Spam Haters Given Right of Reply

rk_cr wrote to mention an Israeli technology firm which has set up a system to allow harried email users the right to reply in force. The system "batters spam websites with thousands of complaints. The plan is to fill order forms on spam websites offering pills, porn and penile health tonics with complaints about the products advertised for sale in junk messages. The plan has been criticised by other anti-spam workers who say it amounts to vigilantism."

Comments

fight fire with fire?

[Prophetic_Truth]

so we spam the spammers sending spam...wait..what? This is some strange paradox that i can't understand at 7am EST..

Re:fight fire with fire?

[FyRE666]

Why not fight fire with fire? These scum have placed themselves outside of the "law" (such as it is when applied to the 'net), and so should not be protected by it. I say do whatever works. The sort of scum who send spam and run spamvertised sites care about nothing other than making money, no matter what the damage is. The only thing they will respond to is a force that affects their ability to make money. Forcing them to pay stratospheric bandwidth bills, or wade through tens of thousands of garbage "sales enquiries" will affect their "business model".

As for the hand-wringers and navel gazers claiming it's "vigilantism", I'm assuming they also considered the US' attack on Afghanistan after 9/11 "vigilantism", or Europe fighting back against the Nazi's as "vigilantism" too? Yeah, we should just sit down and have nice pleasant debates with scum... sure... that'll work... <rolls eyes>

Re:fight fire with fire?

[h4rm0ny]

Right now the Internet is an incivillised place, a sort of new colony, but settled by people who have the benefit of hindsight from the modern societies they have come from. I say let us fight it out for ourselves, establish our own rules, enforecements and bounds of behaviour, not have them imposed from the founding states (physical world).

Re:fight fire with fire?

[SuperWebTech]

"Why not fight fire with fire? These scum have placed themselves outside of the "law" " - FyRE666 "The sort of scum who send spam" - FyRE666 Technically, according to the CAN-SPAM Act, spamming is legal (though I cringe at the thought). A spammer is allowed to send you an unsolicited commercial email as long as he provides his return address and a way to opt out of the message. If you DDoS'd a spammer who followed these rules and he took you to court, he'd win. Please don't be mean to the law-abiding spammers! *snicker*

Re:fight fire with fire?

[DrSkwid]

yay, lets all burn

Re:fight fire with fire?

[giorgiofr]

While I agree with your point I must highlight the humungous differences between:

1. trying to save your people from a nazi dictatorship that, if succesful, would rule over Europe with an iron fist and drown all opposition in blood

2. attacking the first country that comes around, or where you happen to have funded wars for the last 10+ years for your interest, after a smallish attack on your country (sorry man, 6000 is nothing against even the small jew community of 6000000, let alone everybody else) without even retaliating against the real attackers, while seizing the ball to get super rich oil contracts in the next 30+ years.

I *DO* see some differences.

Re:fight fire with fire?

[v1]

Spammers will continue their work as long as it is proffitable. Normally I'd als append "and legal", but it's been demonstrated ad nausium that the spammers really don't care about what's legal and what's not, so that's out. That leaves us with only two alternatives really - increase enforcement of the laws, (isn't that always a problem?) and make it not proffitable.

The problem with the proffitability is that the average consumer IQ is 100, and that means 1/2 of them are below 100, so you're not dealing with the brightest collection of people in the world. There will always be a ready supply of suckers to reply to the spammers, so we can't stop it that way.

If we can't stop their revenue, the only way to financially affect them is by costing them money. The most straightforward way to do this is by bandwidth charges and fake submissions. Is this vigilante action? You bet it is. But right now even though spam is hated by 95% of the world, there is no effective legal enforcement against it. (try to think of anything else that 95% of people in the world don't hate, that isn't illegal as a result?) The main reason this is the case is that there's so much money in spam - it's very proffitable if done correctly. As long as there is incentive in the form of lots of cash, the problem will never go away. It doesn't matter how many laws you make or any other actions you take - if it remains a very proffitable venture, people will continue to engage in it.

