BlackFrog to Take up BlueFrog's Flag

Runefox writes "ZDNet UK has a story about a new SPAM defense mechanism called BlackFrog, a response to the demise of Blue Security's BlueFrog. According to the article, the new service is based on a P2P network of clients, called the 'Frognet', which allows the opt-out service to continue functioning even after a server has gone down, making a DDoS attack like that which crippled BlueFrog ineffective against the new service."

Comments

Link

[Anonymous Coward]

Link to the project website.

Re:Link

[Instine]

On visiting the homepage. Just how much spam do you think nathan@okopipi.org gets? Or is this bait?

eitherway I see some BIG problems coming their way, not least, secure distribution of the software. Looks like they've announced this way to soon. Fingers crossed they manage to get a release out and distributed to the masses before their site falls to the enemy

Re:Link

[WhiplashII]

To get the same effect in a perfectly legal and unstoppable way, alter Mozilla and other email clients so that when you click on the junk button it automatically goes and fills out form, etc - without accessing a separate server. That way, they get a response from each person solicited or spammed (prefectly reasonable) and they have to sort through the responses to find the ones that fell for the scam.

Many people will say that if you do this the spammers will know your address. My response: 1) they obviously already know your address, and 2) if everyone does it, it won't help that they know your address. The point is not to make you personally get less spam, the point is to eliminate spam as an easy option for criminals.

Re:Link

[Smidge204]

1) they obviously already know your address

Maybe, maybe not. They have your e-mail in a list somewhere, but they don't know if it's still valid. Sending a real response proves that it IS valid and IS checked actively, which increases its value when sold to advertisers or sold/traded to other spammers.

NOT replying puts a little "?" on the message, because they know the address is probably still valid (didn't bounce) but there was no reply (maybe nobody checks it)?

I think the better solution would be to send forged bounce errors back to the sender in hopes that they'll think the e-mail is dead, and remove it from their list.
=Smidge=

Re:Link

[DavidTC]

Spammers stopped caring if addresses were valid about four years ago.

Re:Link

[Tim Browse]

To get the same effect in a perfectly legal and unstoppable way, alter Mozilla and other email clients so that when you click on the junk button it automatically goes and fills out form, etc

Then the spammers will start adding captchas to their opt-out pages.

Oh, the irony.

Re:Link

[gbjbaanb]

Then you want Mailwasher, which has used the 'bounce spam as if the address is invalid' for years. I doubt it has helped, but you never know.. layers of defence and all that.

Re:Link

[RedToad]

Then the spammers will start adding captchas to their opt-out pages.

Let's catch up with recent history, and learn from it, huh? Fact is, during Blue Frog campaigns, spamvertized sites adopted two counter-measures.

1. captcha on every feedback, contact-us, order or any other form on the site
2. detection of incoming blue frog IP addresses and adding them to their firewall's blocking filter

The captcha really slowed down their ordering rate, creating a barrier to business. Few sites left them in place, because it hit the wallet.

The IP filtering cost time and time is money - another hit in the wallet. Some of the incoming IP addresses turned out to be large proxy sites! Plus, the concept of sending out invitations to visit coupled with blocking visits seemed to them to be, shall we say, counter-productive. Wallets could be kept bulging by removing the invitations at source - cleaning out all the blue frog addresses from the invitation list. Hey, come to think of it, wasn't that what the Blue group was asking for too? Hmm, maybe it was working after all . . . we can't have that!

Poisonous frogs?

[RingDev]

How long until some hacker poisons the peer system into spamming a legitimate site?

-Rick

Re:Poisonous frogs?

[Paran]

FTA:
Participants will send reports of spam emails to Okopipi, which will use "handlers", including dedicated servers, to analyse it. To avoid suffering the same fate as Blue Security, Okopipi's staff will not disclose information about its servers.

Sounds like the same idea as Blue Security, only they're hiding. Probably will result in the same outcome. Massive DDoS on their "hidden" servers.

Re:Poisonous frogs?

[iminplaya]

...Okopipi's staff will not disclose information about its servers.

Aahhh...the old security throught obscurity trick, eh? Should work as well as the cone of silence.

Re:Poisonous frogs?

[lhorn]

That's the whole point of an analysis before sending opt-out messages from all members. I am not familiar with Black Frog intended function, but if a certain percentage of their members gets similar messages it's a fair bet it is spam. A FrogHerder must look at the message to ensure it is sufficently spammy, before action - this may even be legal somewhere in the world.

Re:Poisonous frogs?

[mapkinase]

You did not get it.

Spammer changes "gett v1agar naw" to "visit momandpopshop at omgponies.com" in their spamail message and hits the same "Spam" button.

momandpopshop ponies got "we hate ponies", feel somewhat offended and report to authorities, "color-of-the-day" frog get busted and a corollary to the Murphy's Law says that it will be busted before any spammer.

Re:Poisonous frogs?

[Starwanderer]

A problem with this is that spam isn't about content, but rather consent. It's not the content of any particular message that makes it spam, but rather it hinges simply on whether the sender has your permission to send to your email address. If someone willingly signs up for male enlargement product emails, or mortgage refi emails, or anything else for that matter, they aren't spam. How would a FrogHerder know just by looking at the message?

Re:Poisonous frogs?

[mybootorg]

I think it might be helpful for you to go back and read up on what Blue Frog was initially about. Their FAQ is undoubtedly cached somewhere. Many of the people posting here -- and nearly all of the media in past weeks -- have missed the point entirely. Because of the deliciously newsworthy "angle" of using spam vs. spam, most reporters have molded Frog to fit that news story, but not to represent what it actually was.

Blue Frog didn't automatically focus on every Spam that was submitted. It focused on the ones where it could do the most good. To be specfic, the developers would identify Spam that had been submitted to the most Frog members and originating from Spam networks that were not in compliance with the Blue Frog opt-out list.

Then the developers would visit the page and develop a script/bot that would submit opt-out requests using the E-Commerce or "For More Information" forms on the website.

Give this, I think it's pretty unlikely that someone would get hit by accident, dont you agree? Frog was never a completely automatic process. It required intervention and that's a good thing.

Blue Frog won because it was systematically beating the big spammers into submission, one spammer at a time.

Really?

[bsdluvr]

I bet this was totally unexpected here ;-)

Social internet?

[Anonymous Coward]

"Social" internet might not sound that great, but at least it has some great advantages like this (I dont consider file sharing an advantage, but fighting against SPAM is).

Slashdot sucks.....

[Anonymous Coward]

Try Digg instead

seems insecure

[robinesque]

Sounds sort of insecure for a project like this to be openly editable to the public via a wiki and p2p network.

Re:seems insecure

[Anonymous Coward]

No. no, no... haven't you heard? There is no scenario in the universe where open source is anything but the best possible choice.

Re:seems insecure

[MarkByers]

Sounds sort of insecure for a project like this to be openly editable to the public via a wiki and p2p network.

The P2P network will almost certainly include some sort of authentication system so that peers cannot fake messages from other peers. A voting system means that the number of 'bad' peers must be very high to cause any damage to the network as a whole. The system will have to be able to identify the bad peers and remove them from the network as soon as possible. A difficult challenge, but given that the spammers have 1000s of machines in botnets, it will be essential to be able to detect them quickly.

good idea

[Amouth]

just too bad that someone couldn't get this into the BlueFrog stuff before it died.. atleast then they would have a large userbase.. but if the Blue peps are the ones that look at the e-mails to make sure someone isn't being evil and submitting normal HAM - how is that going to work without master to authorize the clients???

Re:good idea

[JayClements]

I didn't get ANY spam while BlueFrog was being ddosed.

Re:good idea

[Amouth]

nomy question is more to the fact that what is to prevent someone from exploting this system and using it to spam or DOS a legit place.. with Blue you had a central server that was the only one that could authorize clients to send messages where this thing seems like it would just listen to it's peers..

Once you go black, you never go back.

[DigDuality]

Just as a correction folks, it's not called "Black Frog" this is a mix up. There was two projects. Black Frog and Okopipi aiming for the same goal. Black Frog stopped and the people joined Okopipi.

Re:Once you go black, you never go back.

[Anonymous Coward]

I suppose the phrase "Once you go Okopipi, you never go back" just doesn't have the same ring to it, does it?

Re:Once you go black, you never go back.

[Thwomp]

No doubt it's a name inspired from the Nintendo school of marketing.

Re:Once you go black, you never go back.

[Linker3000]

You kinda beat me to to it - I was wondering whether Okpipi runs on Wii to help piss all over the spammers?

Re:Once you go black, you never go back.

[gbjbaanb]

I'd say the BlackFrog name is much more appropriate to keep the tradition (and advertising brand name) the BlueFrog guys started.

besides, surely BlackFrog is much easier to make icons for... assuming the BlueFrog resources are OSS too. Got knows what an okopipi is anyway.

Re:Once you go black, you never go back.

[DigDuality]

an Okopipi is a poisonous blue frog.

Re:Once you go black, you never go back.

