Slashdot Mirror
Gates' Resolve in Bringing Spammers to Justice
An anonymous reader writes "It didn't seem to me like any single company had the stomach to keep after the scum that are ruining the Net for the rest of us. Unless that company is Microsoft. Since the beginning of 2003, Microsoft has filed 96 lawsuits against spammers, and 119 lawsuits against phishers. By any measure, 215 lawsuits constitutes a legal juggernaut. "
Wow - Microsoft/Gates usually gets a bad rap on /., but
kudos to them for going after the
scumbags
of the Internet. Another group I find annoying is the folks
who do
referrer
log spamming. Even though I don't publish those log stats (so their
efforts are to naught), they continue to send their stupid traffic
and it's a bit annoying to see in the web log analysis.
Hulk SMASH Celiac Disease
REPENT!
Don't you realize that every time you say something nice about Microsoft, Bill and Melinda dine on one of those Indian babies they've "saved" from HIV? How to serve man, indeed!
In all seriousness, the spam epidemic is actually caused by a relatively tiny number of people, so it would seem that this is a workable strategy - but the cause will just be taken up by people outside of our jurisdiction (Russians, mostly.)
The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
...how long until they use this legal and financial power against their "patent infringments"?
Indeed.
How exactly would you suggest that they improve their software to prevent spam and phishing?
Sometimes a little stick can be a good thing...
Here's what I do: Bitty Browser & Andromeda
All the big ISPs have been after spammers for quite a while now. I believe that AOL is owed a few million by that bankrupt spammer who featured in another /. story quite recently.
Strange: If any one company out there has the install base to actually do something technical about spam, it's Microsoft, yet they'd rather sue than improve their product.
I'm surprised ISP's aren't filing hundreds of lawsuits. They claim their servers are so overworked by all the spam, but they aren't doing anything effective about it (legally or technically).
Reducing Spam makes people use MS computers (and Exchange) more (as opposed to the alternatives).
:)
- Investing in spam filter technology reduces spam.
- Sueing spammers also reduces spam.
The optimal strategy will be to persue both strategies till they yield the same rate of spam reduction.
And that rate should be determined by whatever they think they earn on spam reduction.
My bet is that someone at MS has done the math.
And it keeps their lawyers sharp, who knows how and when that will come in handy
...probably just got tired of getting spam and 419ers in his Hotmail inbox / Outlook Express. So instead of developing better filters, he decided to take them out.
Someone might as well invite BillG to Gmail already.
In any battle, technology is only a small bit of it. Policy is an area that is far more important than technology in most situations, even when you don't know it. Would you rather they sit on their hands and let the spammers continue to ruin the internet?
I don't see you taking an active step to stop spammers other than maybe a little filtering and deletion here and there.
Help Brendan pay off his student loans
Can Slashdot ever accept the fact that Microsoft can do some good? I'd be willing to bet that 30% of the comments on this article will be "OMG MICRO$OFT IS GOOD?!". Accept the fact that they really can do good things and shut with the Microsoft bashing.
.
Sure, there will be spammers who think they can evade folks like Kornblum, Spitzer, and Abbott. But for every one of them, there will be others who--when they see what happened to Scott Richter as a result of Gates' resolve--hopefully will realize that spamming and phishing are bad career choices.
So the 'script kiddie spammers' drop out and the smart spammers take over, making even more money. It's supply and demand, and apparently there is demand for SPAM from this small-penised, high-mortgage, porn-searching world.
The next step is improving their software and improving the security on their platform. Just keeping regular security updates is good. Hopefully they will continue with their Anti-Spyware tool which isn't bad.
If there's one place Microsoft should feel right at home, it's in court. . .
The only acceptable defense of scientific results is to say that they were the product of the Scientific Method.
I know it's very hard for some of you people to get over your silly fanboy-ish attitude, but when MS does something good, why not praise them. Yes, they have bad business practices. Doesn't mean you have have crap on their image every single time.
This is somewhat like P2P. They might not be able to get whomever is joining these spamming companies for work, but it would certainly discourage people from getting jobs in these places. I think just that would prove a significant blow to these places.
My two cents.
Do notice that MS isn't suing virus writers. In fact, didn't they just forgive a huge amount against a virus writer in exchange of community service??
No boom today. Boom tomorrow. There's always a boom tomorrow. - Cmdr. Susan Ivanova
"It didn't seem to me like any single company had the stomach to keep after the scum that are ruining the Net for the rest of us. Unless that company is Microsoft."
For your information, the scum that is ruining the Net for the rest of us is... Microsoft!
I'd rather see twice as much spam in my inbox as I'd see Microsoft to continue abusing it's monopolistic powers to break every computer related standard known to man...
But.... what will we talk about then?? Star Wars isn't out yet, and Linus can't release a new kernel every few hours. We NEED MS bashing to keep our over-active/over-worked minds finely-tuned.
No boom today. Boom tomorrow. There's always a boom tomorrow. - Cmdr. Susan Ivanova
All joking aside, we have long considered Micro$oft an evil corporation. Sure on the side Bill Gate$ donates a lot of money, mostly to create little Micro$oft $chools that will plaster the logo all over the place and burn it into little growing consumers heads.
With all the evil they have done, is there any way that they could do enough good for the evil to be forgotten, or at least to break even thus making them a "Corporation" not an "Evil Corporation"?
Sure this is a start, but it is done more to protect themselves and their products than it is to better the lives of consumers. Suing spammers is just a way to hopefully get hotmail back to a point where you can actually use it.
This sig has been removed pending an investigation.
Didn't Bill Gates vow to rid the world of spam entirely within 2 years at some stage? I am sure I read that somewhere. Can anyone find a link to such a quote?
http://www.sandstorming.com
Why does no one (big company or university) sue the ISPs that let own3d boxez and zombies connect and stay connected? if the ISPs looked for the zombis and told those users how to be good "netizens", and offered a CD of EASY TO USE removal software, the spam problem would disappear over night, without bots, no one could send 100,000,000 emails per day.
Referer log spam is a scourge, but as best as I can tell, it doesn't violate any laws.
That means that spammers have continued to be able to fake the headers out, and it makes it harder to filter off the spam (particularly on the send side of email- in other words, stopping spam enter the internet in the first place).
So, Microsoft have taken the decision to fund lawyers, rather than fund technology that is likely to massively reduce spam; Microsoft have sided with a bunch of lawyers.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"Moron.
MS did try to improve the email-scape with their SPF, but this failed because of people like you who had to look a gift horse in the mouth. Now they go out and sue people on your behalf and you diss them for it.
"Linus can't release a new kernel every few hours"
Sounds like a wager to me.