The only thing that makes spam different is that ONE person can annoy the piss out of hundreds of thousands of people at a time, and as far as social injustice is concerned, that's very impressive. Someone with that level of morals doing that degree of harm to the general public deserves no protection from society or its justice, even if vigilante.

Lets say I go driving around town spattering mud on people's houses. It's a nuisance, not really harmful per se, but I'm annoying the piss out of people. How long do you think I'd be allowed to continue to do that before the cops would come haul me away? Now imagine I was managing to do that TO AN ENTIRE CITY. There'd be an APB out on my carcass, you can be sure. The only reason spammers don't have this probelm is they can spatter mud on people's houses from another state or another country. For now this makes them safe. I look forward to the day this is no longer the case.

Legality?

[gunpowda]

Would the users not then be liable for precisely the same kind of charges and punishment that the spammers are?

Re:Legality?

[bobbis.u]

They solicited the business by contacting you first, so there is clear cut difference.

I'm not sure whether the law would reflect this, because as we all know, the law doesn't always reflect justice.

Re:Legality?

[kfg]

No, because the spammer has solicited. The repsonses are not spam, they are responses.

KFG

Re:Legality?

[Anonymous Coward]

Parent's comment feeds nicely into the close of the article:

But the scheme has been criticised by John Levine, a board member of the anti-spam Coalition Against Unsolicited Commercial E-mail.

"It's the worst kind of vigilante approach," Mr Levine told the AP news service. "Deliberate attacks against people's websites are illegal."

Except there's several minor problems with this supposed illegality:

(1) The spammer has sent you email inviting you to the spammer's website. Under the law, this explicit consent makes you an invitee, and not a trespasser.

(2) The company is filling out a form provided by the spammer's website. Arguably, there is implicit consent for the user to fill out the form, and the fact that the response rate has jumped from 0.1% to, say, 10% may be unusual, but it is a foreseeable consequence of the spammer's campaign. If you are replying in exactly the manner intended by the recipient, it's hard to classify the response as a denial of service.

(3) The spam complaints may not be legal in and of themselves, so if the company is smart, it will include an unreasonable counteroffer ("Dear sir, I would like to purchase your product, but I am only willing to pay $0.01 per item, including shipping and handling. You may accept this offer by shipping the product to [P.O. box that nothing is likely to ever appear in anyway owned by company]"), which in fact will be perfectly reasonable because the offer invites counteroffers, and the subjective intent of the person making the counteroffer is irrelevant to a legal analysis of the contract (note: I am not arguing that there is no risk whatsoever, courts are not stupid, but they tend to employ 'cruel' ways of being fair).

(4) The spammers haven't exactly shown that they are willing to disclose their identities. At some point, the spammer has to sue someone. That subjects them to both subject matter and personal jurisdiction for various claims like private nuisancce, misrepresentation, breach of contract, etc. by anyone willing to cooperate with the company based on the admissions that the spammer will have to include in the complaint. Even if a spam association chooses to file suit, the ORIGINAL spammer will have to be identified in the record when whoever brings suit attempts to authenticate the evidence. Given the paltry number of pro-spammer lawsuits based on commercial rather than constitutional theories (where it's easier to hide the identity of the real party in interest), does anyone think that there's a substantial likelihood of civil complaint or criminal prosecution?

Not just getting the spammers though

[intmainvoid]

Sure this might annoy the spammers, but it's also going to cause problems for anyone unfortunate enough to be sharing a network/webhost/isp with a spammer. And what happens when someone sends spam appearing to be from a competitors site, in order for them to be attacked?

Re:Not just getting the spammers though

[tomstdenis]

I don't think you have to worry about the latter. How many legitimate penis-pill and "get rich quick" websites are there anyways?

Chances are if the website is trying to sell you herbal penis-happy-happy pills they too use spam at one point.