[gbjbaanb]

an Okopipi is a poisonous blue frog.

*now* you tell me, after I posted my ignorance on slashdot for all to see. Geeks around the world are openly laughing at me, secretly thankful that they didn't post earlier :-)

Re:Once you go black, you never go back.

[Infoport]

A little more info: Dendrobates azureus is the blue poison arrow frog of Suriname
http://www.atlantabotanicalgarden.org/conservation /amphibian_research.html

One interesting note from the WikiPedia article (couldn't find it elsewhere right now), is that the frog does not make any poison of its own but instead gets poison from insects which it eats. Seemed like an interesting tie-in for a P2P project.
http://en.wikipedia.org/wiki/Dendrobates_azureus

source from bluefrog?

[Janek Kozicki]

I hope that people from bluefrog will release source of their utility. This new initiative could surely benefit from their sourcecode.

Re:source from bluefrog?

[DigDuality]

BlueFrog was open sourced and under the mozilla license, and yes they have the source code.

Re:source from bluefrog?

[Spy der Mann]

We *DO* have the sourcecode. Read the google discussions. But it seems (I haven't read the code yet, so don't trust me much on this) from one of the group participants that Blue Frog is a hollow client, it just executes scripts sent by the server (no wonder Blue Sec wanted us to uninstall).

Spamming the spammers?

[ScouseMouse]

Hmm, wont it be amusing for user's PCs to be spamming as part of an hidden botnet and running this at the same time. Hope their not on dialup.

Re:Spamming the spammers?

[forghy]

The goal is to spam the spammer *sponsors*, not the spammers themselves. This is the exact reason why the blue frog was so successfull.
Once you receive a mail advertizing pills or wrist ornaments , the Blue/Black frog client sends an opt-out message to the advertized mailbox.
Let say this online shop sends a million spam messages by means of a spammer, he (the shop owner) receveives 1 million opt-out messages back !


Days are counted for the spammers ! MUahAhahAHhaHAh

Re:Spamming the spammers?

[ScouseMouse]

Ah this makes more sense now.

Must go away and read the original bluefrog article again.

Actually i wouldnt count on the days of spammers being numbered.
The sneaky little bugg@rs have been getting round new antu-spam systems for years, and the more unscrupulous will start doing things like providing opt out locations that look different when you view then. (IE, providing two links, a link thats invisible for the anti spam engine to chew on, and one that isnt that may be obfuscated in some way)

Unfortunately just like pond scum, once its got a presence, its practically impossible to get rid of it without major work.

Re:Spamming the spammers?

[Anonymous Coward]

he (the shop owner) receveives 1 million opt-out messages back !

I was pretty sure those opt-out forms just went into a black hole anyway. Sounds useless. I would rather flood them with fake orders. That would jam up their way of making money and force them to stop.

SpamCannibal

[Anonymous Coward]

I think one of the most genial spamtools is SpamCannibal
http://www.spamcannibal.org/cannibal.cgi

OMG vigilantes

[giorgiofr]

I can imagine the slew of whiners who will complain about such a vigilante approach to this problem.
Well, remember Firefox, "We're taking back the web"? That's exactly what we're doing here. It's the only strategy that's going to work. Bitching and moaning won't get you a clean mailbox. Taking spammers down will.
If you disagree with fighting fire with fire, I suggest you also criticize any and all law enforcement activities. They're simply state-sponsored vigilantes.

Re:OMG vigilantes

[joe 155]

couldn't we just send the spammers a sony music cd? That rootkit would take out their computers at the source instead of just spamming them

Re:OMG vigilantes

[capt.Hij]

Just remember this post when your local subnet gets knocked out when this new thing and some titan of a spammer start slamming each other and happen to be near you. I believe there is an old African proverb about what happens when two elephants fight that is appropriate here.

Re:OMG vigilantes

[giorgiofr]

So, uhm, we should keep quiet and hope no one notices us? Maybe squeek a bit?

Re:OMG vigilantes

[Anonymous Coward]

I prefer "Those who want to live, let them fight, and those who do not want to fight in this world of eternal struggle do not deserve to live.".

Re:OMG vigilantes

[op12]

If it's a recent Sony music CD, you're going to have a hard time convincing them to put it in their computers as they'll likely be thinking, "Why do I want to listen to this garbage?"

Re:OMG vigilantes

[Mant]

Well, remember Firefox, "We're taking back the web"? That's exactly what we're doing here.

I like Firefox and all, but I really don't see the connection between having a choice over your web browser and launching DoS attacks on possible spammers.

If you disagree with fighting fire with fire, I suggest you also criticize any and all law enforcement activities. They're simply state-sponsored vigilantes.

Once they are state sponsored, they rather stop being vigilantes. They also (hopefully) are held accountable, have their actions limited and open to scrutiny and oversight.

Even by Slashdot standards that is a terrible straw man.

Re:OMG vigilantes

[da cog]

> If you disagree with fighting fire with fire, I suggest you also criticize any and all law enforcement activities. They're simply state-
> sponsored vigilantes.

Actually, in any reasonable democracy law enforcement is more like "state-sponsered vigilantes, with an independent court system designed to prevent them from accidently screwing over the innocent in their zealous quest for justice."

Re:OMG vigilantes

[whyrat]

I think we should solve this with a two tier internet!

One "slow" tier would be for all the people who actually reply to spam (thus giving the spammers money) or get their computers infected with bots and fail to clean them.

The other "fast" tier would be for poeple who know better than to click on everything in their email box and instead delete the spam / trojans.

Re:OMG vigilantes

[99BottlesOfBeerInMyF]

That's exactly what we're doing here. It's the only strategy that's going to work. Bitching and moaning won't get you a clean mailbox. Taking spammers down will.

And you think this is going to work? First, there is little or nothing stopping abuse of this system. I can compromise a machine and send out piles of offensive spam for my competitor, and the system will then fire what amounts to a DoS attack at him. Second, This sort of an attack can be filtered out by ISPs now (on premium accounts) and that capability is trickling down and becoming more and more available. This sort of vigilante crap is a poorly thought out, not quite solution.

If you disagree with fighting fire with fire...

Umm, I usually prefer to use a fire extinguisher. Otherwise, my house burns down.

...I suggest you also criticize any and all law enforcement activities.

Lets see, a official government operating with rules and oversight within the law, versus vigilantes with no oversight that may or may not be worse than the problem they claim to be solving. I think I'll stick with the former.

If I tell a vigilante some guy beat up my mother they might go out and beat him up. Great. Unless, of course I made it up to get him beaten up. If I tell the police someone beat me up, they go and arrest him. Then, if there is enough evidence, they are convicted and punished. Great, unless there is not enough evidence. Which is better? Is it better that some criminals go free or that innocents are punished? The US legal system says the former, and I concur. It is a greater harm to punish the innocent than to not punish the guilty.

Re:OMG vigilantes

[Anonymous Coward]

It's the only strategy that's going to work. Bitching and moaning won't get you a clean mailbox. Taking spammers down will.

Taking spammers down may feel good, but it's not necessarily any more effective than bitching and moaning (which can also make you feel better, and a lot less work). Sorry, although I don't disagree with the general idea, this part is unjustified optimism. Spammers are like mosquitoes; you can slap and slap, you can spray poisons until it knocks you unconscious, but really the best you can hope for is to keep them (relatively) under control most of the time.

Re:OMG vigilantes

[The Master Control P]

Spammers are like mosquitoes; you can slap and slap, you can spray poisons until it knocks you unconscious, but really the best you can hope for is to keep them (relatively) under control most of the time.

Mosquitos and malaria were under control before the world stopped using DDT. Now, malaria is back with a vengeance. I'll take the risk if I get to go out spraying electronic-DDT.

well, speaking from experience

[rucs_hack]

I've been using ODF for spreadsheets and a novel for some time now. The novel has over 400 pages, and I haven't noticed any difference since I switched from the word doc format to ODF, well, other then really liking ODF as a format to work with.

Well, except that I no longer have to worry about only being able to edit my document safely in one editor, on one platform, that's a pretty big issue for me, huge even.

There's no way I'll ever use a microsoft editor again, just because I know they'll never willingly support other formats for the good of the consumer. Ok they *may* add support for ODF, but they wouldn't have if Mass' hadn't pushed them into a corner. That attitude is worrying, it speaks volumes about their trustworthyness. I wouldn't put it past them to somehow add an extension which meant my previously cross platform document 'accidentally' wasn't quite so cross platform/editor any more.

Re:well, speaking from experience

[hjf]

dude, that was so lame... you tried to make a fp and clicked on the wrong article. LOL!

Re:well, speaking from experience

[Anonymous Coward]

But are you writing spam? Or just lost?

Blue Security's reason for shutting down

[Paran]

I thought the reason Blue Security closed shop was because the spammers had diff'd their user database, identified quite a large amount of the participants, and then threatened virus attacks directed at them. Not because of the DDoS.

