Slashdot Mirror


Stichting Spamvrij (spamfree.nl foundation) Closing

TeVi writes "Stichting Spamvrij.nl (Spamfree.nl foundation), the authority on spam in The Netherlands, has decided to stop. Spamfree.nl gained international attention for their fight against the CyberAngels spammers. More information can be found on their website regarding the shut-down." It's the classic story of too much work to do, not enough time; meanwhile another reader notes: "Some new anti-spam products out there - but everyone seems to agree that even Sender ID ideas and laws won't do much."

81 of 118 comments (clear)

  1. English text by Karamchand · · Score: 5, Informative

    is available here.

    1. Re:English text by choas · · Score: 1

      As opposed to the Swahili link in the article ?

      --
      I will work to elevate you, just enough to bring you down
  2. Sysiphus labour? by DenDave · · Score: 4, Insightful

    A sad thing but the reality is that there is nothing they could do to stop spam. In fact the only thing anyone can do to stop spam is to stop using email. Yep, the spammer wins.. I abandoned my email account. So in effect he loses because my address is now worthless..

    --
    -if at first you don't succeed, stay the heck away from paragliding.
    1. Re:Sysiphus labour? by julesh · · Score: 1

      He'll have no idea whether you're using it or not. Using it but not clicking through on any of his links would do just as well.

    2. Re:Sysiphus labour? by Timesprout · · Score: 5, Insightful

      I agree. I was so pissed of with all the junk mail I was getting through the post few years ago I abandoned my house so my address was worthless to them. Altering my lifestyle completely and living in a cardboard box under a bridge can be a bit of a chore but its worth it not to let the spammers win.

      --
      Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
      What truth?
      There is no dupe
    3. Re:Sysiphus labour? by Schlemphfer · · Score: 2, Insightful
      Cute comparison. But I bet you aren't one of those people who has an email account getting over 1000 spams a day. I'm giving up that account because it's taking me a half hour every other day to sort out the remaining spam, even after Thunderbird's spam filter has run.

      By the same token, I bet if some delivery person was putting a thousand unwanted packages in your living room each day, and you couldn't stop him, you would, in fact, choose to move.

      --
      I'm generally "Interesting," "Insightful," and even "Funny" here. What the hell happens to me at parties?
    4. Re:Sysiphus labour? by FictionPimp · · Score: 2, Funny

      no, I could shoot him and hide the body in my septic tank. *note to all law enforcment, there are no bodys in my septic tank, please dont look*

    5. Re:Sysiphus labour? by MvD_Moscow · · Score: 1
      Thunderbird's spam filter is nice, but you might want to try you spamihilator, along with some extensions that should sort out all your spam problems.

      http://www.spamihilator.com/

    6. Re:Sysiphus labour? by Mugros · · Score: 1

      To avoid spam simply use email aliases. Not more, not less. Use a hard to guess email address and never ever publish it. The only tricky thing is to have one address that you use for sending.

    7. Re:Sysiphus labour? by PetoskeyGuy · · Score: 1

      Are you a republican? ;)

    8. Re:Sysiphus labour? by pilgrim23 · · Score: 1

      Currently I have 6 email accounts, and I have discarded about 8. I write my contacts each time the signal to noise ratio rises above a certain point and let them know I am moving again. So far that has worked, but MAN it is a pain in the glutius to deal with!

      I have said this jokingly, but I am getting to the point where a serious effort here might be worthwhile: Small off-shore mercenary army and....

      --
      - Minutus cantorum, minutus balorum, minutus carborata descendum pantorum.
    9. Re:Sysiphus labour? by One+Childish+N00b · · Score: 1

      Totally different scenario. Deserting my email address costs me nothing but the 5 minutes it takes to mass-mail my address book a "hey, this is my new address" mail. To desert my house costs me one house.

      Personally I'd rather change email accounts and spend the 5 minutes it takes switching over and informing everybody of it than spend the 5 minutes everyday it takes to pick through a hundredweight of spam looking for the two emails I might want to read. An email address is not a house, and you don't lose much by deserting it - and you gain a lot more in saved time and effort. An exaggerated example doesn't change anything.

      --
      Dealing with lawyers would be a lot less tedious if they all looked like Casey Novak.
    10. Re:Sysiphus labour? by justinkim · · Score: 1

      How do you get so overloaded with spam so quickly? Even the account that I use in situations where I might attract spam only gets, at most, 10 junk mails each day -- and it's been in use for well over six years. The accounts I use for friends or colleagues and for mailing lists get almost no spam (one or two each month for the last account).

      I admit I'm pretty paranoid about posting my addresses in publicly viewable places. However, I'm surprised that people seem to have to cycle through addresses so rapidly. Obviously, we can't rely on spammers to regulate themselves, so maybe folks should re-examine their online habits if spam is that big a problem.