Though I agree with your former comment. However, realize that you don't need excess bandwidth. The idea is to fill their databases with useless information to make it harder to find any [if at all] orders were made.

Tom

Re:Not just getting the spammers though

[Detritus]

If you sleep with dogs, you wake up with fleas.

Nuke them all. If you do business with a spam-friendly ISP, you are partly responsible for the spam.

Re:Not just getting the spammers though

[sector]

I don't think you have to worry about the latter. How many legitimate penis-pill and "get rich quick" websites are there anyways?

I'm not sure how this is relevant.

Let's say I'm the owner of Whozenflotz, Inc (appologies if there really is a Whozenflotz, Inc) and I notice that ACME Corp's web presence is luring my potential customers away. So I hire a spam outfit to send hundreds of thousands of spams purporting to come from ACME with the expectation that this automated response system will knock ACME's web servers offline (or at least make them sufficiently slow that those customers will return to my site). Note that at no point did I mention what Whozenflotz or ACME actually sells. Maybe the companies are online brokerage firms.

The problem with this and all other automated response systems is that they generally do not (and one could argue that they simply cannot) completely verify that the address they're responding to was the originator of the spam. We receive a dozen or so automated responses per week informing us that our systems have been sending out emails infected with the Windows worm-of-the-month. Given that our machines are all BSD and Linux, this is pretty damned unlikely. It's simply a case of a spammer forging our contact address and the automated responders being fooled.

This system, if deployed, will be abused.

dupe

[Anonymous Coward]

http://it.slashdot.org/article.pl?sid=05/07/18/121 4226&tid=111&tid=1

Futurama

[zaxios]

Leela: Hold it Santa! Consider this: you are programmed to destroy the naughty... I submit to you, that you are in fact naughty, and that, logically, you must destroy yourself.

Santa: Nice try, but my head was built with paradox absorbing crumple zones.

Re:Futurama

[scottv67]

But that logic employed in the grandparent post was also employed in the original Star Trek series. Kirk convinced "Nomad" that he (Nomad) was flawed and therefore it had to "sterilize" itself. While Nomad sat there at 100% CPU util, Kirk and Scotty locked the anti-gravs on Nomad, carried his metal ass to the transporter room and beamed him into Deep Space.

Paradox or not, it works. :^)

You insensitive clod!!!

[rock_climbing_guy]

I'm a spammer and I really don't appreciate this kind of vigilantism. Therefore, I'm going to have my army of spambots crapflood your website with GNAA/Trollkore posts. Have a nice day.

Wrong approach

[giorgiofr]

FTA, I will quote a whiner: "Deliberate attacks against people's websites are illegal."
WTF?! Are you an idiot or what? Since when, exactly, are there laws on the web?
Before you reply with witty comments and dates, please understand I'm not saying that there should not be or that there are no written laws, I'm saying that (almost) nobody respects them. Go on, enforce laws on the web. Come back when you succeed.
Given that it's impossible to regulate the web beyond the very basics like domain registration etc., people like the whiner above should just accept the fact that the lack of laws on the web make this a no-man's land, where criminals are free to do what they want (which they are doing) and those who object are free to take arms and destroy them (which they are not doing).
So who gives a fuck when it's illegal - laws that are not enforced are simply not there. Now do you prefer sitting and whining and blaming it on the innocent ones or actually *doing* something to solve the problem?

Of course spam fighters find this innapropriate

[NeedleSurfer]

The plan has been criticised by other anti-spam workers who say it amounts to vigilantism.

Have you noticed that everytime a brilliant solution arise, a solution that seems just right and appropriate. A solution that would maybe not stop but at least truly hinder spam or virii and stuff like that, security firm says its a bad idea, its vigilantism and crap like that. Who cares if its vigilantism, it works and thats all that count. The fact of the matter is that none of these company want virii gone or spam dead, they want to sell you stuff that gives you the impression its doing something usefull about it. deleting spam, filtering it, scanning for virii and removing the well known ones, it just doesnt do crap about the problems... retaliating might, so facing a technique that could work the "spam fighters" dismisses it...