-Linus.
if they are not served.
While it may be de rigueur here on /. to bash Microsoft, sometimes one has to put the tinfoil hat away and commend them for doing something good.
Sure, you can pull out some commercial motive behind this act, but hey, so what? When they annouce their fantastic new anti spam OS, we can bash them here, but if these lawsuits do help in reducing Spam, then hooray for MS!
Apropos, I remember reading that billg@microsoft.com gets one million messages every day, 98% of which is Spam. I suppose he just got plain old PISSED OFF!!
I'm just wondering why there's been so many MS-fighting-spam stories. Has there been such a dramatic decrease in technology stories that this has to be mentioned everyday now?
Preventing zombie machines, maybe?
What can we talk about? Oh crazy things like the state of world politics, the cure for AIDS, and the way to make an AI that's truly able to think, et al.
If they become the unofficial police of the internet, they will be first in line to be the official ones, when government (with a little help from microsoft) decides that such a body should exist.
I think it's meant to be a form of irony.
This makes me so sad that I've been running FreeBSD, Linux, and various Solaris versions instead of paying Microsoft outrageous sums of money all these years so they can us it to go after SPAMMERS. Of the shame of it all........
Open Source servers don't implement crypto-signed email headers, so spammers continue to use those servers to send spam.
/. culture was that anti-MS.
And you manage to blame this Open Source failure on Microsoft?
I didn't know the
It is good that those annoying spammers and immoral phishers are getting some negative consequences for their misbehaviour. However, it would be in the same spirit for Micro$oft to stop annoying me with their "There is a new MSN update available" spam. When I click on the popup spam, I get an option "to not receive this update message for a week." But there is no option to turn it off permanently. Very annoying.
taking enough literature classes years ago when I was in College!
What evil purpose is behind the M$-scene?
http://slashdot.su/
there is a way... they could prevent stupid people (who think spam and phishing) have the slightest to do with Microsoft software and more to do with personal stupidity from being able to log on.
You can give away all your money to charity, you can help system administrators cross the street and you can do all sorts of good things. But if you continue to kill small children or brake open standards, you will continue to be evil.
They sue spammer, they win, they get awarded money.
Yea Bills in this to improve the net like he sent money to the AIDs victims because he wanted to help. It's called PR people, I suggest you think about it.
I like muppets.
It looks like a way of benefitting customers with some of the money they gain thanks to their unlegal OS monopoly.
It's probably the first good thing they did since they started the company and sincerely wish them to succeed. However I bet that it will require a years-long legal campaign.
Where are the supposed "good guys"?
I realize the OSS community is doing things with their software to try and defeat spammers and phishers, but let's face it, legal action is the only real course of action to stop these guys (or at least whittle down their numbers).
Phishers and spammers will always find ways around filters, no matter what intelligence is brought to bear with new algorithms. New mail protocols would help, but we are hopelessly mired in a standard that will take a miracle to topple at this point (perhaps some new multi-media e-mail standard?). People won't buy into an e-mail system other than SMTP/POP unless it brings something significant to the table, and is as simple and easy to use.
The OSS community has for-profit companies out there... why aren't they flexing their muscle to help stop these scammers? Microsoft is at least doing something... and it demonstrates exactly what a big corporation like that can do when that lkind of capital is directed at doing something worthwhile.
I think in the fervor to attack the supposed "evil monolith" people here tag as "Micro$oft", they forget exactly how much Gates, his company, and his employees donate to good causes around the world.
1. Change your email address.
2. Never give it away except to established websites (Amazon, etc) that require it and to friends/family.
I abandoned my old college 20-spam-a-day email address after graduating. Since switching and then following these two policies, I have received only 1 spam message in the past 7 months.
no argument its a good start , however it would be nice if they would
.. .couples this with some basic computer security knowlidge(dont open LOVEYOU.jpg.VIRUS.WORM) and i assure you it would reduce spam far more in one year than 10 years of legal action
1: make sure active X is patched to make it far more secure.(killing it would be nice , but wont hapen for a while due to a hell of alot of websites using controlls)
2: make sure each user knows that they should not be running as an admin all the time and allow them an easy way to become and admin for installs etc
3: a large list of phising techniques and how they spoof browsers is easily avaliable and could be use to create a few fixes (all browser makers should do this).
In my mind the only way to stop spam properly is education , people need to learn to not accept it and not to buy from it
The only things certain in war are Propaganda and Death. You can never be sure which is which though
Dude, how old are you? About 12 or 13? Just curious.
They're damned if they do, and damned if they don't.
/. where no Microsoft action (good or bad) goes unpunished.
If they sued them, people would yell David and Goliath. If they let them go, people say they're not helping the community.
This is
My Tech Posts on Twitter
My guess is the he is Chinese and, knowing the history of John Paul II, it would make a lot of sense to have a Chinese cardinal elected as the Pope.
John Paul II brought down the Communism in Europe, this guy will bring down Communism in Asia.
At least we could say that Microsoft is doing what they do best for the good of all :)
Funny how what we'd normally consider bad suddenly turns for the good.
But.... what will we talk about then?? Star Wars isn't out yet, and Linus can't release a new kernel every few hours.
How about the latest Gentoo install disk?
... as long as spammers believe that there is money to be made by spamming. And that means that spamming will continue as long as email is so cheap to send and as long as there are sufficiently many dimwits who respond to spam. And there doesn't have to be very many such dimwits. You can sue as many spammers as you like; as long as there is money to be made, new spammers will appear in their place. The only irreplaceable part of the equation is the low cost of email compared to the money to be made even from a very low response rate.
I don't know what the typical response rates for spam are, but even if one in a thousand or ten thousand recipients is an idiot who answers the spam and sends money, or even one in a million, then it's worth it to spam, because the cost of sending a thousand or ten thousand or even a million emails is nearly nothing. At any rate, it can easily be much less than what spammers charge for their product.
One conceivable alternative is to make it more expensive to send email. If there were some way to establish "postage" for email, then even infintesimal costs for sending email, say 1/100th of a cent per email, would probably be effective, because then spammers would lose money by sending a million spams. But I can't see how such a system could be enforced, and I doubt that most people would go along with it, even if the costs for normal email use is very low.
I also doubt that any amount of education or cajoling could reduce that rate of idiots in the general public to less than one in a thousand, certainly not less than one in a million. Putting all these thoughts together, I come to the depressing conclusion that we will never, ever be able to make spam go away, no matter what we do.
Always keep a sapphire in your mind
I don't know about the rest of you
Umm, kinda out of touch with the rest of the world, are we?
but spam doesn't trouble me in the slightest.
