Spam is Dead

Vainglorious Coward writes "Two years on from Bill Gates' promise to eradicate spam, an article in The Observer claims that spam has passed its peak and is now declining. Is it just me that hasn't noticed this?" I got almost a third more spam in 05 than 04. I guess I exist outside the bell curve on this one.

Comments

Oh Please

[GmAz]

As soon as 2006 hit, my gmail account started getting spam. I have gotten 7 today alone. Argh.

Re:Oh Please

[GmAz]

But considering that I only use this e-mail account for family, its quite amazing. I have another account for online purchases and other online stuff. I used to have an account that I quit using because of hundreds a day. I left it be for about 6 months and I had over 55,000 unread messages when I closed it. Good 'ol yahoo mail.

Centralized Email

[(1 -sqrt(5))*(2**-1)]

The problem with the micropayment- or trusted-sender-model seems to be: What stops someone from setting up pop3 cum sendmail and ignoring the illicit contract?

Gates and co. would have to have an effective monopoly on email traffic for that to work. (Which might have been conceivable before the advent of Gmail, by the way.)

Re:Centralized Email

[Phat_Tony]

Here's how I assume micro-payments work: You come out with a standardized system for handling micropayments- that is an open, say, xml format so that any micropayment applications can talk to each other. Then any company that wants to handle micropayments (Paypal, Yahoo, Citibank, Fred's Bargain Micropayments, etc.) starts selling them. When you (your email app working automatically, or whatever) buy a micropayment, it comes with a tag saying how much it's for, who sold it, and what it's record number is. These get attached in the standard micropayment format as an attachment to an otherwise normal email record. The recipient computer's email program then goes and establishes a secure connection with the person who sold the micropayment and makes sure it really exists and is for the right amount. Of course, maybe Fred's Bargain Micropayments is an illegitamate vendor who exists only to facilitate spam and will "confirm" payments but never give you the money. This is why your email client will automatically go get lists online of known, valid micropayment vendors.

Who will maintain these lists? Anyone. Google? Consumer Reports? will they be free, or require micropayments or subscription fees to access, or be ad supported? Who cares, markets competition will work it out between vendors and consumers. At any rate, the basic system is sound, and does not necessarily require any sort of vendor lock-in to work.

To the user, all you have to do is set up your email client with the secure server(s) providing lists of valid micro-payment and email-insurance vendors (or use whatever defaults it comes with), and then tell your client how much money you require (reject, or move to SPAM folder, all messages that don't come with a payment or insurance policy of over $0.015) or whatever. Then say you get a piece of marketing mail you don't want insured at $0.02. Your computer checks the micropayment insurance vendor list and finds the vendor specified is valid, then it goes to the vendor and finds that the listed payment is valid, so the message goes in your inbox. You look at it, you decide it's spam, you click the "get insurance payment" button in your email client, and it goes and retrieves the $.02 and puts it in your account. The spammer who sent it will then see that you collected their payment, and either decide it's worth $0.02 to them to get stuff to you, or else take your name off their list so you don't collect any more of their micro-payment insurance policies.

Maybe not declining, but simply changing

[chriss]

My spam peaked early 2004 with about 30,000 mails per stuffing not only my inbox, but also my DSL connection. I had a "catch all" option on several dozen domains and most of the spam I received was addressed to non existing mail boxes. Due to my local spam filters very efficient handling of the problem I only started to worry about the situation when downloading all the spam started to take hours and my provider complained about the daily traffic.

The problem with the non existent mail addresses became a large one sometimes in 2003, when enough people had some kind of spam filtering that deflected most of the usual spam. I guess that sometime in 2004 even the last catch all rules have been disabled, so that today simply guessing email addresses will gain nothing for the spammer.

So maybe spam has not really peaked, but there are simply different waves of spam techniques. Some of them rely on mass, others on tricking the filters. We may simply be in a "smart spam phase". A lot of the spam that reaches me today shows the message as a picture instead of text and I have not yet figured out why thunderbird will display those pictures, since I disabled this.

But the article is right in spam becoming something like a background noise. I still have to manually mark about 100 mails per day as spam, but I got very fast in recognizing it and it only takes a few seconds. I'm always astonished if I meet friends whose email address have not been public for more than a decade and who are very annoyed if one or to mails per week pass their spam filter. To me it is like complaining about banner ads. It's just an unavoidable part of the internet ecosystem, like mosquitos.

Chriss

--
memomo.net - brush up your German, French, Spanish or Italian - online and free

Re:Someone Forgot To Tell The Spammers

[Threni]

> You are opening yourself up to massive spam if you make so much as a single post
> there

I post to Usenet all the time, using an unobfuscated email address and I don't get any spam, so either what you're saying is no longer true, or gmail's spam protection kicks ass!

really?