Blue Security Gives up the Fight
The spammer also sent another message: Cease operations or Blue Security customers will soon find themselves targeted with virus-filled attacks.
...
"It's clear to us that [quitting] would be the only thing to prevent a full-scale cyber-war that we just don't have the authority to start," Reshef said. "Our users never signed up for this kind of thing."

I'm guessing the only real difference is that users will know this time around.

Re:Blue Security's reason for shutting down

[mikael_j]

You're getting things mixed up, I think most users were quite willing to get involved in the cyber-war, the problem was that the company didn't have the resources to fight it.

I'll probably sign up for this blackfrog thing once I've checked it out. In fact, I'd probably consider giving money to someone collecting money to pay someone else to beat the shit out of the world's top spammers. I'm serious, they're scum..

/Mikael

Re:Blue Security's reason for shutting down

[Have Blue]

It's not that the company didn't have the resources to fight it (although it's true that they didn't), it's that it was causing so much collateral damage. Once the spammer had taken down the primary BlueSecurity site, he took down the third-party site hosting the blog on which BlueSecurity's response to the first takedown was posted, and showed every sign of being ready to take down any other site that overtly supported BlueSecurity. Faced with the choice of shutting down or being indirectly responsible for a DDoS epidemic of unpredictable but probably massive proportions, they shut down.

Re:Blue Security's reason for shutting down

[gbjbaanb]

Frankly, they should have let the spammers go for it then. If you give in to Terrorists, you can only expect more terror in the future. Or so all the western governments seem to keep telling us as they send in the special forces.

If the spammer took out a public enough target, the authorities would have had to get involved. BlueSecurity wasn't doing anything illegal (or even immoral - they only filled in the webform once for each email a user received.) so its a pity they were hounded out.

Re:Blue Security's reason for shutting down

[abirdman]

If the spammer took out a public enough target, the authorities would have had to get involved.

The spammer took out several public targets-- the Blue Security site and the LiveJournal blogger site, as well as the ISP which hosted them last. The authorities aren't going to do anything. The "good guys" in this case are a scrappy web software company in Israel. The "bad guys" are contract "advertisers" for some (probably shady but not proven so) corporations who clog up the internet with crap. Most of "the authorities" can't even seem to figure out what's happened, to say nothing of acting on it. The "authorities" pretty much depend on corporations to define good guys, bad guys, and bad actions. This model doesn't work in this case.

It's sad, and I keep wondering why the FBI isn't investigating the blatant blackmail sent by the spammer(s) to try and intimidate Blue Security users, especially when it was followed by an obvious and admitted DDoS attack on servers, including the LiveJournal site. For me, the whole flap was enough to get me to install and use the program. It allowed me to empty my Yahoo bulk mail inbox (it only holds 30 days of spam, and it hovers between 2500 and 4000 messages all the time), but that wasn't enough. Maybe this new initiative will work. I will check it out. Spam sucks and makes the internet a much worse place to be. I applaud and support anyone who attempts to do anything about it. And I always feel bad when the bad guys win.

Automatically clicks Unsubscribe links in Spam?

[Robmonster]

From their wiki:-

Okopipi will automatically click the "opt-out" or "unsubscribe" links contained within the emails and/or report the spam to the appropriate authorities.

I thought that it was generally a bad idea to click unsub or opt-out links in Spam messages since it only server to prove they have a valid email address and the receipient actually reads Spam messages.

Re:Automatically clicks Unsubscribe links in Spam?

[Anonymous Coward]

Your right, but if everyone does it then they will be flooded :)

Re:Automatically clicks Unsubscribe links in Spam?

[mengel]

Well, if you are trying to find spammers, and get more excuses to slam their websites, etc. then you want to click the unsubscribe links. The more spam they send you, the more they get slammed in response. Also, if this Black Frog stuff keeps track of this stuff, as part of the system, you then collect evidence of them sending you stuff even after you unsubscribed, which could be used to prosecute them in court as well as pounding their servers into the ground.

So it makes sense for a system like this to do it, because it wants to get the spammers to send it stuff, so it can punish the people who hired the spammers.

Re:Automatically clicks Unsubscribe links in Spam?

[dnixon112]

A legitimate concern, but with the Blue Frog system at least, the way this was handled was that the system did not identify which email address was clicking the links. All the "clicking" was done by the Blue Security servers, it just added up to one opt-out/unsubscribe click per spam message sent.

Re:Automatically clicks Unsubscribe links in Spam?

[Beryllium Sphere(tm)]

It would be horribly logical for a spammer to supply an "opt-out" link which was an exploit for a browser bug, installing a remote access Trojan.

Has anyone heard of that actually happening?

Re:Automatically clicks Unsubscribe links in Spam?

[drinkypoo]

If the links are put together by someone who is not a total fucking moron, the link either has the email address encoded within it, or it is a unique token that links to a specific email address. Either way, following the opt-out link will indeed confirm that the address was deliverable. Unless these guys are just generating web traffic to the same server but a wholly different URL, preferably not even accessing the server by name but by IP... Which I doubt.

Re:Automatically clicks Unsubscribe links in Spam?

[compro01]

generally i've found that most of the unsubscribe addresses don't even work. i tried it on one of my spare email accounts and tried mailing some of the unsubscribe addresses. 15 out of 20 of them returned "delivery status notifacation : failure" messages.

Re:Automatically clicks Unsubscribe links in Spam?

[Spy der Mann]

If the website does NOT comply with unsubscribe links (this is why we're going to use SPAM honeypots :) ), we'll use the frogs. This is what Security did, IIRC.

Excuse me, but

[paulxnuke]

isn't this really good botnet vs bad botnet? (With good being defined as "opt-in"?)

The more successful it is, the more the Internet will be too bogged down to be useful to anybody.

Also, if someone programs the botnet's to evolve to attack each other better, we're talking SkyNet right around the corner.

Re:Excuse me, but

[Anonymous Coward]

If SkyNet becomes a reality, we've got a lot more then spam to worry about!

Re:Excuse me, but

[mybootorg]

Excuse me. Me neither Blue Frog, not Black Frog are a botnet -- at least in a sense that the bots are using their combined strength to somehow attack or interupt the normal business of a server or network. If you think this is the case, then you are misinformed -- which isn't your fault, because the press has largely gotten it wrong as well. Please read up.

Re:Excuse me, but

[Billosaur]

isn't this really good botnet vs bad botnet?

More like Autobots vs Decepticons, but in the end it's the same thing. The "good" forces won't be a botnet per se, but a loosely aligned group of people doing the same thing, taking on a group with coordinated resources capable of wreaking terrible havok. It's vigilantism to be sure, but until the government of the world actually get their heads out of their butts and come up with a unified and mutually beneficial set of laws to deal with spammers wherever they live, this is the only tool anyone has to even try and slow the spammers down.

Re:Excuse me, but

[paulxnuke]

If one defines "DOS" as "attack or interupt[sic] the normal business of a server or network", BlueFrog certainly did. They injected bad data rather than saturating routers and they weren't big enough to bring the servers down, but that's hair splitting. DOS adequately describes their attack except maybe for network security guys trying to defend against it.

Given that:

• The Russian interests that killed Blue Frog used a DDOS (almost certainly coming from a botnet);
• *Frog has always been based on a DOS against spammers (Blue Frog admittedly was not a botnet);
• Black Frog wants to use a P2P network (euphemistically called a "frognet") to distribute their DOS over a bunch of user machines, using hidden servers for control;

I stand by my analysis. It pretty exactly describes what is going on.

It will be interesting to see how a many-to-many DDOS plays out.

Re:Excuse me, but

[Anonymous Coward]

Yeah, but with the continued expansion of botnets being used by spammers, how long till the net bogs down under their weight alone? Every year the amount of spam and generally useless data being spewed onto the web by these people increases in leaps and bounds. Can we really afford to simply lay back and take it for fear of the side effect of fighting back?

Re:Excuse me, but

[whyrat]

I, for one, welcome our new botnet overlords.

Re:Excuse me, but

[MrNougat]

It will be interesting to see how a many-to-many DDOS plays out.

I'm interested as well, but it's not going to be many-to-many. Each side will execute many-to-one. *Frog's many against spamvertisers one, multiple times, in a "one response per spam" action. Spammer's many against *Frog's one, in an "as much force as can be mustered" action.

Provided that the spammer's attack can find an appropriate target, and depending on the flexibility of *Frog to make itself a constantly moving target.

The weak link in the *Frog model is that human interaction is required to vet spam and build response scripts, then deliver those response scripts to *Frog clients. The "spam to be vetted and scripted against" information needs to be delivered to a single point somehow. The scripts created need to be distributed to clients from a single point somehow.

Maybe the new clients can make greater use of torrents in their operation (as opposed to simply distributing the client installer via torrent). Example: a "spam vetter" person runs an administrative app that searches for a specific torrent. Spam to be vetted is sent from normal clients via torrent, picked up by "neighbor" clients. Eventually, the admin app is able to see the torrent available on a "neighbor" and picks it up. Same way in reverse for delivering scripts - the admin app torrents the script to a smaller number of neigbors, which seed it for more, etc.