LMAO! Dude, you're brilliant! Back to your cave now...
By any measure, 215 lawsuits constitutes a legal juggernaut.
I guess you've never heard of a little group known as the RIAA.
It's not even a competition. Microsoft has filed 215 lawsuits over a couple years. The music industry is holding steady at something like 700 a month.
That said, MS is targetting corporations who might try to defend themselves. The Music industry is targetting grandma.
Yeah sure. I like then doing this, but I still don't like them.
A bit like Bush: good thing the asshole took care of the asshole Saddam.
Or are you brown nosing again?
Simple logic, spammers use zombied machines to hide their tracks and spew millions of copies of garbage on the internet.
Thus, if Windows wasn't so exploitable and innocents duped, the spammers could be tracked and those ISP's responsible shut off from contacting the internet.
Make sense moron?
Oh the irony.
- First they ignore you, then they laugh at you, then ???, then profit.
"3: a large list of phising techniques and how they spoof browsers is easily avaliable and could be use to create a few fixes (all browser makers should do this). .."
A better way would be to turn OFF HTML in email by default. Most of the phishing scams as well as spams I have recieved have goofy lines of trash text to fool the spam checkers. I always thought it was stupid to use HTML email anyway.
B.
This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
Easy:
Build a PGP based site identity verification infrastructure deployed in the DNS distributed style with trusted root servers.
Add an automatic PGP site identity verifaction to web browsing (IE) and email (Outlook,Exchange) which uses that infrastructure.
Make all the IP needed to implement same F/OSS and pay for the hardware and web connections of the root servers, which would be serving mostly tier 1 and 2 internet carriers. MS could even use the existing DNS and PGP code bases.
Improve the security of MS-Win software so that its at least as difficult to zombie a Win system as it is a Linux system.
Ahem, for those who think that Win systems are zombied more frequently simply because there are more of them, please do some googling and look at all the articles describing how Microsoft's design decisions are the actual reasons why MS systems are the chief virii carriers and propagators on the net.
Here is one:
http://linuxmafia.com/~rick/faq/index.php?page=vir us#virus4/
And an excellent overview of the design/architectural differences beween OSes is here:
http://www.faqs.org/docs/artu/ch03s02.html
First, I'd make the actual email headers more available and legible, to see if email is from where it claims. Second, I'd implement SPF by default on all Microsoft DNS servers, mail servers, and the clients. (Note, I mean SPF, not the SenderID software that Microsoft tried to turn it into and broke badly.) Third, I'd discourage the sending of HTML email by making it no longer a default in all Microsoft mail clients. TXT should be the default, not HTML, it's too easy to hide cruft and phishing based links in the email. Fourth, I'd fix all those stupid mail client that auto-diaplay URL-looking words in email as clickable links, since their common use is part of how many phishers work their schemes. Fifth, I'd simplify the auto-clicking and wackiness and web browser hiding-of-what-you-typed that allows Internet Explorer to hide the first part of the actual URL, leaving only the last part displayed and looking like what the phisher wants it to look like.
Shall I go on?
And remember, Microsoft is not just a software company. They run a quite large set of email services at hotmail.com and msn.com, and they need to protect themselves from incoming spam, and they need to protect themselves from outgoing spam forged to look like it's from those domains, as it so often is, lest people say "block all email from those domains". In fact, I find that blocking all email from hotmail.com and msn.com and aol.com helps cut quite a bit of email that I don't want, from spammers and clueless people who mistype my name.
I'm glad to see that somebody is going after these theives. Now, if only law enforcement agencies would press criminal charges against them, and help ordinary people out the way they do for corporations, we'd be all set.
"Do I dare disturb the universe?"
1> Load a _secure_ version of Windows. No RPC, no running services, default firewall with both inbound and outbound traffic blocked, proper ACLs applied to the filesystem.
2> Disable HTML email completely. Remove the ability to send/recieve HTML email from Outlook and Outlook Express.
3> Secure IE and make it standards complaint. Securing IE includes removing ActiveX.
Do this in the next SP for Win2K and XP as well.
That will remove a lot of the holes exploited by spammers to get zombies from which to spam/phish.
I can throw myself at the ground, and miss.
There's a large Utah-based law firm that is about to be very underemployed. Perhaps Microsoft should just hire them directly instead of using SCO as a proxy? 8-)
Surely Microsoft has the resources to enlist the (admittedly unscrupulous) help of the Russia mafia in the solution of this problem.
Excuse me, but what in the hell are you talking about? Are you perchance referring to their SenderID system? If so, you need to head over to spf.pobox.com and read the archives on what happened there. SenderID was not a solution to spam and forgers, it was a poorly implemented layer on top of SPF to block joe jobs, forgery of MAIL FROM addresses. This is not the header: it's not even in the header people normally see, it's the email address the bounces go to and is useful for tracking forgeries. Given the trivial ease of purchasing SenderID keys from Microsoft and their lack of association with an actual From: header line, and the ease of breaking into many thousands of zombied Windows machines worldwide and sending spam from them now, it's a trivial matter to simply steal SenderID keys from small corporate Windows servers. The SenderID key only proves that the IP address sending the email is authorized to use that "MAIL FROM" line, not the "From:" line which is entirely different. Now, if Microsoft wants to get out of the way of real SPF and encourage its corporate clients to use the DNS TXT record authorization of "MAIL FROM" senders that SPF actually uses, then that would be a very helpful step in blocking a lot of the current phishers. Email from "mybank.com" could be checked against what the DNS for "mybank.com" claims, which is considerably tougher to steal, and mail filter software could even compare the "MAIL FROM" information against the "From:" line to get some additional spam or fraud testing information.
ActiveX is insecure by design. They have done about all they can do, without remaking it in a different language (like Java) with a real security model.
For every expert, there is an equal and opposite expert. - Arthur C. Clarke
Mr. Irving R. POINTYSTICK!!!
N4st0r, trixx0r h0bb1tz0rz! Th3y st0l3 0ur pr3c10uzz!
so i would like to nominate microsoft for most litigious organisation. along with sco and church of scientology.
So unless the ISP's start filtering, nothing will stop the spam from getting to the people who will buy from it.
for those who think that Win systems are zombied more frequently simply because there are more of them
Any OS can be zombied if it allows users to
a) install software
b) run software
c) run software that communicates on the network
It happens to Windows more frequently because
a) it's less secure (that's getting better)
b) there are more users, and hence more users who don't know better than to run untrusted code
c) due to a) and b) there are more people writing malware for it
d) users of other OSes, on the whole, are less likely to fall for trojans and social engineering (as it requires effort and reasonably advanced knowledge of computers to even be using an other OS)
It's official. Most of you are morons.
