Slashdot Mirror
Do Unsubscribe Links Stop Spam?
Kaiten writes "Brian McWilliams of Spam Kings fame has just published a fascinating spammer exposé over at Salon. Using a pseudonym, he was hired to send junk email on behalf of a spam operation that has been burying people (me included) with spam for fake Rolex watches. The article details how the spammers handle the 200,000-plus unsubscribe requests they get each month. Seems that LOTS of geeks actually cross their fingers and click those remove links. And, surprise, surprise, the spammers usually ignore the unsubscribe requests."
Do Unsubscribe Links Stop Spam?
While they don't exactly stop spam, they do prove useful. You can immediately sort possible-spam by whether it offers an unsubscribe option. If it doesn't have it, it's definitely spam. If it does have an unsubscribe link, it's either legit (newsletter perhaps), or spam disguised with a fake unsubscribe. While the fake unsubscribe doesn't really help the end user, it offers a way to track and prosecute those who violate CANSPAM which requires that the unsubscribe option be present in some form, and that it work.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
No, I know for sure that they don't help. For years I have been trying to get MORE spam. The main way I have done this has been unsubscribing from lists! In fact, I even "unsubscribe" an address that was never subscribed. Indeed, that new address is now getting plenty of spam.
Unsubscribing from spammer's sites will get you more spam. Unsubscribing from mailing lists will work, of course, but mailing lists != spam.
Yea it is nice. But unfortunatly I wish I had a feature to select all my spam. and forward it to spam@ftc.gov keeping all the headers.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Some people say spammers don't clean up their lists of email addresses of the ones that bounce.
If this is true, then why would they bother with confirming that each address is "live"?
I believe that a very small majority of spammers go through with the efforts of tracking their "spamees". What incentive do they have to clean up their e-mail lists? Why take a chance of eliminating any possible "spamees"? Do they really care if they send out 500,000 spams instead of 750,000 spams? Of course not.
That may have been the case in the past, but it certainly isn't now.
In the past you would get a little spam from a lot of sources, now you get a ton of spam from just a few sources, and these sources are very good at what they do. It's their business.
Many of them have invested countless hours in custom tools to improve their profitability and the ease with which they spam.
There are exceptions to this, of course.
But as evidence that they are very proactive in grooming their lists, see the recent Slashdot story that turning off your mail server for just one day will get you removed from 90%+ of spam lists. That is a very fast response, and does not indicate laziness or complacency.
Lose Weight and Feel Great with Isagenix
You must not be involved in business or dealing with the public. That's nice. Here on planet "not living in our parents' basement," we need to let people know what our email address is and have that email address be there for a while.
The second part of that might actually be true.
Now before I get modded down, I be to remind whoever might read this that what I am saying is FACT. - bogaboga
Two years ago, it had gotten to the point that I was getting over 200 pieces of spam a day, and not the yummy kind that comes in a tin. Before initiating an email address change, I decided to try an experiment: see if clicking those unsubscribe links actually did anything. So, for one week, I followed the unsubscribe instructions on every piece of spam I got. The result: a 2/3 reduction in spam. That's pretty significant, but hardly worth the effort in my case, as I was still getting dozens of piece of spam a day, and unless you keep up with the unsubscribing, it just goes back up to the previous level within a few weeks, anyway.
So, yeah, you CAN reduce the amount of spam, but it becomes a regular maintenance task every day, and really isn't worth it in the end.
My advice: get your own domain and handle your own email accounts. Create special ones that simply forward to your main email address, to use on sites that require an email address for full functionality, and when you start getting spam, you know where it came from, and can shut that particular email forwarder down. It's a bit of a pain, but a LOT LESS pain than trying to unsubscribe from spam.
Obviously, anti spam tools like bayesian filters and what-not are always a good idea, but can let spam get through, and can block some wanted emails.
YMMV (but probably won't).
Actually...I hate to tell you guys this, but most spammers use those unsubscribe requests all right. They use them to verify that the email address is active, and it goes into a higher priority hit list. Even if they're in the US where the law says they must honor your unsub request, there's nothing that says they can't sell the information to other spammers that this is an actively used email address with a real live person on the other end of it.
About 18 months ago I did a little experiment. I set up my own junk inboxes at different email services and started handing them out. Three of them I unsub'd every spam email I got, and the other three I didn't. Guess which one eventually ended up getting buried in 10 times more spam...
I have a friend that is quite intelligent. He did a spin on the same idea, and I recommend it to anyone that wants to cut their spam to one or two mails per week (or you could just get a gmail account--I only get a few spam messages per week over there). Here's how it works...
Go out to every free email service you can get your hands on that supports POP3 download. Hand those addresses out to every spam list you can get your hands on. Periodically (every hour or so) download those messages into your Bayesian spam filter, marking them as spam (salearn that comes with spam assassin, for instance). I know of no better way to train your filter system and keep your spam stats up-to-date.
Of course, this isn't totally free of manual intervention. There's the initial setup of all this, which is more or less a one-time thing, but for it to truly work well, you have to make sure you also pipe all your regular mail (ham, as spam assassin calls it) into your Bayesian filter as non-spam mail, and if any spam does show up at your regular address, make sure you sort it into a separate folder and deal with it as spam. The spammers are getting more and more clever every day, and the line between spam and ham gets ever fainter, requiring that much more learning by the filtering system to keep straight what's what. But it's really not more work than you go through anyway, and you'll collect far more stats to use against the spammers than you otherwise would.
And let's not forget the best part, either. Signing up for and collecting all that spam costs spammers a little change (though, you could argue it also costs the hosts of your spam accounts, though you can delete the downloaded messages off the server every hour as part of the d/l to try and minimize impact on them).
but have you considered the following argument: shut up.
One thing really missing is a national or perhaps even a global unique "company ID". Law makers are so eager to tag and trace individuals, but ignore company tracking. It is time for a national company-ID number. Every company that pays US taxes is assigned a Tax ID. Been around forever. I used to be able to rattle off Tax IDs for about half of the Fortune 500 due to my job. What possible good would it do to identify companies by a number rather than a name? The problem is fraudulent companies, not an inability to identify them by number.