problem to exist in the first place.

Re:blacklists

[1u3hr]

The question I have is, how do you know the products are from America? How do you know the spammers are in the US?

When my spam mailbox is full of things offering me credit cards, mortgages and such that are only available or sellable in the US. Same for most of the viagra and diet pills, if I follow the links I usually end up at an American company. A small percentage aren't, of course, mainly Nigerian scams and some local stuff, but 95% is.

This isn't just my opinion. See this in The Guardian: "There are really only 150 spammers doing 90% of all the spam we get in the US and Europe... at least 40 of them are in Boca Raton."

Re:blacklists

[1u3hr]

hat article was written in February 2003. The CAN-SPAM act was signed into law in December 2003 and took effect on January 1, 2004. Due to this act, the percent that originates in the US is going to be very small this year and in the future.

Your faith is touching. Was it Nixon who started the first "war on drugs"? How's that going?

end of email?

[randomized]

Excuse me? One university gives up on spam filtering for questionable reasons and you declare death of email? Weird, I still do most of my communication via email. My servers all run spam marking services and my client filters out the junk as soon as it's retrieved.

Of course more bandwidth is wasted on spam mails, but since I don't see much of it, it doesn't bother me so much.

What do you propose to use instead of email? instant messaging? Talk about waste of time :)

Re:end of email?

[LostCluster]

I don't think e-mail is dead, but e-mail as we know it, specificially the SMTP protocol, is long overdue for a retirement party.

Afterall, the "from" field is a total free-response section in SMTP with no need to authenticate that you're really associated with the address you claim to be. That and other weaknesses are why spam is so hard to kill in the first place.

We'd be in a much better place if our e-mail system at least had a trustworthy traceback facility so that we affirmatively know who sent the message by default.

Re:end of email?

[log2.0]

One problem is: who will make this specification? MS? They certainly want to.

Once this new email2 protocol is invented, how long would it take to be implemented around the world by every admin?

What happens when that protocol gets hacked (probably by the spammers)?

I think its the right direction to make an email2 protocol but it wont be easy.

Re:end of email?

[bcrowell]

Of course more bandwidth is wasted on spam mails, but since I don't see much of it, it doesn't bother me so much.
What's OK for you may not be OK for other people. Personally, I get about 200 spams a day, versus about 1-2 real e-mails. When the ratio of spam to good mail is 100:1, it gets hard to implement spam filtering that's accurate enough to do the job. And are you under the illusion that you aren't paying your ISP for the bandwidth they waste dealing with spam?

There are some basic problems here:

1. The e-mail protocols were never designed with the spam problem in mind.
2. Any method for eliminating spam just encourages the spammers to look for countermeasures, viz. the current crop of spams with "pen1s" in them, or subject lines ending in "hekatomb spastic euphorbia malleus."
3. There is no limit whatsoever to the number of spams that the spammers can generate. Any countermeasure that's based on the current protocols will break down once you hit it with a large enough volume of spam. Either it will be too slow, or it will produce too many errors.

Re:end of email?

[Compuser]

What we really need is for our government to take
the word(s) spamassasin literally...

It'll never die.

[DrEldarion]

Is this the beginning of the end of e-mail?

I seriously doubt e-mail will ever die. It's FAR too convenient to just give up on. Even if it comes to the worst case scenario where you have to whitelist everyone who wants to send you e-mail, it'll never go away.

Re:It'll never die.

[Alan Hicks]

I seriously doubt e-mail will ever die.

I would agree, but only on a few stipulations. E-mail as we know it will almost certainly die sooner or later, to be replaced with something else that better fits our future needs. Like gopher and http, smtp, pop, and imap will all sooner or later be replaced by another set of protocols. Perhaps they will require something like SPF to reduce spoofed "From" headers. Perhaps they will support or even require encryption? Face it. Sooner or later, e-mail as we know it will die, but only when something else is able to take its place.

20 servers for only 100,000 messages?

[whizkid042]

Here at the university where I am a sysadmin, we get approx. 100K emails per day and we have no problem pushing them through spamassassin on a single server with dual 2.8 xeon processors. How in the world could this place possibly need 20 servers to process this much mail?!

Re:20 servers for only 100,000 messages?

[EvilGrin666]

I bet they run exchange.

Re:20 servers for only 100,000 messages?

[chris_eineke]

we get approx. 100K emails per day and we have no problem pushing them through spamassassin on a single server with dual 2.8 xeon processors.>

RTFBT! (Babelfish Translation) They are processing 10,000 emails an hour and we don't know what kind of servers (old, old p2-233 boxen maybe?) they are using. Right now German univer-cities dn't have enough money to buy f'ing chairs and seats for their buildings.

Re:20 servers for only 100,000 messages?

[dj245]

How in the world could this place possibly need 20 servers to process this much mail?!

1 server processes spam, 1 processes viruses, 1 is a DNS server. The other 17 process data for the SETI@home German team.

Re:20 servers for only 100,000 messages?

[kunudo]

They probably run NT. :)

Re:20 servers for only 100,000 messages?