1. Yess they did lock down ActiveX in SP2. And it seems to be doing a much better job.
\ 2. Yes/No/Maybe. Longhorn has lesat priviledge thing, but i dont think that iwlll happen in XP. Although technically possible, it is too much effort to convert everyone.
3. Training does not solve this issue, people trust email, and the web way to much. If training solved these problems, we still would not most of the mass mailing viruses still. Technology solutions are the best way to go, and sadly we have to wait until longhorn for regular people. Tech people i am sure can be smart enough to create a user account, and use runas if they need apecial priviledges.
Suing spammers is just a way to hopefully get hotmail back to a point where you can actually use it.
More like, they'll jump at the chance to appear to be a champion of the people (you know... users), and to offload the evil factor somewhat onto another entity.
Use this php code on your website ;)
?php if(strstr($HTTP_USER_AGENT,"MSIE")) { ?> echo "Your Web Browser Is junk download firefox free at: http://www.mozilla.org/products/firefox/";
1. To the general public it looks as if they are solving the issue, where we know here that most spam is send by proxy on Wintendo machines.
2. By solving it this way they do not have to solve the technical unsafety.
3. If they win they make money out of the spammers.
Now if I were Microsoft, I would just start suing everybody. As long as you see that the case will be more expensive then what they can afford, people will settle out of court. Where you took Joe "the bonecracker" Seipacchetti to meetings to 'convince' people of the advantages of insurence, you now just take a lawer with you, take their money and don't even bother about delivering anything.
As long as 'suing till they are broke' is possible, I fail to see justice. Sorry. No matter how much I hate spam, I hate justice by money even more.
Don't fight for your country, if your country does not fight for you.
I don't know for you but for some reason
MS suing the spammers reminds me of
that MS vs. the Borg skit.
Difference it that I don't know if I should cheer for either side. (both are still evil)
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Why do you ask?
Okkkaaaaayyyyyy.... Do you have ANY evidence that such has resulted in ANY reduction of spam?
From what I've seen, spam levels haven't dropped at all.
So why do you believe that this approach is effective?How many cracked Linux boxes do you think the spammers use? None? Well, it would seem that the OSS community is dealing with the problem at the technological root.Again you go with your ASSUMPTION that lawsuits will result in less spam.
That's the THIRD time you've hit that ASSUMPTION yet you have not provided any EVIDENCE that supports it.Why do you Microsofties hang out here?
If the best you can do is, "Bill does some good things with the money he made from illegally leveraging his monopoly", then you've lost from the beginning.
When you're worth $50Billion, it's easy to put a few million on some pet causes. And the gullible hero-worshipers will eat it up.
Yay! Bill is taking some spammers to COURT!
But Bill is NOT working with the Open Source community to implement PATENT-FREE systems to improve email.
And THAT is the deciding factor. Bill makes a LOT of money from illegally leveraging the desktop monopoly.
Bill sells a LOT of crap software that is completely insecure by default (and makes a LOT of money from it).
But you think that other people don't understand because they still dislike him even though he is willing to take a tiny percentage of his money to do some nice things (as long as those nice things in no way, shape or form could ever harm his illegally leveraged monopoly).
So, would YOU feel sorry for those spammers if THEY were giving hundreds of thousands of dollars to fight hunger or disease?
Would you support their continued spamming efforts?
If you say "no", then you're a hypocrite.
I can't bring myself to cheer wildly for Microsoft but I can do a muted golf-clap.
*clap**clap*
*clap*
--
Robbing banks is VERY lucrative.
Yet your corner bank isn't robbed every day (or week or month or year).
There might be strong incentive to send spam and make lots of money, but the spam still has to go out on technological avenues. All you have to do is to identify those and limit their effectiveness.
#1. Zombies.
#2. Open Relays.
#3. Individual email accounts (30 day AOL free!)
#4. Sites owned by the spammer.
If you look at it that way, you'll see why MULTIPLE measures are needed. What will work against zombies will NOT work against Individual email accounts.
If you deal with the tech, then the incentive won't matter because there won't be any way to implement it.
Since this is about Microsoft's involvment, I'll focus on what they could do.
#1. Zombies. Microsoft announces a partnership with the ISP's and those ISP's block outgoing port 25 on their home connections. Microsoft offsets the cost of this with a couple $$Million$$ to each ISP for hardware upgrades and support calls. Anyone who needs port 25 access (people who work from home and don't have systems setup to handle it) can call and have enabled for their address.
#2. Open Relays. Microsoft forms a partnership with spamhaus, spamcop, etc to mirror the open relay databases of those people. Since Microsoft also has Hotmail and MSN, Microsoft is in a great position to identify new open relays and add them to the list as they are abused.
#3. Individual email accounts. Not much that Microsoft needs to do here. All the ISP's need to do is to limit the outgoing email to 10 unique connections per minute.
#4. Spammer sites. Again, Microsoft helps by hosting a mirror of the blacklists.
There, the spam problem is down to a tiny fraction of what it was. The spammers might still WANT to send spam, but HOW are they going to do it?
I dont know how this got moderated to insightful. Its a fairly ignorant comment -
Is the poster trying to equate the presence of IE only sites to the types of problems caused by phishing, spam and the other assorted BS that goes on?
Its this type of moral ambiguety that is causing the
types of problems MS is suing people for.
I don't agree with this. The senderId keys wouldn't be on most machines, only the email servers, which presumably would be better protected, and atleast in principle they can be repudiated in real time if a particular key owner starts spamming, or if a spammer makes it look like that. So spammers would soon run out of useable senderIds.
So, stealing serverIds doesn't help as much as you seem to think it does. serverIds aren't like from or Mail FROM addresses, there's a finite number, and they can be managed. That matters.
Also, serverId implementation implies that all the mail from a domain has to go through a mail server, hence prefiltering of the mail for spam can be performed at the same time (as in when a server gets dodgy looking email, the server goes- yep, sent it, but sticks it in a file for the admin to authorise/ditch). Prefiltering of email before it goes onto the internet has got to be a good idea (my ISP blocks email, unless it routes through their servers already, presumably for these kinds of reasons).
Mail with a particular serverId can be correlated against spam; and atleast nobody else has to accept mail from a serverId with a high spam ratio.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"My 8 month old Hotmail account has never had any spam. I have made no adjustments to any filters but assume MS is filtering some.
My main account, over two years old and served by myself, has absolutely no filters, yet I have never recieved any spam.