    11. Re:Sysiphus labour? by pilgrim23 · · Score: 1

      As to online habits: I did an experiment: I opened 4 email accounts, 2 free, 2 paid for which I did NOT use AT ALL for 5 months. All of them became spam bait. I kept a graph for a while of the stats on spam per day on them. I wanted to see if "paid for" or "free" email addresses were more vulnerable. One of the two paid for accounts was a telnet only account. I wanted to see if that had any effect. after the 5 months I found no difference. Web Based, telnet only and accessed via Pine, POP3 service.... IT DIDN'T MATTER. Only thing in common for all of them was my name which starts with a "B". I gave up and just continued my practice of abandoning an account when the Nigerian V1agra Silicon Bra Mortgage offers get to be too much. Incidentally, One account I had for a time was with a smaller outfit. I noted one day a email that came to me that had on the cc the name of another subscriber that I know personally (A dear lady who loves to click "remove", send greeting cards, and subscribe to all sorts of things. I surmised that this might have been a harvest vector. Stating that "online habits" contribute to the problem is similar to blaming a rape victim's choice of habiliment for their victimization. I think that is both un called for and overly paternalistic.

      --
      - Minutus cantorum, minutus balorum, minutus carborata descendum pantorum.
  3. need anti spam adverts by Anonymous Coward · · Score: 4, Insightful

    on TV etc.. encouraging public not to buy from spammmers citing illegality of approach & risks

    1. Re:need anti spam adverts by Stokey · · Score: 1

      This is a solid idea.
      Who do you get to fund it though? The actual adverts themselves would be hilarious.
      "Look Maureen, those manhood enlargement pills I bought from manh00dgr0w3r.com have arrived. Pass me a glass of water, I'm going to get started"
      Death occurs. Someone stump up to fund this.

      --
      Natsu gusa-ya, Tsuwamono domo-ga, Yume no ato
    2. Re:need anti spam adverts by cpghost · · Score: 1

      Great! More spam to counteract spam...!

      --
      cpghost at Cordula's Web.
    3. Re:need anti spam adverts by ericspinder · · Score: 1
      [how] do you get to fund it though?

      By selling a pamplet on TV about "How to make money on the Internet! (spam your way to fame and fortune). You sell them on your great rise from a 'one bedroom apartment' to a mansion and tell the people how they can as well. Once you have your fortune, you can use part of it to educate the same people you just ripped off! Even better, since you already have their addresses you can just direct mail them! It'd save a ton of money on TV costs.
      --
      The grass is only greener, if you don't take care of your own lawn.
  4. They were good at something. by Killjoy_NL · · Score: 4, Informative

    From what I read this morning in the dutch news, they did find out that a notorious dutch spammer didn't stop spamming, so they got him into a lot of trouble. There was also something about some more "detective" work that they were good at, but I can't remember what it was at the moment.

    --
    This is the sig that says NI (again)
    1. Re:They were good at something. by XemonerdX · · Score: 1

      Yes, they did a lot of good work, but they were also a relatively unknown foundation themselves unfortunately... Maybe if they'd been a bit more pro-active (not thru spam :)) to get their name across to the general public as well, there would've been more volunteers to help them (and/or even more funding) and they wouldn't have to close down... A sad loss.

    2. Re:They were good at something. by LuSiDe · · Score: 3, Informative

      Agreed. Rejo (from Spamvrij.nl) really did a lot of good investigations. When the accused ones attacked him, accusing Rejo for e.g. libel, he was always able to back up what he said, or did so later because he still depended on some details. His succesful research made various big spammers shitting in their pants.

      Martijn Bevelander, Akin Franks, Patrick de Bruin among others, they really got bashed away in the media. Even when they tried to defend themselves, Rejo was able to be too smart, providing details which mattered and looked suspicious. And these discussions were sometimes even live, e.g. on Webwereld.nl. Search of Webwereld.nl for 'Rejo', 'Spamvrij', or one those names i mentioned earlier. Its in Dutch though. Rejo also did some interviews and debates on the public radio in NL, discussing the spam problem.

      Thanks Rejo. You'd be a good cop ;^)

      --
      WE DON'T NEED NO BLOG CONTROL.
  5. CyberAngels? by computational+super · · Score: 2

    What are (were?) the "CyberAngel spammers"? I missed that one.

    --
    Proud neuron in the Slashdot hivemind since 2002.
    1. Re:CyberAngels? by TeVi · · Score: 4, Informative

      short answer: http://www.cyberangels.nl/

    2. Re:CyberAngels? by computational+super · · Score: 1

      Ummm... is that safe for work?

      --
      Proud neuron in the Slashdot hivemind since 2002.
    3. Re:CyberAngels? by TeVi · · Score: 1

      Yeah it is. It's an explanation on how spamvrij.nl identified a group of spammers called 'cyberangels', and took over their domain. The analysis of mail received for cyberangels.nl was fascinating to say at least...