[Anonymous Coward]

Heck, at the ISP I run, we use eight old Netra t1's (single 440 MHz Ultrasparc) running qmail, and we run through over a million messages a day. They'd have to be running twenty 386 machines to have capacity issues with 10k/hour.

Re:20 servers for only 100,000 messages?

[some_schmuck]

er, let's see ... 10,000 messages per hour, across 20 boxes ... that's what, 500 messages per hour, per box? I'd think pretty much *any* computer worthy of the name could swing that.

Re:20 servers for only 100,000 messages?

[Seumas]

No, Sendmail:

220 rzcomm5.rz.tu-bs.de ESMTP Sendmail 8.11.1/8.11.1; Mon, 24 May 2004 06:46:39 +0200 (METDST)

Re:First Post

[Anonymous Coward]

Wait, don't tell me.

1: They refused to use blacklists to cut the load.
2: They refused to publish SPF records and use SPF to block all the email forged to look like it's from their domain, significantly cutting the spam load.
3: They used one of those "commercial-grade" virus/spam mail scanners that's designed to use entirely Bayesian scanning without ever setting time-outs on the generated rules, and which was written for "completeness", not speed.
4: They forgot to set up a honeypot machine to auto-block spam domains.
6: They underbudgeted for the servers to actually do the mail handling, forgetting to set up up appropriate MX records with good fallover behavior, so when any of their served domain's MX record listed machine blinked that entire domain went offline.
7: They're using MS Exchange SMTP servers, which bog down incredibly under load, especially if you run any separate service such as spam processing.

Another riduculous law!

[edoc]

"Because of the legal obligation to deliver all mail and of the delay time exceeding critical 5 days(!)"

Is it just me or is this another ridiculous law? The University is providing free email services to those that are students at this establishment and they obviously need to filter out spam in order to be able to offer this service with there current hardware requirements. Spam is a legitimate problem and people that are offering free email services should be allowed to attempt to filter it as it can be extremely taxing on a busy mailserver. They can filter the spam without being intrusive or breaking privacy laws so I see no reason that it should be prevented by law.

Re:Another riduculous law!

[LordLucless]

Are they providing free internet access? Or are the students paying for it, directly or indirectly? Because if they're paying for it, and legitimate mail gets lost due to the Universitys system, that's probably a basis for somebody to sue them. Failure to provide a service that was paid for. The Uni probably can't take the risk of legal action.

Re:Another riduculous law!

[AndyChrist]

Some university departments run on email. If you don't deliver reliably, you could create chaos in some classes.

Real Time Blackhole Lists

[OldMiner]

Personally, if it were my universtiry, I would prefer they started to use a RTBL. The fact of the matter is, if the likely spam isn't sorted out first, I have to try to discern the stuff entirely by hand. And although I can easily pick out Viagra ads, I have relatives and the occasional acquaintence who send mail that looks awfully like spam. Didn't want to type a subject. Used "hello" as the subject. Didn't configure their mail client properly, so their "replyto" looks crazy. Without some initialy spam filtering, I would miss at least some of these -- in fact, I'd probably miss more mail with no filtering than with a judicious blackhole in front of me.

Love or hate SPEWS and other kinder, gentler RTBLs, they're better than the present choice. It would certainly reduce the load of these email servers to where it could be more easily handled. And, if nothing else, they couldbe used to prioritize mail. Use Spam Assassin or something else to do some initial tag and filter so that mail coming from Asian IPs or originating from mail servers on cable/ADSL networks gets put into the "slow" processing queue while everything else gets sent down the faster pipe.

</spouting with little to no knowledge>

Client Side Filters

[cbreaker]

The students and other users of their mail system will just have to use their own spam filters now.

It's not the end of the world. There's a few good spam filters for outlook and outlook express, and some really awesome free ones for linux/unix.

Encouragement to spammer

[fembots]

This kind of shutdown is only going to encourage spammers to send out even more junk mails.

Now they know that most servers will eventually not able to cope up with the traffic, they might as well send out randomly-generated '@domain.com' spams until the admin gave in.

Self-Destructing E-Mail helps

[MikTheUser]

www.spamgourmet.com has always worked well for me. Give your adress to whom you want, receive just as much mail from them as you want.

Re:Self-Destructing E-Mail helps

[KD5UZZ]

Have you actually used the service? You can specify how many messages you recieve from EACH address you give out. You can reset the counters anytime you want. You can also DISABLE the counter at any time. Its a great service!

Beginning of the end?

[nurb432]

No, but its one more nail in the coffin..

Something has to be done soon or email just wont be practical to have. Between Spam and viruii its overloading a lot of comanines network feed and servers..

And don't forget the cost of having to maintain antispam and antiviral solutions..

I know personally where I'm at, we are hitting over 2/3 of all email is spam/virus. ( i hear we drop 10k a day from the black hole list alone )

At home its 98%...

Parasites

[Merlisk]

One would think that even spammers would realize that if things go too far, businesses might not carry emails at all anymore.

I mean, even parasites usually try to not kill the host.

*sigh*

Re:Parasites

[dougmc]

One would think that even spammers would realize that if things go too far, businesses might not carry emails at all anymore.

