Getting on Top of Spam Down Under

The Register is reporting that Australia has implemented a new industry code for the regulation of email with respect to spam. From the article: "Under the new code, internet service providers (ISPs) will bear some of the responsibility for helping fight spam. Service providers must offer spam-filtering options to their subscribers and advise them on how to best deal with and report the nuisance mail. ISPs will also be compelled to impose 'reasonable' limits on subscribers' sending email."

Comments

Re:getting on top of the comments page

[rovingeyes]

How about a first post spam filters? May be we don't require law to make slashdot do this...or do we?

Hmm

[Vokbain]

While this is a good idea, I'm surprised most ISPs wouldn't do this anyways. It's a considerable waste of bandwidth, and their best interest to reduce spam.

Re:Hmm

[Bromskloss]

I'm surprised most ISPs wouldn't do this anyways. It's a considerable waste of bandwidth

I'd say the kind of spam filter I'd prefer does not delete any mails, just tags them so I easily can do any filtering I want with them. But oh, I forgot. You don't have to know how to use a computer to use a computer. That is, people could never be bothered with something like that.

Re:Hmm

[arivanov]

Dealing with lusers who have been quarantined costs much more than the actual cost of the uplink bandwidth of a DSL line. In addition to that in an ISP which does not do significant amounts of colocation the overall balance of traffic is towards incoming. As a result extra outgoing traffic is usually outright ignored.

So the economic driver to quarantine Typhoid Marries is simply not there. As a result the Telcos and access ISPs will continue not to care until the rest of the industry (banks, e-commerce, etc) buy enough congress(or MP)critters to force a regulatory regime through.

Personally I am all for the immediately quarantining utility customers on the first SPAM sent out and forcing the mandatory usage of relays. Same for DDOS, so on so fourth. And anyone who does not want to be subjected to this regime should simply pay an extra for not having it.

Re:Hmm

[grasshoppa]

I'd say the kind of spam filter I'd prefer does not delete any mails, just tags them so I easily can do any filtering I want with them. But oh, I forgot. You don't have to know how to use a computer to use a computer. That is, people could never be bothered with something like that.

While elitest, you fail to grasp what the grand parent was saying;

ISPs should be doing this anyway, to save on bandwidth. This has nothing to do with a user. Hell, I'm careful with my email address, and I still get spam.

It can be considered a truth; The probability of any email address recieving spam approaches 1 in direct relation to said address's age.

So your comment really makes no sense. Yes, I tag my spam and filter it on my own. But I also have my mail server setup to check spamhaus so I can *NOT* recieve that mail in the first place.

Re:Hmm

[cayenne8]

I hope there are stipulations for what kind of account you have...

I always go for a business connection at home from my ISP...so I don't have limitations on what servers I can run...etc. While I don't send out a ton of email, I do have a good bit of traffic on my email server....for my business and others. Who is to say what a 'reasonable' email sending limit is? My traffic can get pretty high sometimes, but, I do keep an eye on it to make sure others aren't sending spam through it...

I supposed the majority of people do need hand holding for all this, but, I hope it isn't applicable to the home user with a business acct....or at least an opt out for this ' mandatory' filtering...

Re:Hmm

[Bromskloss]

While elitest, you fail to grasp what the grand parent was saying; ISPs should be doing this anyway, to save on bandwidth.

Yes, I think I understood that. My point was that if they are going to deliver the mail anyway (as I would like them too) they aren't saving any bandwith.

Elitist.. well, whatever you say. It just happens that I think "Oh, they shouldn't be using a computer if they don't know how to fix this or that." when I hear of someone who has some problem with their computer. But I then realise that everyone is supposed to use a computer nowadays, whether they want it or not. It's kind of like it would be if everyone was forced to play their share of tunes on the violin every day, even if they couldn't. Not pleasant for them, and not for people around them either.

Re:Hmm

[Punkrokkr]

I worked at an ISP for a while, we were attempting to implement some sort of spam filtering; yet our biggest problem was giving the users a choice. Why are there spammers? Why is spamming such a lucrative thing to do? Because somewhere there is some moron who wants the spam. That was our problem, we couldn't filter out all the spam because some of our customers wanted the spam. It took a bit for me to wrap my head around that one.

Re:Hmm

[SCHecklerX]

A friend of mine and I are thinking of starting a postini-like business for reliable mail filtering (We've learned a lot about how to do this administering the sendmail infrastructure for a large global company :). A logical set of first companies would be ISPs. They can offset their cost by making it an option users could pay for. They would have control over filtering settings, and for ISPs, users who get forwarded to our anti-spam relays.

Re:Hmm

[Buran]

So you anger the majority of your customers by catering to a tiny majority who are in turn causing others huge problems? I'd say a response of "We do not do that as it is causing problems for our other paying users" would have been appropriate here, along with a page on your website about why you do not and will not knowingly pass spam along.

Re:Hmm

[turbidostato]

"But I also have my mail server setup to check spamhaus so I can *NOT* recieve that mail in the first place."

Then, you know where this road takes you.

Dear Mr grasshoppa, in our fight against spam, side by side with the legal forces and (somehow) following their indications, we have to tell you we're going to shut down all your towards-port-25 traffic. Sorry for the incoveniencies.

Only they won't send the letter, you'll find suddenly because your mailq is steadily growing and no mail is going off.

And among the minority that will pay a bit of attention to it at all, quite a big percentage will be saying "after all, no honest individual has any need for a local MTA; they should be using their ISP's anyway".

Re:Hmm

[Ironsides]

Personally I am all for the immediately quarantining utility customers on the first SPAM sent out and forcing the mandatory usage of relays. Same for DDOS, so on so fourth. And anyone who does not want to be subjected to this regime should simply pay an extra for not having it.

Define SPAM, when coming from one computer. The same can go for a DDoS. My father sends out e-mail messages to a mailing list of well over 50 individuals. That is not SPAM, but to some filters it may look like it. Maybe you suggest looking at the emails that get sent out? Well, we forward SPAM to abuse and phishing addresses. That would block me for trying to help defeat SPAM. I use Bit Torrent, and the ammount of uploading I do may look like a DDoS as well.

