Slashdot Mirror
No Federal Do-Not-Spam Registry For Now
Decaffeinated Jedi writes "The AP reports today that the U.S. government has no plans to create a do-not-spam registry in the immediate future. Why not? They argue that the proper technology is not yet in place. 'A national do-not-e-mail registry, without a system in place to authenticate the origin of e-mail messages, would fail to reduce the burden of spam and may even increase the amount of spam received by consumers,' said the commission." The moral of the story is: never try. See the FTC's press release or their report (pdf).
Homer: Trying is the first step towards failure.
Life is the leading cause of death in America.
I'm glad that they haven't jumped in headfirst, I can't imagine how they could enforce such a list right now with so much spam coming from outside of the United States and from unknowing zombie PCs within the US. If they did create a list it would place an expectation in the public eye that the US government can enforce it, when it obviously (to us slashdot readers) cannot.
Like it or not, we need to come up with more clever hardware or software solutions like Yahoo's "Domain Keys", Meng Weng Wong's SPF (Sender Policy Framework), or god forbid, Microsoft's Caller ID for E-mail.
Urge to post... fading... fading... RISING!... fading... fading... gone.
I thought they had this now: Isn't it the "Opt-Out" thingy?
My processed lunch meat business will continue for now.
The moral of the story is: never try.
Funny, when someone does propose an anti-spam solution, people here can't poke holes in it fast enough.
So you want to hear these lame proposals so you can scoff at them and feel superior? Or what?
Toronto-area transit rider? Rate your ride.
At least they are smart enough to realize that it is not technically feasible yet. Score 1 for the FTC.
Billions of messages are sent every day, the majority of which are spam. That's different than telemarketing calls, which require a live person-to-person (or at least phone circuit-to-person) connection. Also, even if volume wasn't the problem, the fact that spammers are almost always either outside the US or using compromised zombie PCs is just going to complicate things immensely.
The moral of the story is: never try.
Come now, michael. If it is most likely going to CAUSE more spam, its something that shouldn't be done.
Its a "damned if you do, damned if you don't by people with kneejerk reactions that normally hate everything you do anyway" thing, isn't it?
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
A do-not-spam list right now would be a spam-me-now list. So many spammers are beyond the reach of the law at the moment that adding your address or domain to this list would be like adding it to WHOIS.
sulli
RTFJ.
I completely agree. How do you intend to enforce such a registry? People are forever insulting the gov't for creating unenforceable laws, and the FCC is right to hold back. You must remember that CAN-SPAM makes it a civil crime, while a national registry would make it a federal crime, requiring the gov't to spend money trying cases that obviously won't be won (and could also implicate a lot of innocents).
Read jack phelps dot net
Don't hand the spammers what would probably be the worlds largest distribution list on a silver platter.
There is a lack of proper legislation. The fundamental property of the Do-Not-Call list is that violators will be prosecuted by the FCC and can be held accountable with serious punishments. Quite frankly the current state of things leaves much to be desired in terms of punishment for spammers.
Fist I want to see some good national anti-spam legislation; then I'll ask for a national Do-Not-Spam list.
100% Crunchier
They should have a do not spam list. It will kill off at least one segment of spam. Spam mails trying to sell you a list of valid email adresses.
They actually have reason for the rejection of a do not psam list; How would they enforce it?
How can you say who spammed you? Is it the email referrer who spammed you, the zombie machine that used the referrer or the person from Russia?
And how would they enact vengeance upon said spammer? We have to have a system in place first so that even the slickest lawyer couldn't wiggle through a loophole.
This is my sig. There are many like it but this one is mine.
Spammed if you do, spammed if you don't.
"How am I supposed to remember you, when you won't let me forget?" --Bare Naked Ladies
This ignores the fact that a national 'do-not-spam registry' would provide a wealth of mostly valid email addresses allowing spammers to focus their efforts. Without an authentication mecahnism the registry is a useless list. This submitter is idiotically biased since he ignores a very valid issue that would give any straight thinking individual pause about such a registry.