Yes, but suppose you're a spammer. A big-time spammer, but still just a single person. You're worried about killing the goose that lays the golden egg, so you cut the spam that you emit by 90%. Your income drops by 90%, but the total spam sent world wide drops by, oh, 0.5%?

Even if the spammers band together and make a big organziation to self organize and police, spammers by almost by definition dishonest (no honor among theives!), and as soon as one realizes that he can make more money by ignoring the organzation (i.e. almost immediately), he will.

Reject at SMTP time solved the problem..

[E-Prime]

I run Exim with an ACL extension called Exiscan, which runs SpamAssassin and virus checker during the SMTP dialogue.

Rejected mails thus don't generate any undeliverable bounce messages to fill up the local mail queue, and the sender gets an immediate response.

Offtopic.......but

[Anonymous Coward]

Having gone through German, I find that WorldLingo.com returns a much more accurate translation than Altavista.

So?

[Anonymous Coward]

We shut off our email filters too. No need for them now that we go through Postini (http://www.postini.com). They filter the spam before it hits your server, then give each user power to customize their filters and view caught messages.

In tomorrows news

[wheels4u]

University capitulates. /. visitors break down apache server. Oh .. i mean IIS server.

Re:Not the end of email

[Tezkah]

Yeah, who needs those stupid spam countries?


You, for example, if you live in the US or Canada, or Europe... or.... you get the picture.


Certainly, nobody likes the current situation, but suggesting that we send spammers (or people whos boxes have been hijacked by spammers) to prison camps without charge or bomb their countries (How'd you fix the economy? Bomb it?) is clearly stupid.

No filter day

[reynaert]

Maybe there should be an n-monthly day on which spam-filters are disabled. That way the public may realize the extent of the spam problem. Can you expect that they know it when they only get a few spams because all the rest is blocked at the server?

Reverse DNS to MX record checking....

[kraemer]

Why dont these people start using reverse DNS to MX record verification? It checks to make sure the machine sending you email has a real reverse DNS that matches their MX record. If not, it disconnects. Combine that with the real time black hole list and you'll never see spam again! This mail package does it: Icewarp

Re:Reverse DNS to MX record checking....

[Anonymous Coward]

Why dont these people start using reverse DNS to MX record verification? It checks to make sure the machine sending you email has a real reverse DNS that matches their MX record. If not, it disconnects.

That really isn't a good idea - you will reject a lot of legit mail as well. There are lots of cases where that isn't true. If SPF becomes common, then you can implement that, but the legit receiving mail server is very often not the legit sending mail server for a domain.

Re:Reverse DNS to MX record checking....

[beakburke]

No, you should be using a MAIL SERVER that has an A record anyways. It's not that you can't send mail, you just can't run the SMTP server on a machine that you can't do a reverse-lookup on.

FUD ALERT, FUD ALERT

[DeadPrez]

The university probably doesn't pay much but there are many unemployed American citizens such as me who would welcome the opportunity to visit Germany and solve your spam problems. All the facts of this article suggest the problem is in implementation, not in technical feasiblity.

Re:Not the end of email

[Backov]

No, really both those options sound good.

Specs of the servers?

[PurifyYourMind]

Anyone know the specifications of the 20 servers they were using? 100,000 messages isn't that much. Five day delays? Did I read that right?

Wish my university would get rid of filters

[foidulus]

I go to Penn State, but since the university feels it has to protect dumb windows users from themselves, I cannot even send or recieve email with the subject, "Hi such-and-such"(Try explaining to a friend overseas who has almost never in her life touched a computer, in her language, why she can't send you mail with that subject) because it might contain the bagle virus. This is the same university that put in a firewall because supposedly too many people on campus had a butt-load of viruses and spyware.
Yet this same university loves to publish my email address on the web; ensuring I get tons of spam(some even in Chinese!)
I hate when the community at large has to pay for the transgressions of a few slimeballs and the idiocy of some(not even most) gullible windows users.

Don't be so naive

[Shamashmuddamiq]

I have several accounts that I have given to nobody -- not friends, relatives, or even my wife -- for the purposes of testing whether or not they would get spam. Several of them are receiving spam. Even my root account is getting spam (though that's not so hard to guess). I'm not sure how the spammers' guessing algorithms work, but they do a pretty good job.

In addition, I have two accounts that I use regularly -- one that I give to everyone (web registration forms, etc) where I don't care about spam, and another one that is personal and I only give to close friends. Guess which one gets more spam? That's right. My personal account gets about 150 per day. My "don't care" account gets like 6 per day. They have both been active for many years.

Block Direct Access, use upstream MX record

[just someone]

98% spam and virus's? Damn. Think that the mail is coming from campus.

Outside world:
Block direct contact to the mail servers, use an upstream MX record.

Inside world:
authenticated SMTP.

No, sendmail

[marnanel]

7: They're using MS Exchange SMTP servers, which bog down incredibly under load, especially if you run any separate service such as spam processing.

Nah, it's sendmail:

$ dig -t MX tu-bs.de
[...]
tu-bs.de. 172738 IN MX 10 rzcomm5.rz.tu-bs.de.