Define Spam and DDoS from the sending ISPs point of view where they may only have a few computers doing this and they have to detect it at the FIRST SPAM or at the begining of a DDoS.

Re:Hmm

[emjoi_gently]

Most Australian ISPs do offer antispam protection.
Some want payment for it (which I consider pennypinching), some do it for free, using different methods and policies.

It makes sense for them to do so. It cuts down on traffic, and it makes their customers happier.

Alot of ISPs are doing some port blocking to protect their customers too, often with options to opt out if you have a need.

All good things, IMHO.

ISPS do have a responsibility to protect their customers if they have to tools to do so, despite the rhetoric that always goes around about how it's not up to them. Giving the lazy ISPs a push to provide some of this stuff is a Good Thing.

Re:Hmm

[emjoi_gently]

My ISP recently did this.
Sent out the email, and is going to block ports as of April 1. But you can unblock yourself any time you like via their website.

ISPs, the good ones anyway, don't have to be draconian about this stuff. They can, and do, build in flexibility for people who have special needs.

Re:Hmm

[rtb61]

Actually I take a portion of the spam so I can report it to the proper authorities, so that those individuals, where possible can be pursued and convicted for their crimes. ISP's when they filter spam don't necessarily do anything about reporting the offenders or provide proper data to the authorities so the legal process can be reviewed and updated as necessary.

ISP false positives are also a hassle, you have to go back and check all the spam to make sure email you wont is not being intercepted, hence your not escaping the spam at all, you are just seeing it once a week.

Thunderbird doesn't do a bad job of filtering it and you can sort the spam to more readily check for false positives and of course in Australia there is the added benefit of forwarding it to "reportingspam@acma.gov.au".

Re:Hmm

[edgr]

My ISP just inserts [SPAM] at the start of the subject-line of emails their filter deems to be spam. I've found it quite accurate, so I just set my client to filter all emails like that to my spam folder, and so it doesn't download the contents of the emails, just their headers. It also inserts a header with a spam-likeliness score so you can set the extent to which you filter.

paid spam

[dotpavan]

How would this clash with the pay-for-spamming option by AOL?

Re:paid spam

[HoosierPeschke]

This might actually restrict mail you don't want whereas AOL will allow anyone who gives them money to spam your mailbox. Pretty much if you report nuisance mail they should stop the flow with filters. AOL doesn't care what you want unless you're willing to pay more than the business that wants past AOL's filters.

Agh

[c0dedude]

What a stupid law. Why put enforcement on the ISP's? There aren't that many spammers, the key is to go after them with harsh penalties. The rest will wake up after a few test cases.

Re:Agh

[Tweekster]

Most spammers are already committing multiple felonies as it is that would result in pretty harsh sentances. There is no point in NEW laws that wont be enforced when there are already laws that exist that attack the actual important laws being broken.

Re:Agh

[nickh01uk]

I agree, having worked at an ISP... cracking down on the network operators just tends to lead to spammers migrating more and more frequently to new hosted servers and providers. Spammers find it pretty easy to up-sticks and leave at short notice, and most providers pride themselves on getting new customers up and running fast.

There was a newsletter I caught recently talking about some of the successful prosecutions for spam 'downunder'. It sounds like they are making progress.

The full text of that newsletter is here.

Nick.

Re:Agh

[moranar]

You make it sound like zombie boxes acting as spam servers don't exist. When I checked the server at one of my relatives' firm, I found no less than 300 different pieces of malware (virii, spyware, etc), and the antivirus I installed immediately started detecting spam sent everywhere. No wonder they felt that it was a slow network connection!

Stopping this flow of spam the users don't even know about is best managed by the ISPs, and in their own interest too: the effort to explain to customers this stuff might be balanced by the lessened impact on the ISP's resources: bandwidth, IT personnel, etc. After all, sending automated mail can't have the same impact as waking up your sysadmin at 3 am on a saturday because some idiot is spamming the smtp server down, can it?

Re:Agh

[gurps_npc]

That just means they need to put in smarter controls, rather than none.

For example, you can easily arrange for all accounts to be limited to 50 outgoing email/day unless the person has a valid credit card that gets charged a $1 set up fee, or they receive by regular mail a form, that they must sign and mail back.

The few NON-spammers that send more than 50 out going/day should be either willing to wait for their 51st email per day or pay $1. I can't see anyone except spammers being pissed off about this.

Re:Agh

[Buran]

It's a lot easier to enforce regulations barring ISPs from willingly ignoring spam than it is to find the assholes who are dumping crap into my mailbox every day. You tell me why my bank keeps wanting to give me $20 multiple times a day and who is sending those messages, and cram a wrapped bundle of 20s up his/her ass and send me proof (not a photo, please!) and then I'll believe that this law is stupid.

It would be stupid if enforcement was actually going on. The thing is, there are spammers being busted and I'm still being spammed, so the existing laws that you suggest using are not doing any good. Those are the laws that are stupid.

Re:Agh

[Buran]

They will be enforced. Why? Because legitimate ISPs are easy to find and sue, but spammers aren't. The idea of suing spammers, and not doing anything further, was idiotic in the first place. We need to keep the laws that make spamming a crime -- AND stop allowing ISPs to pretend it's not their problem.

Re:Agh

[Tweekster]

The hell spammers arent easy to find not to mention the companies hiring these assholes to break the law. Trivial to find.

Re:Agh

[Buran]

So my bank hires phishers to try to get me to hand over my account info? So Pfizer hires spammers to sell its medications without a prescription? So Microsoft and Adobe and Symantec hire spammers to sell OEM bundle-only CDs?

The hell spammers are easy to find.

Hmm...

[jamesgamble]

So the law states that ISPs have to give consumers a choice on their spam protection. Does the law mention anything about if the ISPs can charge the customer for that option?

Re:Hmm...

[CrankyOldBastard]

Great point. I got an email from DoDo (my ISP) the other day, where they offered to add SPAM tags to my e-mails for a small monthly fee.