Catch a clue

[DynaSoar]

A vigilante is someone who usurps ot assumes power or authority from where it rightfully
exists.

Now, show me an elected or appointed spam cop that this is taking authority away from. There is none. Don't even bother to pretend ISPs fulfill this role. Their role is to keep customers. Some do better than othres at cleaning the trash, but none can act beyond their boundries.

And speaking of boundries, that's where your anti-spam laws stop. And that's as it should be.

This is the emergence of a regulatory force in the absence of any. That is not vigilantism. The net should police itself, including the dirty work. If it doesn't, someone will.

Re:Catch a clue

[Trailwalker]

A vigilante is someone who usurps ot assumes power or authority from where it rightfully exists.

Other way around. Vigilantes arise when there is no authority, or when authority is corrupt and part of the problem.

The ultimate responsibility for protection lies with the community. As circumstances warrant, they may establish a police force to do this, or if police are powerless, do whatever is necessary themselves.

It is seemingly forgotten that governments, and the services they provide, are established by communies to serve those communities.

People who take advantage of lawless conditions can expect no protection from those they harm.

Re:Catch a clue

[Tim C]

No, it's anyone who dishes out justice or punishment without official power to do so. Just because there's no authority to combat spam doesn't mean that those who take it upon themselves to do so aren't vigilantes.

This is the emergence of a regulatory force in the absence of any. That is not vigilantism.

Actually, that's precisely what it is, until and unless such force becomes official, either by sanction from an appropriate body, or by default.

Let's get it done and over with...

[tamnir]

Your post advocates a

(x) technical ( ) legislative ( ) market-based (x) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

(x) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
(x) Eternal arms race involved in all filtering approaches
(This time the spammers will be doing the filtering, and that will be quite easy for them.)
(x) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Let's get it done and over with...

[ZorbaTHut]

Also missing . . .

(x) Anyone could anonymously destroy anyone else's career or business

(x) Joe jobs and/or identity theft

(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
(x) Countermeasures should not involve sabotage of public networks

Re:Let's get it done and over with...

[ozmanjusri]

A couple of years ago I submitted a request to the Thunderbird team to include a button which would do exactly this. I still believe it's a good approach, although an Outlook plugin would probably be more effective.
I'll try to address some of your objections, but I think you missed the main one;

(*) Joe jobs and/or identity theft

I've had to deal with dozens of Joe jobs every year, and I'll have to deal with dozens more every month for the forseeable future. It's already so bad, a few more won't make it significantly worse.

(x) Requires immediate total cooperation from everybody at once

No, even a few thousand false records in a spammers database would be enough to increase their costs. That's the goal here, and while more would be better (especially if the company which hired the spammer is paying per response), it's a step in the right direction.

(x) Laws expressly prohibiting it

None.

(x) Eternal arms race involved in all filtering approaches (This time the spammers will be doing the filtering, and that will be quite easy for them.)

It will reduce their profits. That's good.

(x) Extreme profitability of spam

This will reduce it.

(x) Feel-good measures do nothing to solve the problem

Doing nothing will achieve even less.

(x) Sorry dude, but I don't think it would work.

It doesn't have to, at least not by itself. Spammers are just another in a long line of parasites humanity has had to deal with over the years. We're winning more often against most of our parasites, but rarely do we ever eliminate them completely. Spammers are winning now, they're a plague on the internet. Getting them under control in the way we have lice or fleas under control is a process, not a once-off event. This will be one control out of many.

Re:Let's get it done and over with...