  6. Looking for an Altruisitiic Billionare by Alien54 · · Score: 3, Insightful
    Maybe some Altruistic Billionaire would be interested in funding these guys. Especially guys who have a track record contributing to the public good. You know, get them some help.

    Sure, we know of billionaires giving the money away to things like cancer research. Computer Industry Billionaires

    Maybe something like just a mere few hundred thousand or a million for these dedicated warriors. Get them some help.

    But then, my cynicism kicks in hard, really hard.

    --
    "It is a greater offense to steal men's labor, than their clothes"
    1. Re:Looking for an Altruisitiic Billionare by LuSiDe · · Score: 1

      Billionaire? If all those who cared just gave some money the problem would be solved. ISPs don't want spam, the government doesn't want spam, and internet users don't want spam. Why not donate a few EURs? Especially the ISPs get a lot in return from that, but apparently only BIT and XS4ALL -2 ISPs- donated money.

      --
      WE DON'T NEED NO BLOG CONTROL.
    2. Re:Looking for an Altruisitiic Billionare by gnu-generation-one · · Score: 4, Funny

      "Maybe some Altruistic Billionaire would be interested in funding these guys. Especially guys who have a track record contributing to the public good."

      Maybe he could secure the operating-system he sells first, so it doesn't get used to send spam...

    3. Re:Looking for an Altruisitiic Billionare by jamesl · · Score: 1

      Or if a few hundred thousand people each contributed a buck ...

      How much did you send them? Before you ask, I haven't sent them anything either. But I've never heard of them before today.

  7. Laws *can* do much by decarelbitter · · Score: 4, Insightful

    The postings states that people seem to agree on the fact that laws can't do much in the fight against spam. I disagree on that. At the moment many countries have fairly good laws against spam. However, the problem is not with those laws, but the lack of enforcement of them. If countries aren't willing to setup a group/agency/team/etc. that has the technical expertise to trace and track the spammers and the legal abilities to use the existing laws to their full extent than those laws aren't going to be of much help.

    Oh, and the correct URL for the English Spamvrij.nl website is www.free-of-spam.nl.

  8. Spam can be stopped... by ravind · · Score: 2, Interesting

    Here's an idea. Give the spammers what they want, which is more traffic. Create a small client that anyone can install on their machines, all it does is use your spare CPU cycles and Bandwidth to repeatedly hit the links that are advertised in spam. If the servers can withstand the mass DDOS, then the bandwidth costs will make them think twice before sending out emails. Use P2P to distribute the list of links to be hit and the spammers will have no central "black-list" server to bring down in retaliation.

    The reason spam is hard to stop is because right now it costs next to nothing to send out those emails, we need to raise the cost of sending out spam, and I think a DDOS will do it. Put the slashdot effect to good use!

    1. Re:Spam can be stopped... by Linux_ho · · Score: 1
      Here's an idea. Give the spammers what they want, which is more traffic. Create a small client that anyone can install on their machines, all it does is use your spare CPU cycles and Bandwidth to repeatedly hit the links that are advertised in spam. If the servers can withstand the mass DDOS, then the bandwidth costs will make them think twice before sending out emails.
      Yeah, that would be great except that it wouldn't work. There would just be more spammers hosting their web sites on Windows virus zombies, or at least proxied through zombies. Your idea would make their victims pay more, while increasing the overall negative effect spammers have on Internet bandwidth, and it wouldn't work anyway!
      --
      include $sig;
      1;
    2. Re:Spam can be stopped... by ravind · · Score: 1

      That's great if they proxy it through a zombie, it will take even less effort to shut it down. Most broadband home connections have a very limited bandwidth for upload precisely because your ISP doesn't want you to act as a server.

      Also, it's not like the spammer can send you an updated URL when the first zombie goes down. I don't see and easy way for spammers to make your suggestion work.

    3. Re:Spam can be stopped... by scambaiter · · Score: 1
      As if we didnt already discuss the whole issue a hundred times here... *sigh*

      It is _no_ good idea to try striking back by auto-ddosing all urls mentioned in some spam. First as already mentioned abov in most cases you simply attack some zombie box; so what, 50k fellow minions waiting to take its place when the next spam flood is coming... And there is always the famous joe-job, which means you will help to attack some more or less innocent third party which already gets tons of complaints and trouble with their hoster / registrant for being mentioned in spam.

      But maybe your strategy works and the us military will adopt auto-retaliate for its icmbs one day;) man, this planet will be a safe place then.

      --
      sick of sigs... *sigh*
    4. Re:Spam can be stopped... by a_n_d_e_r_s · · Score: 1

      Another solution is to make it so that anyone who spams for a domain loses that domain.

      PS Yes if that someone does not own the domain and tries to make it hard for the onw who owns the domain - it is not a domain-losable offence.