Now I can't see how routing ALL mail through spam-assasin so it gets tagged actually costs anything extra and above 4 or 5 people doing this. So I've come to the conclusion that DoDo sees this ruling as a great way to make money from spam, and and they have NO committment to cutting down spam going through the network.

DoDo charges a monthly fee plus data charges after a certain amount of usage. These fees are capped at different levels based on plan. So IF clients are getting spam to their machines, then DoDo earns more money.

If only I could find an ISP with a clue that charges a realistic fee I'd be away from DoDo so fast.

A recent report showed that spam (mass unwanted email) now accounts for three-quarters of all email traffic, up from 40% in 2003. In addition to the amount of spam, viruses are most commonly known to be transferred via email. They attach themselves to emails sent from other computers with viruses, and quickly spread out to thousands, even hundreds of thousands of users.

Because of the large increase in spam and viruses, Dodo has implemented 2 new systems, Spam Filters and Virus Filters. The new Spam Filter will mark any commonly known spam emails delivered to your individual mailbox with a [SPAM] tag at the front. The Virus Filter will tag any commonly known viruses with a [VIRUS] tag that are delivered to your individual mailbox.

If you are interested in having spam or virus filters setup on your mailbox, for just $1.90 per filter per month or $2.50 for both, please enter account management and select the Mail/Web tab then follow the steps displayed.

I find this rather immoral - I fail to see why every mail isn't scanned and tagged for virus.

Re:Hmm...

[sinewalker]

This is a great point, but I think it's open, since this is not a law, it's a code-of-practice.

An ISP cannot be convicted for failure to comply with a code-of-practice. The worst that might happen is that said ISP would not be able to say “We comply with the Australian ISP code-of-practice regarding SPAM protection”.

The ISP may suffer financially since it doesn't have that tick-box feature, so the cost/benefit of implementing the Code could be weighed against the percieved risk of customer disenchantment through not implementing it.

Summary: market preasure would probably drive adoption without needing to charge end-customers. Though whether the risk of customer attrition is real or not would probably only surface from customer feedback, so this is all conjecture (of course, this is /. ;-) The alternative (ISP offers a spam-filtering service for a fee) would need to be weighed against the percieved market for this service.

Re:Hmm...

[techno-vampire]

I find this rather immoral - I fail to see why every mail isn't scanned and tagged for virus.

Especially as there are ISPs here in the USofA who already do that at no additional charge.

Re:getting on top of the comments page

[dotpavan]

ha! getting on top of comments page? but you wont get noticed because your score wouold drop to 0 and less and no moron would dare to read comments below 1.

Oh shit, did I just do that?

Hows does it define SPAM ?

[DrSkwid]

Anyone got a link to the *actual* legislation ?

Re:Hows does it define SPAM ?

[Tweekster]

That is easy to define: unsolicited bulk email...(this includes political spam too) How much is bulk. well I doubt any normal user is sending out 50 messages a second to friends that may not be expecting an email (technically unsolicited) If it is a legit mailing list, it isnt unsolicited. If you are emailing a friend from college, it isnt bulk. I wish more ISPs would filter port 25 outgoing (with a reasonable way to get unblocked for those 2 users that need it) and rate limit the mail. That would stop the zombie problem dead. But for some reason ISPs refuse to do those things (and no it wont cause problems for 99% of the users on the planet) a few customers might have problems, however exceptions can be made easily enough, a ISPs are doing that already.

Re:Hows does it define SPAM ?

[tpgp]

Anyone got a link to the *actual* legislation ?

Here you go (pdf warning)

It's not legislation, but a code of practice (a sort of howto follow the legislation). from the linked pdf:

means commercial electronic messages that:
          (a) are unsolicited within the meaning of section 16
                  of the Act; or
          (b) do not include accurate sender information as
                  required by section 17 of the Act; or
          (c) do not contain a functional unsubscribe facility
                  as required by section 18 of the Act.'

I'll dig up the 2003 legislation, but you will be sorely dissapointed when I do, as our lying, Saddam-conspiring, refugee hating, spamming bastard of a prime minister is a spammer himself

Re:Hows does it define SPAM ?

[slowbad]

Anyone got a link to the *actual* legislation ?

Because the 2003 anti-spam code was so totally effective to reduce all spam, let's have another.

Re:Hows does it define SPAM ?

[tpgp]

means commercial electronic messages that: [emphasis mine]

Here's the legislation - and a link to the rather more helpful plain english explanation of what constitutes a commercial message

Quoting it:

EXAMPLES OF COMMERCIAL ELECTRONIC MESSAGES
The following are common examples of electronic messages which are likely to be considered a commercial electronic message:
* offers of stock-market options, credit and mortgage arrangements;
* offers of computer goods including software and hardware;
* promotions of pharmaceutical and health-related products;
* promotions of sales at markets, shops or warehouses;
* sale of franchises or business ventures;
* advertisements for restaurants, exhibitions or trades services;
* promotions of pornographic websites or services; and
      advance fee or Nigerian scam2 emails, get-rich-quick schemes and gambling services.
*
EXAMPLES OF ELECTRONIC MESSAGES THAT MAY NOT HAVE A COMMERCIAL PURPOSE
The following are examples of electronic messages which are not likely to be considered commercial electronic messages:
* community-focussed messages, for example, about the closure of local riding and walking tracks;
* surveys, for example, collecting statistics about the use of public services and utilities; and
* newsletters, for example, providing updates about matters of interest to the local community.

Nuisance messages such as those containing viruses may also not have a commercial purpose and may not be considered to be spam.

Messages of these types however may be subject to separate Australian legislation.

So... if you're a marketing company (doing a survey), a church, political party or charity, feel free to spam whomever you choose - in Australia, or abroad, the government wont touch you.

Re:getting on top of the comments page

[athakur999]

Brilliant!

"No post shall be made until another post has been made first."

I predict the end of all Slashdot troll posts!

Those Aussies...

[nathan s]

...have some bizarre fetishes.

Re:Those Aussies...

[se7en11]

I'm sadden to admit my mind is also in the gutter today...

Re:Those Aussies...

[pedalman]

Tell me more of this female you refer to as Spam.

