Slashdot Mirror


Stichting Spamvrij (spamfree.nl foundation) Closing

TeVi writes "Stichting Spamvrij.nl (Spamfree.nl foundation), the authority on spam in The Netherlands, has decided to stop. Spamfree.nl gained international attention for their fight against the CyberAngels spammers. More information can be found on their website regarding the shut-down." It's the classic story of too much work to do, not enough time; meanwhile another reader notes: "Some new anti-spam products out there - but everyone seems to agree that even Sender ID ideas and laws won't do much."

118 comments

  1. English text by Karamchand · · Score: 5, Informative

    is available here.

    1. Re:English text by StevenHenderson · · Score: 0, Flamebait

      Apparently we are modding up links that don't provide what they promise?

    2. Re:English text by choas · · Score: 1

      As opposed to the Swahili link in the article ?

      --
      I will work to elevate you, just enough to bring you down
    3. Re:English text by TeVi · · Score: 0

      I've contacted the people of spamvrij.nl, it should be fixed soon...

    4. Re:English text by TeVi · · Score: 0

      One of the servers hosting spamvrij.nl had some issues, which should be resolved by now.

  2. Sysiphus labour? by DenDave · · Score: 4, Insightful

    A sad thing but the reality is that there is nothing they could do to stop spam. In fact the only thing anyone can do to stop spam is to stop using email. Yep, the spammer wins.. I abandoned my email account. So in effect he loses because my address is now worthless..

    --
    -if at first you don't succeed, stay the heck away from paragliding.
    1. Re:Sysiphus labour? by julesh · · Score: 1

      He'll have no idea whether you're using it or not. Using it but not clicking through on any of his links would do just as well.

    2. Re:Sysiphus labour? by Timesprout · · Score: 5, Insightful

      I agree. I was so pissed of with all the junk mail I was getting through the post few years ago I abandoned my house so my address was worthless to them. Altering my lifestyle completely and living in a cardboard box under a bridge can be a bit of a chore but its worth it not to let the spammers win.

      --
      Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
      What truth?
      There is no dupe
    3. Re:Sysiphus labour? by Schlemphfer · · Score: 2, Insightful
      Cute comparison. But I bet you aren't one of those people who has an email account getting over 1000 spams a day. I'm giving up that account because it's taking me a half hour every other day to sort out the remaining spam, even after Thunderbird's spam filter has run.

      By the same token, I bet if some delivery person was putting a thousand unwanted packages in your living room each day, and you couldn't stop him, you would, in fact, choose to move.

      --
      I'm generally "Interesting," "Insightful," and even "Funny" here. What the hell happens to me at parties?
    4. Re:Sysiphus labour? by FictionPimp · · Score: 2, Funny

      no, I could shoot him and hide the body in my septic tank. *note to all law enforcment, there are no bodys in my septic tank, please dont look*

    5. Re:Sysiphus labour? by MvD_Moscow · · Score: 1
      Thunderbird's spam filter is nice, but you might want to try you spamihilator, along with some extensions that should sort out all your spam problems.

      http://www.spamihilator.com/

    6. Re:Sysiphus labour? by Mugros · · Score: 1

      To avoid spam simply use email aliases. Not more, not less. Use a hard to guess email address and never ever publish it. The only tricky thing is to have one address that you use for sending.

    7. Re:Sysiphus labour? by Anonymous Coward · · Score: 0

      It is easy to stop them using DNSBLs. Try them sometime. I used to get 1000-2000 spams per day, now it's down to like 2-3, literally. DNSBLs end spam overnight.

      Use sbl-xbl.spamhaus.org, dnsbl.sorbs.net, and bl.spamcop.net and you will practically eliminate spam.

    8. Re:Sysiphus labour? by Anonymous Coward · · Score: 0

      In fact the only thing anyone can do to stop spam is to stop using email.

      Not at all. Are you familiar with the Usenet Death Penalty? That's where Usenet administrators drop of all postings by a particular domain that habitually spews Usenet spam.

      Now, imagine an Internet where the big internet providers (or, acually, the big email providers)all have similar agreements regarding email.

      For instance: Let's say you get internet service from AT&T. You run your own domain, and have your email _certified_ by AT&T. What this means (at least theoretically) is AT&T has checked you out and has found you to be legitimate. They certify this to all the other major email providers. If you start sending spam, the other providers come back to AT&T and threaten to drop ALL email from AT&T unless AT&T drops you.

      Now, simply set your email to only accept certified senders, and you virtually eliminate spam. And it you really WANT spam, simply set your email to accept non-certified emails.

      Is this extreme? Yes. Would it work? Yes, provided all (or at least most) email providers signed on. There are a few details that I haven't gone into, but this is an idea that would pretty much stop spam.

    9. Re:Sysiphus labour? by PetoskeyGuy · · Score: 1

      Are you a republican? ;)

    10. Re:Sysiphus labour? by pilgrim23 · · Score: 1

      Currently I have 6 email accounts, and I have discarded about 8. I write my contacts each time the signal to noise ratio rises above a certain point and let them know I am moving again. So far that has worked, but MAN it is a pain in the glutius to deal with!

      I have said this jokingly, but I am getting to the point where a serious effort here might be worthwhile: Small off-shore mercenary army and....

      --
      - Minutus cantorum, minutus balorum, minutus carborata descendum pantorum.
    11. Re:Sysiphus labour? by One+Childish+N00b · · Score: 1

      Totally different scenario. Deserting my email address costs me nothing but the 5 minutes it takes to mass-mail my address book a "hey, this is my new address" mail. To desert my house costs me one house.

      Personally I'd rather change email accounts and spend the 5 minutes it takes switching over and informing everybody of it than spend the 5 minutes everyday it takes to pick through a hundredweight of spam looking for the two emails I might want to read. An email address is not a house, and you don't lose much by deserting it - and you gain a lot more in saved time and effort. An exaggerated example doesn't change anything.

      --
      Dealing with lawyers would be a lot less tedious if they all looked like Casey Novak.
    12. Re:Sysiphus labour? by justinkim · · Score: 1

      How do you get so overloaded with spam so quickly? Even the account that I use in situations where I might attract spam only gets, at most, 10 junk mails each day -- and it's been in use for well over six years. The accounts I use for friends or colleagues and for mailing lists get almost no spam (one or two each month for the last account).