Even if I knew that tomorrow the world would go to pieces, I would still plant my apple tree. -Martin Luther
If a registry is ever created, it cannot be a list that people can download. It needs to be a query system that gets fed an address or list of addresses, and returns whether or not each one is on the list.
Otherwise we'll just have spammers downloading the list and using that.
Need Free Juniper/NetScreen Support? JuniperForum
Your message probably best sums up the response to this, and nothing else really needs to be said by anyone. If you create a list of email addresses and attach to it an American law governing their use, then someone from China isn't going to care one bit. The global nature of the Internet (which defies censorship) is also the same thing that allows for spam.
Personally, I'd get a little scared if they can legalize away spam. Although a different medium, if they go all-out for spam, it probably makes for a good sign/precident for 'other things' to be eliminated from the Internet. (Be it pirated files, porn, 'ideas that my citizens shouldn't be having', etc.)
But I still wish spam would go away, like everyone else.
For once stopped legislation regarding spam is a good thing.
Think about how successful the Do-Not-Call list is right now.
"Hi, I'm not calling to 'sell' you something. I'm doing a survey for INSERT COMPANY HERE. There is an option to buy, but that's not the reason for our call...."
Right...I said 'Do not call' that means 'No calls'
spammers lie.
Great the FTC caught on to that..
Now if only all those idiots actually ordering Viagra, Vicodin, larger penisses and mortgage quotes would get the message..
Perhaps a more viable option for enforcement would be sting-operations, where if you buy a spamvertized good, you the exact opposite of the advertized benefit. Higher mortgage! Smaller penis!
SCO employee? Check out the bounty
... I'm gonna report myself as '*@*.*'.
"Derp de derp."
Why pass unenforceable legislation which has a good chance of making matters worse?
For once it looks like a responsible decision has been made, lets not mistakenly equate that with doing nothing.
Imagine the screaming you would have done had they tried and failed miserably, or tried and made things worse.
"Talk minus action equals nothing" - Joey Shithead, D.O.A.
"Talk minus action equals
Unlike the You CAN-SPAM Act, this decision by the FTC shows that they have two clues to rub together. There's no guarantee that spammers would adhere to the list..witness the fact that telephone spammers are moving their operations offshore to evade the do-not-call list.
The only way to stop spam is to hammer the advertisers. Follow the money. Penalize the folks who benefit. No other law-based solution will work.
Disinfect the GNU General Public Virus!
For the zillionth time, can we put an end to boneheaded ideas like this?
Almost all spammers are violating Federal law right now. A do-not-email list would be the most ridiculous thing ever heard of, and would more likely serve as a great source of addresses for spammers.
The problem is there is no enforcement of existing laws in this area. We don't need more laws; we don't need more goofy schemes. We need resources dedicated towards educating and funding law enforcement authorities on how to catch and prosecute spammers.
If the US Govt. Imposed a draconian policy regarding spam and the technology was dicey or imposed on end user rights (such as no more anonimity) you would see the admin here go apeshit.
Michael also seems to think that whatever is decided in the US will magically become policy for the whole net. After all, if the US govt says you must comply with a no spam list, we must expect the rest of the world is going to suddenly stop sending spam. Right?
No, Michael, it's not. What they said was
And quite frankly they're right. Additionally, it's not in the FTC's jusrisdiction, I don't believe, to change the SMTP protocol. As such, they do not have the ability to actually solve the problem.
Given the degree to which the FTC fought for the Do-not-call registry, I think they deserve more credit than Michael's snide editorial remarks. They also deserve credit for having the courage to admit that they can't solve the problem under the current situation and providing a damned good reason why, as well as leaving bad enough alone and not doing something simply for the sake of doing it. Sometimes, inaction is the best course, and it takes maturity to realize it.
Right now, setting up a do-not-email registry would be as smart as responding to the "Please remove me" addresses. In short, it would be absolutely stupid.