I achieved this by using a non standard name for the account - one that's not in the spammer's dictionaries, and by not EVER entering it into an online form (I have yet another temporary hotmail account for that - when it starts getting to much spam I simply ditch it and get another)
If you get a lot of spam, it's because you did something foolish, like let your E-mail address out to the world at large or used a common name for your address, like "bob@somemail.com". Spammers use dictionaries and "brute force" techniques to get these addresses.
Tommy
Open Source for Open Minds
"Windows - the first refuge of incompetent fans"
r us#virus4
Gee Tim C- I guess you are either very lazy or you can't read, or if you can read you can't comprehend.
In your second block, reasons b,c, and d all follow from the "Windows is more popular" argument and are invalid. It is "a" that is true. please read below and read all the rest of the pointers in the parent.
Stolen without permission from:
http://linuxmafia.com/~rick/faq/index.php?page=vi
Isn't Microsoft Corporation's market dominance, making Linux an insignificant target, the only reason it doesn't have a virus problem?
Not at all. This question is virus pundits' pons asinorum: If they can't think past this fallacy, don't even try to reason with them, as they're hopelessly mired in rationalisation.
( The fifth proposition, book i., of Euclid?the first difficult theorem, which dunces rarely get over for the first time without stumbling. It is anything but a ?bridge;? it is really "pedica asinorum", the ?dolt?s stumbling-block.? )
The speaker's supposition is that virus writers will (like himself/herself) ignore anything the least bit unfamiliar, and attack only the most-common user software and operating systems, thus explaining why Unix viruses are essentially unknown in the field. This is doubly fallacious:
1. It ignores Unix's dominance in a number of non-desktop specialties, including Web servers and scientific workstations. A virus/trojan/worm author who successfully targeted specifically Apache httpd Linux/x86 Web servers would both have an extremely target-rich environment and instantly earn lasting fame, and yet it doesn't happen.
2. Even aside from that, it completely fails to account for observed fact: Assume that only 1% of Internet-reachable hosts run x86 Linux (a conservative figure). Assume that only one virus writer out of 1000 targets Unixes. Then, given the near-instant communication across the Net that at this writing is blitzing my Linux Web server with dozens of futile probes for the Microsoft "Nimda" vulnerability per second, the product of that one virus writer's work should be a nagging problem on Linux machines everywhere ? and he/she will be working very hard to achieve that, given the bragging rights he/she would gain. Yet, it's not there. Where is it?
The answer is that, for various reasons discussed in prior essays, such code is very easy to write, but ? given minimally competent system maintenance (including the automated kind, cited below) ? completely impractical to propagate. And likely to remain so.
Submittors Note: For those actually interested in and capable really thinking, please read the rest of the essay. (follow the URL above)
#5. The chance of getting caught. Just try this little experiment. Call you local police station (not via 911 or any emergency number) and do the following test:
1. Tell them you are a bank and are being robbed
2. Tell them you are an individual and are being robbed
3. tell them you are a person and are being scammed
4. Tell them you are a person and are being spammed
I am sure that with the last one most of the time you are asked to get lost. When number 3 and 4 come together, it mostly ends with "Sorry, they are in another city/state/country/mindset.
It should be governement who should be going after the spammers, not companies or individuals, Now in the worst case what can happen is that they say: OK, we will not spam hotmail/msn anymore. Settle out of count and go on with business.
Don't fight for your country, if your country does not fight for you.
The more they howl about spammers, the less attention will be paid to the fundamentally broken qualities of Microsoft email clients. Security holes in Outlook? LOOK OVER THERE, IT'S A DIRTY SPAMMER.
When I was a kid, we only had one Darth.
Microsoft NEVER does anything without a motive to line their pockets and force their monopolistic practices on everyone. Microsoft has proven this time after time, so don't be so quick to applaud their actions.
They key to solving spam is to move away from it. Email has been out quite a long time, and has greatly helped to increase communication in the world. But as many, including Don Knuth, have stated, it's time for email to die its timely death. There are many more capable tools out there, which serve for faster and more reliable communication, without being subject to the extreme abuse of email. I realize that the odds of people quitting email is low, but all legacy systems fade eventually.
Microsoft Sucks, F/OSS Rocks. I get mod points now right?
Go after the farkheads making the spyware!
MadOgre.com
I suggest installing rocket propelled grenades up the Spammer's soft posteriors.
For the cost of an American law suit, you could pay a huge number of ex-Mafia/KGB hit-men, and spammers would be a thing of the past.
Perhaps you could hire some suicide bombers to handle locations outside the USA.
You dont need to kill them all - just get a lot of publicity for those you do kill.
Why doesnt someone put forth the effort to educate people about the internet? we teach our kids to stay away from crime, dark alleys and generally bad people and places in the real world so why not teach people the same things about the internet?
You know, if Firefox had 95% of the browser market, those folks would prbably add some goodies and people would start writing Firefox-only sites.
In general, the only people who care about standards are the people who watch while almost everyone else goes off and does what they want to do.
-- Slashdot: When Public Access TV Says "No"
Is Gates going after spammers per se, or going after competition They still sell out their Hotmail and MSN mailing lists to interested advertisers, don't they?
This applies to one-man businesses run by teenagers and grannies as much as IBM and M$.
I have news for you: Having to spend twenty times as much time on deleteing penis enlarger ads as responding to sales leads does not appeal to the average grannie.
These people are legitimate and constructive e-mail users, and not geeks. There is no reason why they should be showered with shit just because the US legal authorities fails to lock up the perpetrators of scams within its jurisdiction.
If you tell me Canada is better,I'll whack you round the head with a 512MB ST506 hard disk filled with spam from some Canadian pharmacy that can't tell the difference between the USA and Europe, and appears to have purchased an "Op-in" mainling list consisting of 10,000 copies of my e-mail address spelt wrong.
Sent from my ASR33 using ASCII
What did I say in my original post?
Yet your corner bank isn't robbed every day (or week or month or year). Gee, do you suppose that SECURITY can counter INCENTIVE?
Which was the ENTIRE point of my original post.So TECHNOLOGICAL solutions (the machine that dispenses the cash) are implemented to counteract the INCENTIVE.
Again, that was the entire point of my original post.It doesn't matter WHERE it is stored.
What matters is the SECURITY.
If a jewelery thief has to rob the storage site instead of the store, so what? The INCENTIVE is still there.
But the SECURITY measures mean that almost every attempt will fail, no matter what the INCENTIVE is.
Now, to bring this back around to the ORIGINAL article, filing LAWSUITS will NOT stop spammers the same way jail time does NOT stop robbers.
Lawsuits and jail time are not enough to counter the incentive of lots of easy money.
It takes well-designed and well-implemented SECURITY measures.