ISP

[u16084]

I run a tiny web host biz (150 or so domains) .. Our Clients INSIST on spam filtering.. We're not an ISP... I could say "Heres Spam Assasin" deal with it, but, it doesnt work in the real world. We have to deal with the spam. Why would anyaone give out their primary email address on a form anyways? Let the Yahoos,gmails,and hotmails deal with it. (no?)

Re:ISP

[Khyber]

Let the Yahoos,gmails,and hotmails deal with it.

No, because quite a few services plain and simple do not accept free email accounts for registration or other things.

Re:ISP

[hedwards]

Personally, I still have my first email address from circa 1997. I have used it for a number of years on forms and I am sure that a google search would find numerous listings.

Right now I get approxamtely 10-15 spam messages a day. That is without any sort of blocking and is on the high end of what I generally get.

Surprisingly the majority of spam actually goes away if you unsubscribe from it at the bottom. I used to get 1500-2000 spam messages a week until I started unsubscribing.

I am currently trying out http://www.bluesecurity.com/ to see if that improves things even further.

Re:ISP

[scum-e-bag]

Surprisingly the majority of spam actually goes away if you unsubscribe from it at the bottom. I used to get 1500-2000 spam messages a week until I started unsubscribing.

Suprisingly it didn't do that for me. The best method I know of is to forward all my mailboxes into gmail and let that filter do its work.

Unimpressed.

[tpgp]

Colour me unimpressed - the Prime Minister of this country (John Howard) phone spammed the continent prior to the last election, then paid his smug looking son to spam the nation.

Anyway, back on topic, here's an article from a local paper - it contains a link to the actual code of practice (pdf warning)

Re:Unimpressed.

[sholden]

Are you just using random words for fun? Or did his son spam people in Australian territories that aren't part of the Australian continent (which is more likely with email than phones I guess)...

Re:Unimpressed.

[tpgp]

Are you just using random words for fun?

I describe a continent-nation as a continent and a nation - and thats random?

I hearby apoligize for failing to realise that other nations are themselves not continent-nations and failing to modify my post to reflect sensitivities of non-australian readers. (yeesh)

Re:Unimpressed.

[Kadmos]

It seems that netharbour.com.au is no longer operating.
The domain name does not resolve and ASIC lists the company as deregistered.

Extracted from ASIC's database at AEST 11:06:40 on 29/03/2006
Name NET HARBOUR PTY LIMITED
ACN 106 807 201
ABN 20 106 807 201
Type Australian Proprietary Company, Limited By Shares
Registration Date 24/10/2003
Next Review Date 24/10/2006
Status Deregistered Date Deregistered &nbsp08/01/2006
Locality of Registered Office not available
Jurisdiction Australian Securities & Investments Commission

21/10/2005 022477426 1 6010 Application For Voluntary Deregistration of a Company

Re:Unimpressed.

[sholden]

There were no sentitivities. And I'm not non-australian.

I just wondered if there was a reason for using the two words or if it was just random (ie. you could have used them in the other order with no change to your intended meaning).

Re:Unimpressed.

[idlemachine]

> It seems that netharbour.com.au is no longer operating.

Such a shame. Johnnie was so proud of his son being "one of those willing to make a go" of a new Aussie business (I'm guessing in comparison to the rest of us lazy bastards who're only too willing to suckle dependent on the government teat).

If I was cynical, I'd assume it was just another nepotistic scam... Thankfully, Howard's never done anything before to make us doubt his sincerity...

*sigh*

Should be running already

[fak3r]

Why wouldn't they have this running already? It would reduce wasted bandwith, and make users happier. ISPs should do their best, and let users know in case some crappy 'joke' fwd'd to 100s didn't get through. My suggestions: Graylisting Mailscanner ClamAV Bitdefender Spamassassin DCC checks This will help reduce things CONSIDERABLY - again, if I can do it at home, why can't an ISP have a dedicated FreeBSD box (or two) that just handle this step, and then pass it on IF it passes?

Re:Should be running already

[dodobh]

The good ISPs already have dedicated boxes. Lots of them. The ones who run SA have about 8 times as many dedicated boxes as the ones who purely block based on DNSBLs (IME).

ISPs _can't_ afford to run filters generally. If you want to run SA or other content filters, you should be doing those at the end user nodes, and not at the central hubs. Content filters work after the fact of accepting the email, at which point the only reasonable responses are to discard the spam silently, or generate a bounce.

I was under the impression...

[irimi_00]

That United States spam laws are working really well. I was going to say why bash on the ISP's and just have tough criminal/civil penalties. I seldom get spam I have to sort through.

On the other hand these stats are interesting:
http://www.ciphertrust.com/resources/statistics/

They tell me a few things.

1. Don't use citibank.
2. We're not doing as well as it seems to me

Re:I was under the impression...

[Phroggy]

That United States spam laws are working really well. I was going to say why bash on the ISP's and just have tough criminal/civil penalties. I seldom get spam I have to sort through.

I'd have to say you've been under a false impression. I run a very small mail server at home for family and friends, and it blocks thousands of spams every week. With my own mailbox, an average of about four spams a day make it through all my filters without getting blocked - certainly better than it used to be, but that's because I've set up more complex filtering, not because of anything the government has done.

Re:I was under the impression...

[PigIronBob]

Yeah, but what do United States spam laws have to do with Australian ISPs, unless something horrible happened overnight.

It's appreciated, but...

[Weaselmancer]

It's another token effort.

internet service providers (ISPs) will bear some of the responsibility for helping fight spam.

Some is not all, which means that any percentage they block meets the requirement. If they delete one, and pass 1000 - that fits the definition of some.

ISPs will also be compelled to impose 'reasonable' limits on subscribers' sending email.

Do any spammers use their own account for outbound spam?

Re:It's appreciated, but...

[Red Flayer]

"'ISPs will also be compelled to impose 'reasonable' limits on subscribers' sending email.'
Do any spammers use their own account for outbound spam?"

No, but how many people unwittingly have a zombie machine in their home? If their zombie status affects their ability to send the email they intend to send, you can bet they'll take action to correct the problem.

Re:It's appreciated, but...