$ telnet rzcomm5.rz.tu-bs.de smtp
Trying 134.169.9.40...
Connected to rzcomm5.rz.tu-bs.de.
Escape character is '^]'.
220 rzcomm5.rz.tu-bs.de ESMTP Sendmail 8.11.1/8.11.1; Mon, 24 May 2004 04:00:51 +0200 (METDST)

Re:No, sendmail

[Cheile]

That may not actually be the server handling the mail though. It's rather common to have a sendmail/postfix mail forwarder on the outside that forwards all mail to/from the Exchange server on the inside.

Ideas for a new email protocol...

[rice_burners_suck]

Is this the beginning of the end of e-mail?

I would say this is probably not the end of email, nor is it the end of the Internet as a whole. However, it is probably the end of the protocols currently used to send and receive email.

I believe that spam is ultimately a security issue, because it slows down systems and creates problems for users and system administrators. Sometimes, security problems are caused by buffer overruns and other programming errors. However, in this case, I think the entire protocol is faulty. It may have worked wonderfully before spammers, but it's time to introduce something new that will make it extremely difficult to send spam.

I don't know exactly how the new protocol needs to look. But I have some ideas. Paying for "postage" is not one of them, as I think it is a very bad idea. Unless some payment system could be set up whereby the recipient of the mail receives the payment, not some 3rd party, like Microsoft, which would profit incredibly from garbage spam mails going all over the place. In fact, if that were the setup, then each recipient could state a price per email and/or per kilobyte of the mail message for receiving an email from a source, which the source would pay to the recipient as postage. A whitelist could be set up to allow certain senders, like one's friends, family, coworkers, etc., to send emails without paying the recipient. A blacklist could be set up to disallow all emails from specific senders and/or domains, as we have today, and if you read further in this post, you'll see my ideas for making sure that addresses are not spoofed. But I digress...

Perhaps first of all, the mail headers need to include digital signatures based on the source and destination domain names, email addresses, and other identifying information that is unique to each email sent. To avoid address spoofing, for example, people sending junk with a 'yahoo' or 'hotmail' address, when in fact it originates elsewhere, each such domain would have a private key, which upon sending, would be used in the computation. A valid signature could not be computed when the address is spoofed, and so all spammers would need to use their own valid domain name. Further, the need to make computations would make it more costly for spammers to send mail in high volumes. The algorithm should be designed so that recipients of email will have a much lower cost to verify the key. Further, the signature system could, should, and would be used to verify that each bit of the contents of the email, including all attachments, arrived correctly and without being tampered with or corrupted in transit.

Re:Ideas for a new email protocol...

[Anonymous Coward]

Your post advocates a

(*) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work.
(One or more of the following may apply to your particular idea, and it may
have other flaws which used to vary from state to state before a bad federal
law was passed.)

( ) Spammers can easily use it to harvest email addresses
(*) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
(*) It is defenseless against brute force attacks
(*) It will stop spam for two weeks and then we'll be stuck with it
(*) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(*) Requires too much cooperation from spammers
(*) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential
employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(*) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(*) Asshats
( ) Jurisdictional problems
(*) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(*) Technically illiterate politicians
(*) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(*) Outlook

and the following philosophical objections may also apply:

(*) Ideas similar to yours are easy to come up with, yet none
have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(*) Countermeasures must work if phased in gradually
(*) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(*) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(*) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn
your house down!

The Delivery Obligation Is Their Problem

[numbsafari]

The whole thing about them being legally obligated to deliver mail is the silliest thing I've ever heard. Leave it to the Germans to enact such a law.

Better to just not deliver ANY mail than to deal with that requirement.

Re:The Delivery Obligation Is Their Problem

[Wastl]

The whole thing about them being legally obligated to deliver mail is the silliest thing I've ever heard. Leave it to the Germans to enact such a law.

Maybe you are living in a country where privacy laws are no longer enacted, but I prefer to have rather strict privacy laws over having someone spy on me.

There are simple solutions that allow to abide to the law while still providing Spam filtering. We add appropriate headers to Spam and Virus Mails and deliver them to certain subfolders of a users mailbox. He/She can then decide to delete the mails. Users who would click on attachments are also not capable of using IMAP instead of POP and thus won't get access to the messages.

Sebastian

Something is not right

[kbsingh]

the numbers dont add up, Loads of people have already raised the issue about the fact that 20 servers ( even decently mid spec single CPU machines ) will handle 100k emails an hour ( about 80 emails per min per machine is very achieveable ... ).

But there are some other issues you need to look at, with these emails not being scanned - do you know how much of storage you need to have online to have a mailstore this size and developing by the hour at 100k msgs ? not everyonce will use pop3 to get their emails, and not all the users will check email every day. Were talking about a very very large and very well setup Mail Store for this kind of volume. What about network bandwidth ?

A few basic things can reduce the work of those servers : Duplicacy level across these emails is going to be very high - all 100k emails per hour cannot be unique, there are going to be loads and loads of dupes, that dont even need to be scanned.

Creating a small database in-house with bad MailSender's list ( kind of like an in house RBL ), and flushing that list on an 6 hour interval will slow the inflow as well to quite an extent - in some tests done, i have seen it go down by almost 15 - 18% when there is a heavy load. Since most 'real' mailservers tend to retry, even if a genuine mailserver is blacklisted for 6 hours - it wont make much of a difference, however most 'hijacked PC's sending spam' dont have any retry or resending mechanism - and will just not be able to send into your server.