I think you stopped at the first line of my original post.
i know right? i love slashdot but people need to stop obessesing about hating microsoft. The whole "create software to stop spam" idea sounds awfully familiar to microsoft's initiative to get Sender ID accepted across major ISP, which could help stop spam at the software level. unfortunately they haven't had the best support with it from other ISPs.
in case you couldn't figure it out its not as simple as writing some software and flipping a switch to start protecting everyone's email inbox. it takes a very long time to convert all the ISPs and millions of email users to a new type of email authentication.
seems to me like microsoft is taking steps on the legal front and the software front to stop spam. no one else is really doing much, or at least not close to what microsoft is doing. stop being so biased and accept the fact that the company you might hate is doing you and the world a big favor by spending a lot of money it doesn't have to.
-mr silver
90% of security problems on the net today are due to Microsoft's inability to produce systems that don't have massive security holes.
Dude? Who's your daddy? Just curious.
This is just another PR move by MS. It makes them look good to non-geeks while all of us techies know what's really going on. A bunch of lawsuits aren't going to stop the spread of spam of virii. Sure they may punish the big-bad-wolves of the industry, which is a good thing. But the money won from the defendants (if any) of a lawsuit should go to something like the w3c or the ieee for research and implementation of standards that will serve to prevent spam and the like from being the norm anymore.
I would only agree with MS taking the money if it meant that they were going to put it DIRECTLY into security R&D to patch up their holes.
That being said...DAMN THE MAN!!!!
Microsoft's legal juggernaut vs. spambot Windows installs and Hotmail accounts. Either way, Microsoft wins, with Gates looking like our benevolent protector! That guy really is a genius.
--
make install -not war
"barely literate in English"
--
make install -not war
Everybody knows they wear white hats, not red ones.
[UID-HeinzIntel]
i.e. all the owned Windows machines that are used to send the spam?
No. We remain as vulnerable as before, MS is going to pass the bill of their lawyers to the people foolish enough to buy stuff from them for the "favour" (ok, wake me up when we see the dent in their profits due to litigation costs).
So instead of providing a technical solution to the problem (like sitting down in a comitee to create a new, secure, email standard) they fo in SCO mode (i.e. legal battling).
Give all the kudos you wish. The problem is still there, MS is wasting its money, the bill will be duly passed to MS customers.
IANAL but write like a drunk one.
I think ISPs should share more of the blame. A computer that doesn't connect to a network, and only one user doesn't really need that security. M$ started and grew in the personal computer industry with MSDOS- not networked, multiuser computers. AOL (which is getting better at security awareness) Earthlink and other ISP should be more involved
http://en.wikipedia.org/wiki/Signature_bloc
If you write the complaint properly, you can avoid the money from the case being discharged in bankruptcy.
Fight Spammers!
Those types of battles are usually short lived, especially in the corporate world but in the meantime; "The enemy of my enemy is my friend."
I still can't get the screen shots of Castle Wolfenstein for the Apple IIe out of my head.
will a post stating that security can defeat an attacker be mod'ed as "flamebait".
Where are the news? We already knew that Microsoft doesn't like competition.
(i'm just kidding, not trolling. laugh.)
42.
It mentions Microsoft, and then mentions "the scum that are ruining the Net for the rest of us", as if those were two separate entities. Huh?
(In analyzing their motivations, please keep in mind that Gates does not have a warm feeling for your inbox. He has a big ol' stiff one for your WALLET. This War On Spam shit wouldn't even come up if it weren't part of the larger World Domination program.)
There are two different mechanisms that this approach uses. One is that many of the scammers run on free or cheap web pages with monthly traffic quotas, so if you burn their quota they're out of business. Another is that many sites charge for bandwidth based on 95th percentile usage, so if everybody gangs up on them for 5% of a month (about a day and a half) you can jack up their bill and then move on to the next target. It's especially effective for the few scammers who are actually running their websites in Nigeria, since that's mostly expensive satellite bandwidth, but they're more likely to be in some random European or Chinese web hosting farm.
Obviously it's only useful to run if you've got a network connection that doesn't have monthly bandwidth quotas of your own, because you don't want to slashdot yourself, but most US cable modem and DSL services don't. (Now if we could only get the Koreans to run this stuff :-)
A technical comment on AA419 - it's not very efficient, because it's simply using a browser to display the illustrations. That's fun to watch, but burns a lot of CPU, so if you're running the various SETI@Home types of CPU sinks, they won't get any work done. It would be really simple to build a shell script that loops wget>/dev/null requests (with caching turned off) which doesn't waste time displaying the targets. On the other hand, using the current site is a no-brainer for times that you're not busy.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
All you need is a few lawyers to file these lawsuits and one or two supervise them all. It's anyone's guess how large Microsoft's legal department is, but between in-house counsel/staff and the all attorneys working for law firms hired by Microsoft to represent them in their never ending litigation, I doubt anyone is working overtime.
As for the cost, most likely it's a drop in the bucket when compared to what's already been spent or is being spent on antitrust cases. Whatever the cost, the bankers are used to it, the shareholders are used to it, as so is everyone else. And when one considers the PR value of these lawsuits, I doubt anyone would raise an eyebrow if real money was at stake.
Also, do the spammers pound a site with multiple requests from the same referrer, or do they do requests for lots of sites (e.g. Search Engine Optimizer scammers doing this as a business?
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I tried to contact Spamhaus about one of their ROKSO listings. I've been trying to give them *correct* and *up to date* information that they do not have on file, but I cannot seem to get anyone to respond to me.
If people are going to use SPEWS/Spamhaus/etc to dunk spammers, shouldn't the RBL maintainers take some responsibility to make sure that the information is accurate?
Lawsuits are one thing, but making sure you're nailing the *right* people is another thing.
Reports show that Gates began his all-out assault after receiving 10,000 emails advertising enlargement of certain organs found in male humans. This reportedly outraged Gates, who believes that his organs are already the maximum size allowed under Washington law.
In other words, how do you intend to stop me from installing something (a porn dialer, screensaver, shareware app, or whatever) that, as well as its legitimate function, makes my PC part of a botnet, without preventing me from installing software at all?
True, 100% prevention is probably impossible, but ISPs do monitor their customer's net usage. It shouldn't be too difficult to detect zombie machines. They should then cut the machine off the net, call the owner, tell them that starting N hours ago their machine became a zombie, and help them fix it. Do that often enough, and publicize it, and perhaps the average user will be more careful in the future.
Q: What does the "B." in Benoit B. Mandelbrot stand for? A: Benoit B. Mandelbrot
They dropped the fine because the guy never would have been able to pay it. Instead they at least got the guy doing something useful, Didn't the guy still get jail time?