      I admit I'm pretty paranoid about posting my addresses in publicly viewable places. However, I'm surprised that people seem to have to cycle through addresses so rapidly. Obviously, we can't rely on spammers to regulate themselves, so maybe folks should re-examine their online habits if spam is that big a problem.

    13. Re:Sysiphus labour? by pilgrim23 · · Score: 1

      As to online habits: I did an experiment: I opened 4 email accounts, 2 free, 2 paid for which I did NOT use AT ALL for 5 months. All of them became spam bait. I kept a graph for a while of the stats on spam per day on them. I wanted to see if "paid for" or "free" email addresses were more vulnerable. One of the two paid for accounts was a telnet only account. I wanted to see if that had any effect. after the 5 months I found no difference. Web Based, telnet only and accessed via Pine, POP3 service.... IT DIDN'T MATTER. Only thing in common for all of them was my name which starts with a "B". I gave up and just continued my practice of abandoning an account when the Nigerian V1agra Silicon Bra Mortgage offers get to be too much. Incidentally, One account I had for a time was with a smaller outfit. I noted one day a email that came to me that had on the cc the name of another subscriber that I know personally (A dear lady who loves to click "remove", send greeting cards, and subscribe to all sorts of things. I surmised that this might have been a harvest vector. Stating that "online habits" contribute to the problem is similar to blaming a rape victim's choice of habiliment for their victimization. I think that is both un called for and overly paternalistic.

      --
      - Minutus cantorum, minutus balorum, minutus carborata descendum pantorum.
  3. need anti spam adverts by Anonymous Coward · · Score: 4, Insightful

    on TV etc.. encouraging public not to buy from spammmers citing illegality of approach & risks

    1. Re:need anti spam adverts by Stokey · · Score: 1

      This is a solid idea.
      Who do you get to fund it though? The actual adverts themselves would be hilarious.
      "Look Maureen, those manhood enlargement pills I bought from manh00dgr0w3r.com have arrived. Pass me a glass of water, I'm going to get started"
      Death occurs. Someone stump up to fund this.

      --
      Natsu gusa-ya, Tsuwamono domo-ga, Yume no ato
    2. Re:need anti spam adverts by cpghost · · Score: 1

      Great! More spam to counteract spam...!

      --
      cpghost at Cordula's Web.
    3. Re:need anti spam adverts by ericspinder · · Score: 1
      [how] do you get to fund it though?

      By selling a pamplet on TV about "How to make money on the Internet! (spam your way to fame and fortune). You sell them on your great rise from a 'one bedroom apartment' to a mansion and tell the people how they can as well. Once you have your fortune, you can use part of it to educate the same people you just ripped off! Even better, since you already have their addresses you can just direct mail them! It'd save a ton of money on TV costs.
      --
      The grass is only greener, if you don't take care of your own lawn.
    4. Re:need anti spam adverts by Anonymous Coward · · Score: 0

      Teach kids while they're in grade school how their purchases provide positive reinforcement to the seller's marketing tactics. OK, not in those words exactly, but using the case of spam makes this simple to illustrate: 1) Spammer spends very little to send out millions of advertisements. 2) A few people respond and buy in. 3) Spammer has more money (and tactical information) to send more and better advertisements. 4) More spam on Internet, more people frustrated by it.

      This isn't an immediate overall solution, as it takes time for the generations of kids to grow up and become the majority of consumers, but in the meantime they can practice and advocate smart consumerism.

      Have our school systems caught up yet? Are we teaching about spam? identity theft protection? social engineering awareness? In grade school you can educate a large percentage of the future population while you have their attention. Later on, they learn these things from TV commercials, little pamphlets sent with bank statements, website ads... things that are easily ignored, right? Talk to your teachers and school board members. and to your kids - but you already know that. :)

      Remember, kids teach their parents too. How many of you were educated about the benefits of recycling, then went home and showed your parents how easy it is to set up a recycling bin and separate the trash?

  4. another one bites the dust by Space+cowboy · · Score: 0, Redundant

    ... and another one comes, ... and another one comes,
    (repeat ad nauseum)

    Unfortunately, the subject refers to the spam-fighting groups, and the body refers to spam itself. Sad.

    Simon
    (Assuming the site was to do with fighting spam, since I can't get to it after it's gone public on /. :-()

    --
    Physicists get Hadrons!
  5. They were good at something. by Killjoy_NL · · Score: 4, Informative

    From what I read this morning in the dutch news, they did find out that a notorious dutch spammer didn't stop spamming, so they got him into a lot of trouble. There was also something about some more "detective" work that they were good at, but I can't remember what it was at the moment.

    --
    This is the sig that says NI (again)
    1. Re:They were good at something. by XemonerdX · · Score: 1

      Yes, they did a lot of good work, but they were also a relatively unknown foundation themselves unfortunately... Maybe if they'd been a bit more pro-active (not thru spam :)) to get their name across to the general public as well, there would've been more volunteers to help them (and/or even more funding) and they wouldn't have to close down... A sad loss.

    2. Re:They were good at something. by LuSiDe · · Score: 3, Informative

      Agreed. Rejo (from Spamvrij.nl) really did a lot of good investigations. When the accused ones attacked him, accusing Rejo for e.g. libel, he was always able to back up what he said, or did so later because he still depended on some details. His succesful research made various big spammers shitting in their pants.

      Martijn Bevelander, Akin Franks, Patrick de Bruin among others, they really got bashed away in the media. Even when they tried to defend themselves, Rejo was able to be too smart, providing details which mattered and looked suspicious. And these discussions were sometimes even live, e.g. on Webwereld.nl. Search of Webwereld.nl for 'Rejo', 'Spamvrij', or one those names i mentioned earlier. Its in Dutch though. Rejo also did some interviews and debates on the public radio in NL, discussing the spam problem.

      Thanks Rejo. You'd be a good cop ;^)

      --
      WE DON'T NEED NO BLOG CONTROL.
  6. CyberAngels? by computational+super · · Score: 2

    What are (were?) the "CyberAngel spammers"? I missed that one.

    --
    Proud neuron in the Slashdot hivemind since 2002.
    1. Re:CyberAngels? by TeVi · · Score: 4, Informative

      short answer: http://www.cyberangels.nl/

    2. Re:CyberAngels? by computational+super · · Score: 1

      Ummm... is that safe for work?