Re:Excuse me, but

[mybootorg]

But how is it bad data? We can't reply to the email to opt-out because they've forged it. We use the opt-out function on their website and it's invariably broken or results in us getting more spam.

All we're doing is exercising our "right" to opt-out as we've been promised by the spammer that we can do.

They exercising their right to advertise - which as a side affect fills our Inboxes with crap and annoys the living sh*t out of us. We're exercising our right to opt-out which seems to be annoying the living sh*t out of them. All they have to do is **LET US OPT OUT** and we stop annoying the living sh*t out of them.

It's a perfect pairing.

Incidentally, having worked on a net team recovering from a DDOS from several thousand zombies sending unbelievable numbers of packets a second, I think there's a huge difference between what Blue Frog or Black Frog or Ok-Ok-I-pee-pee proposes to do. But I do see your point.

Re:Excuse me, but

[grimwell]

The weak link in the *Frog model is that human interaction is required to vet spam and build response scripts, then deliver those response scripts to *Frog clients. The "spam to be vetted and scripted against" information needs to be delivered to a single point somehow. The scripts created need to be distributed to clients from a single point somehow.

Maybe the new clients can make greater use of torrents in their operation (as opposed to simply distributing the client installer via torrent). Example: a "spam vetter" person runs an administrative app that searches for a specific torrent. Spam to be vetted is sent from normal clients via torrent, picked up by "neighbor" clients. Eventually, the admin app is able to see the torrent available on a "neighbor" and picks it up. Same way in reverse for delivering scripts - the admin app torrents the script to a smaller number of neigbors, which seed it for more, etc.

I think what you looking for/describing is a hidden service on the Tor network

BlackFrog could include the Tor client with their client app and the clients could submit the spam to the spam vetters via a Hidden Service URL. This would hide BlackFrog's servers' IP address.

The attack against BlackFrog's server would then be an attack against Tor. Which might succeed the first few times. Don't know enough about Tor/Onion routing or hidden services to know how well a DDOS against a hidden service would work. It is an interesting thought experiment, tho.

Re:Excuse me, but

[RelaxedTension]

"If one defines "DOS" as "attack or interupt[sic] the normal business of a server or network", BlueFrog certainly did."

Umm, no. Blue Frog only automated the process of going to the website and opting out. And, that was only once for each spam email that was recieved by the members. That is not a DOS attack any more than a sight being hit with the slashdot effect. It does not slow down or make a sight unavailable, but it ups their bandwidth consumption meaning higher bandwidth costs to them, and administration time to deal with the opt out request. Even if they are ignoring them they probably have to be cleaned out.

They solicit a million people to visit their website, and that is what's happening. The difference being is that it's for opt-out requests instead of purchases.

Re:Excuse me, but

[paulxnuke]

The difference being is that it's for opt-out requests instead of purchases.

Is that a difference? Slashdotting is the result of insufficient bandwidth to handle a temporary load composed of mostly bona fide page requests. That's not the same thing as going to a site solely to attack the operator, with no interest in any content beyond maybe using it in the attack.

BlueFrogger's went to a site with the express intention of breaking it / causing problems / costing the operators money. They were more artful than just doing lots of page loads to clog the server, but it was for the same purpose and it positively worked, judging by the response.

I suppose you could argue the precise definition of the word "Service" in DOS (*Frog attacks deny service (as in intended usage) to the website operators rather than the public?) Then again, does anyone really have a problem understanding what's going on here, or care enough to invent or learn a bunch of new acronyms to more precisely express the motivation for loading a URL?

Re:Excuse me, but

[RelaxedTension]

"That's not the same thing as going to a site solely to attack the operator, with no interest in any content beyond maybe using it in the attack."

If the site operator sends out a million invitations to come to his website, and gets a million hits because of that, is it an attack? No. The invitation has 3 options, browse, buy something, or opt out. Automating that process is not an attack. If the operator sends out a million invitations he had best have the bandwidth to accomodate the million potential hits. If he doesn't then too bad. The spammers are like the ISP's that have oversold bandwidth. Now that someone wants to take them up on their offer to come and visit, planning on a 1% or 2% response to the spam adds won't cut it. And for that I have ZERO sympathy.

And finally, Bluegrog's stated intentions was not to break it or slow it down. In fact they went to very reasonable lengths to avoid exactly that. Call it an attack if you want, but looking at the methods and actions involved, I just don't see how that term applies. They were a lot more reasonable than I would have been.

Re:Excuse me, but

[Tracy Reed]

Asking to be taken off of a spammers list is definitely not vigilantism. Far too many people are talking here who have no idea how their service worked.

Re:Excuse me, but

[raduf]

    It's not vigilantism. I, the receiver of the email, an entitled to answer it if I choose. I am also entitled to use a piece of software to help decide which mails I'll answer to. If the business model of the sender depends on only 0.1% of his emails beeing answered, that's his problem. My problem is with the one and only email I got from him, to which I can decide to answer or not.
    This can be stretched quite broadly from here. I can answer anonymously, I can answer through a proxy. I can answer without any real content other then "I'm not interested". As long as they wrote first, I can do any of those things and a lot more. Again, if the sender gets an answer from too many people to handle, too bad for him. I'm only responsible for my own actions.

    The main thing here is that email is directed communication. It's not TV, it's not a billboard. They sent the email, they "touched" me. I'm ethically and legally allowed to do a lot of things based on that.

    Things change very quickly if the 1:1 rate of spam:answers changes. At that moment it becomes retaliation and vigilantism and I quit. But until then... bring on the frog!

I am holding out for CrunchyFrog.

[1_brown_mouse]

Every spammer gets a "Spring Surprise."

CrunchyFrog explined. http://orangecow.org/pythonet/sketches/crunchy.htm

FHailzo8s...

[Anonymous Coward]

muchI as Windows BSD style.' In the clean for the next SO ON, FREEBSD WENT In a head spinning I have a life to as little overhead it has to be fun and distraction Already aware, *BSD sales and so on, what they think is but many find it another troubled Apple too. No, The Cathedral ass of them all, 1. Therefore it's shall we? OK! for a living got the wind appeared rival distribution, To be about doing About bylaws elected, we took and/or distribute OpenBSD leader Theo Apple too. No, Guest and never get About outside member. GNAA (GAY ass until I hit my For successful wasn't on Steve's

Before comparing to DDOS, or botnets. Be informed

[mybootorg]

Ok folks, let get a few things straight.

Blue Frog was NOT effective not as a denial of service attack or distributed denial of service attack. It was never meant or designed to be. The Russian spammer said it himself - they never brought down our servers, they only served as "a daily nuisance". The nuisance was this: for every spam that the spammer sent to the some 500,000 Blue Frog members, an automated script (bot) visited the website advertised and filled out the form for snakeoil, home refinancing -- whatever was being hawked. But instead of filling it in with valid input from someone interested in what the website was hawking, it filled it in with a legitimate plea from a single person to Opt-out of being spammed further. With me so far?

The spammer -- or worse, the spammer's client -- in turn, goes to check on their database of people or leads to which they can hawk their snakeoil and generic viagra and low and behold, instead of being filled with legitimate contacts of people they can do business with -- it's filled with hundreds upon thousands of opt-out requests.

Undoubtedly there are real requests from potential business contacts in there. But first they have to filter out all the opt-out requests that Blue Frog has submitted.

Sound familiar? It sure does. It's what we've been putting up with for years. We open our Inbox and instead of seeing email from friends and business associates, we first have to sift through and filter a few gazillion pieces of spam -- each with "Hi How are you?" and "Important Account Information" fake titles. Only then can we get down to the email that's actually sent to us. It's a nuisance.

Blue Frog forced spammers to deal with the SAME NUISANCE they cause us. And the spammers didn't care for it too much. They don't care about opt-out requests, the Internet, what people think of them, possible prosecution --- all they care about is making money and they're making it by the truckload. The fact that Blue Frog actually bothered them enough to use their botnets to attack is VERY encouraging. It means we've found a way to kick them in the ass and make it hurt.

Please don't compare Blue Frog or Black Frog to a DDOS or DOS. As the Russian Spammer demonstrated with his attack, what little network disturbance Blue or Black Frog causes for the spammer or spammer client server pales in comparison to a real attack. Mainly because it isn't meant to be an attack in the first place.

If Black Frog ends up with 1,000,000 subscribers, then lets talk DDOS.

Uhm... Okopipi

[Anonymous Coward]

What kind of name is Okopipi. That is real markettable. Stupid. Leave it up to a bunch of nerds to use a ridiciulous name for a product.

Re:Uhm... Okopipi

[Magee_MC]

Okopipi is a poisonous blue frog. Quite appropriate I think.

As to the fact that it isn't "marketable", who cares. Would anyone have thought google was marketable before they started? If the product is good enough, the market doesn't care about the name.

Re:Uhm... Okopipi

[mybootorg]

Black Frog. Easy to remember. Ominous sounding. Appropriate because it's the next generation of Jedi. The Darth Vader to Blue Frog's Blue.