[pete6677]

This "spam form" is both funny and informative, however I think someone could use it on almost any approach to spam fighting. ANY solution or attempt at a solution will have drawbacks. Having a local spam filter carries the disadvantage of possibly deleting legitimate mail, especially from mailing lists you may have subscribed to. If we want to get serious about fighting spam, at some point we (the internet community) will have to adopt the least-bad solution and go with it, despite the drawbacks. I'm thinking of something like sender-ID. Sure, it will be a pain in the ass to work out the details, and people won't trust whoever the central authority happens to be, but what is the alternative? How much longer do mail administrators want to continue dealing with spam consisting of upwards of 90% of their total mail?

Who was stupid enough to fund this nonsense?

[Arrogant-Bastard]

Unbelievably stupid. Or, as Mitch Wagner observed:

• InformationWeek Weblog: Dumb As A Bag Of Hammers

And even he doesn't cover all the problems; for example, as everyone with the slightest clue about spam has known for years, responding to the spammer in any way is absolutely idiotic.

But since the people involved in this company have no anti-spam credentials, no track record of involvement, and no clue how their "counter-attacks" will be neatly retargeted (surely nobody is naive enough to believe that spammers will sit still for this?) I can't say I'm surprised. This is merely the latest bonehead idea in a long series (e.g. challenge-response, callbacks, SPF, etc.) of bonehead ideas put forth by people who have clearly failed to comprehend even the rudimentary aspects of the spam problem...or who have, but simply do not care about the conequences for everyone else as long as they can selfishly "solve" their part of the problem.

I've already blacklisted the company behind this tripe and null-routed their address space. I recommend the same for everyone else. There's simply no place on the Internet for those who want to profit from our collective misery by making it worse.

Re:Who was stupid enough to fund this nonsense?

[InfraRED]

the biggest problem with this may be that it opens yet another attack vector to you

Re:Who was stupid enough to fund this nonsense?

[Q Who]

And even he doesn't cover all the problems; for example, as everyone with the slightest clue about spam has known for years, responding to the spammer in any way is absolutely idiotic.

Really, mr. expert?

I guess when I caused an SMS spammer to stop by spamming their phone back from ICQ accounts, I just dreamed it up, then.

"Slightest clue", "has known for years"... bleh. You go get a clue.

Spam Haters Given Right of Reply

[wljones]

This is an old pattern. The bad guys (Spammers this time) inflict themselves on the public. Authority is asked to help, but cannot or will not do so. Victims then search for their own solutions. Authorities see their monopoly threatened and cry,"Vigilantes!" The authorities, whether government or private concerns, feel they have more to gain protecting their monopoly than by fighting the problem, and victims are an easier target than organized thugs. Notice that their protests against the victims do not offer a better solution, only name-calling and threats.

Re:and what if it says

[DogDaySunrise]

FTA: The plan is to fill order forms on spam websites...

No 'From' header required...!

Same as the

[jurt1235]

1. DOS on spammers proposal: http://it.slashdot.org/article.pl?sid=05/07/18/121 4226&tid=111&tid=1;
2. The, I believe english, innitiative to reply on spam by going to the websites and not buy anything (1/3 of users responds on spam advertising: http://it.slashdot.org/article.pl?sid=05/03/23/238 205&tid=95&tid=111)

Somehow I do not feel like going after these spammers at all, but more for just better working ISPs to disconnect bots of the net, and disconnect spammers of the net.

Re:This is how the world works actually.

[sim82]

No there is a difference.
Spammers misuse a cheap communication medium for unwanted advertising and nothing can stop them. So massive (mis)use of their own reply mechanism (btw. that was exactly what they wanted me to do by sending the spam in the first place) will drive the cost up for them (bandwidth etc.), so in theory at some point their action will be no longer profitable and they will stop.
That's a different story than 'spam them becuse they spammed me'. It's about making spam unprofitable.

I just won't buy anything from them

[hydrino]

What an idea!
Why OH WHY do people buy from them?

Fully justified

[VGR]

I have my doubts about whether this will actually work, but I'm not sure it matters.

I just think getting thousands of complaints should be the natural result of pissing off thousands of people.