So let's leave the FTC alone, shall we?
Right, michael. Like you wouldn't have been the first to complain about how the government's antispam list does nothing if they had decided to create a do-not-spam list. At least it sounds like they gave the idea some consideration, and had a real reason not to do it.
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
I have some asswipe forging my domain right now which is a form of identity theft. I could call the FBI, but who would bother answering my call. Forget the local police department.
Fact is that eliminating spam is a 3 part solution:
- Technical, make it such that it cannot be transmitted or very easily filtered with minimal to no false positives.
- Laws, make it illegal to send spam
- Enforce laws - Ralsky and others like him should hang. They know what they are doing pisses off millions, they are nothing but sociopaths and should be treated as such. Spammers should pay 2-4x the money spent to investigate and prosecute them.
It's sad, spammers IMHO are doing far more damage that Mitnick ever did or could. Yet they are not being taken down as publically or as hard as he was.GAAAAAH. Sometimes, Michael, you are the biggest idiot.
Did you ever stop to think that sometimes just doing "anything" is not the best way to go? Can we please give the government a little credit for not jumping in and just "doing something" to score political points?
Creating a do-not-spam list just creates a beautifully maintained list of people to spam.
Sometimes it's best to just let stupid people be stupid.
it probably makes for a good sign/precident for 'other things' to be eliminated from the Internet. (Be it pirated files, porn, 'ideas that my citizens shouldn't be having', etc.)
I am certain that's exactly what they are looking to do. They do plenty of law making that is questionable but it falls under the guise of protection or something that is "good" for us.
We all nod our heads in unison as they wipe away the rights of terrorists because afterall, we're not terrorists. We all nod in unison as they give us national ID numbers because, afterall, it's so much easier to just use that rather than having this card and that card and that card, right? We all nod our heads in unison as they eliminate our rights to privacy because, afterall, when you're in a public place you shouldn't have the right to privacy -- you should have your every movement tracked by a central governing body, right?
Slippery slope.
I don't think there should be any government do-not-spam list.
Among other reasons, it intrudes on the right of people to advertise their political opinions, which is crucial to a democracy.
It's pretty easy to filter out spam. Bayesian filters block nearly all spam, and have the benefit of being tailored to the user's interests, not the spam definitions of the government (which will inevitably hurt those who oppose government policies).
Use Mozilla's mail application: It has excellent spam filtering built right in. If you don't want to use Mozilla, than use Popfile or Spambayes to accomplish the exact same thing: Bayesian Filtering that will nearly eliminate your spam headache.
Check out my blog: My Galaxy is Milky Way Adjacent
This seems like a near-perfect application for a one-way hash of the email address. Rather than publishing a list of do-not-spam email addresses, publish the SHA-1 and/or MD5 hashes of the email addresses. It's then possible to confirm that a given email address is on the list, but it's not possible to convert the list into a set of usable email addresses. Am I missing something obvious here?
All they need to do is set up a web service that responds YES or NO to whether an address is blocked. There is NO NEED to publish the list itself. In a single line:
wget http://nospam.gov?address=some@address
which would return:
Content-Type: text\plain
NO|YES
Why is that so hard?
----- Refactoring is the reason why man does not mistake himself for a god.
There is a key difference between telemarketing and spamming. Even if you had a prerecorded voice message (which is illegal) these phone calls cost money, tune the tune of a several cents a call and up. Adding an operator costs more, even with the scams they play on their own operators. So it's actually in the best interests of the telemarketers to have some sort of don't-waste-your-time list.
Spammers, on the other hand, can pay as little as $0 (0 for you foreigners) by using open relays, zombies, etc. So it's in their best interests to hit everybody, even if they're not interested. Rather than miss somebody, they'll hit everybody. A do-not-spam list would only provide a list of verified addresses.