Another issue that helps stem the tide of bad email is to check for Virus infections before checking for spam. A lot of cases the tides of mail coming in can be virus infections ( which are easier and faster to check against - compared to rules + logic based spam checkers ).

However, all this is said and done without knowing of what system and what kind of a setup they use, there is no way anyone can really know what happened and why.

In the end, classic case for Linux and Unix based technologies to come into the frame I think.

Obligatory

[Anonymous Coward]

Your post advocates a

( ) technical ( ) legislative ( ) market-based ( ) vigilante (*) lack of an

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(*) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(*) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
(*) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(*) Technically illiterate politicians
(*) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(*) Outlook

and the following philosophical objections may also apply:

(*) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
(*) No-lists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
(*) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
(*) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(*) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(*) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Solution:

[The Master Control P]

Spam people with ads for viagra. If someone is stupid enough to buy, send them a cyanide capsule :)

Joking aside, it boils down to economics. Spam is profitable. If something is profitable, people will do it. Selling drugs is profitable, and the war on some drugs hasn't changed that. The answer to spam (and drugs) is not to try and stop them, but to make doing them unprofitable.

What makes spam profitable is the presence of people on the internet who are SO incredibly stupid that they fall for it. (See Junkie loves his spam) Remove them, and you shoot spam through it's purtid heart. I can think of several methods of doing do:

• If you respond to spam, you've probably got shitloads of viruses on your computer. Beyond any shadow of a doubt some of them are spamming people. If you ISP detects lots of mystery traffic from you on known virus ports, you're given one warning. Then you get kicked off without ceremony and not allowed to reconnect until you can prove to them that all computers using your connection are malware-free. No more malware, no more spam zombies.
• (You, the ISP) Send test-spams. Specify in the header that it is NOT a real spam so you don't get blacklisted. Anyone who responds to them loses all services except port 80 until you prove to a professional who visits your house that you know enough not to buy from spam. Do it again and you will never be allowed to use your ISP's mail servers again.

Neither of these can possibly be routed around or hacked by spammers, because they are not involved in any part of the process. If you are not in the habit of perpetuating malware with your computer, you needn't worry of getting caught up in it all. Neither of these requires a major invasion of your privacy

Securing the entry point

[87C751]

We'd be in a much better place if our e-mail system at least had a trustworthy traceback facility so that we affirmatively know who sent the message by default.

No doubt, but that's a classic Hard Problem. How do you authenticate the entry point without a central credential clearing house? And who runs that clearing house? VeriSign? (hint: that would be a bad choice)

I agree that SMTP needs a makeover, but what to replace it with is still very much an open question.

Disc space vs. CPU

[darnok]

It seems that they've decided to provision potentially 50x their existing disc space for email (as 98% of the email is currently spam, which is presumably filtered out at the moment), instead of deploying additional resources for filtering before it gets to the users.

Good luck with that approach! If their primary constraint is budgetary, as it would seem, it would make more sense to invest *more* in filtering so that the crap didn't get to users' mailboxes where it will doubtless stay indefinitely in some cases.

Note: I'm assuming that, because they have some apparent requirement that all mail gets delivered, that they cannot effectively enforce email quotas that would result in non-delivery of email.

Easy Solution...

[bruthasj]

> /dev/null.

Report that all emails are stored in an infinitismally small location that only future, advanced technologies will be able to restore email upon request. Requests will be queued until the technology has been developed.

OpenBSD has a Good Solution: spamd

[trippinonbsd]

spamd is a new approach to blocking spam. Its called greylisting. It rejects all email with a temporary failure notice in the hopes that the large volume spam senders don't have the resources to wait 30mins and send the same email again. Apperently this method works quite well and uses little resources.

Re:OpenBSD has a Good Solution: spamd

[benna]

I seem to recall the whitepaper about this method being posted on slashdot a while back. My free email provider (softhome.net) implements this and it works ok but it still lets quite a bit through. It seemed like a great idea in theory though.

Must be using SpamAssassin

[ChrisWong]

The MTA's work is relatively light compared to what anti-spam software must do. This is especially true of SpamAssassin. While it does have some advantages over its competition, SpamAssassin is extremely resource intensive. Firstly, SpamAssassin is not written in fast C/C++ but Perl. Every email is sent through zillions of Perl regex rules. Then there is the Perl implementation of the Bayesian test, which really bogs down when an email auto-learned. Then there are the various (optional) network lookup tests: several RBLs, Pyzor/Razor/DCC ... each email can eat up a lot of resources even if you bypass the startup overhead by running spamd.

I have also seen situations where SpamAssassin was not correctly respecting the maximum child spawn limit. Since spamd is a fairly heavyweight process, the server started swapping and throughput plunged.

Such heavy overhead is not a essential part of anti-spam software. Something NOT written in Perl nor any "interpreted" language, something with a smaller footprint, will be much, much faster. I wonder how many people have switched to dspam for this reason?

What about network load?

[xixax]

OK, you could tell the end users to find their own tools and just cope.

