Slashdot Mirror
A Day In The Life Of A Spammer
kaip writes "Internetnews.com has a story of a spammer. The individual sends 60 million spam emails for four days worth of work and claims that one in 19 of AOL users clicks the links in his mortgage spam (this number should however be taken with a grain of salt, see rules 1 and 2). Maybe not
everybody has heard of the Boulder
Pledge... The article also tells how the CAN-SPAM Act,
which legalises spamming, is turning the US into the spam haven of the world. Currently, 86 percent of the total spam volume is coming from the States."
I think MS might have been onto something with Penny Black... if sending unsolicited e-mail (sending to an address that didn't have you on their contact sheet) cost a small micro-payment, it would quickly offset any profits to be made from spamming on the scale described in the article, and wouldn't be prohibitive to those who needed to send the occasional unsolicited e-mail.
It's either that or get into the murky waters of concrete identity, and of the two the former is the least opressive regime.
sgalton@galtonhelm.com
happy now?
- reject_unknown_client is on. This means
that a connecting client MUST have a reverse-dns
lookup for its IP, and the resulting name
MUST resolve back into that IP. This alone
blocks most spammers before their client
can even begin to send a message.
- I use xbl.spamhaus.org. This is a wonderful
thing. This blocks not only any box known
to spam, but also any box found to be
infested by some virus, ie zombies.
Once again, this stops them dead before
the message even starts.
- In the unlikely event that they get past
those hurdles, I have a homebrewed filter
that watches for bogus HTML tags, since
they like to intersperse bogus empty
tags in the middle of words in order to
foil content-based filters. This simple
filter actually blocks 90% of anything
that made it that far.
- Spamassassin. The few brave soldiers of
spam that got this far rarely pass this.
I leave this filter near the end because
it's rather CPU intensive...
-
Finally, a simple procmail rule: If my name
isn't in the "To:" or "Cc:" line, file it
as spam.
I haven't seen a spam message in, uh, maybe a year or two?"the simple situation is that I don't need _any_ advertising through email"
That's a bit draconian. I would like to be notified when Blizzard is releasing a new game or the new Glen Cook book is being released. To get this info from the web sites, I would have to poll (check regularly) the web sites. I would rather receive a notification.
The key to this is opt in only lists. One way to do this is to make a server with your email provider that allows you to register an email as requested (bulk mail whitelist). Those can go through. Other bulk mail is prevented. There are other methods as well; that is just one example to handle both.
The real key is no *unsolicited* email advertising. If I request it, I want to be able to see it. Frankly, if a newspaper (to get back to that example) drops off their product unrequested, I would like to be able to prosecute them for littering. Further, a newspaper includes other things besides advertising. Spam does not.
And they're sponsored by our old friends, The Bulk Club. Can't we spread a rumour that Osama is actively funding spammers or something?
Carousel is a lie!
And when the TDMA user doesn't use SPF or something to block forged envelopes, they spam the world with their "did you send me some email" replies. And the reply template is customizable - so every TDMA spammer is unique. Also, while using a temporary envelope address for their own reply, the system does not work with other systems that use temporary envelope addresses like SRS or SES. The underlying design assumption is that TDMA is the only anti-SPAM measure worth using.
I use Mozilla and have been doing so since before they offered a filter. The filter hardly ever has a false positive, but it does miss about 30% of the spam I get - despite training.
Maybe 20 a day is not enough.
Mielipiteet omiani - Opinions personal, facts suspect.
I don't see how all this adds up to the US providing some obscene proportion of the world's spam.
But spammers? They're not particularly organized, as far as I know.
I would guess it's mainly the direct marketing association that lobbies for weaker spam regulation. They are opposing a national do-not-spam list, and they're the main reason why the do-not-call list has no power.
Now, they're not that big, but there's not really anyone lobbying against them. At least, not in the ways it counts, through money and people actually in congress talking with congressmen day in day out.
I find the most effective spam blocker is DEA's. You either use something like spamex with it's bookmarklet(well worth the 9.95 a year to me) or get an ISP that provides the service(more and more do), or do it with your own Domain/E-mail server.
Then, DON'T ever use your real e-mail address. Make a new DEA for every e-mail address you have to give out, and turn it off if it starts getting spam, or when you're done with it.
Also, use some common sense about where you place an e-mail address.I have to use a DEA for every online purchase, but only once got spam from the account, and rarely get monthly e-mails from the company I bought from - and those opt out easily in my experiance.
Conversly, when I used a DEA for Usenet posts, I got spam in a matter of minutes, but just turned off the account.
Opera, Proxomitron-Grypen,GPG 0x0A1C6EE3
http://www.tla.org/papers/spa-ndss03.pdf
I bootleg Fizzy Lifting Drinks.
The solution isn't to stop it on it's way! You got to stop it being sent. This shit eats up the Internet by fact of being sent.
Take snailmail junk mail - even though you throw it away anyway, the post office still charges for the postman to deliver it (and pay him) - if he didn't, then he, you and the post office would be a lot better off!
6 months!!! If I had to train a filter for 6 months before it becase effective I would go insane.
You need K9.
http://keir.net/k9.html
RM
I have no sig yet I must scream.
Spam has ceased to be a problem for me.
I use POPFile. http://popfile.sourceforge.net/
My current stats:
Messages classified: 9,144
Classification errors: 67
Accuracy: 99.26%
80% of the classification errors were in the first 2 weeks of training - and classification errors are almost always on the "let spam through" rather than "good message marked as spam", so it's not at all dangerous.
It's easy to set up, and includes instructions for popular email clients. Spammers just can't do much to beat something like this.
"Nothing strengthens authority so much as silence." - Charles de Gaulle
This is yet another content filter. The real solution to spam will prevent my servers and bandwidth from being overloaded by spam, rather than use even more of it to to accomplish keeping it out of my mailbox. The ultimate solution is to have spammers disconnected from the internet by their ISPs, or disconnect their ISPs if the ISP continue to help spammers steal and waste the resources I pay for. You say you don't have a mail server and don't need to be worried? How much is your ISP charging you? How much is your ISP taking out their own profits to cover the costs of spam you just end up deleting?
now we need to go OSS in diesel cars