So "never try" is definitely the right response here, at least at the moment, since it will be ignored by the spammers in a way that the do-not-call list avoids. The only question at this point is, who hasn't signed up for the do-not-call list:
* Very lonely people
* Very ignorant people
* People with a higher tolerance for telemarketing than me
Unfortunately, this probably just thrills the telemarketers. They can't call your grandma (since you signed her up) but it means that people who haven't signed up for the list are more likely to be scammable. (No offense to your grandma or anything. I'm sure she's a sweet lady but statistically speaking the elderly are more suceptible to scams, and less likely to take advantage of technological solutions.)
That's odd, toothless legislative spam fixes never got vetoed in the past just because they'd do nothing to stop the problem - or make it worse. Wonder what makes this one so special?
-- I'm not a pessimist, I'm a realist. It's not my fault that life sucks so much. --
"The moral of the story is: never try"
Um no. The moral of the story is do not kick a dead horse. Email as it is needs a fundemental change. I mean, come on, clear text passwords over a network? You can sniff out 99.9% of all email traffic on the internet easily. Nevermind how easy it is to spam and exploit the vast majority of systems out there. Yes I know email can now be encrypted, blah blah blah, almost no one on the net knows what that means let alone knows how to use it.
I personally do not want my tax money being spent kicking a dead horse. They would spend millions on a system that's unmanagable at best when they could instead spend that money on developing a better email system.
The moral of the story perhaps, is fiscal responsibility. While not kicking a dead horse and picking their battles wisely they will save us tax payers a fair amount of money. This is probably the best news I've heard all week.
Why does it have to be do-not-spam registry. Why not please-spam-me-registry. Just make spamming illegal to all addresses, but those that are in the registry.
Wouldn't it be a lot easier to make a law that would condemn spamming, period. I bet about 90% of voters don't like to receive spam. Why we have to make the effort to block spammers, when lawmakers should be on our side?
If you create a list of email addresses and attach to it an American law governing their use, then someone from China isn't going to care one bit. The global nature of the Internet (which defies censorship) is also the same thing that allows for spam.
This isn't really true, however. Research has shown that almost all spam actually comes from America. Much, if not most, of it is routed through either Chinese servers or worm-hijacked PCs, but the origin is still American.
The problem with this whole idea is enforcement. I think a "do not spam" list would be great if there were serious investigation into tracing who sends spam to addresses on this list, and then extremely harsh penalties for sending spam to people on this list (like a public execution). If there's no serious penalty when a spammer misuses this list, then it will only serve to help them by providing them with more email addresses.
And yes, I really do advocate public executions of spammers. Back in the colonial days, public executions were commonplace for serious criminals, and surprise, surprise, they didn't have a serious problem with crime.
To do it right, they'd either distribute a list of MD5 hashes, or setup a system where the spammers sent their list and the feds told them which ones were ok to spam.
True. But if the latter were implemented wouldn't a spammer just send a file containing millions of *possible* email addresses? Then the US government would send them a list of the addresses not in their records. Taking the difference between the two lists would provide you with a list of the valid addresses.
PDF. Why not have a look at it?
Speak truth to power.
There is no contradiction whatsoever in opposing government interference with private property and free (as in speech) speech while supporting government crackdowns on spamming -- the former do not fall into any of the legitimate concerns of government; the latter alwasy fall into one (theft) and almost always into a second (fraud).
It would be much more productive to work on real technical solutions to the problem of spam, rather than whining that the government should bail us out.
There is no contradiction here, either. Yes, a prudent homeowner should install locks and other technological means to foil burglars. However, this is not a substitute for having police to arrest burglars or prisons to lock them up.
/. If the government wants us to respect the law, it should set a better example.
Result - Slashdot complains about how ignorant and evil the US government is.
Option 2) The US government concludes a do not spam list will cause more problems and the correct solution is to fix email itself.
Result - Slashdot complains about how lazy and evil the US government is.