      --
      Proud neuron in the Slashdot hivemind since 2002.
    3. Re:CyberAngels? by TeVi · · Score: 1

      Yeah it is. It's an explanation on how spamvrij.nl identified a group of spammers called 'cyberangels', and took over their domain. The analysis of mail received for cyberangels.nl was fascinating to say at least...

  7. Looking for an Altruisitiic Billionare by Alien54 · · Score: 3, Insightful
    Maybe some Altruistic Billionaire would be interested in funding these guys. Especially guys who have a track record contributing to the public good. You know, get them some help.

    Sure, we know of billionaires giving the money away to things like cancer research. Computer Industry Billionaires

    Maybe something like just a mere few hundred thousand or a million for these dedicated warriors. Get them some help.

    But then, my cynicism kicks in hard, really hard.

    --
    "It is a greater offense to steal men's labor, than their clothes"
    1. Re:Looking for an Altruisitiic Billionare by LuSiDe · · Score: 1

      Billionaire? If all those who cared just gave some money the problem would be solved. ISPs don't want spam, the government doesn't want spam, and internet users don't want spam. Why not donate a few EURs? Especially the ISPs get a lot in return from that, but apparently only BIT and XS4ALL -2 ISPs- donated money.

      --
      WE DON'T NEED NO BLOG CONTROL.
    2. Re:Looking for an Altruisitiic Billionare by gnu-generation-one · · Score: 4, Funny

      "Maybe some Altruistic Billionaire would be interested in funding these guys. Especially guys who have a track record contributing to the public good."

      Maybe he could secure the operating-system he sells first, so it doesn't get used to send spam...

    3. Re:Looking for an Altruisitiic Billionare by jamesl · · Score: 1

      Or if a few hundred thousand people each contributed a buck ...

      How much did you send them? Before you ask, I haven't sent them anything either. But I've never heard of them before today.

  8. Laws *can* do much by decarelbitter · · Score: 4, Insightful

    The postings states that people seem to agree on the fact that laws can't do much in the fight against spam. I disagree on that. At the moment many countries have fairly good laws against spam. However, the problem is not with those laws, but the lack of enforcement of them. If countries aren't willing to setup a group/agency/team/etc. that has the technical expertise to trace and track the spammers and the legal abilities to use the existing laws to their full extent than those laws aren't going to be of much help.

    Oh, and the correct URL for the English Spamvrij.nl website is www.free-of-spam.nl.

  9. Re:MODERATORS please re-score the referenced comme by Anonymous Coward · · Score: 0

    Why are you people so hip on censorship? Isn't it just enough to reply with your own opinion and let the readers make up their own mind instead of imposing your opinion on everyone by making the comment not visible to everyone?

  10. Spam can be stopped... by ravind · · Score: 2, Interesting

    Here's an idea. Give the spammers what they want, which is more traffic. Create a small client that anyone can install on their machines, all it does is use your spare CPU cycles and Bandwidth to repeatedly hit the links that are advertised in spam. If the servers can withstand the mass DDOS, then the bandwidth costs will make them think twice before sending out emails. Use P2P to distribute the list of links to be hit and the spammers will have no central "black-list" server to bring down in retaliation.

    The reason spam is hard to stop is because right now it costs next to nothing to send out those emails, we need to raise the cost of sending out spam, and I think a DDOS will do it. Put the slashdot effect to good use!

    1. Re:Spam can be stopped... by Linux_ho · · Score: 1
      Here's an idea. Give the spammers what they want, which is more traffic. Create a small client that anyone can install on their machines, all it does is use your spare CPU cycles and Bandwidth to repeatedly hit the links that are advertised in spam. If the servers can withstand the mass DDOS, then the bandwidth costs will make them think twice before sending out emails.
      Yeah, that would be great except that it wouldn't work. There would just be more spammers hosting their web sites on Windows virus zombies, or at least proxied through zombies. Your idea would make their victims pay more, while increasing the overall negative effect spammers have on Internet bandwidth, and it wouldn't work anyway!
      --
      include $sig;
      1;
    2. Re:Spam can be stopped... by ravind · · Score: 1

      That's great if they proxy it through a zombie, it will take even less effort to shut it down. Most broadband home connections have a very limited bandwidth for upload precisely because your ISP doesn't want you to act as a server.

      Also, it's not like the spammer can send you an updated URL when the first zombie goes down. I don't see and easy way for spammers to make your suggestion work.

    3. Re:Spam can be stopped... by scambaiter · · Score: 1
      As if we didnt already discuss the whole issue a hundred times here... *sigh*

      It is _no_ good idea to try striking back by auto-ddosing all urls mentioned in some spam. First as already mentioned abov in most cases you simply attack some zombie box; so what, 50k fellow minions waiting to take its place when the next spam flood is coming... And there is always the famous joe-job, which means you will help to attack some more or less innocent third party which already gets tons of complaints and trouble with their hoster / registrant for being mentioned in spam.

      But maybe your strategy works and the us military will adopt auto-retaliate for its icmbs one day;) man, this planet will be a safe place then.

      --
      sick of sigs... *sigh*
    4. Re:Spam can be stopped... by Anonymous Coward · · Score: 0

      The OpenBSD guys have done that. Using pf's passive fingerprinting I redirect all SMTP traffic coming from Windows machines to spamd, which is a fake MTA that sends replies at 1byte/sec and then gives a 450 Temporary Error. My spam rate dropped from 100/day to 3, which are then trapped by spamassassin. Makes e-mail usable again.

      Erlang Smorgreff

    5. Re:Spam can be stopped... by Anonymous Coward · · Score: 0
      But maybe your strategy works and the us military will adopt auto-retaliate for its icmbs one day;)

      Isn't that precisely the strategy that was adopted in the cold war? The threat of retaliation is what kept that war cold. It might be MAD, but it worked.

    6. Re:Spam can be stopped... by a_n_d_e_r_s · · Score: 1

      Another solution is to make it so that anyone who spams for a domain loses that domain.

      PS Yes if that someone does not own the domain and tries to make it hard for the onw who owns the domain - it is not a domain-losable offence.