[RosenSama]

I guess everyone has different desires as far as the tradeoff between /dev/null'ing false positives and letting spam through, but I don't want my ISP doing any filtering of my content. If they want to tag it to help me identify it, OK. But otherwise I want to retain control of what makes it to me and what doesn't.

Re:It's appreciated, but...

[Vellmont]

Some is not all, which means that any percentage they block meets the requirement. If they delete one, and pass 1000 - that fits the definition of some.


Lawyers may be evil, but they're not idiots. If there's a law that says the have to offer spam filtering, you can bet that that means it actually has to be somewhat effective. The means to filter out 99% of spam is available, and relatively cheap. Any sane judge when given a spam filtering scheme that removes only 1 out of 1000 spam mails is going to say that it's not an honest effort at a filtering scheme.

easy solution

[misfit815]

I saw an article elsewhere on /. about wrong numbers directed to someone's cell phone (in essence, accidental phone spam). A few days ago, I saw a print article on the difficults an admin at a school corp. has with students' use of school computers, and that he routinely blocks 150 or so sites a week.

These are all related issues with one simple solution - implement a "deny by default" rule. Deny all communications except what is permitted. Given the option, I'd have all phone calls from number other than what's in my built-in phonebook routed to voice mail. I would block all email other than what's sent from my list of 'approved senders'. And in the admin's case, I'd block all internet access except what's specifically permitted.

Why don't people do this?

Re:easy solution

[zpeterz63]

People don't do this because of exactly the same reason that you suggest that they should. If, as a network administrator (or God forbid an ISP), I block all but the Internet traffic I'm sure is good, the upkeep that I would have to do in order to enable all traffic that people want/need is going to be horrendous. Not to mention the fact that people are likely to be more upset about not being able to access something that they need access to then getting a bit of extra spam...I know I would.

Re:easy solution

[trazom28]

Some do that - it's called a whitelist. Anyone in your whitelist goes to your inbox, anyone not in your whitelist goes into the bulk/trash.

Re:easy solution

[misfit815]

I disagree. Sure, if you're an ISP, you've got no business doing that. But if you run a private firm (I'm *not* thinking Fortune 500 here) or especially a school district, where you can be much more draconian, then by all means do it. Even better, a home environment. I use WEP, disable DHCP, and deny by default at home - makes it a lot easier on me.

As far as the Day 1 deluge, you can always grab the logs for the last day/week/whatever and use that for your initial filter (with some eyeballing for pr0n and such).

Why not implement SPF?

[trazom28]

SPF assumes all email to be spam unless proven otherwise.. seems to reduce it by the ton from what I've seen. We should have more implementation of this.

Re:Why not implement SPF?

[Bromskloss]

(-- this comment has not yet been proved to be non-spam and is therefore not visible to you --)

psst.. because people want to communicate sometimes also.

Re:Why not implement SPF?

[trazom28]

(-- this comment has not yet been proved to be non-spam and is therefore not visible to you --)

psst.. because people want to communicate sometimes also.

----------

If you implement it correctly, they can.. the kicker is lazy admins who won't fix their own side of things correctly, so their traffic bounces. Read up on it.

Re:Why not implement SPF?

[Bromskloss]

Read up on it.

Ok, I will. Oups, gotta go. Incoming SPF! Gah, I'm no spam I'm tellin ya! Get off me!!!

Documents and Articles

[Slashdotgirl]

The Following links are as follows:

Spam and internet security information http://www.acma.gov.au/ACMAINTER:STANDARD::pc=PC_2 008 web page

Spam Act Review: http://www.acma.gov.au/acmainterwr/telcomm/industr y_codes/codes/iia%20spam%20code%20dec%202005.pdf

Spam Review http://www.dcita.gov.au/ie/spam_home/spam_act_revi ew2 documents.

Knock yourselves outwith it.

Regards

Slashdotgirl

Don't use Citibank?

[XanC]

While there may be plenty of other reasons not to use Citibank, I don't think this is one of them. You'd let the bad guys pick your bank for you?

I think the real lesson is not to be an idiot about emails from "the bank".

Spam regions

[whois_drek]

I can see where the Aussies would have a pretty bad spam problem; most spam is already focused on the Down Under regions.

I had hesitated...

[nathan s]

...to press submit, but figured I might as well live a little.

YES, WORLD, MY MIND IS IN THE GUTTER!;-)

hear, hear

[XanC]

SPF, I think, is a great idea. And it can be implemented gradually. The receiving server doesn't have to simply drop messages without SPF; that's just one input to that decision.

As more and more people put SPF into their DNS, the punishment for a message not having it can increase. In turn, then, more and more people put SPF into their DNS.

Let's get the ball rolling!

http://en.wikipedia.org/wiki/Sender_Policy_Framewo rk

What gives?

[Khammurabi]

The title of the article is "Getting on Top of Spam Down Under," and I haven't even seen one v1@grA joke yet.

Better yet, profile your customer's habits.

[khasim]

Your customers will usually send out the same amount of email every day. If it's within their regular levels, don't worry about it.

But when they suddenly start sending 100 emails a second, to 100 different address, it's time to shut them down and email/call them to see if they meant to do that.

Scanning outbound email can be a problem. I send virus tests to servers and I would not like an ISP stopping that.

The same with scanning for "spam" because I also send spam examples to lists and other people.

For me, the best approach would be for all companies (ISP's or otherwise) hosting email services to limit outgoing email to 100/minute or something and automatically blocking accounts that have a huge change in the amount of their outgoing email.

It's never going to happen, but that's the approach I'd take.

Re:Better yet, profile your customer's habits.

[Architect_sasyr]

I send virus tests to servers and I would not like an ISP stopping that.

Ah, that's what we call it now :)

Having never ran an ISP I can't comment too tightly on this, but in broader terms, filtering spam for my company is a bitch. The problem is, of course, that automated programs (such as spamassassin, which I use personally), just don't cut it on a grander scale. I have seen 11 year old kids with hotmail address' that are more random than the 90% of the spam addresses that we get [by default, I recommend blocking hotmail, and then allowing a select number of emails through to your secondary filters]

Now, the problem arises when you start filtering your emails on keywords. Take the recent "bank" worms that (at least here in aus) we started to get, "National Australia Bank" and "Westpac" were just two of them. We thought we could do the right thing, and save ourselves some time, so we just set these to be automatically deleted on detection... BAD MOVE. We find out later that at least two high level director's in the company had accounts with these people, and were liasing with customer support people on the inside. Do you see the problem here? You can profile your customers habits only so much, and (in the case of 300+ users) it becomes innefficinet to continually update and check these profiles (even with automation).