Okopipi is less appropriate because no one knows how to pronounce it. Pronounced correctly, it may end up sounding like 'Ok-Ok I pee-pee!' - which is bad for everyone.

Worse still, it's obscure and spelled oddly and consequently most people are going to mistake it for the name of a new Linux Distro.

Re:Uhm... Okopipi

[plover]

Just because someone is multibooting between Ubuntu, Mandriva and Xandros doesn't mean that Okopipi will be ... uhh, ... confused ... oh, never mind.

OK, so maybe they should have stuck with Black Frog. It'd probably be even better if it were followed by a parenthetical "of Doom", as in "Black Frog (of Doom)". Now that sounds more like something people should be afraid of.

Re:Uhm... Okopipi

[Anonymous Coward]

"man, whats this 'ebay' crap? What do oceans have to do with auctions? And why the hell would I buy books from some jungle?"

Re:Uhm... Okopipi

[RedToad]

OK, so maybe they should have stuck with Black Frog.

They considered calling it the "Blue Screen of Death" but found that it was copyrighted by a VERY large software company which has sole bragging rights.

"They're simply state-sponsored vigilantes"

[Anonymous Coward]

Wow, a real live anarchist.

FrogNet?

[Anonymous Coward]

Isn't that the old Minitel system?

Never trust the users

[Jac_no_k]

You can't trust the "members". Say that a savvy black hat creates many "tainted-members". What happens if the "tainted-members" all report that a legitimate site is spamming?

I think one method for this to work is for each suggested target be evaluated by each member. The member has to agree that this is a valid target before his account participates in the attack.

Re:Never trust the users

[sk8king]

>I think one method for this to work is for each suggested target be evaluated by each member. The >member has to agree that this is a valid target before his account participates in the attack.

With a certain threshold of participants required before the attack even takes place. If there are 100 members, perhaps 20 would need to agree on the item in question being spam. 15 wouldn't be enough to initiate a retaliatory opt-out.

I wonder how much of the "background" noise on the internet is this sort of crap floating around....DNS requests for viruses, port scanning for viruses, traffic in the form of spam, spam responses, systems to deal with spam....probably more than anyone realizes.

Re:Never trust the users

[Anonymous Coward]

> I think one method for this to work is for each suggested target be evaluated by each member. The member has to agree that this is a valid target before his account participates in the attack.

Sounds ... unwieldy.

Anyway, Blue Frog maintained a number of spamtraps on its "do not spam" list as well as normal users. If there was any question about a mail's legitimacy, it could usually be resolved by determining how many spamtraps it also hit. I don't think the "do not spam" list was really the best idea (it's what dragged bluefrog users into the escalation), but it really is an integral part of the model, to give fair warning to anyone who actually might just be mistaken, or at least to tell the targets of their complaint storm, "you had the ability to prevent this".

Blue Frog was never about DDOS'ing spammers bandwidth, only their ordering infrastructure with real opt-out mechanisms. It's naive to think spammers consider it anything more than a technical speedbump, but advertisers linked with spammers are also contacted, and they may actually take notice at the negative publicity.

Hormel won't like it...

[jacksonj04]

Minor point here, but SPAM (All caps) is the foodstuff. Spam (Not all caps) is the bloody awful mountain of email we all recieve every morning.

I thought we knew better than that.

Re:Hormel won't like it...

[RobertLTux]

they do in fact don't like it details: http://www.spam.com/ci/ci_in.htm

ways to avoid poison

[Jac_no_k]

I think one method for this to work is for each suggested target be evaluated by each member. The member has to agree that this is a valid target before his account participates in the attack.

So I guess the question is how is this any different from individual users crafting their own attacks? For me the nice thing about Blue Frog was they crafted a script for me that will be used to attack. I'm sure this new project will do something similar.

And I could even see a karma system for the members. Members that suggest valid targets gets modded up.

Myopic-kneejerk-retribution-a-go-go

[ear1grey]

I have no mod points, so I must respond...

I'd like to hope Okopipi could make a positive difference, but it cannot, because it is open to exploitation by the very people it's trying to stop.

Okopipi's greatest asset: people who are desparate to stop spam; is also it's greatest weakness, because their frustration sometimes leads them to take ill considered actions without first understanding the facts. Choosing to publish the statement below is a fairly pertinent example:

If you disagree with fighting fire with fire, I suggest you also criticize any and all law enforcement activities. They're simply state-sponsored vigilantes.

It's difficult to see any way this statement could be more wrong.

When a state sponsored law enforcement official does their work they are enacting the will of a democratically elected governement. It is a careful and methodical process designed to protect the innocent.

Their job works like this:

1. A law is defined (there are many ways for this to happen).
2. A transgression of that law is identified.
3. Evidence is gathered.
4. The transgressor is prosecuted and can defend their actions.
5. If the transgression is proven a sentence is handed down.

The problem with Okopipi is that it amounts to an unelected and unrepresentative group that is appointing itself as police force, judge, jury and executioner.

The result is that members of the Okopipi network and innocent bystanders with websites will become the target of the organised crime that is funding the spammers.

At which point your friendly "state sponsored vigilante" is only a phone call away.

Re:Myopic-kneejerk-retribution-a-go-go

[linvir]

I have no mod points, so I must respond...

Awww, poor you. No mod points to mod down a point of view you disagree with. Perhaps you could do us all a favour and go uncheck the 'I am willing to help moderate' in your preferences.

Re:Myopic-kneejerk-retribution-a-go-go

[prattle]

The problem with Okopipi is that it amounts to an unelected and unrepresentative group that is appointing itself as police force, judge, jury and executioner.

Nonsense. All Okopipi will do is automate the opt-out/unsubscribe requests.

http://wiki.okopipi.org/wiki/Frequently_Asked_Ques tions

Re:Myopic-kneejerk-retribution-a-go-go

[compro01]

you seem to be labouring under the delusion that a law will actually work and that the spammers won't simply buy loopholes in the law.

look at CANSPAM. it seems to be real effective.... >/sarcasm

Re:Myopic-kneejerk-retribution-a-go-go

[ear1grey]

oh, I agree completely that CAN-SPAM is useless.
Step 1. Fix the law.
Step 2. Let the law fix the spammers.

Re:Myopic-kneejerk-retribution-a-go-go

[Infoport]

No, that is how a PERFECT system would work. What ACTUALLY happensis that you have law enforcement that is PAID to do a job, and is also picked from applicants who often feel personally about their work. This makes the law enforcement act for what they feel is best, in much the same way that others might, except for the fact that law enforcement is "official".
This leads towards enforcement of laws in ways that use loopholes in one law as tools to find other transgressions, or to use interpretation and hope that it is not challenged or is supported by the courts. The courts also interpret laws, sometimes in ways that are later CHANGED by other courts.
In addition to these ways of using to laws by your own flavor of enforcement, law enforcement also has the ability to selectively enforce laws that might be stopped if those laws were enforced upon all.
Also in addition, there is the matter of the less honest law enforcement, who breaks or misuses the law, who breaks the law for corrupt purposes, etc.

At a higher level, we do not live in a democratic society-- we live in a representative democracy, NOT A true democracy, plus the entrencement of the two party system gives more than a democratic enfluence upon what sort of representative we have. Those reprentatives are then able to pursue whatever flavor of government they REALLY believe, regardless of campaign personae. Many lawmakers portray themselves as religious moral characters with strong beliefs, and their lawmaking uses those religious and non-democratic principles as one of their "strengths" -- leaving We the People in a society ruled by many laws that the community governed does not hold dear.

On a related note, our elected officials are NOT necessarily representative of the comunity, due to low voter turnout, influence of the entrenched candidates, the HUGE money required to campaign, and the nuisance of couting votes so that the candidate with the most might win (think Election 2000). Plus, most law enforcement officials are NOT elected, they are hired or appointed.

I would agree that their could be issues with Okopipi, but to say that law enforcement is the perfect system is just misguided-- that is why we MUST HAVE so many checks and balances, although the effort of being required to use those checks and balances makes many peopole "just settle so it will go away" (also very true in civil law cases).

It seems that you are really disagreeing with who holds the fire and not with the idea of fighting fire with fire, unless you think that getting all those replies to your spam would be cruel and unusual?

Re:Myopic-kneejerk-retribution-a-go-go

[ear1grey]

It seems that you are really disagreeing with who holds the fire and not with the idea of fighting fire with fire

Yes; although if there were appropriate legislation in place, the authorities wouldn't need to fight fire with fire. I also agree that "the system" can never be perfect (because we keep inventing new things that require new legislation) so there is at best, a lag. Perhaps the Okopipi volunteers will spend some time lobbying their government representatives - in the long run that may do more good.

Re:Myopic-kneejerk-retribution-a-go-go

[Infoport]

On more issue: many spammers are not "in the system".