      --
      Just saying it like it are.
    5. Re:Spam can be stopped... by Linux_ho · · Score: 1

      The combined total bandwidth of all the endpoint broadband connections far exceeds their upstream bandwidth. When attacking multiple broadband connections at the same ISP, your DDOS attack will max out the ISP's uplink long before it takes out all the end-users' links.

      Congratulations, you have now taken out an internet connection belonging to some Grandma who doesn't know anything about viruses (arguably a problem that needs to be dealt with in SOME way if not DDOS), but as a bonus you've also horked bandwidth for anyone else that uses the same ISP she does, and likely contributed significantly to bandwidth expenses all over the Internet. Completely unfair to many, many innocent third parties, especially the ISPs, but of course the ISP's expenses get passed down to the rest of us end-users eventually anyway. And all the spammers have to do is keep cycling from zombie to zombie every couple minutes. Like they already do.

      --
      include $sig;
      1;
  9. The only solution by MadDirector · · Score: 1

    The only solution to the problem is to start paying for sending emails. Before everybody starts modding me down, tell me is it a problem for you to pay 1 cent per sent email? Of course not, except if you are a spammer and planning to send billions of emails. Why are spammers not using regular mail for spamming purposes (well, they do it, but in a much lower scale)? Its because its not free.

    1. Re:The only solution by Karzz1 · · Score: 2, Insightful

      The only solution to the problem is to start paying for sending emails. Before everybody starts modding me down, tell me is it a problem for you to pay 1 cent per sent email?

      I work for a company that sends out legitimate email newsletters to several million subscribers a day. Even at 1 million emails a day, that would effectively put my company out of business.

      Also, what about all the mailing lists out there. This would have the same net effect on say the Linux Kernel Mailing List as having patents in OSS/Free software.

      --
      Beware of he who would deny you access to information, for in his heart he dreams himself your master.
  10. Bogofilter by Gadzinka · · Score: 2, Interesting

    I don't understand all this cry about spam. I've been using bogofilter almost since day one and today, if I see one spam a month I'm surprised.

    Meanwhile, my spam folder is autocleaned via cron job from messages older than five days. Sometimes it accumulates 1500 messages (yes, that's 1500 spams in five days)[1].

    But I had to ignore some guidelines to achieve these results. I didn't teach bogofilter from dead corpus, I just installed it over empty database and taught it live. Also spam cutoff is set to 50 instead of the default 90 (?). I do have occasional false positives (much rarer than false negatives) this way, but I like it anyway.

    The best testament to all this is the unmasking of my address on /.

    And there are better filters than bogofilter.

    Robert

    PS I work exclusivelly on Linux, but viruses are annoying anyway, so I installed Clam AV, hence viruses don't increase my spam count.

    --
    Bastard Operator From 193.219.28.162
    1. Re:Bogofilter by swv3752 · · Score: 1

      One still has to download the email.

      The filters in Mozilla, work pretty good, but I only have less than 5 valid emails a day out of 50. That is still a pain to have to download 50 emails to only read a couple.

      --
      Just a Tuna in the Sea of Life
    2. Re:Bogofilter by silas_moeckel · · Score: 1

      Funny I run Spam Assassin and rarely download spam. Just setup procmail to put spam in it's own folder, dont download that folder (You are using IMAP to read your mail right :) if I think I might have a false positive I go look in the folder but otherwise it gets cleaned on the server. Filtering spam isn't something the mail client should be doing thats a server job.

      --
      No sir I dont like it.
  11. Laws could work by Monoman · · Score: 3, Insightful

    The problem is that everyone keeps trying to create laws to specifically address the spam problem.

    There are already existing laws against fraud, computer B&E, etc.

    What needs to changes is obviously the mail protocol and the parties held accountable. I know you could joe-job someone to frame them but in some countries you are innocent until proven guilty.

    --
    Keep the Classic Slashdot.
  12. I guess I just don't get it by Duke+Machesne · · Score: 2, Insightful

    It still doesn't make any sense that there is as much spam as there is: these people are out to make money, right? It's not just to annoy people, is it?

    But nobody even reads this shit, do they? Much less buy whatever it is they're selling... do people actually give money to these fuckers?

    1. Re:I guess I just don't get it by BShive · · Score: 1

      Yes, people do read/purchase/visit from spam otherwise it wouldn't be as profitable as it currently is. With the low costs involved, even 0.1% 'read' rate for of millions of sent messages makes it profitable. Just blocking the content won't solve the problem. Shutting down the websites and phone numbers that the spam is pitching is a longer-term solution.

  13. Only one way to stop spam by gregor-e · · Score: 2, Interesting

    Spam exists because it is profitable. If each of us would take the time to select just one spamming business per day, and tie up their resources by calling their agents, requesting literature, doing whatever we can to decrease their profit, we could end spam by cuting it off at the root. As long as spam is a more affordable delivery vehicle, it will get used.

  14. PopFile by bstadil · · Score: 2, Insightful
    I don't understand what the big deal is with spam. I implemented PopFile 6 months ago and I get 99.5%+ accuracy. Less than one piece of misdirected mail per day.