The onus shouldn't be on the ISP to do the filtering, as this would cost them a lot more than it does now just to consume the bandwidth...

Besides I happen to think the price for those "ultra allure pheremones" is pretty cheap, now all I need is someone else's credit card...

Re:Better yet, profile your customer's habits.

[Buran]

Bad move? So you acted to protect the majority of your users and two people complained so that makes it a bad move? If it's only two people out of 300 users that complained about it, you helped 298 people. Those that actually do want the emails can be exempted from the filter if they request it, but filtering spam by default is what I'd expect from my mailserver, and it's up to me to act if I actually want to receive mail that is perfectly legitimately normally caught by spam filters.

GOOD MOVE.

Re:Better yet, profile your customer's habits.

[Architect_sasyr]

Well paid. I do see your point, but think that something was lost in translation.

The bad move was the fact that it was deleted rather than caught and filtered. Other than that, I agree with you.

So give them their own line.

[khasim]

Dealing with lusers who have been quarantined costs much more than the actual cost of the uplink bandwidth of a DSL line.

Yep. It all comes down to money.

Personally I am all for the immediately quarantining utility customers on the first SPAM sent out and forcing the mandatory usage of relays.

I agree on the relays.

What I don't understand is why the ISP's don't do SOME degree of spam checking and dump the offending customers onto their own email server?

Okay, I know why BellSouth doesn't do that. They send out a lot of spam.

But other ISP's. If you're just going to buy more bandwidth, at least be sensible and put the problem children on their own server with their own, tiny, pipe and keep the big, fast pipes for your good customers.

It had to be done.

[HUADPE]

Your government advocates a

(x) technical (x) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
(x) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(x) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(x) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(x) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
(x) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(x) Sending email should be free
(x) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(x) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid government for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Hi! I'm a firewall!

[Big_Al_B]

Perhaps you've heard of me? I'm pretty popular!

By default I block all inbound IP connections, "except what's spefically permitted."

AOL/Goodmail is NOT "paid spam"

[billstewart]

There are serious problems with AOL's use of GoodMail, but "paid spam" isn't one of them. Goodmail has fairly reasonable anti-spamming policies, and charges enough per message as well as their big upfront deposit. They're designed for commercial email senders that people actually do want to subscribe to - customer support mail for products, banks emailing customers, and that sort of thing. Some of it's junky mail, but it's junky mail you subscribe to, and unsubscribe have to work or the sender gets spanked.

The big problem is a combination of three things:

• Goodmail is only useful for commercial mailing lists - it's not useful for people who aren't making money, whether that's non-profits or open-source developer lists or political grass-roots organizing or groups of friends or whatever, and
• by whitelisting Goodmail customers, AOL can turn up the screws on other high-volume email, which is bad for spammers but also causes collateral more damage to other legitimate mailing lists.
• AOL isn't providing a mechanism for people to choose whether to reject more of the non-GoodMail or not - they're just saying that the Goodmail is good.

From a social standpoint, the collateral damage is focused on non-commercial groups. I remember the days when almost any civic or recreational group typically charged a membership fee of $20-30/year, which covered printing and postage on a dead-tree newsletter. It'd be really annoying to have to go back to those days - for $20/year you can get yourself a real email provider instead of AOL :-) (You can also get free email from Yahoo, Gmail, etc., but of course the Goodmail folks and their competitors are trying to sell to them too...)

Laws hit ISPs because Foreign Spammers ignore them

[billstewart]

The reason to make laws telling ISPs to fix the problem is because laws telling spammers not to spam at best would only stop domestic spammers, not foreign spammers. So if Australia actually wrote an effective anti-spammer law, it would push Aussie spammers offshore (or get them to spam Americans and leave spamming Aussies to us and the Chinese.) Of course, the politicians haven't written an effective anti-spam law, and it's not clear that such a thing is possible, so they're dealing with their previous failures by telling somebody else to fix the problems, and the ISPs are the other people who've got some ability to do it.

If they write laws that are too draconian, they'll break all the Aussie email providers and ISPs, and you'll will be stuck using Telstra to reach email providers in the US or Hong Kong - and Linux users probably won't be able to run their own email at home unless UUCP slides by the rules...

Bad law

[Mr. Freeman]

"ISPs will also be compelled to impose 'reasonable' limits on subscribers' sending email"
Of course, if you want to exceed the "reasonable limit" of 2 messages per day, you must pay $30/month.

Also, a lot of ISP's spam filters suck. I have earthlink service and I get no less than 14 spam emails per day. that makes me quite reluctant to try their other "services" such as "scam blocker".

Re:Bad law

[emjoi_gently]

... which is of course a deliberate misreading of what is intended.

Re:Bad law

[techno-vampire]

Also, a lot of ISP's spam filters suck. I have earthlink service and I get no less than 14 spam emails per day. that makes me quite reluctant to try their other "services" such as "scam blocker".

I see: Earthlink's spam blocker sucks because it doesn't catch everything. I've been using it for years, and I'd say it catches between 70 and 90% of all spam thrown at it. In all that time, I've never found a false positive. Finally, I was satisfied it was doing its job properly and told it not to save the spam for examination. It's not perfect, some still gets through, but it does cut down the quantity. I'm very happy with it because, unlike you, I don't have unreasonable expectations.

Really bad idea...

[Kazoo the Clown]

And will contribute further to the unreliability of email. False positives are much worse than spam, but just try to convince spamfiltering ISPs of that...

"Getting on Top of Spam Down Under"

[SeaFox]

Hey, that sounds like the title of a spam message I recieved recently.

Re:Hi! I'm a firewall!

