Slashdot Mirror
Do Unsubscribe Links Stop Spam?
Kaiten writes "Brian McWilliams of Spam Kings fame has just published a fascinating spammer exposé over at Salon. Using a pseudonym, he was hired to send junk email on behalf of a spam operation that has been burying people (me included) with spam for fake Rolex watches. The article details how the spammers handle the 200,000-plus unsubscribe requests they get each month. Seems that LOTS of geeks actually cross their fingers and click those remove links. And, surprise, surprise, the spammers usually ignore the unsubscribe requests."
Do Unsubscribe Links Stop Spam?
While they don't exactly stop spam, they do prove useful. You can immediately sort possible-spam by whether it offers an unsubscribe option. If it doesn't have it, it's definitely spam. If it does have an unsubscribe link, it's either legit (newsletter perhaps), or spam disguised with a fake unsubscribe. While the fake unsubscribe doesn't really help the end user, it offers a way to track and prosecute those who violate CANSPAM which requires that the unsubscribe option be present in some form, and that it work.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
No, I know for sure that they don't help. For years I have been trying to get MORE spam. The main way I have done this has been unsubscribing from lists! In fact, I even "unsubscribe" an address that was never subscribed. Indeed, that new address is now getting plenty of spam.
Unsubscribing from spammer's sites will get you more spam. Unsubscribing from mailing lists will work, of course, but mailing lists != spam.
Actually...I hate to tell you guys this, but most spammers use those unsubscribe requests all right. They use them to verify that the email address is active, and it goes into a higher priority hit list. Even if they're in the US where the law says they must honor your unsub request, there's nothing that says they can't sell the information to other spammers that this is an actively used email address with a real live person on the other end of it.
About 18 months ago I did a little experiment. I set up my own junk inboxes at different email services and started handing them out. Three of them I unsub'd every spam email I got, and the other three I didn't. Guess which one eventually ended up getting buried in 10 times more spam...
I have a friend that is quite intelligent. He did a spin on the same idea, and I recommend it to anyone that wants to cut their spam to one or two mails per week (or you could just get a gmail account--I only get a few spam messages per week over there). Here's how it works...
Go out to every free email service you can get your hands on that supports POP3 download. Hand those addresses out to every spam list you can get your hands on. Periodically (every hour or so) download those messages into your Bayesian spam filter, marking them as spam (salearn that comes with spam assassin, for instance). I know of no better way to train your filter system and keep your spam stats up-to-date.
Of course, this isn't totally free of manual intervention. There's the initial setup of all this, which is more or less a one-time thing, but for it to truly work well, you have to make sure you also pipe all your regular mail (ham, as spam assassin calls it) into your Bayesian filter as non-spam mail, and if any spam does show up at your regular address, make sure you sort it into a separate folder and deal with it as spam. The spammers are getting more and more clever every day, and the line between spam and ham gets ever fainter, requiring that much more learning by the filtering system to keep straight what's what. But it's really not more work than you go through anyway, and you'll collect far more stats to use against the spammers than you otherwise would.
And let's not forget the best part, either. Signing up for and collecting all that spam costs spammers a little change (though, you could argue it also costs the hosts of your spam accounts, though you can delete the downloaded messages off the server every hour as part of the d/l to try and minimize impact on them).
but have you considered the following argument: shut up.
One thing really missing is a national or perhaps even a global unique "company ID". Law makers are so eager to tag and trace individuals, but ignore company tracking. It is time for a national company-ID number. Every company that pays US taxes is assigned a Tax ID. Been around forever. I used to be able to rattle off Tax IDs for about half of the Fortune 500 due to my job. What possible good would it do to identify companies by a number rather than a name? The problem is fraudulent companies, not an inability to identify them by number.