      --
      Just saying it like it are.
    7. Re:Spam can be stopped... by Linux_ho · · Score: 1

      The combined total bandwidth of all the endpoint broadband connections far exceeds their upstream bandwidth. When attacking multiple broadband connections at the same ISP, your DDOS attack will max out the ISP's uplink long before it takes out all the end-users' links.

      Congratulations, you have now taken out an internet connection belonging to some Grandma who doesn't know anything about viruses (arguably a problem that needs to be dealt with in SOME way if not DDOS), but as a bonus you've also horked bandwidth for anyone else that uses the same ISP she does, and likely contributed significantly to bandwidth expenses all over the Internet. Completely unfair to many, many innocent third parties, especially the ISPs, but of course the ISP's expenses get passed down to the rest of us end-users eventually anyway. And all the spammers have to do is keep cycling from zombie to zombie every couple minutes. Like they already do.

      --
      include $sig;
      1;
  11. The only solution by MadDirector · · Score: 1

    The only solution to the problem is to start paying for sending emails. Before everybody starts modding me down, tell me is it a problem for you to pay 1 cent per sent email? Of course not, except if you are a spammer and planning to send billions of emails. Why are spammers not using regular mail for spamming purposes (well, they do it, but in a much lower scale)? Its because its not free.

    1. Re:The only solution by Karzz1 · · Score: 2, Insightful

      The only solution to the problem is to start paying for sending emails. Before everybody starts modding me down, tell me is it a problem for you to pay 1 cent per sent email?

      I work for a company that sends out legitimate email newsletters to several million subscribers a day. Even at 1 million emails a day, that would effectively put my company out of business.

      Also, what about all the mailing lists out there. This would have the same net effect on say the Linux Kernel Mailing List as having patents in OSS/Free software.

      --
      Beware of he who would deny you access to information, for in his heart he dreams himself your master.
  12. Bogofilter by Gadzinka · · Score: 2, Interesting

    I don't understand all this cry about spam. I've been using bogofilter almost since day one and today, if I see one spam a month I'm surprised.

    Meanwhile, my spam folder is autocleaned via cron job from messages older than five days. Sometimes it accumulates 1500 messages (yes, that's 1500 spams in five days)[1].

    But I had to ignore some guidelines to achieve these results. I didn't teach bogofilter from dead corpus, I just installed it over empty database and taught it live. Also spam cutoff is set to 50 instead of the default 90 (?). I do have occasional false positives (much rarer than false negatives) this way, but I like it anyway.

    The best testament to all this is the unmasking of my address on /.

    And there are better filters than bogofilter.

    Robert

    PS I work exclusivelly on Linux, but viruses are annoying anyway, so I installed Clam AV, hence viruses don't increase my spam count.

    --
    Bastard Operator From 193.219.28.162
    1. Re:Bogofilter by swv3752 · · Score: 1

      One still has to download the email.

      The filters in Mozilla, work pretty good, but I only have less than 5 valid emails a day out of 50. That is still a pain to have to download 50 emails to only read a couple.

      --
      Just a Tuna in the Sea of Life
    2. Re:Bogofilter by silas_moeckel · · Score: 1

      Funny I run Spam Assassin and rarely download spam. Just setup procmail to put spam in it's own folder, dont download that folder (You are using IMAP to read your mail right :) if I think I might have a false positive I go look in the folder but otherwise it gets cleaned on the server. Filtering spam isn't something the mail client should be doing thats a server job.

      --
      No sir I dont like it.
  13. Laws could work by Monoman · · Score: 3, Insightful

    The problem is that everyone keeps trying to create laws to specifically address the spam problem.

    There are already existing laws against fraud, computer B&E, etc.

    What needs to changes is obviously the mail protocol and the parties held accountable. I know you could joe-job someone to frame them but in some countries you are innocent until proven guilty.

    --
    Keep the Classic Slashdot.
  14. I guess I just don't get it by Duke+Machesne · · Score: 2, Insightful

    It still doesn't make any sense that there is as much spam as there is: these people are out to make money, right? It's not just to annoy people, is it?

    But nobody even reads this shit, do they? Much less buy whatever it is they're selling... do people actually give money to these fuckers?

    1. Re:I guess I just don't get it by BShive · · Score: 1

      Yes, people do read/purchase/visit from spam otherwise it wouldn't be as profitable as it currently is. With the low costs involved, even 0.1% 'read' rate for of millions of sent messages makes it profitable. Just blocking the content won't solve the problem. Shutting down the websites and phone numbers that the spam is pitching is a longer-term solution.

  15. chicken or egg? by rmolehusband · · Score: 0, Redundant

    Was the site linked from slashdot 'cos it shutdown,
    or shutdown 'cos it was linked from slashdot?

    --
    Reginald Molehusband. Edinburgh, Scotland
  16. Only one way to stop spam by gregor-e · · Score: 2, Interesting

    Spam exists because it is profitable. If each of us would take the time to select just one spamming business per day, and tie up their resources by calling their agents, requesting literature, doing whatever we can to decrease their profit, we could end spam by cuting it off at the root. As long as spam is a more affordable delivery vehicle, it will get used.

  17. PopFile by bstadil · · Score: 2, Insightful
    I don't understand what the big deal is with spam. I implemented PopFile 6 months ago and I get 99.5%+ accuracy. Less than one piece of misdirected mail per day.

    Keep the bucket simple and have lots of Magnets for the people you normally interface with and Spam is a thing of the past. You can even put the server on a remote location so it is available when you travel.

    You can even redirect your spam to a Gmail account and have it all marked Spam thereby helping Google et al improve their filtering tools.

    --
    Help fight continental drift.
    1. Re:PopFile by ravind · · Score: 2, Insightful

      99.5% accuracy is good, but not good enough. It means I still have to scan through the 1500 emails marked as spam to find the 1 email a month that might be a false positive. The only difference is I'm sorting them out in the "spam" folder as opposed to the "inbox".

      If I sound overly critical, it's only because I want to emphasize the importance, in my mind of having a solution that is 100% accurate, which I can blindly rely on.

    2. Re:PopFile by bstadil · · Score: 2, Interesting
      What is the problem with a false positive? IF you have Magnets from everyone you normally interface with it has to come from someone that you do not normally correspond with

      If really important that person most likely has other means of getting hold of you and relaying on email is folly.