They argue that the proper technology is not yet in place
Unless I'm mistaken, we've had laser-guided missiles since the first gulf war which is all the technology we need to deal with spammers. It didn't take some Navy supercomputer to find Eric Head or Scott Richter and any half-assed napalm-delivery system would easily show them the error of their ways.
Why create a list. WHO WANTS TO BE SPAMMED?!?
It's incredibly silly to make a list and try to maintain it, enforce it, keep it out of the wrong hands, etc.
Just make it completely illegal to send unsolicited garbage messages and start making money trails to follow and nail some people.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Spammers would just get a copy of the do-not-spam list and start spamming it! There's absolutely nothing to stop them.
We need SMTP v2.0, and we need it soon.
SPF is the answer. Unfortunately, nobody's discovered what the question is to go with that answer
I'll take Spam Solutions for one hundred, please. Question : what FUSSP is an anti-forgery technique that doesn't address the underlying problem, breaks forwarding and is simply defeated anyway by using the null envelope sender?
Ironically, these and other reasons may be an argument that SPF should be adopted
My next sig will be ready soon, but subscribers can beat the rush
I took a chance and signed up to be on the FCC's Do-Not-Call list. All the telemarketer calls just dried up. So the telemarketers are toeing the line. For now.
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
All my respect to the FTC and their spam efforts, and especially Commissioner Orson "What we need is a few good old fashioned hangings" Swindell. Hopefully it's merely having to work within the beltway mentality that caused this conclusion to be reached and announced at this late time, because this is precisely what everyone (except the few spammers present) told them at the spam conference 15 months ago.
Ensconsed in Commissioner Swindell's colorful words is a hint of the real problem: The problem is a social one, not a technological one.
The means of execution (no pun intended, but I'll take it) may be technological, but not the cause. Trying to solve it technologically will be equivalent to allopathic medicine where the symptoms are treated instead of the cause. Sure, you can kill the tumor, but if you don't remove the cause of the cancer, the problem remains.
Stop treating spam as though it came forth by breaking the vaccuum symmetry and existed suddenly where nothing had before. It's a new face on an old problem and could easily be treated as such, if it weren't for the mentality that still thinks that anything printed in dot matrix on green and white line tractor feed paper is more real and authoritive than handwriting.
The TCPA works for junk faxes. Rewrite it so as not to be strictly telecom.
When people hijack machines as spam drones, catch their ass and prosecute them under computer crimes laws.
There are STILL cops who refuse to handle stalking cases where email is involved because they're allowed to claim their ignorance prevents them from acting, when the fact is the stalking laws say nothing like "unless it's in email".
Stop treating it as if it's all new and different. It's all just new ways of doing the same old things, and the old ways of stopping it would still work.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
1) Buy whatever they are selling. ....
2) Subpoena the bank that cached the check or processed the credit card.
3) Arrest the spammer and jail them.
4)
5) End of spam
evil is as evil does
This seems like a near-perfect application for a one-way hash of the email address. Rather than publishing a list of do-not-spam email addresses, publish the SHA-1 and/or MD5 hashes of the email addresses. It's then possible to confirm that a given email address is on the list, but it's not possible to convert the list into a set of usable email addresses. Am I missing something obvious here?
Publishing such hashes would, of course, not be as irresponsible as publishing the addresses in clear text (provided the encryption is strong enough), but it would still benefit spammers: dictionary attacks would be quite easy to do: just try out common names at common domains. Spammers can, of course, do that now, but it would be more convenient with the hashes than actually sending mail and checking from a valid account whether an error messages comes back. Furthermore, spammers who use dictionary attacks would have better chances to send their spam to e-mail accounts that are actually used. When no error message comes back, it can still be an abandoned or throwaway account, but if it is actually on a do-not-spam list, it is most likely in use and therefore of more value for spammers.
And even if the e-mail addresses are encrypted, I wouldn't trust that the key isn't leaked somehow. Then, suddenly, spammers had their wonderful list of e-mail addresses. I would find adding my e-mail addresses to a list that would be so much scrutinized by spammers too risky in any case.