However, I work in a large organisation, and with a 98% spam ratio, the mail infrastructre would need to be much larger (and more expensive!) than it actually neeeds to be. Let alone the (*&&^$@# junk traffic and bounces caused by auto-responses to forged addresses. Plus we have a significant number of staff who are clueless who would be excluded from communicating effectively because they do not have the time or skills to learn how to train a spam filter. in such a situation, no-one could no-longer *rely* on email to contact/inform our staff, reducing its value as a tool.

Our email infrastructure already groans under the load each time another Outlook virus arrives.

The hay-stack of spam is probably just as disruptive as false scanner positives.

Xix.

Re:What about network load?

[AftanGustur]

Plus we have a significant number of staff who are clueless who would be excluded from communicating effectively because they do not have the time or skills to learn how to train a spam filter. in such a situation, no-one could no-longer *rely* on email to contact/inform our staff, reducing its value as a tool.

True, I also work in a large international organisation, but our Spam/Ham ratio in "only" about 40%..

I am handling the Spam problem and we have been running SpamAssassin, as a pilot project, for the last year.

The SpamAssassin project almost got replaced by a commercial solution when people started asking themselves, "what good is it if we still deliver, the Spam to the users inboxes ?". Our users may be experts in other fields, but for many, computers are not their thing.

Some commercial solutions have "Quarantine" system where you can send a report once a day to the recipients, with a list of all spam they received the day before, with a link for each email the user can click if he wants it delivered to his inbox.

It took me 4 days, but I wrote my own Quarantine system that does exactly that, and got permission to release it under the GPL..

That way the Spam doesn't constantly flow in the user's inboxes and takes up the users time. (And, 'no' manually creating a filter rule for thousands of users is not an option)

I wonder

[BCW2]

Does Germany have a law that I'm not familiar with? Email is free not a paid service, why is there some obligation to deliver? Snail mail is normally Govt. run and delivery is what you pay for with a stamp.

No one has to or could guarantee anything for email. With the amount flowing because of SPAM the dropped packets must be astronomical.

Authorization Based eMail systems the way to go.

[phyrebyrd]

I use Cashette for my email server. It's free, allows POP access, gives you the ability to activate its systems on other email accounts, and it works by using an authorization system. Basically, if someone isn't on your "authorized" list, then their mail gets put into a special folder. You can either review what's in that folder, or just forget about it. Here's the nifty part... If a spammer REALLY wants to get their message to you, they can pay you for delivery. You set the price, up to $300 for them to get their message to you.

You can get your own account at http://www.cashette.com/

Have fun!

-Phyre

Won't Last

[fdiskne1]

Being the person that blocks spam is a lose/lose situation. They don't understand how bad the problem is when you do your job right. They complain when spam gets through and complain when legit email gets blocked, but don't want you wasting all your time on it.

I predict that this school will be forced back into filtering spam by their students (customers).

[rant]See, 3 years ago, as spam was beginning to get bad, I began filtering spam on the email system I manage. Over 2.5 years, I developed a rather intensive filter, but since I knew I was not perfect, I had to scan blocked email for false positives. It got to the point I was spending 25% of my time scanning for false positives and the boss didn't like that. He also didn't want me to spend time trying to figure out how to set up Spam Assassin. (I'm not a Linux guru. Sorry!) The board didn't want to spend the money on a purchased system and didn't want me wasting my time with spam. They didn't think it was a problem so they told me to just stop blocking spam. My boss told them that spam was a BIG problem, but they never saw it so they didn't believe him. I asked my boss 10X "Are you sure you want me to stop blocking spam? They won't like the results." He confirmed. I stopped blocking spam and about 50,000 additional spams per week came flooding into the system. The 50,000 were what was being blocked previously. I was flooded with phone calls until everyone realized what was happening. Then, just 2 weeks ago, I was instructed by the board to go back to my filtering, but only spend 30 minutes a day on it. RIIIIGGGHHHHHTTTTT! Ever try scanning for legit email among the trash, adjusting filters to make it better and taking calls and emails from people that want you to be sure an email is blocked and only spend 30 minutes a day on it? I managed to put together a Spam Assassin box and it blocks 10,000 per week, but there's a lot that doesn't get blocked. I don't know enough about it to make it better.[/rant]

Re:Won't Last

[julesh]

OK, some stats:

My company receives about 3,000 e-mails per week, of which 2,600 or so are junk.

I recently installed a simple bayesian junk filter + whitelist on this, and it is catching about 2,500 of those 2,600 junk messages. Last week there were two false positives; the week before there were none. 99% of the false positives have come through mailing lists that add loads of shite to the bottom about how to unsubscribe. In the 2 months we've been using this filter, we have not had a single business-critical message filtered.

Previously we used a spam-assasin style points system, which I would spend about an hour a week fine tuning. We were letting through about twice as much junk, filtering about 5 times as many legitimate messages.

The message - try a bayesian filter (yes I know s.a. has a bayesian filter built in now, but IMO the other stuff it does just confuses the issue). Set up an IMAP folder for everyone to dump the junk that they receive into, one to put their false positives into, and one for their filtered messages to be delivered to. Instruct them clearly about what to do with them. Re-train every other week. You'll get much better results than you're getting now, by the sounds of it.