    Keep the bucket simple and have lots of Magnets for the people you normally interface with and Spam is a thing of the past. You can even put the server on a remote location so it is available when you travel.

    You can even redirect your spam to a Gmail account and have it all marked Spam thereby helping Google et al improve their filtering tools.

    --
    Help fight continental drift.
    1. Re:PopFile by ravind · · Score: 2, Insightful

      99.5% accuracy is good, but not good enough. It means I still have to scan through the 1500 emails marked as spam to find the 1 email a month that might be a false positive. The only difference is I'm sorting them out in the "spam" folder as opposed to the "inbox".

      If I sound overly critical, it's only because I want to emphasize the importance, in my mind of having a solution that is 100% accurate, which I can blindly rely on.

    2. Re:PopFile by bstadil · · Score: 2, Interesting
      What is the problem with a false positive? IF you have Magnets from everyone you normally interface with it has to come from someone that you do not normally correspond with

      If really important that person most likely has other means of getting hold of you and relaying on email is folly.

      What I am trying to say is you have to amortise the problem of one false positive with the effort involved in getting better accuracy. Not worth it and most likely not doable.

      By the way a mis-directed email does not mean Spam but often is Personal stuff that goes to a Subscribe or Business bin.

      --
      Help fight continental drift.
    3. Re:PopFile by ravind · · Score: 2, Insightful

      You seem to be approaching this problem only from your experience with an email address reserved for personal matters.

      Other people have their addresses up on websites because it is important for legitimate strangers to be able to contact them, and it is often their only means of being contacted.

      These are also the kind of email addresses that get the largest amounts of spam. In short, false positives can be a problem, and we should be looking at a way of eliminating them rather than taking the "it's a cost I can live with" approach that you seem to advocate.

    4. Re:PopFile by dodobh · · Score: 1

      This is what $WORK rejects. Those numbers are culled from a random minute of log analysis, and are accurate.

      Half of what spam slips through is caught by some more complex filters.
      And about 20% of what gets through is still spam.

      Do you really think that spam still isn't a problem? Or that *any* content filter will scale to that kind of load, on a reasonable budget?

      The right point of stopping spam is before it hits your MX, not after it has been accepted.

      --
      I can throw myself at the ground, and miss.
    5. Re:PopFile by bstadil · · Score: 1
      That's interesting and scary. My mail goes thru 2 filters upper level filters before hitting me. One at the forwarding level and one at my ISP (comcast)

      I turned the filter off at Comcast once and saw no real difference.

      This level of spam that your graph shows should be nuked differently. Zombie killing or turning off whole subnets once in a while.

      Before Bayesian filters came available I nuked all Hotmail and aol extensions at my mailserver.

      --
      Help fight continental drift.
    6. Re:PopFile by dodobh · · Score: 1

      You think we don't have filters on our border routers?
      This is stuff that comes in past the packets filters for the most abusive netblocks.
      And we block huge swathes of netblocks (smallest block I have ever applied is a /24) for spam runs. If > 25% of a /24 is found to be hitting our spamtraps, they get nullrouted.

      --
      I can throw myself at the ground, and miss.
  15. bah by smurfi · · Score: 1

    That shut-down notice need a serious apostrophectomy. :-/

    Anyway -- too bad, though I hazard to say it's their own fault: if you do consulting you got to charge for it.

  16. SPF, Caller-ID and Sender-ID by Zocalo · · Score: 4, Informative
    Once again, there seems to be some confusion over this in the linked articles, both of which were written after the situation stabilised, so for those that don't know:
    • SPF (Sender Permitted From) is one of the original DNS based schemes for verifying an IP was authorised to send an email. It is an open standard using text only records that was proposed by Meng Wong of pobox.com and is still going just fine with many big mail domains (Hotmail, Gmail...) using it.
    • Caller-ID is the original closed standard Microsoft proposal that uses XML records. It goes beyond SPF in its scope, but is encumbered by numerous pending patents which Microsoft has yet to adequately disclose.
    • Sender-ID is a derivation of Caller-ID, also by Microsoft, that was proposed to the IETF as a potential "standard" mechanism for acheiving DNS based sender validation. Owing to it sharing many of the same patent issues of Caller-ID and a failure of the parties in the MARID working group at the IETF to arrive at a compromise that open source developers were happy with, Caller-ID was rejected.

    Caller-ID and Sender-ID are currently languishing in Redmond, with Microsoft yet to make any announcements about whether or not it intends to implement them anyway. SPF-Classic on the otherhand is still gaining momentum, with tens of thousands of domains registered as having SPF records, plus an unknown number of unregistered ones. SPF-Classis is also supported by most MTAs and anti-spam solutions, either directly or via a plug-in, and is most likely to become the "default standard" as things stand.