      What I am trying to say is you have to amortise the problem of one false positive with the effort involved in getting better accuracy. Not worth it and most likely not doable.

      By the way a mis-directed email does not mean Spam but often is Personal stuff that goes to a Subscribe or Business bin.

      --
      Help fight continental drift.
    3. Re:PopFile by ravind · · Score: 2, Insightful

      You seem to be approaching this problem only from your experience with an email address reserved for personal matters.

      Other people have their addresses up on websites because it is important for legitimate strangers to be able to contact them, and it is often their only means of being contacted.

      These are also the kind of email addresses that get the largest amounts of spam. In short, false positives can be a problem, and we should be looking at a way of eliminating them rather than taking the "it's a cost I can live with" approach that you seem to advocate.

    4. Re:PopFile by dodobh · · Score: 1

      This is what $WORK rejects. Those numbers are culled from a random minute of log analysis, and are accurate.

      Half of what spam slips through is caught by some more complex filters.
      And about 20% of what gets through is still spam.

      Do you really think that spam still isn't a problem? Or that *any* content filter will scale to that kind of load, on a reasonable budget?

      The right point of stopping spam is before it hits your MX, not after it has been accepted.

      --
      I can throw myself at the ground, and miss.
    5. Re:PopFile by bstadil · · Score: 1
      That's interesting and scary. My mail goes thru 2 filters upper level filters before hitting me. One at the forwarding level and one at my ISP (comcast)

      I turned the filter off at Comcast once and saw no real difference.

      This level of spam that your graph shows should be nuked differently. Zombie killing or turning off whole subnets once in a while.

      Before Bayesian filters came available I nuked all Hotmail and aol extensions at my mailserver.

      --
      Help fight continental drift.
    6. Re:PopFile by dodobh · · Score: 1

      You think we don't have filters on our border routers?
      This is stuff that comes in past the packets filters for the most abusive netblocks.
      And we block huge swathes of netblocks (smallest block I have ever applied is a /24) for spam runs. If > 25% of a /24 is found to be hitting our spamtraps, they get nullrouted.

      --
      I can throw myself at the ground, and miss.
  18. Re:FP cockgobblers! by DenDave · · Score: 0, Offtopic

    and hence another argument to disable anonymous posting...

    --
    -if at first you don't succeed, stay the heck away from paragliding.
  19. bah by smurfi · · Score: 1

    That shut-down notice need a serious apostrophectomy. :-/

    Anyway -- too bad, though I hazard to say it's their own fault: if you do consulting you got to charge for it.

  20. SPF, Caller-ID and Sender-ID by Zocalo · · Score: 4, Informative
    Once again, there seems to be some confusion over this in the linked articles, both of which were written after the situation stabilised, so for those that don't know:
    • SPF (Sender Permitted From) is one of the original DNS based schemes for verifying an IP was authorised to send an email. It is an open standard using text only records that was proposed by Meng Wong of pobox.com and is still going just fine with many big mail domains (Hotmail, Gmail...) using it.
    • Caller-ID is the original closed standard Microsoft proposal that uses XML records. It goes beyond SPF in its scope, but is encumbered by numerous pending patents which Microsoft has yet to adequately disclose.
    • Sender-ID is a derivation of Caller-ID, also by Microsoft, that was proposed to the IETF as a potential "standard" mechanism for acheiving DNS based sender validation. Owing to it sharing many of the same patent issues of Caller-ID and a failure of the parties in the MARID working group at the IETF to arrive at a compromise that open source developers were happy with, Caller-ID was rejected.

    Caller-ID and Sender-ID are currently languishing in Redmond, with Microsoft yet to make any announcements about whether or not it intends to implement them anyway. SPF-Classic on the otherhand is still gaining momentum, with tens of thousands of domains registered as having SPF records, plus an unknown number of unregistered ones. SPF-Classis is also supported by most MTAs and anti-spam solutions, either directly or via a plug-in, and is most likely to become the "default standard" as things stand.

    --
    UNIX? They're not even circumcised! Savages!
    1. Re:SPF, Caller-ID and Sender-ID by BenFranske · · Score: 2, Interesting

      I really wish people would stop thinking SPF is only a spam stopping thing. Really, it's not! As you can see if you really read about SPF for more than 30 seconds is that SPF is a way of checking to see if a server claiming to send mail from some domain is really authorized to do so.

      Lots of people on /. think this isn't a problem, most of them are clueless. For those of us that run mailservers that see any kind of real traffic we know that a LOT of mail is sent with spoofed domains. Some of it is spam, some virii, some just annoying but it IS a problem and SPF solves it in a pretty easy to implement way.

    2. Re:SPF, Caller-ID and Sender-ID by harr2969 · · Score: 1
      I want to address the other thing that people tend to get confused over:

      SPF is primarily about spoofing (and thus phishing), not about spam. I currently work in the e-mail department of the #2 financial institution. I see the impact that phishing has, and how SPF can be used to alleviate it. Each phishing e-mail that doesn't arrive because SPF averted it is a potential victim protected.

      Spoofing/Phishing is what SPF protects against best and that's what it's for. If some spam dies an early death because it was spoofed using someone else's SPF-protected domain, so much the better.

      Read about it here: http://spf.pobox.com.

    3. Re:SPF, Caller-ID and Sender-ID by Zocalo · · Score: 1
      True enough, but I didn't go into that because it's not entirely on-topic for the discussion at hand. SPF and the like have almost zero impact on the problem of spam as they are intended to stop the problem of joe-jobs and social engineering emails claiming to be from "admin@your.bank.com". Indeed, there's nothing to stop a spammer publishing SPF records for their domains, as several of them do in the hope that someone will think that adds some legitimacy to the email.

      I publish SPF records for all my personal domains, yet even so I'm getting about 100 DSN failure messages a day as a result of virus backscatter where my domain was spoofed as the sender. My MTA rejects the email with a "user unknown" failure on the "Rcpt To:" of course, and it's not that much traffic either, but that's not the point. If all of the ISPs concerned would implement SPF (not to mention stop sending bounces when they have already ID'd the email as a trojan) then that number would fall to zero. Not only that, but the ISP concerned wouldn't have had to deal with the spam or trojan in the first place - every one wins except for the trojan writer or spammer, and there's nothing wrong in that.