Why not tell the spam filter that non[A-Z] = spam?

[mbourgon]

Dumb question, but someone mentioned the odd spellings these days... ba|\|a|\|a = banana. How many people spell that way? Why not tell the spam filter that more than one word using ^[A-Z] (for English language) has an increased likelihood of being spam?

Spam & ISPs

[Anonymous Coward]

If I understand this spam problem correctly, why do they (ISPs) filter incoming mail when logically they should be filtering outgoing mail? The way I see it is spammers hit unsuspecting network vendors (Chinese, Brazilian, Korean etc.) who are all to glad to have netted a hefty account until a week or two later they find themselves blacklisted all over the world. The damage is done and the spammer has already moved on to another ISP.

If email were channelled, filtered, throttled and who knows what else on its way out instead of in, spammers would be discouraged or at least slowed down to a snail's pace. A trustworthy registry of ISPs using this technique could be created and providers could choose to receive mail from this list only. Spam has become a world wide plague and requires a global effort. Does this make any sense, anyone?

Paul Graham says: do the opposite

[jsburke]

If you really want to make spam unprofitable, don't prevent people from clicking on the links. Instead, make everyone do it.

There's a point.

[r00t]

There are graphics format exploits, including a
recent one for Internet Explorer using BMP files.
Lossless graphics re-compression is dirt cheap
compared to SpamAssasin, Bayesian filters, and
Apple's word vector thing.

Rule: Do the cheap and obvious filtering, plus
the filtering needed to protect Microsoft junk.

I get legit email with HTML tags and even images.
Often this lets me know the sender has no taste,
but sometimes it is justified. You used an italic
font to quote me; that doesn't work in plain text.
Bold, underlining, and fixed-width characters can
all be justified. The sort of formatting you'd see
in a man page is perfectly legit.

less centralized servers

[KalvinB]

This isn't even the beginning of the end of email. It's simply becomming less and less workable to run a single mail server system with a large amount of users. Small time mail servers aren't targeted by spammers. Universities are heavily targeted because there are lots of users all going to a common domain.

It's the same reason users of major ISPs are more likely to be probed for vulerabilities.

I've found the method of filtering based on the "Click-Me" domains to be the most effective with virtually no false positives (zero is a realistic number).

I've found that setting up a secure public mail system is cake. Mercury Mail is free and handles well. A single check box set by default is all it takes to keep it from being an open relay. Students of the university could probably do rather well offering their own e-mail services to students. Mercury Mail's filtering system is quite robust.

MM supports IMAP/POP3/SMTP and alternate ports as well as SSL on all them. Adding a web-based front end also isn't that difficult if you know what you're doing. There's actually one built in and a more robust version coming.

I already have a few hundred users on Indie-Mail and the amount of bandwidth used per day is pretty negligable.

Ben

dsbl.org

[DreamerFi]

Make your boss happy, and block on these three DNS based lists: dsbl.org, spamhaus.org, dnsbl.org. Everything coming from IP addresses in these range is basically garantueed not to contain false positives. It'll clear your inbox quite effectively. (I'm one of the volunteers helping out dsbl.org, so feel free to mail me with questions)

-John

Assist, not preempt, the user.

[quinkin]

My approach has been to use spamd (avoid thread creation overheads) and run a base spam assessment on all mail. The assesment is stored in the header of the mail and the users can then filter/sort accordingly. Any "evil" attachments are automatically toasted, although the heuristic is very lax due to a high number of techie users.

If required they can also set a spam level on the mail server in a MySQL user/account database to automatically delete mail over the specified threshold (for accounts receiving oodles of obvious spam).

It has a nice balance between performance, security, and leaving most of the control in the hands of the users. We haven't faced extreme loads but it hasn't even raised an eyebrow over the load so far. Most importantly, no unhappy usres complaining of missing emails...

Q.

Perhaps they need some Canadian help...

[MagicFab]

Linux Journal recently featured an article on How HEC Montréal's new mail installation handled the spam and virus explosion of early 2004.

The measured UBEs over a 3 moth period were 172,887 - only for their top-25 most spammed employees!

No false positives?

[grahamsz]

How can you know you've had no false positives.

Have you personally reviewed the 2.9M messages which were filtered out... if you have then i'd question the value of your filtering.

I know i've occasionally had false positives and i get nowhere near your message volume. My personal favorite is the UK paypal-esque service NoChex which sends emails with the subject line "YOU'VE GOT CASH!!"...

Re:No false positives?

[Reziac]

The sysop of a local BBS grew his own spam filter, based on all sorts of header criteria, as observed in actual spam. It fails very rarely, maybe once or twice a year (either a false positive or a spam let through) and yes, he DOES hand-vet the results (did so every day for months, until he was absolutely sure it could be trusted, and still checks it on a regular basis).

Anyway, if an amateur could do that well, I'm sure close enough to 100% accuracy *can* be achieved by a professional solution. In fact, it's made me wonder why some solutions don't perform better than they do.

Centralism has its costs

[urdak]

I've seen this happen in my local University too.