Our system has no control over those who are outside the system, spamming from an offshore account (or even one in another country that isn't willing and cooperative to help with our law enforcement.) Even when we do have cooperation from other places, we are then relying upon other governments which were NOT elected by us, potentially using methods which we do not condone-- how about fighting fire with napalm? (ex. use of torture to extract information, lack of same Constitutional rights and protections, different level of overview of law enforcement practices).

Re:Myopic-kneejerk-retribution-a-go-go

[ear1grey]

Offshore affairs certainly put a different spin on the problem, and moves to internationalise control of the Internet through the UN may present an opportunity to control wayward countries and ensure that they enforce internationally binding internet laws* in accordance with the declaration of human rights.

* laws that don't exist yet, hence the unsolicited commercial email problem.

What Do We Really Want?

[carpeweb]

Don't we have two objectives regarding spam?

1. Reduce/eliminate the network clutter it creates
2. Prevent it from reaching our inboxes

I don't see why the froggy approach is the best direction. Yes, I see the logic in fighting fire with fire. But I've heard that water and foam are also used -- sometimes with good effect -- to fight fires. Sometimes axes are also used.

As an email user, I only care about the second objective. (Don't worry, as an Internet user, I realize my self-interest in supporting the first objective, but it seems more directly relevant to network admins and a "tragedy of the commons" problem for the rest of us.)

Permission-based email starts to make real headway on the second objective, but it doesn't seem to be a common offering. I'm pretty sure one of the Baby Bell ISPs offers it, but I forget which one. Does anyone know more about this and which ISPs might offer it?

Better still, does anyone know of an open-source add-on for mail servers that will do this?

Re:What Do We Really Want?

[pwrtool 45]

Don't we have ... objectives regarding spam?

...Sometimes axes are also used

I am intrigued by your ideas and wish to subscribe to your newsletter.

Re:What Do We Really Want?

[bitt3n]

for a permission based system to work for all senders, wouldn't it have to notify the sender that he must perform some additional act before the message gets sent to the recipient? and if so, wouldn't the sender need to be notified via email, and if so, wouldn't this message sometimes be caught in the sender's own spam filter and never seen, preventing the legimate message from being received? if this happens just 1 in 100 times, such a method would be useless for many people.

Re:What Do We Really Want?

[shokk]

I'm confused. Which are you advocating?
a) Freezing them with fire retardant foam
b) Hack off a few appendages with an axe
c) Drowning
d) All of the above in that order

I think any one will do. Why be picky?

Re:What Do We Really Want?

[hobbesx]

I don't see why the froggy approach is the best direction
Not to say that it's the best direction, but I think you're missinge the objective because you're thinking of this as a DOS of computing resources. It's actually meant to be a DOS of the information that the end-using companies receive. There's other posts that explain it better, but this way the spammer's customer receives a large number of phony responses alongside the genuine responses to their spam messages. This makes things a bit more of a hassle for the spammer's customer and (hopefully) less desirable for their end-users trying to make money with that data.

Security?

[Rob T Firefly]

This does look promising (from TFA:)

"It will be based on a P2P network (the frognet)," according to a posting on the wiki. "On failure to connect it could still opt out given email addresses."

Participants will send reports of spam emails to Okopipi, which will use "handlers", including dedicated servers, to analyse it. To avoid suffering the same fate as Blue Security, Okopipi's staff will not disclose information about its servers.

"Only the Okopipi administrators will know their locations," the group said on its wiki. This should make a DDoS attack "very difficult", it said.

That seems solid, but I wonder how something so open can keep a secret like what and where its servers are. It's beyond me, anyone have more info?

Re:Before comparing to DDOS, or botnets. Be inform

[Anonymous Coward]

If Black Frog ends up with 1,000,000 subscribers, then lets talk DDOS.

Misses the point entirely. If Black Frog ends up with 1,000,000 subscribers, let's talk about forming a PAC and getting legislation passed. Think $5-10 donation per person, with all proceeds going to fund the PAC. Now you can buy laws and screw spammers permanently. You've also got a handy voting bloc for, let's say, the next Presidential race. Before you laugh, remember that the last race was won by a lot less than that.

Re:Before comparing to DDOS, or botnets. Be inform

[mattsucks]

The Russian spammer said it himself - they never brought down our servers, they only served as "a daily nuisance".

And we know this is true because Russian spammers are known throughout the world for their unassailable truthiness.

Subject tongue twister

[fritzk3]

No, I didn't RTFA. I could barely get past the subject without the words getting tangled up.

Can anyone read the subject line five times quickly and get it right? :)

Re:Subject tongue twister

[Anonymous Coward]

Read with your eyes, not with your mouth.

history

[dmindless]

There is a history of this issue and related links here. The castlecops stuff has threads of the original spam message board threads.

OT: Myopic-kneejerk-retribution-a-go-go

[Spaceman40]

When a state sponsored law enforcement official does their work they are enacting the will of a democratically elected governement. It is a careful and methodical process designed to protect the innocent.

Perhaps the GP was from the US, where that doesn't hold true anymore...

This is a monumentally stupid idea.

[davidu]

Let's be realistic -- This is a great way to get arrested.

Building software to construct botnets is a totally unproductive use of time. Running botnets that DDoS sites all over the net is illegal. Blue Security isn't out of the woods yet legally and their DDoS of SixApart is far from a closed case.

If you think this kind of coding is interesting and fun then shoot me an email -- I'll give you an internship (or a job) working on way more productive and positive projects that will impact just as many (if not more) people.

-david

Re:This is a monumentally stupid idea.

[pembo13]

Maybe they need to form a cooperation then.

Re:This is a monumentally stupid idea.

[mungtor]

I don't think it's a matter of being interesting or fun. It's a question of whether it is neccessary or not.

Rather than ignoring it and hoping it goes away, how about suggesting an alternative solution to the problem at hand?

Re:This is a monumentally stupid idea.

[dmindless]

Said a million times, I'm sure, but neither blue nor black was a DDOS. One spam received. One response or less sent back as an opt-out. Fair enough. The reason for distributing this is because of the targetting problem.

Re:This is a monumentally stupid idea.

[hjf]

Let's be realistic: It's not. The system is not designed to bomb the spammers, just to send spam back at them IN THE SAME AMOUNT they send spam at us. That is, if a spammer sends you 1 spam message, you send him 1 spam at him. But if he sends you 500.000 spam messages... well, you do the math. I don't see anything illegal on that. Put it this way: if you have 500.000 people in a "club", who take the time every day to do that exact thing manually, would that be illegal? I don't think so. Neither writing a program for doing just that would be "illegal".

Re:This is a monumentally stupid idea.

[davidu]

Ususally the sites hit were the former home of a spamsite or spammer and at the time of being hit were just the compromised box of an innocent webhost, university computer or other bystander. You can argue all you want about the 1:1 ratio of it, or that networks should be more responsible (I agree) but that doesn't make it right.

And to the person who said I should suggest something better -- how about a botnet reporting engine to let responsible ISPs know they have compromised machines on their network? Or a system of sifting through whois and domain registration data to determine who the good or bad registrars are out there (like are all phishing sites coming from one policy-loose registrar or not?). Or a system to combat phishing and fraud on the net.

I can come up with a 100 good ideas to make the net a better place and teach you 1000 things about system administration, networking, running big networks, building scalable systems. Take advantage of that, not of the Internet.

Being an operator (sysop/netop) is infinitely better than being a hacker. A hacker just needs to know one way into your system, an operator needs to know all the ways in. :-)

Best,
David

Re:This is a monumentally stupid idea.

[larytet]

regarding interesting tasks/job
my e-mail larytet at yahoo com

Re:This is a monumentally stupid idea.

[hjf]

that's your mistake, you suppose that the ISPs ARE responsible. they are not, not outside the US/EU anyway. I live in Argentina. I'm a customer of Telecom Argentina, the largest telecom carrier with 200.000 ADSL customers (it's not that big, as you can see). They are NOT responsible. They don't give a shit about spam or whatever. Once, I asked one of the tech support guys why don't they do anything about spam. He told me, we do. We blocked outgoing traffic to port 25, other than that we can't do anything else, we are too few to handle all of this, we get blocked in every spam blacklist, and we can't do anything to get out. In order to do this we must close the customer's account and tell the guys at the blacklist we did, and we will make sure this person will never be a customer of us again, and that we are very sorry for all the damage we caused and a lot of crap. Also, as soon as they remove 1 or 2 of our netblocks, we get 20 more blocked.

That's basically the situation in every "third world" country. Legislation won't help, I don't know why people insist with that. It didn't work inside the US, where they enforce the legislation, it will work even less in countries such as mine. You know, in my country (and most others) we spend a lot of time just trying to survive to worry about "stupid things as spam". I'm usually an anti-Telecom (Telecom Argentina), but I understand them. They get robbed every single day. The price of raw copper is extremely high nowadays here, so thieves go and steal phone wires. You think telecom is going to worry about spammers, when they have to replace tens of thousands of kilometers of phone wires that were stolen? To get you in perspective: Pirelli re-opened their cable factories in Argentina to supply Telecom with their extremely high demand of phone cables.

so, we users have to defend ourselves because the telcos won't help.