The psychopathic behavior of a spammer wouldn't be tolerated for an instant if he were face-to-face with his victims. Try attending a ballet or opera, and yelling "I have cheese in my butt!" at top volume.

Whether it works or not, what Blue Sec is doing should be an expected inconvenience of spamming. Even if it just causes spammers to set up their own filters, at least it will weed out some would-be casual spammers.

Replies

[rbarreira]

(x) Requires immediate total cooperation from everybody at once

What? No it doesn't.

(x) Laws expressly prohibiting it

Couldn't it be called self-defense?

(x) Eternal arms race involved in all filtering approaches
(This time the spammers will be doing the filtering, and that will be quite easy for them.)

Cool! Let THEM start sweating around trying to protect their sites for once. How cool is having a spammer deal with the same kind of shit that they spread around?

(x) Extreme profitability of spam

That doesn't mean this can reduce their profits, which is always good.

(x) Feel-good measures do nothing to solve the problem

That's just an opinion, not a fact, at least in this particular case.

Re:One message != vigilante

[Rick Zeman]

Spamhaus' definition of spam: (the rest of the definition is [here.

The word "Spam" as applied to Email means Unsolicited Bulk Email ("UBE").

Unsolicited means that the Recipient has not granted verifiable permission for the message to be sent. Bulk means that the message is sent as part of a larger collection of messages, all having substantively identical content.
A message is Spam only if it is both Unsolicited and Bulk.

- Unsolicited Email is normal email
(examples: first contact enquiries, job enquiries, sales enquiries)

- Bulk Email is normal email
(examples: subscriber newsletters, customer communications, discussion lists)

Technical Definition of Spam

An electronic message is "spam" IF:

(1) the recipient's personal identity and context are irrelevant because the message is equally applicable to many other potential recipients;

AND

(2) the recipient has not verifiably granted deliberate, explicit, and still-revocable permission for it to be sent.

(The rest of the definition is here.

I call BS on the other spam worker claim.

[PotatoHead]

How exactly is this different from a bunch of people just filling out bogus information?

Answer: It isn't.

If a significant percentage of us, just did this, the spammers would be hurt by rising costs and sharply reduced product value proposition. (leads)

This company is just making that easier.

No harm, no foul.

Unless you are the spammer making money off of shared resources without giving anything back that is...

I hope this works and it catches on. I would use this service in a minute.

Want to cut down your junk mail? Spend a few days each month filling their postage paid envelopes with their competetors offers and other interesting bits you can stuff in there. For those little card things, fill 'em out with crap.

People have done this for years and this spam service is no different than hiring somebody to send crap data for you.

"Other Anti-Spam Workers"?

[Caveman Og]

Sheesh! Slashdot has gotten really lame.

"Other anti-spam workers" is none other than John Levine, Ph.D, co-author of the BEST SELLING INTERNET BOOK OF ALL TIME (I kid you not) "The Internet for Dummies" (Now in its ninth edition). Some of you cretins need to read it.

In Commonwealth of Virginia v. Jeremy Jaynes Dr. Levine served as an expert witness for the prosecution. His testimony helped send Jaynes to prison for nine years.

At the second annual Conference on Email and Spam Levine presented a technical paper on his experiences with greylisting.

Dr. Levine is the chair of the IRTF Anti-Spam Research Group. He's a founding member of the Coalition Against Unsolicited Commercial Email. He runs the Network Abuse Clearinghouse.

"Other Anti-Spam Worker" indeed.

Take a good look at Blue Security's product. I think you'll see that it's little more than an HTTP DDoS tool. BlueSecurity claims that it's okay to DDoS spammers, and that they make very sure that only spammers are DDoS'd (although their careful not to call what they do a DDoS).

I'm given to understand that they moved their hosting to Israel when Verio terminated their service for violations of Verio's acceptable use policy. Verio doesn't allow folks to host denial of service tools on their network (nor will any normal ISP do so).