      --
      UNIX? They're not even circumcised! Savages!
    4. Re:SPF, Caller-ID and Sender-ID by ajs · · Score: 1

      Indeed, there's nothing to stop a spammer publishing SPF records for their domains, as several of them do in the hope that someone will think that adds some legitimacy to the email.

      Actually, this is a good thing. As we move forward with SPF (hopefully sans the Sender-ID, MS-patented features), more and more of the world will be able to build relationships and trust maps with the domains that send them mail. If spamloser.com has sent me spam on several occasions, then I can start to ignore mail from them. If that causes them to want to switch domains, then I deal with them as an unkown, but in no case can they claim to be an SPF-using domain which has a good reputation.

      So SPF does not prevent spam, but its use makes spam prevention much easier in the future. SPF is slowly being adopted by more and more companies as they ask, "how can I protect users from scams claiming to be me?" As that adoption becomes more wide-spread, we can start to trust the domain names used in envelope (not header) information and this is a very good thing!

  21. One small step for spam... by Anonymous Coward · · Score: 2, Funny

    ...one giant leap for spamkind.

  22. Re:Looking for an Altruisitiic Billionare - I am by RedLaggedTeut · · Score: 2, Funny

    Well, I have been promised 20 Mio. from a wealthy billionaire to fight spam, but the sponsor wants to stay unnamed, so could you please help me in this business transaction - call me at NIGERIA-1414-14124

    --
    I'm still trying to figure out what people mean by 'social skills' here.
  23. Re:MODERATORS please re-score the referenced comme by Anonymous Coward · · Score: 0

    Moderation is not censorship. Learn to like it or else you'd better leave Slashdot.

  24. ddos the spammers by wolfywolfy · · Score: 3, Interesting

    I have an idea for beating spam -- renegade style. Everyone forwards their spam to a server(s), which intelligently sorts the mail, finding culprit websites, then a massive distributed network (SETI@home style) retrieves worst-offending URLS from the server, then DDOSes (./ effect s) the spammers websites. Their bandwidth is quickly maxxed. IANAL but I imagine this isn't law-friendly. It's using the zombie-network theory against the spammers (except this time we opt into the network).

    I've set up a SF project, anyone wanna help?

    The simple version right now just uses a javascript auto-refresh page to draw images off several sites at a time, display, then request the server for more URLs. Once a site goes down you get a 'kill'. You could run teams like seti.

    Ideally it'd run as a daemon or win service, and be bandwidth-limited.

    --
    *meep*
    1. Re:ddos the spammers by FooAtWFU · · Score: 2, Insightful
      The problem: Spammers don't run their own websites. You do.

      (Well, at least if you use Internet Explorer or don't keep your virus protection up to date, you do.)

      --
      The World Wide Web is dying. Soon, we shall have only the Internet.
    2. Re:ddos the spammers by Anonymous Coward · · Score: 0

      Also good. Internet "stops working", PC-savvy friend / colleague / relative scrubs PC, world is good again.

      Also note that losing the box that hosts your site should be worth much more than just another spam-zombie. After all, that's where all the spam points to.

      So how legal is this? Assuming the site in question really does support spam one way or another, could/would a spammer sue for downloading with the intent to deny service (or at least drive up the hosting costs)? Could/would the owner of a hosting zombie sue?

      What if you just do a daily wget mirror of the site, indistinguishable from a real request? Could someone trace such a request back to you as a DOS / cost raising attempt?

    3. Re:ddos the spammers by wolfywolfy · · Score: 1

      Actually they do. Think about it. They aren't spamming you for sh*ts and giggles, are they? There MUST be a website on the end of it, somewhere, otherwise there's no way to make money!

      I guess you could be email harvesting, but, on the large part, there are live websites (With lots of pretty pictures) at the end of those URLs in your spam.

      --
      *meep*
  25. Re:MODERATORS please re-score the referenced comme by Anonymous Coward · · Score: 0

    Yes, Big Brother.

    War is peace. Ignorance is Strength. etc..

  26. standard "filtering is not the answer" post by FooAtWFU · · Score: 4, Insightful

    Filtering! You think spam is "OK" because of filtering?!? My site has had 4 gigabytes of traffic these past six days, and I'll tell you: Most of that is not the httpd. It's just spam spam spam spam spam to the umpteenth degree. Someone has to pay for that bandwidth and the processor power to do that filtering. And it's not the spammer.

    --
    The World Wide Web is dying. Soon, we shall have only the Internet.
  27. A modest proposal by INT+21h · · Score: 5, Interesting

    "Spamhunters" the tv-show. I'm serious! Think about it, several episodes of pretty ppl running around with wifi-gear and blinkenboxes and having lovelife-problems while hunting down spammers, crackers, 419ers, identity thieves, pedos, virus writers, whatever. It seems to be the only way of educating the public these days. CSI: Internet, you know it makes sense!

    1. Re:A modest proposal by rabbit994 · · Score: 1

      It only makes sense if they are properly armed with Assault rifles and Desert Eagles.

    2. Re:A modest proposal by MenTaLguY · · Score: 1

      Let's not forget showing them heroically tracking down the evil users and authors of P2P software.

      You know they would.

      --

      DNA just wants to be free...
  28. Re:MODERATORS please re-score the referenced comme by Anonymous Coward · · Score: 0

    How is moderation similar to censorship? If you want to you can always read at -1

  29. What bridge? by kop · · Score: 2, Funny

    Please tell me where your cardboard box is located,
    i might have an interesting mortgage offer for you.
    You can safe many $$$ on loans that way!

  30. Re:MODERATORS please re-score the referenced comme by Anonymous Coward · · Score: 0

    Because a reader unfamiliar with the system here will not see -1 posts and may not know that a modded down post exists or how to view any such posts. So yes, its a disguised form of censorship.

    I find it disgusting that people would mod down an opinion they do not agree with and then justify their censorship by clamiming its not.

  31. choking on spam by Doc+Ruby · · Score: 2, Interesting

    If spam fines were earmarked to support exactly these effective antispam groups, the scaling of spam would scale their efforts. The predator/prey relationship would keep spam to a minimum. Once at the top of a sustainable foodchain,feed on other privacy/security vermin in the abundant ecosystem could allow them to hunt spam to extinction. Now that fines are actually being collected, the rest of us can learn from this negative example.