    --
    UNIX? They're not even circumcised! Savages!
    1. Re:SPF, Caller-ID and Sender-ID by BenFranske · · Score: 2, Interesting

      I really wish people would stop thinking SPF is only a spam stopping thing. Really, it's not! As you can see if you really read about SPF for more than 30 seconds is that SPF is a way of checking to see if a server claiming to send mail from some domain is really authorized to do so.

      Lots of people on /. think this isn't a problem, most of them are clueless. For those of us that run mailservers that see any kind of real traffic we know that a LOT of mail is sent with spoofed domains. Some of it is spam, some virii, some just annoying but it IS a problem and SPF solves it in a pretty easy to implement way.

    2. Re:SPF, Caller-ID and Sender-ID by harr2969 · · Score: 1
      I want to address the other thing that people tend to get confused over:

      SPF is primarily about spoofing (and thus phishing), not about spam. I currently work in the e-mail department of the #2 financial institution. I see the impact that phishing has, and how SPF can be used to alleviate it. Each phishing e-mail that doesn't arrive because SPF averted it is a potential victim protected.

      Spoofing/Phishing is what SPF protects against best and that's what it's for. If some spam dies an early death because it was spoofed using someone else's SPF-protected domain, so much the better.

      Read about it here: http://spf.pobox.com.

    3. Re:SPF, Caller-ID and Sender-ID by Zocalo · · Score: 1
      True enough, but I didn't go into that because it's not entirely on-topic for the discussion at hand. SPF and the like have almost zero impact on the problem of spam as they are intended to stop the problem of joe-jobs and social engineering emails claiming to be from "admin@your.bank.com". Indeed, there's nothing to stop a spammer publishing SPF records for their domains, as several of them do in the hope that someone will think that adds some legitimacy to the email.

      I publish SPF records for all my personal domains, yet even so I'm getting about 100 DSN failure messages a day as a result of virus backscatter where my domain was spoofed as the sender. My MTA rejects the email with a "user unknown" failure on the "Rcpt To:" of course, and it's not that much traffic either, but that's not the point. If all of the ISPs concerned would implement SPF (not to mention stop sending bounces when they have already ID'd the email as a trojan) then that number would fall to zero. Not only that, but the ISP concerned wouldn't have had to deal with the spam or trojan in the first place - every one wins except for the trojan writer or spammer, and there's nothing wrong in that.

      --
      UNIX? They're not even circumcised! Savages!
    4. Re:SPF, Caller-ID and Sender-ID by ajs · · Score: 1

      Indeed, there's nothing to stop a spammer publishing SPF records for their domains, as several of them do in the hope that someone will think that adds some legitimacy to the email.

      Actually, this is a good thing. As we move forward with SPF (hopefully sans the Sender-ID, MS-patented features), more and more of the world will be able to build relationships and trust maps with the domains that send them mail. If spamloser.com has sent me spam on several occasions, then I can start to ignore mail from them. If that causes them to want to switch domains, then I deal with them as an unkown, but in no case can they claim to be an SPF-using domain which has a good reputation.

      So SPF does not prevent spam, but its use makes spam prevention much easier in the future. SPF is slowly being adopted by more and more companies as they ask, "how can I protect users from scams claiming to be me?" As that adoption becomes more wide-spread, we can start to trust the domain names used in envelope (not header) information and this is a very good thing!

  17. One small step for spam... by Anonymous Coward · · Score: 2, Funny

    ...one giant leap for spamkind.

  18. Re:Looking for an Altruisitiic Billionare - I am by RedLaggedTeut · · Score: 2, Funny

    Well, I have been promised 20 Mio. from a wealthy billionaire to fight spam, but the sponsor wants to stay unnamed, so could you please help me in this business transaction - call me at NIGERIA-1414-14124

    --
    I'm still trying to figure out what people mean by 'social skills' here.
  19. ddos the spammers by wolfywolfy · · Score: 3, Interesting

    I have an idea for beating spam -- renegade style. Everyone forwards their spam to a server(s), which intelligently sorts the mail, finding culprit websites, then a massive distributed network (SETI@home style) retrieves worst-offending URLS from the server, then DDOSes (./ effect s) the spammers websites. Their bandwidth is quickly maxxed. IANAL but I imagine this isn't law-friendly. It's using the zombie-network theory against the spammers (except this time we opt into the network).

    I've set up a SF project, anyone wanna help?

    The simple version right now just uses a javascript auto-refresh page to draw images off several sites at a time, display, then request the server for more URLs. Once a site goes down you get a 'kill'. You could run teams like seti.

    Ideally it'd run as a daemon or win service, and be bandwidth-limited.

    --
    *meep*
    1. Re:ddos the spammers by FooAtWFU · · Score: 2, Insightful
      The problem: Spammers don't run their own websites. You do.

      (Well, at least if you use Internet Explorer or don't keep your virus protection up to date, you do.)