Fighting spammers with axes?

[Anonymous Coward]

Yes, I see the logic in fighting fire with fire. But I've heard that water and foam are also used -- sometimes with good effect -- to fight fires. Sometimes axes are also used.

Are you saying that we should be fighting spammers with axes?

I'd personally like to collapse their children's skulls with a rusty used camshaft taken from a 1985 Pontiac Iron Duke. Think of an overweight cast iron baseball bat with induction-hardened lobes to ensure non-uniform cranial trauma.

Re:Before comparing to DDOS, or botnets. Be inform

[mapkinase]

If Black Frog ends up with 1,000,000 subscribers, then lets talk DDOS.

I hope it will end up with 10,000,000 subscribers, so the scoundrels that payroll the spa[cu]mmers choke in their own vomit.

Oblig Futurama reference

[Anonymous Coward]

Hey what about a anti spamming version of this toad [en.wikipedia]? XD

Glad to know...

[Nom du Keyboard]

Glad to know that annoying solutions are evolving as quickly as annoying intrusions. A weakness was discovered in the first system, and now an improved version is available. Clearly the first system was sufficiently annoying to be attacked, which means it was working. In the end it's all a question of who you want to annoy. I vote for annoying spammers since they've annoyed me for far too long.

As far as "poisoning" the black list with a wrong target, who needs to? That would only be an overly complicated form of DDoS attack, which can be accomplished much more simply already. It's not something to worry about yet.

Re:Glad to know...

[99BottlesOfBeerInMyF]

As far as "poisoning" the black list with a wrong target, who needs to? That would only be an overly complicated form of DDoS attack, which can be accomplished much more simply already. It's not something to worry about yet.

Actually, it would accomplish a little more. It would not only attack a target with a DDoS, but also may train DDoS filters to automatically remove DDoS from the same hosts. Thus, it makes the system ineffective against spam for a company from the same link.

What does Richi think BlackFrog's doing?

[astronouth7303]

"The project should also take care not to cross the line from legitimate spam complaints to attacking spammers using DDoS-like techniques,"

That's what it basically sounds like.

They're automatically doing what spammers wanted people to do, based on the assumption that the spammers didn't set up the infrastructure necessary to support the e-mails they're sending.

T-Bird Plugin?

[amcdiarmid]

For me, this would work well with a Thunderbird plugin: Say an option to send the opt-out as a right-click.

I have a catchall account for non-valid email addresses in my domain. Everything that goes there is junk. I could have t-bird's junk filter grab it (mostly it does correctly at this point.), and then when I manually delete stuff, perhaps there could be a right-click to mark as frog-food? (about two thousand a day. fun fun.)

My $.02

mod 3own

[Anonymous Coward]

later seen in goodbye...she 4ad Fact: *BSD IS A Fly...don't fear BUWLA, or BSD benefits of being BE FORGOTTEN IN A though, I have to for a living got

It's not DDoS.

[blueZ3]

The service fills in forms on spammers websites and submits it. This "corrupts" the data that the spammers are collecting by inserting hundreds of "opt out" submissions which makes finding the "valid" submissions (where stupid people responded to the spam looking to buy v1agr@) more difficult. There's nothing illegal (as far as I know) in using your own computer to fill out forms with bogus data.

The few hundred frog subscribers don't have the horsepower to shut down a Web server anyway. They just make the results of spamming much more difficult to sort through.

Nice Name

[Anonymous Coward]

I've been running an ISP called FrogNet (http://www.frognet.net/) for the past 10 years. I am SO looking forward to feeling misdirected spammer wrath.

Re:Nice Name

[Anonymous Coward]

1996 called, it wants it's website look & feel back....

Ray Charles called, your site is hurting his eyes.

Jim Hensen called, he wants Kermit back, but first, tell him to return Ray Charle's sunglasses.

First post to get a clue!

[crovira]

"so it can punish the people who hired the spammers"

When the spammers' clients have to pay BIG TIME for MY inbox and everybody else's inboxes getting full of spam, that is when I expect spam to dry up.

Until then its all just wanking.

Re:First post to get a clue!

[mengel]

Now how effective these guys will be at actually punishing those who hire the spammers, I can't tell you. But it does appear to be their intent...

Two pronged approach

[Monster_Juice]

Remove the demand
Get people to stop buying things from people that Spam. If they open a storefront, send out Spam and get zero response they will stop.
Educate people:
Tell grandpa to stop ordering Viagra from these people!
You cannot buy a Rolex for $99!
Your Johnson will not grow if you take a pill!

Remove the supply.
The other thing that needs to happen is the companies that produce these products being sold need to be accountable for where their merchandise is being sold. I think the best approach to this is for a service like Black Frog that sends an E-mail to the manufacturer stating "Please inform merchant XYZ that I no longer want to receive E-mail offers that include your product." This will be a long hard road since many of the pill companies sell knock-offs that are not genuine. These companies will be more inclined to prosecute the people that are misrepresenting their product this way. The others will find ways to control the supply chain better.

I don't see a spammer ever going away unless you make the internet unprofitable for them. Irritating them costs them $0 Removing the supply and demand is the only solution.

Better idea

[KDR_11k]

Find out their physical locations and make them public. Mob justice works fast.

How to prevent DDOS on the servers.

[Spy der Mann]

We're (yes, I'm part of the team - hello slashdot!) currently discussing using the main servers thru various proxys to anonymize the IP address. On a DDOS attack, the servers would just disconnect and then reconnect to another proxy and voila.

Also, the servers are the ones with the Central PGP authority. The network can still operate without servers, they're just needed for login (for now).

Hierarchical P2P

[Spy der Mann]

The network is P2P, but authority is hierarchical. We'll use anonymous routing to prevent DDOS on the high authority nodes. And the network will require a validated login.

On the remote case we suffer a complete P2P blackout, the frogs can still opt out - the network will only be used as a regulation mechanism.

For clarification, we're *NOT* DDOS'ing the sites.

[Spy der Mann]

We'll use throttling techniques to let them live and breath.

What we're going to do, is poison their purchase forms (as Blue Sec. did) with enough requests so they have to search in them before finding true customers.

My personal opinion and some clarifications

[Spy der Mann]

The problem with Okopipi is that it amounts to an unelected and unrepresentative group that is appointing itself as police force, judge, jury and executioner.

Unelected? Unrepresentative? We've received HUNDREDS of volunteers to help us. And with more than 700 diggs (yes, blasphemy! don't burn me), i doubt it's "unrepresentative".

The problem with Okopipi is that it amounts to an unelected and unrepresentative group that is appointing itself as police force, judge, jury and executioner.

It should be obvious by now that you haven't RTFA. The network will have a system of trust and reputation (karma), and there WILL be people gathering evidence.

One thing to clarify. It's an open network, but unlike other P2P networks this one is willing to cooperate with the police. We're going to give authorities and recognized companies PGP-based authorization (on request) so they can work with their own nodes and recognize authentic SPAM.

The result is that members of the Okopipi network and innocent bystanders with websites will become the target of the organised crime that is funding the spammers.

Sure, let them earn MORE money and become MORE powerful so they'll lobby the congress and throw away the can-spam act.

You're forgetting something, currently there's *NO* mechanism to enforce ALREADY EXISTING laws regarding SPAM. Spammers' servers are across the globe, where there are no laws. And not only they're bypassing the countries frontiers, they're also committing FRAUD. They're telling the marketers: "Look! These people are willing to receive your offers for cheap viagra, they WANT to buy our products!". But we're not. ALL WE ASK is to GET OUT of their lists.

Also, we don't want to DDOS sites. I already said that, the "attacks" will be controlled but significant enough to disrupt the spammers' business.

And FINALLY, the network will NOT be used to INITIATE attacks. The attacks are the sole responsible of the CLIENT - the system has been designed this way to prevent abuse.

In other words:

* The police force is THE PEOPLE (those who submit their SPAM, plus we'll have spam honeypots and cooperate with SpamHaus and other authorities)

* The jury is THE PEOPLE (the people who have earned enough trust to participate in the classification of websites, or simply those who emmit votes. As if that wasn't enough, people who have voted to punish an innocent website will receive bad karma, this eliminates corruption from the network.

* The judge is also appointed by THE PEOPLE. Those who have earned enough trust to write the opt-out scripts. Maybe even the FTC with their own authorized nodes.

* The executioner is the PEOPLE, those who have installed the clients on their system. It's their decision to opt out from the websites, no one else's.

It seems pretty democratic to me.

Any questions?

Re:My personal opinion and some clarifications

[ear1grey]

Hi SpyDerMan, I appreciate that you're trying to make a positive difference, and I'm concerned that the project may be trying to solve the problem by entirely the wrong means...

We've received HUNDREDS of volunteers to help us. And with more than 700 diggs, i doubt it's "unrepresentative".

The number of volunteers is certainly promising, and although 700 is a good start its definitely not a representative sample of the 1 billion people who now use the internet.