    --

    --
    make install -not war

  32. Try Challenge/Response... it works! by radio_babylon · · Score: 1

    i felt the same way for a long time about my primary email address... after 9 years of using the same address, i think i was on pretty much every list around, and was getting somewhere around 300-500 spams a day, up to 800+ on particularly bad days...

    i tried filters... i tried stuff like spamassassin... i tried dns black holes... nothing worked...

    then one day i decided to try a challenge / response package called TMDA (tmda.net)... it took quite a bit of fiddling with to get things just like i wanted, and a lot of testing with other email addresses before i felt comfortable with it, but it turned out to be well worth the effort... since implementing this for my main email account, i have received ZERO (yes, really) spams in my box... its been about 3-4 months now, and i dont know how i ever lived without it...

    i suppose its possible that i may have missed one or two legitimate emails from people to offended by the challenge message or too stupid to understand the challenge message, but odds are i missed or accidentally deleted at least that many legitimate emails while wading through the daily spam...

    1. Re:Try Challenge/Response... it works! by cpghost · · Score: 1

      /Me too!/

      TMDA is absolutely great and the best solution so far. Highly recommended!

      --
      cpghost at Cordula's Web.
  33. New anti-spam tool by bhirsch · · Score: 1

    The delete key. Press it once for each piece of spam you get.

  34. Spamgourmet solved my problem by SysKoll · · Score: 2, Informative
    At the risk of repeating myself, spamgourmet solved my problem. It's a free and open source disposable email address system that is traceable and also good for anti-phishing measures.

    Let's say your spamgourmet account is joeblow. This gives you unlimited addresses of the form prefix.accountname_at_spamgourmet.com.You post on some web forum with the address web.forum.joeblow_at_spamgourmet.com. But you give your bank the address mybank.joeblow_at_spamgourmet.com. If a spammer collects the address from the web forum and sends you a phishing message, you can 1. disable the web.forum.joeblow address except for some selected senders, 2. immediately know that the phishing message is a scam because your bank would not write you to this address.

    Note: Yes, I _did_ have to abandon my old email address because it was mass-spammed all the time. The spamgourmet server filters out the crap (spammed addresses are disabled) and then forwards my email to a private "secret" address.

    There are also various features that limit the ability of a random spammer to attack your account.

    The code is free. Right now there is only one public spamgourmet server. It would be nice if someone picked the code and created his own replica. And of course, the project could use more coders.

    --

    --
    Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/

    1. Re:Spamgourmet solved my problem by Anonymous Coward · · Score: 0

      Just a small nitpick. My understanding of spam gourmet is that it "locks down" an address after a certain number of messages is sent through the account, or the default is hit. I prefer systems like that at sneakemail.com for communicating with places I'm pretty sure aren't spammers and want to receive multple messages from (your example being the bank). In such instances, I don't want to constantly log in to spamgourmet to refresh to count of messages received in order to have the address open to email again.

      I do love spamgourmet for use at sites I never want anything past a registration email or single purchase invoice from.

  35. In a very real sense, time *is* money by Anonymous Coward · · Score: 0

    As an active participant in a FOSS community project, I can tell you, this is the underside of things that we all need to be very clear on: time is money. Not in some proprietary, corporate sense, but in a real sense.

    When you're in school, you have time to work on projects. When you're in college, you can make time to work on them. But when you enter the working world, there are problems. It's not some simple 'work == no more volunteer time' equation. It's subtle, and it's slow---you spend more time at work, you get a family, there are demands on your time, and over the next decade or so, a lot of people slowly slip away from the FOSS community. Unless you've got a job with IBM or Red Hat or OSDL, you might well find yourself doing the same.

    There has to be a way to fix this, because these are some of our most experienced people, slipping away. Don't kid yourself---time is money, in the sense that money gives you the opportunity to work on things you want to work on, instead of having to spend that time working on your own survival.

  36. Reply to all spam! by Anonymous Coward · · Score: 1, Interesting

    Reply to all of it!

    If everyone replied to every spam message, the spammers resources would be overwhelmed, and they would not be able to determine which are the legitimate replies, and their reasons for sending spam would disappear. It would take a while, and take general cooperation (but not necessarily from everyone.)

    Of course, this isn't something one can do on their own; it has to be a movement. Everyone ready?

    1. Re:Reply to all spam! by Anonymous Coward · · Score: 0

      Yep. You first...

  37. If only such a thing would be *educational* by Anonymous Coward · · Score: 0

    The sad thing is, I can envision some hack writer using this idea right now to propose a script.

    Sadly, this is Hollywood we're talking about here. You know, the people who brought us "The Net" among others *shudder* I dread to think just what "facts" people would be taught in their shows. Then again, Hackers, for all its flaws, had some parts that were real (recording the long distance tones, the names of certain programs, that method of bank fraud was used once, though without the extra, elaborate bit about sinking ships, and the ending was clear out of whack).

    Speaking of which, I think I'll go make a little "pi" icon, and link it to "youareatotalmoron.com" or somesuch...

  38. the exit of some scumbags by Anonymous Coward · · Score: 0

    will we now see all /. ers are starting to shed a tear for it? So what folks? This organization/research/project/ or whatever it is called was created by the some scumbags who saw the lack of any authority and started to fill their pockets with money and 'advise' high ranking IT and governmental agencies that abviously had no idea what these guys were talking about. They have enough money now so it's time to give some excuses to honest public and buy some tickets for bahama. Bye Bye spammers! No seriously, who wants to fight spam? Do you?

  39. RTFA by Anonymous Coward · · Score: 0

    From now on Spamvrij.nl will concentrate mainly on investigating and analyzing spam sent by Dutch organizations and will assist CERTs, abusedesks of providers and officers of the law to the best of its capabilities. Is this called 'closing'? Are we a bunch of morons? These people were tired of doing a 'dirty' work. From now on, they just work as anti-spam advisors. More money in the banks, that's all.

  40. Reasonable colours by Anonymous Coward · · Score: 0
  41. Filters... And losing important email. by hkmwbz · · Score: 0, Troll
    So you are in a position of luxury where it doesn't matter if a legit email is filtered out every now and then. I'm sure it works for you.