Filters and Lawsuits hit different ends of the spammer market. Lawsuits aren't very useful against the little spammers - it's a whack-a-mole game, where any spammer you bankrupt has two or three more following in his footsteps. They're much more effective against the big spammers - Spamhaus estimates that 200 spammers put out 80% of the spam, and putting any of them out of business can make a big dent - and most of them are based in the US, where you can sue them, even if their infrastructure is mostly in China or Zombieland. The nice thing about whack-a-mole lawsuits is that they're usually easy to win - you don't make any money off of it, because most of them aren't making much money compared to the amount they're costing the Internet as a whole, but if you've got a collection of 200 heads nailed up on your office's front gate, it starts to get their attention.
Exchange, Outlook, and Outlook Express do get spam filter technology added to them - it makes the users happy, and if it implements spam-reporting capabilities well, it can help the ISP side of MS improve their filters. But the main filtering happens at the ISP level, because that's what most customers want.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
They'd take care of the retards over at http://www.cryptic.net/.
What does he do? Just curious.
Phishers, on the other hand, can operate from anywhere; they're popularly blamed on Russian Mafia, but I haven't seen any real statistics. But until banks start running SPF or similar protocols that make it easy to filter out forgeries, phishing won't go away that fast. Banks and credit card companies also need to start running stings on phishers - things like setting up dummy accounts that instantly flag anyone who accesses them, sending this information to the phisher's traps, and then nailing them when they try to get them money.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
With all the evil they have done, is there any way that they could do enough good for the evil to be forgotten, or at least to break even thus making them a "Corporation" not an "Evil Corporation"?
They just need to stop beeing evil and start to agregate value for our society. Honest people/corporations have no need for good actions to be accepted (but them sometimes do that anyway). If Microsoft turned not evil, people will start to trust them again. All they need is time.
But good actions also don't make evil people/corporation less evil. Bill Gates donnating money or M$ suing spammers will no make M$ less evil. Not even a bit.
Rethinking email
It didn't seem to me like any single company had the stomach to keep after the scum that are ruining the Net for the rest of us.
I thought it was Microsoft that is ruining the net for the rest of is. Isn't it Microsoft that created the spam industry?
Have you got your LWN subscription yet?
Back in 2002 I decided to change my email address to [insert real username]@microsoft.com and then post to usenet so that Microsoft employees got spammed. Microsoft gets annoyed and spammers get sued - It's a win-win situation.
That doesn't mean that most ISPs shouldn't try to detect and reduce most of their zombie and spammer problems - one reason I don't use cable modems is that they're mostly cluelessly fascist about not letting you run arbitrary servers. There are cable and DSL ISPs that have a policy that by default you can't run Port 25 and maybe a couple of popular MS Windows ports unless you fill out a form saying that you want to enable it (with a Turing-Test Captcha on the form so zombies can't enable it for you), and that's really just fine, because you've got a choice if you want it, but you're less of a security risk if you don't.
Got any spare CDs of Easy To Use Removal Software you'd recommend? (Knoppix doesn't count :-) Once a machine gets infected, if it doesn't have a Decent Operating System on it, the malware can infect almost everything, in ways that are often hard to detect. McAfee and Symantec anti-virus software are a good start, and reinstalling your OS and any applications from scratch from CD-ROM helps, but sometimes you just can't tell what's infected. A lot of people could do just fine running Knoppix instead of Windows, which is a lot more secure not only because it's Unix but because the executables are on a read-only medium, but that doesn't support kids who want to run the latest games, and obviously Microsoft doesn't want most people doing that so they'll keep coming out with new Office features or whatever.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
This is a feature end users expect, and they will get upset if the feature is removed. A lot of people like having real smileys in their email.
The real solution is to limit the kinds of tags HTML email can have (this is how Evolution handles the problem).
Too many legacy applications depend on ActiveX. The real solution, and the one Microsoft implemented for XP SP2, is to severely limit who can run ActiveX.
About standards compliance: I agree that it is a bloddy shame that IE7 isn't going to fully support CSS2.
Not in the Microsoft usage model. The SenderID keys would be on every single PC, implemented as part of the local email client. The theory is that people who send from desktops that move or laptops that move or VPN'ed machines can still be authenticated at the next SMTP server. SenderID actually breaks SPF, because the SenderID overrides the SPF based domain settings on who is allowed to send email from a domain, and it wastes a bunch of CPU and resource that SPF would have blocked at the originial "MAIL FROM" line. Since the vaguely encrypted key information has to be read out of the header, it means the message has already been transmitted and is already wasting the server's disk and CPU. Requiring the encryption parsing will merely add insult to injury, and gain almost nothing.
"Accept the fact that they really can do good things and shut with the Microsoft bashing."
Memo:
Negative talk is no longer spelled 'criticism'; it is now spelled 'bashing'.
Seriously, how is it 'bashing' when one points out that publicly available information shows a large number of their business strategies are illegal or unethical and accomplished not on merit but through lies, coercion and pay-offs?
Call it 'bashing' if you must, but don't pretend that makes it untrue.
Crumb's Corollary: Never bring a knife to a bun fight.
Just want to hear Gates standing over some spammer and ask "You've got to ask yourself one question: 'Do I feel lucky?' Well, do ya spammer?"
"You don't assign him to spammer cases, You just turn him loose." "William Henry Gates the Third. He doesn't break spammer cases. He smashes them."
"I know what you're thinking. Did he assign six lawyers or only five? Well, to tell you the truth, in all this excitement, I've kinda lost track myself. But being as this is Microsoft's legal department, the most powerful legal entity in the world, and would sue your head clean off, you've got to ask yourself one question: 'Do I feel lucky?' Well, do ya spammer?"
And just how many spammers are there out there right now?
What do you have to fear more? Being sued by Bill Gates for spamming, or the **AA for file sharing?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Ever since Microsoft started this campaign against spammers, we haven't seen a reduction in the 100,000+ spam messages we get on our mail server.
This is like the lawsuits they launch against people who pirate Windows. Horribly, horribly ineffective.
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
Can you say 'PR fun'? That's exactly why they're doing this. SO that they can say 'we help keep your inbox clean!'
Show this to your friends and family that don't know what a real hacker is
How exactly would you suggest that they improve their software to prevent spam and phishing?
Perhaps you missed the fact that 80% of spam comes from zombied Windows computers?
Nope. Microsoft can't do ANYTHING about this, can they?
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Yah, sure, Microsoft = teh "evil".
Gates is right up there with Stalin when it comes to "evil", after all, "Micro$oft" did bundle a browser in an OS, right? Can't get much more "evil" than that!