[misfit815]

I'd be willing to bet the number of firewalls that are configured to allow by default exceeds the number of firewalls that are configured to deny by default by about 5 to 1. At least.

I'm not talking about ports, but about source/destination of traffic. Of course, everybody's going to restrict to 80, 443, etc. But then you let in /. over port 80 and look what happens anyway.

You've misunderstood SPF

[billstewart]

SPF doesn't assume that mail is spam by default - it's a forgery-reduction tool, and assumes that forged mail is probably spam or otherwise unwanted.

• More specifically, it assumes that mail from specific domains comes from specific IP addresses, and gives the owners of the domain ways to communicate those addresses.
• If mail purporting to be from a given SPF-using domain comes from the wrong IP address, you can presume that it's forged and reject it.
• You *could* decide to reject all email from domains that don't use SPF, but that'd be pretty foolish, given the low takeup of SPF so far.
• Many spammers started advertising SPF information for their domains - that lets you be sure that email claiming to be from Nigerian-Herbal-Viagra.com is the genuine article!

Re:You've misunderstood SPF

[trazom28]

You are correct - I was going for the high level interpretation. The majority of spam I see coming through for our users is spoofed addressing, which the implementation of SPF has reduced significantly. The spammers that *do* have things entered correctly are kindly putting on a sign that says "Here I am!" and can be dealt with accordingly.

Btw.. you left something out...it's Nigerian-Herbal-Viagra-Enlargement.com :-D

The big Phishing targets aren't using SPF :-(

[billstewart]

Unfortunately, the big phishing targets don't appear to be running SPF - eBay, PayPal, Chase Manhattan, e-Gold, etc., and unless they do, it won't have a lot of influence on spam. SPF can't stop all the possible abuses - somebody can still register names similar to the real ones (remember paypa1.com, with a digit 1 instead of lower-case L in the name?), and even give them SPF records - but at least it would be possible to block a lot of the junk. But if *they* don't adopt SPF, or DKIM, or PGP signatures, or S/MIME signatures, then they're not much help. Any ideas on how to reach clueful people at those companies to get them on board?

Re:The big Phishing targets aren't using SPF :-(

[XanC]

One would think that PayPal / Amazon would be scrambling to implement something like this. I know if I were in their shoes, I'd be livid that these scammers are using my good name to steal from my customers. But they don't actually seem to care very much... Maybe it's like free advertising.

Filtering where I work is easy.

[khasim]

We have an old GroupWise 5.5ep system. But I have it sending through an app called Guinevere that runs SpamAssassin and the anti-virus apps. Guinevere hands off to Exim4 running on Debian.

Exim4 runs greylisting, checks open relay lists, etc. If everything passes there, it hands off to Guinevere which runs anti-virus then SpamAssassin (with Bayes) to flag anything suspicious.

Prior to that, 8 out of 10 messages would be spam.
Now, less than 1 out of 10 messages is spam.

I prefer Exim4 because I can put my phone number right in the error message that our server kicks back. I only block during SMTP receipt. Everything that I accept, I deliver. I might deliver it with a SPAM tag, but it gets delivered.

I get about 1 call a week from someone who's blocked or has problems. Usually it's because their server is incorrectly configured or they're using their ISP's email server and their ISP is on multiple blacklists for spamming (BellSouth is a prime offender there).

In the past month, we've received 2,005 messages that were flagged as "spam". I'm sure that many of those were legit ads from reputable companies.

We've also sent out 14,960 messages. So our incoming spam is even a fraction of our outgoing email.

We've received 29,594 messages that same month.

I cannot recommend Exim4, greylisting and SpamAssassin highly enough.

Re:Hi! I'm a firewall!

[Big_Al_B]

The following list is by no stretch exhaustive but hits many of the major enterprise level vendors available today. I'm primarily a router/switch guy, not firewall guru, but my experience reflects the same info I got from a couple quick googles:

Checkpoint:
Default deny "any" where "any" is a configurable list that by default actually omits some popular types of traffic. Yuck...just...yuck. Still, most services are in the "any" list.

Cisco (by far the largest market share):
Pix-OS based? Default deny external to internal. Fine.
IOS-based? Default deny external to internal. Fine.

Fortinet FortiOS(all platforms):
Default deny external to internal. Fine.

Juniper/Netscreen:
Default deny external to internal. Fine.

So you must be talking about SOHO broadband router and/or host-based software firewalls. Woe is the mail server admin who hides behind those.

Re:Laws hit ISPs because Foreign Spammers ignore t

[Kadmos]

Can you elaborate on how you think the ant-spam laws are ineffective?

As far as I can tell the laws have had quite a good effect, apparently spammers have either stopped, or have moved overseas: http://www.spamhaus.org/news.lasso?article=154, and http://www.spamhaus.org/news.lasso?article=161

All we need now is a law against fax spamming so that Dell and getawaysdownunder.com.au stop using my equipment and resources for their own marketing campaign.

Privacy implications

[clockwise_music]

What I am surprised by is that no-one has noticed section 8.1:

"ISPs directly responsible for the allocation of IP addresses to their subscribers (eg, all of them) will use all reasonable efforts to retain information pertaining to those allocations for a minimum period of seven days."

Can someone tell me what this has got to do with spam? Isn't this just a case of our privacy being thrown out the window but disguising it within a "spam act"?

How to reduce SPAM in 4 steps

[jonwil]

1.ISPs need to filter or block port 25 by default unless someone specifically requests it unblocked. Or, failing that, detect zombified machines and block those.
2.ISPs need to implement good email based virus scanning (email is a major attack vector for viruses & trojans including spam zombies)
3.ISPs need to implement SPF. SPF wont stop spam but it will make it easier to detect if email claiming to be from fraud@paypal.com is really from paypal.com or if email from asdgtrqwrdasfsd@hotmail.com is really from hotmail.com (and therefore if there is a legit account associated with the address and if the sender of the email owns that account)
4.Governments need to introduce penalties for any provider that knowingly provides hosting (web, email or whatever) to a sender of unsolicited bulk email.