Take a university that has thousands of people actively using email, and thousands of computers, probably a hundred of which function as mail server. Now, decide that "we need a central mail server to filter viruses and spam". Take a few useless machines lying in the computer center, and make them the mail server that's supposed to replace the hundred you had previously. Then slow down the new mail server by applying every concievable virus and spam filtering.

What do you get? Incredibly slow service (sometimes mails get stuck for hours or more in the queue), single point of failure, and officially-mandated false positives (noone in the university can avoid them). AND, you still get a lot of spam.

Computer centers must know that if they want to centralize a service that was previously decentralized (different departments and individual running their own mail servers and filters), they must be prepared. Prepared to handle the load (Google had to buy 100,000 machines to handle their load!), prepared to handle the humans who use their service, and prepared to handle exceptions (a person or department that doesn't want the centralized filtering). Often, these computer centers don't think of these issues in advance, causing things like described in this article.

SMTP Tarpits are another powerful tool

[Phatmanotoo]

Spamd and other means for "tarpitting" the calling SMTP are another great tool to be used in combination with RBLs and bayesian filters.

It's a strategy in layers:

• Apply tarpit to the most nasty IPs (maybe keep your own blacklist, since this could consume resources on your firewall)
• Use RBL's as the second barrier; this is what will save most resources on your smtpd sever.
• Use spam and virus filtering as the third barrier.

I think the article may be misimplying the load .

[millisa]

It doesn't say breaking down after 100k emails a day. Everyone here knows most mail servers can do that on junk hardware in a day(yes, Even exchange can do it).

It sounds more like they are having problems when they start reaching 100k messages in the queue. Anyone who's dealt with tracking a large number of small files across a file system knows that there can be slow downs (not that there aren't solutions to those, but they may not have been able to spend the time to address the problem since they've been 'fighting fires'). When my incoming postfix/amavis/spamassassin systems get 100k or so mails in their queues on ext3 file systems, they start behaving badly too. We addressed the 'fire' problem by throwing more front end servers at it while we take time to rethink our file systems where the queues reside. We'll get the the luxury of a few weeks to address it with other hardware before we start getting unacceptable delivery delays again (for us, thats
Universities don't always have the money to throw hardware at a problem like this or are willing to give their often student supported IT administration the benefit of the doubt that 'we need $20k (euros, lira, beads, whatever) to buy some hardware to roll a better solution'.

Yes, I'd be surprised too if they mean '100k emails a day and we bog down' . . . I just seriously doubt that is what they mean. Maybe they are stopping their spam/virus processing just to clear their backlog. Maybe its not that they aren't receiving it & spam processing it fast enough; maybe its their backend server that is taking it all in just can't keep up. I mean, if they've got 20 spam/virus receivers that are getting the job done and trying to hand off to one fat exchange box that isn't keeping up then their queues are going to grow on those front ends and eventually kill them which makes it look like their spam/virus scanners are causing the delays.

Then again, they could be a bunch of retards and everyone is right that they don't know how to run even a low volume mail server . . . but somehow I doubt it . . .

It's a moving target

[Cesare Ferrari]

Because once a solution becomes commercial, the spammers get hold of it and work out how to modify their spam so that it gets through.

Re:It's a moving target

[David Horn]

I don't suffer from spam as much as I do from emails bouncing back to my inbox from the sender saying "YOU'VE GOT A VIRUS!!!!!"

After checking headers, none of these have come from my server but they have my name and email address as the sender. It pisses me off no end when I get near enough a thousand of these a day when none of them are from me.

That's the reason so much useless traffic is on the net - bounced email reports pinging backwards and forwards and backwards and forwards and, well, you get the idea.

Would it really kill this software to check to make sure that the sender's domain and reported email address match?

Why not sign email...

[oliverthered]

Why not sign email, at the mail routers and gateways.

Email from large organizations could then be given priority (you'd know who it was by the signiture).

If an organizations starts spamming remove there signiture from the trust list.

Re:Why not sign email...

[oliverthered]

Why not, do tell.

Lets say that there are a few thousand trusted parties,(shouldn't be too hard to set up).

They are the top email servers (apart from spammers).

Any mail from the servers gets priority delivery. (you know that it's really is from the servers because they've signed the message).

Everything else (sorry all you who run sendmail/postfix at home), gets slow tracked, along with the spam.

If a trusted sender is found to be sending span there trust certificate is removed and they get slow tracked.

Known spammers could be put in the even slower mail delivery pool.

Its hard work, but you can get close...

[smoker2]

I run my own webservers, with mail service etc.
1 good thing was to make sure every user has a defined email address, or alias to their username. That means I can send a good 85% of mail straight to /dev/null as most spam is sent to madeupname@domain.com

The rest of the spam is due to people leaving their addresses in plain site (on web pages etc) and not having virus free computers.

I also run MailScanner to remove viruses, before the user can get to them, but I don't use spam assassin, because thats not my problem. The users are, to a large extent, to blame for the amount of spam going through the server, (see above) and I don't see why I should deprive them of their ill-gotten gains !
My spam count in my inbox is virtually zero, the few I do get are forwarded from other servers, but are trivial to delete.
If only people would use personal certificates to identify themselves, then spam filtering would be so much easier.