LOL - You guys are hilarious! LOL
-- "I never gave these stories much credence." - HAL 9000
How exactly would you suggest that they improve their software to prevent spam and phishing?
You do realize that the bulk of spam and phishing messages these days are transmitted by zombified Windoze machines, don't you?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
you are fucking gay, troll
But your college's system still gets hit by 20+ spam messages to your mailbox a day. Not to mention the 20+ per the majority of other addresses on that system, and the 2000+ that the computing center filtered out before it hit your mailboxes, and the 200000+ dictionary attacks, ...
Just because you're not at that address anymore doesn't mean the spammers will stop pounding at the door.
I did this and :
While it helps alot, it doesnt work.
I now get 5 spam messages a day (and increasingly more) on an account that was strictly "Friends only". I do have this account for over 7 years now, so 5 messages a day is not that bad, but still, and whats really worrying me it that's slowly increasing. (Up from 2 messages/day a year ago.)
Reason : Some non-geek friends that fall for some social network scam (sms.ac, hi5.com, etc) and people who forward every stupid chainmail of the net.
So I guess, whatever I do, eventually the adress will fall into spammers hands.
Having said that, my university's account is still spam-free since 6 years, but I think that they run a spam-filter, so I dont know if it's really spam-free or not. (AND I use my university's account only for university related friends, most of whom are in CS.)
I have discovered a truly remarkable proof for my post which this sig is too small to contain.
Of course, they could just be giving their IP lawyers warm-up practice for when they sue the leaders of the Linux community for sudo, and all of their other random patents.
It's kinda hard to know with Mr. G.
OS Software is like love: The best way to make it grow is to give it away.
Referrer log spammers should be obvious from my ability to move, and does not want to do.
Because i decided to have a child, and here you are a part of the internet. Referrer log spammers should be sued too. Cosmology is the long bone in the web log analysis.
the real answer is for people not to respond to spam...if there was no profit, it would not attract so many folks...outlawing drugs hasn't stopped drug use...prosecuting spammers will just make the remaining few more powerful...folks need to be edumacated :-)
You know who really deserves the thanks for this. Yep, its you. All you guys who signed up for all kinds of spam and dubious web based offers using every possible permutation of bill, william, gates, msn, hotmail, and microsoft.com. I heard that he had to hire a staff full time to sift through tens of thousands of emails to try to pick out the actual business communications. And then out of sheer desperation he signed up for an AOL account.
Liberals call everyone Nazis yet they are the closest thing to it.
Yes this is horribly pedantic, but can't the editors at least abide by this one page from Strunk & White?
i.e. Gates's, not Gates'
Democracy is two wolves and a sheep voting on lunch.
Brandioch, actually, I've got the spams and the admin replies to demonstrate, that Linux (and BSD) systems aren't immune. The big culprit since about November has been PHP mailform scripts, and I've seen quite a few of these sites acknowledged and wiped off systems by their administrators. Many at hosting sites.
Yes, it's apparently proxies or dedicated "bulletproof" hosting systems that are the primary sources. but Linux isn't a silver bullet. Oh, and PHP has its share of problems. awstats p0wned, anywone?
What part of "gestalt" don't you understand?
or is it just a smokescreen... has actually fixing the vulnerabilities in windows become so difficult that gates/m$ have to go out and make examples of people who harass users...
Get your torrents...
Linux isn't perfect. And in your example, a stupid admin can install a service such as PHP mailforms without securing it correctly.
But, by default, those aren't installed/enabled.
oh look, he signed his name....
Sigs are for wimps
He Schutze, He Scores!
Well, considering that Microsoft's CEO is in fact, the most spammed person on the internet , it would be pertinent to say that eliminating spammers would be in the company's best interest.
"Those who think they know everything are of great annoyance to those of us who do." - Isaac Asimov
Yes (as I was explaining to the school LAN admin yesterday afternoon), I can deliver a perfectly insecure GNU/Linux box. Yes, GNU/Linux is inherently much more securable than legacy MS Windows.
That wasn't the point. You made an unsubstantiated claim that no spam is being sent from GNU/Linux boxes. I've seen plenty that was. I've seen boxes run by generally paranoid admins hacked. You're far more credible when you stick to the truth, Brandioch. Temper your enthusiasm. It sells better.
The OS alone doesn't guarantee security. GNU/Linux boxes are used in various attacks. Easy-to-find and widely deployed (on fat pipes no less) PHP holes all the moreso. Keep up on your security bulletins and site updates, monitor your logs, run an IDS, scan your perimiter, check your traffic, read your abuse mail. You'll be ahead of the game.
(aptitude|urpmi|yum|yast) install security isn't sufficient by itself. Stop selling that myth.
What part of "gestalt" don't you understand?
If someone sets up a Linux box and installs software that allows an open relay, that box has not been cracked.I think I'll just stick to the facts, if that's all right with you.
So, dispute my claim with a fact. Show me a cracked Linux box spewing spam.
Not one configured by the admin to be an open relay. Not one where the admin installed software that was configured as an open relay. No open relays need be mentioned.
If you handle the mail yourself, that shouldn't be too hard to do. All you have to do is check the spam that didn't come through a relay and find a Linux box that isn't legitimately owned by a spammer.
I'll give you a week.
If you can exploit a box without gaining root, why bother gaining root. Matters little to me how a box is being utilized, rather more that it is. The distinction is a red herring. If someone's using your system in an unauthorized manner, it's effectively exploited, root or no root (yes, there are different implications, you and I both know that, stick to the point).
That said, I've seen Linux boxes cracked, and I've seen 'em spamming. I'm generally not tracking which is what, but reporting on spam. If you're so keen on finding 'sploited Linux boxes, you can search news.admin.net-abuse.email on my email address, find my reports, and query the IPs yourself to find out what they're running and whether you think they're cracked. That's your question, I'm not your consulting department. Fresh crop of ~250 hosts posted daily.
And that said, http://www.123stereo.com/ turned up serving a PayPal phish Aprl 6. It's already been cleaned. But that would be a PHP site which was conned into loading and serving pages. Couldn't tell you it was cracked for certain, but it smells like it. No, not spamming, but that's just what I saw. Satisfied?
Anyway, turnabout's fair play: prove to me that no compromised Linux boxes are spewing spam. You've got a week.
What part of "gestalt" don't you understand?
Therefore, you lose.
Too bad. All you would have had to have done to show that you were right is to reference a Linux box that was cracked and spewing spam.
Bullox, Brandy.
A single counterexampe will suffice. I gave you my datasource. You've got nmap -O. Start tracking. Or pay me for my time.
What part of "gestalt" don't you understand?