Re:How to reduce SPAM in 4 steps

[jonwil]

Simple answer is to give people wanting to run a mailserver (and not wanting to have mail go from their server to the ISPs SMTP server) a static IP in a subnet that can be routed differently (I have done most of the training for a Cisco CCNA so I know it can be done without a huge amount of work in the router configs). Or even if not that, just blanket block port 25 and tell people that they can forward email through the ISPs SMTP server or they can buy a "business package" that includes static IP or they can have the ISP host their mailserver.

Or even just identifying zombified customers and giving them some kind of assistance to get rid of the sombies would help.

As for SPF, what SPF allows you to do is to identify that the SMTP server it was sent by (e.g. mail.paypal.com) is allowed to send mail for the domain the email claims to come from (e.g. @paypal.com). Nothing more. What that gives you is a way to mark email comming from mail servers other than those permitted to relay for the domain (especially for domains that are high fraud targets e.g. paypal.com) as possibly suspicious.

SPF wont stop SPAM and I never said it would. What it gives you is a way to look for messages that might not be from who they claim to be from and mark them as possibly suspicious. (hotmail already does this and I think its good)

Re:Laws hit ISPs because Foreign Spammers ignore t

[billstewart]

Sure, they've killed a few spammers who deserved it, and good for them! And they've chased a few others overseas, so they have to rent servers behind the Great Firewall of China or use zombies to send their dreck or even spend a few hundred dollars to start a corporation in the US or Panama or whatever so the AU government thinks they're foreigners and so their assets are harder to steal. But most of them can still operate, and thousands more spammers are waiting to take their place on the top 200 list. Perhaps Aussies are less interested in Nigerian Herbal Viagra than the rest of the world and spammers targeting them need to develop other products to separate fools from their money, and most of the phishing spam probably needs to target Australian bank customers instead of trying to get Australians to give out information on their US bank accounts, but that probably just means that you're less interested in the spam you get.

But until the economics of the spamming game change significantly, the stuff won't go away, and the economics include the facts that worldwide communication is nearly free, worldwide money transfer is convenient, at least from modern Western economies, and suckers are born every minute.

Re:Hi! I'm a firewall!

[misfit815]

You're misunderstanding me. It's not the firewall, it's the loose screw behind the keyboard that's using it. Firewalls, just like any other electronic appliance, are generally capable of doing their job AS LONG AS THEY'RE CONFIGURED PROPERLY. Of the homes and businesses with which I've been familiar enough in the past 5 years or so, I'd say 5% of homes, 10% of small businesses, and 20% of large businesses are setting their firewalls to "deny by default". And yes, I'm pulling those figures out of my anal orifice - it's just personal observation over the years.

Re:Hi! I'm a firewall!

[Big_Al_B]

I think we're talking past each other. To me, "configured by default," means the device comes from the factory with that behavior configured. To you, it apparently means, "a rule administrators deliberately configure to handle types of traffic that aren't specifically handled by other rules."

By default most firewalls deny all inbound traffic on an external interface and allow all outbound traffic that originated on an internal interface. Adminisitrators usually have to "break" their configurations to allow inbound from the outside "by default"--and, yes, this happens. I don't know that I'd say 80% are broken, but many are.

What about this for a SPAM control??

[smothepeanut]

After looking through a few possible anti-spam plans the best I can see is chargin people to send emails. I don't really know how to administer it but if you charge a small amount, say 1c for each email. This wouldn't really effect the average user but to the people that spam sending thousands/millions it would become ecomically impossible to continue sending it?? I know the idea isn't perfect but it would have an immediate effect on the amount of spam. Let me know what you think. Cheers

Re:Hi! I'm a firewall!

[misfit815]

Keep in mind that I'm talking about source/destination blocking, not port blocking. Sure, ports are blocked by default, and most people leave it that way. I'm talking about blocking by IP or DNS mask. How many home users realistically deny by default when it comes to addresses? Personally, I think that ought to be the approach to a lot of communications - email, web, IM, phones, even cable channels! Deny by default, then let in what you want.

J

The only solution is a technical solution

[LinuxDon]

They need to redesign the e-mail protocol, as it seems to allow insufficient control to block spam.
Some clever people need to sit down together and invent something new and future-proof, since the e-mail protocol as it exists has had it's best time. The anti-spam battle can go on forever until it's technically impossible to keep sending spam.
The whole spam filtering stuff is just hogging down e-mail servers, it's like fixing a leak by putting a bucket underneath it.

The best solution would be some opensource e-mail/instant messaging/VOIP/file exchange/blog integrated solution. It would fix many problems at the same time!

Re:Hi! I'm a firewall!

[Big_Al_B]

Keep in mind that I'm talking about source/destination blocking, not port blocking.

Er, default "deny all" rules do block by IP, not by port. The only times the firewall would look at the transport or higher layers are:

1) When there are existing entrie in its session table for internally initiated sessions that would expect return traffic. For that it would match transport layer ports and src/dst IP addrs to table entries.

2) There are exception rules superceding the default behavior. Then each packet must be inspected at layer 4 or higher to see if exceptions apply.

3) If NPAT one-to-many overloading is configured, such that every packet's layer three and four headers are updated according NPAT table entries.

How many home users realistically deny by default when it comes to addresses?

If they don't mess up their default configurations, then "many". But who knows? Home users aren't the demographic of this article.

Personally, I think that ought to be the approach to a lot of communications - email, web, IM, phones, even cable channels!

What a PITA that would be. Doesn't scale, breaks more stuff than it fixes, and generally just ugly conceptually. But to each their own...

It really doesn't have to be done.

[ladadadada]

I don't know about you but I don't find this funny anymore. It might have something to do with only one of the points actually being valid with respect to this article and even that one's only a "maybe".

In case you hadn't noticed, the government isn't actually advocating any particular approach but simply saying that you must take some approach to fighting spam or we'll fine you big time.

All this code has really done is to create a big stick that the government can use to whack ISPs who harbour spammers or who make it easy for spammers to operate. I'm sure this will improve the situation somewhat but three quarters of Australian ISPs will already comply with this code today, before it is enforced and the others are probably the small players. The market place demands that ISPs have spam filtering and virus scanning. Not sending out devices in default configuration is just common sense. Common sense is now legally mandated.