[Phil Urich]

My own gmail account remains Free and Clear; I actually got one spam message ever on it, and I've had it for quite awhile now (and get quite a few e-mails and even subscribe to a few yahoo groups via it). And it's not like my e-mail address is that obscure, just my own first name followed by two other letters (and then the @gmail.com, naturally). The same could be said of my ISP e-mail address, or my university e-mail, or my hotmail/msn address, or even better my yahoo mail address which I fling around willy-nilly to sign up for things or whatnot whenver they require an e-mail address. And yet none of those e-mail addresses, all of which (except for my Uni one) I use astonishingly frequently and throw around all over the place, get any spam. Whatsoever. None. Except for that one gmail one (which ruined my perfect record, grr).

Note, also, that I turned off spam protection in hotmail, turned it off in yahoo mail, have none for my ISP one or my Uni one (both would only mark e-mail as spam instead of blocking it anyways, so I would know), and etc. Considering how high the signal-to-noise ration is, the possibility for false-positives understandibly outweighs the miniscule spam concerns I would have.

So what the hell am I doing right that most people seem to be doing wrong?

First off, none of my addresses are entirely intuitive or plain. No numbers even, nothing other than pure letters, but nothing that would show up unmodified in a wordlist or namelist (not even with good ol' "two random letters at the end of the string"). My sister has a gmail address of the same length as mine, but gets literally hundreds of spam messages every single day. The difference is that hers is her last name, while mine is my first name with two letters from my last; so hers is likely to show up in wordlists. That seems to be the kicker.

Meanwhile, my yahoo address seems to attest to the idea that signing up for things online won't get you spam, BUT the things I sign up for are message boards at places like BeyondUnreal.com or the official The Trews webboard or maybe to view some newpaper online (for those amnesiac days that I don't remember about BugMeNot). So nothing particularily sketchy.

In other words, as long as a person is relatively smart about how they handle their e-mail, they should be fine, 'tis my theory. This theory is not without major flaws, though, I'll admit. And furthermore, sometimes a person just wants a specific e-mail address, and it sucks then that it might just doom them to spam.

And further going down the questionable route of using my own personal experience as a scientific study, seeing as I had no spam until that one message, it would look something like this, starting arbitrarily in 2000:

2000 - 0%
2001 - 0%
2002 - 0%
2003 - 0%
2004 - 0%
2005 - 100% OMFG 2005 IS TEH SPAM APOCALYPSE
2006 - 0% (so far...)

So, in other words, I can prove anyone right. Parent? Sure, spam has
increased DRAMATICALLY in the last while. Naysayers? Bah, spam isn't
a problem! Etc. Ah, subjectivity.

Re:really?

[fingusernames]

So what? Your steps to avoid spam don't disprove that it is a massive problem, or that it is worsening or lessening.

I have had the exact same email address since 1990. It is just three letters long, and is plastered all over the place on Usenet from the 90s, various old web pages, mailing list subscription lists from before they were confidential. I receive about 1300 spam messages per day on average, every day. And that is AFTER the MTA (Postfix) eliminates a lot of spam through DNS blacklists, RFC and RDNS compliance checking, and so on. I'll be doing greylisting next.

I also help to run the mail system of an ISP. Spam and viruses, by far, are most of the email these days. By far.

Spam is a horrible disease on the Internet. It increases the cost to everybody, in bandwidth, the cost of staff at ISPs battling it, and in end-user time wasted on it.

Larry

Re:Spam is dead for me.

[nwbvt]

"We're switching 3 big companies from Exchange to gmail."

Unless you work for Google (in which case you should have mentioned it before you started this thread) that is almost certainly a violation of their Terms of Use.

How Lucky You Are To Get Mail In English

[patio11]

I keep three email boxes -- work (also has my old college address forwarding to it, for business/professional/family use only), gmail (general use, except I give all US-based or English-using websites this address), and yahoo Japan (general use, except I give all Japan-based websites this address). I get zero spam at work in my inbox because the address is non-published, and all of the spam comes to my university address where it gets munched by Spamassassin and spat out by Thunderbird. I've never gotten a single spam at gmail in a year of using it. Yahoo, despite everyone telling me "Their filtering is great, gets almost as much as Google", is *buried* in spam every time I open it, all very sickeningly spammy content in Japanese (can you imagine an email saying, in plain text, "Local girls want to meet you tonight to have SEX! Join our matching site, only $10 a month!" getting through your spam filter in this day and age? Thats what all my spam looks like -- they don't even bother trying to obfuscate.) I can only assume that this is because yahoo and Thunderbird's content analysis breaks down on Japanese... probably for lack of a decent segmenter for languages which aren't written with whitespace. Someday I've got to take a look at Thunderbird's filtering and see if I can't improve it a little bit. I work at a technology incubator in Japan and when they say, "Hey, patio11, got any ideas for what you would do if we gave you a lot of money?" I've got a pretty good idea :

1) Take Spamassassin
2) Make it work in Japanese
3) ???
4) Profit.