    But others want to make sure their filter doesn't filter out email they were supposed to read! It happens, you know.

    I'm happy for you. You don't care if you lose a few non-spam messages. Well, I do, and even using filtering, spam is a major pain in the neck, as I need to go through it anyway, to make sure the filter didn't catch anything important.

    --
    Clever signature text goes here.
    1. Re:Filters... And losing important email. by Gadzinka · · Score: 2, Insightful

      So you are in a position of luxury where it doesn't matter if a legit email is filtered out every now and then. I'm sure it works for you.

      For the last 3yrs I've been working as a freelance consultant. Also I'm the typical guy with anxiety-depression condition, that has problems with everyday life support. And yet, I am able to keep all the important (i.e. paying) jobs w/o worrying about emails lost to spam filtering.

      Get a life, get some good spam filter and stop bitching. In fact, for last three years, most of my lost income has been due to overzelous spamfighters (like ORBS etc).

      Robert

      --
      Bastard Operator From 193.219.28.162
    2. Re:Filters... And losing important email. by hkmwbz · · Score: 0
      "In fact, for last three years, most of my lost income has been due to overzelous spamfighters (like ORBS etc)."
      Which is exactly my point. You let the spam filter kill mails without checking if it got any valid ones. I'm glad that works for you. It doesn't for me. I need to go through my spam to make sure my filter hasn't caugh anything it shouldn't.
      --
      Clever signature text goes here.
    3. Re:Filters... And losing important email. by hkmwbz · · Score: 1
      WTF? Wonder why both my posts explaining that trusting one's spam filter not to catch legit mail is not a luxury everyone can afford was modded down.

      Maybe I should get in touch with CT again, and see if there's mod abuse involved. Mod points will be lost.

      --
      Clever signature text goes here.
  42. "Politics of Assassination" and anonymous digital$ by Anonymous Coward · · Score: 0

    are the good answer.

    Lew

  43. Past reply still applies by OldHawk777 · · Score: 1

    I replied to this topic last year (I think). what I (sort of) said then still applies.

    A fix depends on email server software allowing the email recipient to easily define and edit an approved list based on content of one data packet. SPAM in one data block is not really possible, but a bank ID, purchace transaction number, many other unique identifiers like family or friends names, email addresses, fit neatly in one content data block (beyond routing history) and leave little or no room for SPAM content. As the recipient on an innitial email, a user would deceided to receive or reject the email that would update the email account accept list and forward to client/host all future emails. Rejection of a marked "possible/innitial SPAM/Email" would place the SPAM source server/domain/IP on an automatic reject list unless later deleted/edited by the email recipient account user.

    SPAM fails to achieve purpose and dies a slow death across the internet over three to five years. This method takes the decicion process out of government and/or corporate control.

    --
    Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
    1. Re:Past reply still applies by ajs · · Score: 1

      Your idea is a good one, but a bit too limiting. If you step back from some of the terms (e.g. "data block") and look at existing implementations, I think you'll see that an authentication system (of which, for example SPF is a good first step) combined with SMTP-time weighting of the headers (something like SpamAssassin, but working only with header information) and then a reputation system with a few for degrees of granularity than you suggest above, still meets the basic requirements you set forward.

      The key in fighting spam will have to be reputation. The only question is: will it be a decentrallized reputation system, or will it be run by some entity, in a credit-report-like way?

      The answer to that is ultimately our decision, but time is running out....

    2. Re:Past reply still applies by OldHawk777 · · Score: 1

      Thanks, I agree, maybe a bit to limiting .... I am not a big fan of most bulk filter list generated for mass consumption. I always want everything, then I limit as needed on IP-subnet/domain/.... Authentication of frinds, family, interest, ... is a personal activity for me not for an ISP and/or government, and for me good reputation I limit to friends and family, but remain open to most content/news/....

      If an ISP/Domain could scan a personal reject email list (... many of them ...like all accounts) SPAM source/paterns may allow some transient blocking methods that float with the offending domain/host/IP changes by a spammer.

      I get far less spam at home then in the office behind corporate firewalls, website and content/file type filters. For years, I kept Active-X off, but kept JVM in a sandbox, I use at home non-common applications Mozilla FB/FF and TB, Panda, Sygate, ... when WinXP gets hit ... my Gnu-Linux box remains up. Unlees the ISP/Telco are down I always get my email and surf whenever I want.

      At work in the USA most everything at an office is a duplicate/common config of applications and OS, and safe-user basics are seldom patrt of training. I think, it is a bit sad/funny when no one at work can get their email for a day or two ... and/or they have 20 to a few hundred spam-mail to wade through.

      Okay, I am dead tired to little sleep for the past few days and one too few beers tonight.

      Thanks again - OldHawk777

      --
      Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
  44. Re:cluestick 2 by Anonymous Coward · · Score: 0

    No. Think about it again.

    Spammers just get one of their owned zombies to host a web site for a given number of reciepiants. In effect using distributed web servers. DDoSing an ip in spam only DDoSes a zombied machine.

  45. Re:cluestick by Anonymous Coward · · Score: 0

    Certainly make a nice weapon to use against a competitor. So what happens when someone joe jobs, or otherwise includes a legitimate web server URL in a spam message.

    You need people to review the web sites. Making someone criminally responsible for initiating a DDoS . Good luck finding volounteers.

  46. Re:cluestick by wolfywolfy · · Score: 1

    That's where you use bayesian filtering of target websites. Spammer websites are even more obvious than spam emails. Imagine going to a site in spam-ese obfuscation! Heh, I can't wait

    --
    *meep*
  47. Re:cluestick 2 by wolfywolfy · · Score: 1

    In some cases.

    The theory is that spam websites aren't equipped to handle traffic (1/10000 responses or whatever) so once you send them traffic, the ones with actual hosting use up their bandwidth, and the zombies.. well.. their computers get even slower, until they eventually get some geek to clear the junk out, or install sp2, or buy a new computer.

    It certainly makes it harder for the spammers IMO.
    Even if you only used it on phishing sites. (I've seen one in action before, seemed to be effective)

    --
    *meep*
  48. MODERATORS ON CRACK by Anonymous Coward · · Score: 0

    Mod up the guy who defends spam and mod down the guy who opposes it.

    Since when did spammers start moderating on Slashdot?