      --
      The World Wide Web is dying. Soon, we shall have only the Internet.
    2. Re:ddos the spammers by wolfywolfy · · Score: 1

      Actually they do. Think about it. They aren't spamming you for sh*ts and giggles, are they? There MUST be a website on the end of it, somewhere, otherwise there's no way to make money!

      I guess you could be email harvesting, but, on the large part, there are live websites (With lots of pretty pictures) at the end of those URLs in your spam.

      --
      *meep*
  20. standard "filtering is not the answer" post by FooAtWFU · · Score: 4, Insightful

    Filtering! You think spam is "OK" because of filtering?!? My site has had 4 gigabytes of traffic these past six days, and I'll tell you: Most of that is not the httpd. It's just spam spam spam spam spam to the umpteenth degree. Someone has to pay for that bandwidth and the processor power to do that filtering. And it's not the spammer.

    --
    The World Wide Web is dying. Soon, we shall have only the Internet.
  21. A modest proposal by INT+21h · · Score: 5, Interesting

    "Spamhunters" the tv-show. I'm serious! Think about it, several episodes of pretty ppl running around with wifi-gear and blinkenboxes and having lovelife-problems while hunting down spammers, crackers, 419ers, identity thieves, pedos, virus writers, whatever. It seems to be the only way of educating the public these days. CSI: Internet, you know it makes sense!

    1. Re:A modest proposal by rabbit994 · · Score: 1

      It only makes sense if they are properly armed with Assault rifles and Desert Eagles.

    2. Re:A modest proposal by MenTaLguY · · Score: 1

      Let's not forget showing them heroically tracking down the evil users and authors of P2P software.

      You know they would.

      --

      DNA just wants to be free...
  22. What bridge? by kop · · Score: 2, Funny

    Please tell me where your cardboard box is located,
    i might have an interesting mortgage offer for you.
    You can safe many $$$ on loans that way!

  23. choking on spam by Doc+Ruby · · Score: 2, Interesting

    If spam fines were earmarked to support exactly these effective antispam groups, the scaling of spam would scale their efforts. The predator/prey relationship would keep spam to a minimum. Once at the top of a sustainable foodchain,feed on other privacy/security vermin in the abundant ecosystem could allow them to hunt spam to extinction. Now that fines are actually being collected, the rest of us can learn from this negative example.

    --

    --
    make install -not war

  24. Try Challenge/Response... it works! by radio_babylon · · Score: 1

    i felt the same way for a long time about my primary email address... after 9 years of using the same address, i think i was on pretty much every list around, and was getting somewhere around 300-500 spams a day, up to 800+ on particularly bad days...

    i tried filters... i tried stuff like spamassassin... i tried dns black holes... nothing worked...

    then one day i decided to try a challenge / response package called TMDA (tmda.net)... it took quite a bit of fiddling with to get things just like i wanted, and a lot of testing with other email addresses before i felt comfortable with it, but it turned out to be well worth the effort... since implementing this for my main email account, i have received ZERO (yes, really) spams in my box... its been about 3-4 months now, and i dont know how i ever lived without it...

    i suppose its possible that i may have missed one or two legitimate emails from people to offended by the challenge message or too stupid to understand the challenge message, but odds are i missed or accidentally deleted at least that many legitimate emails while wading through the daily spam...

    1. Re:Try Challenge/Response... it works! by cpghost · · Score: 1

      /Me too!/

      TMDA is absolutely great and the best solution so far. Highly recommended!

      --
      cpghost at Cordula's Web.
  25. New anti-spam tool by bhirsch · · Score: 1

    The delete key. Press it once for each piece of spam you get.

  26. Spamgourmet solved my problem by SysKoll · · Score: 2, Informative
    At the risk of repeating myself, spamgourmet solved my problem. It's a free and open source disposable email address system that is traceable and also good for anti-phishing measures.

    Let's say your spamgourmet account is joeblow. This gives you unlimited addresses of the form prefix.accountname_at_spamgourmet.com.You post on some web forum with the address web.forum.joeblow_at_spamgourmet.com. But you give your bank the address mybank.joeblow_at_spamgourmet.com. If a spammer collects the address from the web forum and sends you a phishing message, you can 1. disable the web.forum.joeblow address except for some selected senders, 2. immediately know that the phishing message is a scam because your bank would not write you to this address.

    Note: Yes, I _did_ have to abandon my old email address because it was mass-spammed all the time. The spamgourmet server filters out the crap (spammed addresses are disabled) and then forwards my email to a private "secret" address.

    There are also various features that limit the ability of a random spammer to attack your account.

    The code is free. Right now there is only one public spamgourmet server. It would be nice if someone picked the code and created his own replica. And of course, the project could use more coders.

    --

    --
    Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/

  27. Reply to all spam! by Anonymous Coward · · Score: 1, Interesting

    Reply to all of it!