Someone should ask BlueSecurity about their legal threats against Everyone's Internet for attempting to do the same.

These are not nice people. The only difference between them and the normal crop of script-kiddie miscreants, is that they have found venture capital.

Is it me

[I_redwolf]

Or whenever someone speaks about standing up for themselves or protecting ones self. It amounts to some form of vigilante act or "Oh GEEBUS!! No, thats not the way to handle it!!!" It's in line with modern day cops. Sure, we'll make an attempt to protect you but if someone robs you or tries to physically harm you. The best thing to do is just give them your money or try to run away; the last thing you should do is try and protect yourself.

I'm sorry to all the SpamProtectors out there but you have been ineffective. You've done nothing to protect the people who need it. Your tools are always one step behind. Seemingly asking one to not retaliate should come from the lips of others. Not you, one with vested interest in Spam. If there is no more Spam, there is no more SpamProtector. You will be out of a job and thats what you should be striving for.

Now, i'm not recommended vigilante acts meaning putting a hot orange in ones eye socket or random acts of grotesque violence. However, I see nothing wrong with complaining or disabling a Spam server to protect not only myself but others who aren't able to protect themselves from this problem.

1. The government has continously failed us
2. You the Spam Protector has failed us
3. Everything to date has FAILED.

You then turn around and ask the honest abiding citizens to continue to be run over the coals at the expense of SPAM?

Not today or tomorrow, so you could kiss my ass. The way I see it, the more vigilantes the better. At the very least they have not failed us and have taken the fight right to the spammers doorstep.

They seemingly understand that the only way to win a war, is to fight one. The spamprotectors seemingly remind me of the weapons dealers who play both sides. You're as bad as the spammers.

So; Cheers! To all the vigilantes out there standing up for the little guy and even the not so little guy! You are welcome round these parts anyday.

Re:Legal crimes

[nwbvt]

"To get hit, those companies would have to spam wouldn't they?"

No, you are missing the point. Say Company A sells software. Lets say that for some reason (maybe my company competes with them, maybe I'm a disgruntled former employee or customer, who knows) I don't like Company A. I can just get a spammer to send out a chain of spam emails in the name of Company A. When people receive these emails they get pissed off and launch a counter-offensive. Their website goes down, they lose business, and people lose their jobs for doing nothing wrong other than working for a company that pissed of a creative vigilante.

Passivity does not work on lame spammers

[canuck57]

The plan has been criticised by other anti-spam workers who say it amounts to vigilantism."

Being passive about spam simply does not work. It allows the sending host to continue operation and upstream providers to simply ignore the abuse.

Now if each person who got a spam were to send 30 times as much bytes every minute for 1/2 hour back to the source connection in which the spam arrived it would not take spammers very long before their connection was congested and the upstream provider would close them down.

Having the upstream providers shut down bad systems for a week is not a new concept, just one that needs to be brought back. Call this a collective protest, a collective DoS of a spamer to get their attention.

Re:bullshit!

[PsiPsiStar]

hey didn't invite you to visit the Web site to waste their computer resources. Saying "We were invited, so it's legal" is like saying that being invited to someone's house for dinner makes it 100% okay to show up, shit on the table, punch the other guests in the faces, and then break a few windows on the way out.

These acts are crimes in themselves. Filling out a web form is not.

The point was, replying with a garbage reply is not SPAM because you were invited to the page, explicitly. The spammer was not invited.

If you believe your own arguments, why wouldn't the spam complaints be legal?

The less clear cut their case, the less likely they are to retaliate legally. It would be hard for the government to make absurd business offers by invited parties illegal, no matter how odd the offers are. They can make DDOS attacks stick in court though. Personally, I don't think that replying to spam is illegal in the first place (unless, perhaps, you provide false information), but even if you do break the law, spammers are unlikely to waste money on legal expenses.

Vigellanteism is okay if you can get away with it and noone is physically hurt and no property damaged.

It doesn't go far enough!

[Aldric]

All this does is put them out of business. I want to kick them in the nuts too.

Terrorism

[XAlba]

wait what? "Terrorism" in which no one is physically hurt and no property is damaged? Wouldn't that just be "protesting?"

Threat of force is as valid a form of terrorism as force itself (which is actually secondary - the point of the violence is to induce fear).

The point of terrorism is the use of terror, not necessarily violence, to achieve your aims. The clue's in the word.

Sure it is

[Tom]

It's the natural reaction. When the government or whoever else claims the monopoly on force can't defend the people anymore, they take up the weapons themselves.

Governments the world over have made it very clear that they don't intend to pursue this problem seriously. We know who the spammers are, and yet they still run around free man. It doesn't get more clearer than that.

Re:Sure it is

[pe1chl]

Governments all over the world have more interest in multinational industry and commerce than in the wellbeing of individuals. Look how they keep a biased system like the patent system in place, while they do nothing about the spam problem.

I remember when..

[jcr]

Spammers used to include 800 numbers to place orders for the shit they were selling. I left a couple of truly offensive messages on their answering machines, and one of the assholes actually called me back to complain about it (on my modem line).

Having a real, live spammer on the phone, was highly satisfying... I covered a lot of ground, from his anatomy to his parentage. ;)

-jcr

"Please Spam Me" Registry?

[dettifoss]

I took a look at Blue Security's privacy policy and found this:

"email addresses that Blue Security establishes for you may be published on the Internet, and your designated email addresses will be provided in encrypted form to senders of unsolicited bulk email. In addition, email messages sent to your named email account will be forwarded to other members of the Do-Not-Intrude Registry." (my emphasis)

So it seems to me that not only are these folks distributing a list of email addresses of real people to spammers on request, they're also forwarding any spam destined for any person on their list to all the others - providing a very valuable service to the spammers themselves.

Is this just a cynical attempt to increase spammers' hit rates? Am I just too cynical? Please tell me I'm wrong.

Wow, he, and you, didn't read the site.

[Fordiman]

1) They do not reply directly to the spammers. They first question the company that the spam links to, after checking the distribution of spam to that website versus to others (ie: the worst offenders are targeted).

2) For each user signed up, a honey-pot email account is set up. That email is seeded with your "identity" in places spammers look for addresses. It's bait.

3) For each spam recieved at a honey pot, a complaint is sent to the target company. The upshot of which is that if, like a spamming company, the server takes that honeypot account and says, "Hey, it's real!", the spammer will send out more, recieve more - and bog down the server.

I don't see why this is a bad thing; for one thing, it's the natural evolution based on an environment that contains such systems.

A system that uses "real" addresses to send more "business mail". Etiquette dictates that they send only one unless active business is taking place. Etiquette evolves for a reason. Anyways, these systems, called "spammers" don't take the hint, being mostly automated anyway.

In society, breaking etiquitte is annoying, and if continuous, is dealt with by the society. In human civilization, this is done by the public appointing authority, and insisting that to keep this authority, they take care of the etiquette-breakers. There is no such valid authority on the internet. I suggest there never has to be.

Instead, organizations like this develop as community projects. They can be professional and efficient, because they're also mostly automated, but programmed by those who have a very specific target and intent.

Best way to deal with spammers? Exploit a simple cause-effect relationship between incoming form data and outgoing mail, but never initiate contact. Bait? Sure, but don't initiate. Let them hang themselves.

Which is the point, really. Spammers who don't make it to the top of the list aren't targetted. Spammers who actually remove you from the sender list aren't targetted.

Additionally, the link between spam-collection and target-picking is not automated. It's done by the maintainers of the site, who first ASK the company in question to change their advertising methods away from spam.

As for spoofing your enemy's company, I'm sure they have a way of dealing with that; because there's human interaction before target-picking, these sorts of things can be dealt with.