    If everyone replied to every spam message, the spammers resources would be overwhelmed, and they would not be able to determine which are the legitimate replies, and their reasons for sending spam would disappear. It would take a while, and take general cooperation (but not necessarily from everyone.)

    Of course, this isn't something one can do on their own; it has to be a movement. Everyone ready?

  28. Past reply still applies by OldHawk777 · · Score: 1

    I replied to this topic last year (I think). what I (sort of) said then still applies.

    A fix depends on email server software allowing the email recipient to easily define and edit an approved list based on content of one data packet. SPAM in one data block is not really possible, but a bank ID, purchace transaction number, many other unique identifiers like family or friends names, email addresses, fit neatly in one content data block (beyond routing history) and leave little or no room for SPAM content. As the recipient on an innitial email, a user would deceided to receive or reject the email that would update the email account accept list and forward to client/host all future emails. Rejection of a marked "possible/innitial SPAM/Email" would place the SPAM source server/domain/IP on an automatic reject list unless later deleted/edited by the email recipient account user.

    SPAM fails to achieve purpose and dies a slow death across the internet over three to five years. This method takes the decicion process out of government and/or corporate control.

    --
    Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
    1. Re:Past reply still applies by ajs · · Score: 1

      Your idea is a good one, but a bit too limiting. If you step back from some of the terms (e.g. "data block") and look at existing implementations, I think you'll see that an authentication system (of which, for example SPF is a good first step) combined with SMTP-time weighting of the headers (something like SpamAssassin, but working only with header information) and then a reputation system with a few for degrees of granularity than you suggest above, still meets the basic requirements you set forward.

      The key in fighting spam will have to be reputation. The only question is: will it be a decentrallized reputation system, or will it be run by some entity, in a credit-report-like way?

      The answer to that is ultimately our decision, but time is running out....

    2. Re:Past reply still applies by OldHawk777 · · Score: 1

      Thanks, I agree, maybe a bit to limiting .... I am not a big fan of most bulk filter list generated for mass consumption. I always want everything, then I limit as needed on IP-subnet/domain/.... Authentication of frinds, family, interest, ... is a personal activity for me not for an ISP and/or government, and for me good reputation I limit to friends and family, but remain open to most content/news/....

      If an ISP/Domain could scan a personal reject email list (... many of them ...like all accounts) SPAM source/paterns may allow some transient blocking methods that float with the offending domain/host/IP changes by a spammer.

      I get far less spam at home then in the office behind corporate firewalls, website and content/file type filters. For years, I kept Active-X off, but kept JVM in a sandbox, I use at home non-common applications Mozilla FB/FF and TB, Panda, Sygate, ... when WinXP gets hit ... my Gnu-Linux box remains up. Unlees the ISP/Telco are down I always get my email and surf whenever I want.

      At work in the USA most everything at an office is a duplicate/common config of applications and OS, and safe-user basics are seldom patrt of training. I think, it is a bit sad/funny when no one at work can get their email for a day or two ... and/or they have 20 to a few hundred spam-mail to wade through.

      Okay, I am dead tired to little sleep for the past few days and one too few beers tonight.

      Thanks again - OldHawk777

      --
      Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
  29. Re:Filters... And losing important email. by Gadzinka · · Score: 2, Insightful

    So you are in a position of luxury where it doesn't matter if a legit email is filtered out every now and then. I'm sure it works for you.

    For the last 3yrs I've been working as a freelance consultant. Also I'm the typical guy with anxiety-depression condition, that has problems with everyday life support. And yet, I am able to keep all the important (i.e. paying) jobs w/o worrying about emails lost to spam filtering.

    Get a life, get some good spam filter and stop bitching. In fact, for last three years, most of my lost income has been due to overzelous spamfighters (like ORBS etc).

    Robert

    --
    Bastard Operator From 193.219.28.162
  30. Re:cluestick by wolfywolfy · · Score: 1

    That's where you use bayesian filtering of target websites. Spammer websites are even more obvious than spam emails. Imagine going to a site in spam-ese obfuscation! Heh, I can't wait

    --
    *meep*
  31. Re:cluestick 2 by wolfywolfy · · Score: 1

    In some cases.

    The theory is that spam websites aren't equipped to handle traffic (1/10000 responses or whatever) so once you send them traffic, the ones with actual hosting use up their bandwidth, and the zombies.. well.. their computers get even slower, until they eventually get some geek to clear the junk out, or install sp2, or buy a new computer.

    It certainly makes it harder for the spammers IMO.
    Even if you only used it on phishing sites. (I've seen one in action before, seemed to be effective)

    --
    *meep*
  32. Re:Filters... And losing important email. by hkmwbz · · Score: 1
    WTF? Wonder why both my posts explaining that trusting one's spam filter not to catch legit mail is not a luxury everyone can afford was modded down.

    Maybe I should get in touch with CT again, and see if there's mod abuse involved. Mod points will be lost.

    --
    Clever signature text goes here.