I note that there are as yet no volunteers in the "Legal Advice" section. Hopefully this will change and you'll have some specialists in international law willing to help out (perhaps a call to the EFF - see if they know anyone?).

It should be obvious by now that you haven't RTFA.

Only "the FAQ", "Security Concerns", "Project Description", several diagrams and some of the google groups discussion - and I enjoyed your peer review idea.

You're forgetting something, currently there's *NO* mechanism to enforce ALREADY EXISTING laws regarding SPAM. Spammers' servers are across the globe, where there are no laws.

So if there are no opt-out laws, how will clicking an opt-out link help? Is Okopipi entirely helpless against international spammers?

Note: "Yarr! We'll DDoS those scurvey ridden pirates" is not the correct answer here, obviously. So is Okopipi impotent?

I already said that, the "attacks" will be controlled but significant enough to disrupt the spammers' business. As if that wasn't enough, people who have voted to punish an innocent website will receive bad karma, this eliminates corruption from the network.

Whilst that might deter people from being petty and spiteful; its not perfect:

1. it cannot stop mistakes from being made
2. genuinely honest people can be corrupted, hoodwinked or can have their machines compromised.

Perhaps a short example will explain my concern. Imagine a web company that has an email list for their customers (a company that never spams, because they have to pay for the limited inbound and outbound bandwidth).

That company has an opt-out web page for their customer-email list. If someone were to "spam in their name" (i.e. without their knowing) how would they be able to stop their entire month of bandwidth being wasted by Okopipi clients automatically trying to unsubscribe?

Who is responsible if Okopipi "accidentally" attacks such a company? What recourse does the company have against the members of the Okopipi network? Will individual members be liable to court action, or will Okopipi?

For the Nth time, we're NOT GOING TO DDOS!!!

[Spy der Mann]

Disclaimer: This is my personal opinion and does not reflect the viewpoints of other members of the Okopipi project.
--

Sheesh people! I hate to have to respond to 1,000 comments made by kneejerks who don't even RTFA, saying how terrible it's to DDOS and how the system could be abused.

Do you think we're idiots to let something like this happen?

1. The "attacks" on websites will be moderated. We want to make sure that the force is non-lethal to websites. We haven't discussed the implementations, but the decision has been taken: We will use throttling to PREVENT denial-of-service attacks.

2. The P2P network does *NOT* control the clients, it'll only distribute opt-out scripts for websites. Also, the customer can log out ANY TIME they want. So, NO, it's NOT a botnet.

3. Spammers Don't need P2P networks to initiate an attack. They already have their effective botnets in infected WinXP machines.

4. There will be a reputation system AND a hierarchy system (so not everyone can mod someone down), people will have to earn their trust to classify scripts, those who report wrong sites will be modded down, and the usernames and reputations are permanent. The hierarchy system we're studying requires at least two people acting as an individual before taking any action, to prevent infiltrations.

5. We're already considering infiltration of spammers in our model, we're researching papers written by experts in graph theory and computer science for this. A spammer could at most try to disable the network, but with the currently planned infrastructure, i doubt they can do it.

6. We haven't started to code. We're still discussing (and will continue to discuss) the possible consequences, abuses, attacks and how to prevent them or at least minimize them. We cannot afford to have ANY point of failure.

7. If any wants to cooperate, the google group is open to ideas.

8. And I repeat: we will *NOT* DDOS websites. It's a decision the commitee has taken, and it's a final decision. There have been people who have proposed to DDOS the spammers to death, and we're already shutting them up.

Re:For the Nth time, we're NOT GOING TO DDOS!!!

[JesseHathaway]

Well, well said. I understand your frustration, but sometimes Slash-think can be hard to pierce through. The best that you can do is fight the misconceptions and misfired synapses with "truthiness" and transparency. I think that it's good that this discussion is taking place, so that people can learn about the program and if they wish, voice their concerns and ideas in community-driven forums like /.

Re:For the Nth time, we're NOT GOING TO DDOS!!!

[larytet]

you can find interesting one idea from rodi project. i call it a message collector.

in UDP protocol you can work completely connectionless. you send message, you get no response, but message collector keeps the message, checks signature, takes action if needed, etc. Port scan of the message collector is pointless because message collectr never responds to incoming packets.

Let; say that you are a great listener, but you do not like to talk much (not even TCP ack). you post a IP range on some messge boad (for example subnet 0.168.1.1, where first 0 is intentional). Only one (or very small number) of the IPs belong to you. your "subscribers" should send packet to all IPs in the subnet to reach you.

Size of the UDP packet is relatively small and subscribers do not create lot of traffic when send 256 (in example above) packets. Port scan can not be used to find oout the peer. Simultaneous DDoS attack against all IPs in the range is unlikey. The only way of action of a spammer try to choose one IP, ran attack against it for some time and see for any results (or lack of it). this solution takes time and unreliable.

In Rodi project peers use IP scan to find each other. Peer (Rodi host) posts IP mask and port number. Host check signature of the incoming packets and drops (or logs) unsigned packets. Host acks only correctly signed packets.

fact that a peer is a message collector can not be established

there is more on the Rodi User Manual pages. check the last part - General Q&A hope it will help to the project

Re:For the Nth time, we're NOT GOING TO DDOS!!!

[Raenex]

Well, even after reading your posts and the FAQ on the website, it still seemed like a denial of service, but one that was meant to be non-crippling.

However, after reading this post by "mybootorg", the idea is a lot clearer. He explains it very well. Maybe you should ask him if you can appropriate it for your web site.

Re:For the Nth time, we're NOT GOING TO DDOS!!!

[lon3st4r]

Well I see two methods to tackle this problem effectively.

• reply with opt-out from an invalid email address: let their server add another non-existant email id and waste their bandwidth
• follow the links, and fill their subscription forms two times. Once with *junk data*, and another time (after a random time interval) with a request to un-subscribe. this way, their (spammer's) customers won't do a grep -v unsubscribe!

if a lot of home users join in as well and somehow do this for the spam they get in their mailboxes as well, then they can't effectively be targetted for retalliation as they're running on dynamic ip addresses. just wait till the anti-spam net strength reaches 100K+
we're living in very interesting times

* lon3st4r *

Mod parent down!

[Spy der Mann]

-1, both ignorant and irresponsible. Thank you.

Re:Mod parent down!

[Anonymous Coward]

From the author of the project? Way to take criticism buddy...

I don't mean to sound like I'm bragging....

[Mistshadow2k4]

... But I use gmail almost exclusively and receive a ton of spam, but what little gets through their filter is caught by Thunderbird. Now, I know Google and Mozilla, Inc. are pretty innovative groups, but why can't others do what they're doing? Especially as Thunderbird is open source? Spam exists because it is profitable. If people saw very little spam it wouldn't be so profitable anymore.

Re:I don't mean to sound like I'm bragging....

[Professr3]

We're slashdot. Joe Public isn't going to use GMail and Thunderbird and know how to set up filters like this... So, even if all of us set this up and get less spam that way, the spammers will still get money from Joe. This means they won't stop spamming, and we'll still keep getting the backlash, like higher ISP costs, server maintenance, and bandwidth bottlenecks due to the huge volume of spam traffic.

I'm thinking something more substantial

[Fry-kun]

... like infecting the spammer with AIDS or Rabies - I'm sure they'll be the last customer of those "cureall" stores

Cone of Silence?!?

[LunaticTippy]

Nobody uses the Cone of Silence anymore.

Hover Cover!

IMPORTANT ANNOUNCEMENT FROM BLACK FROG

[Spy der Mann]

Due to TradeMark conflict, I have closed the Black Frog project. Actually the project was just a nameholder, since Okopipi was a separate project which I joined later.

So the official name of the P2P antispam software is now "Okopipi". Please stop naming it "Black Frog" or we could get sued for Trademark Infringement.

Thank you.

(More info on my journal)

DDoS of SixApart

[babanada]

What do you mean by "Blue Security isn't out of the woods yet legally and their DDoS of SixApart is far from a closed case." SixApart was attacked by the same people that attacked Blue Security. Blue security changed their DNS to point at their blog. Granted, changing the DNS records under the circumstances was irresponsible; however, your quote is misleading.

Re:DDoS of SixApart

[davidu]

Would it be misleading of Blue Security was charged with being responsible for the attack on SixApart?

What about if they were held financially responsible for it?

-david

Re:DDoS of SixApart

[babanada]

Even if you don't give credit to Blue Security for their version of the story, saying they DDoSd SixApart is misleading, because, well, they didn't. Maybe they are partly responsible, but it is more like if I know a bunch of outlaws are going to show up any minute because I POd their leader. Before they arrive I switch the numbers on my house with my neighbor. The outlaws arrive and trash my neighbor's house. I am not a "trasher of houses", although it is quite possible my neighbor could sue me for misrepresenting the number of my house. This must come up alot in other areas. He's Spartacus!

Re:DDoS of SixApart

[Anonymous Coward]

That anaology doesn't really fly but let's suppose it does. If you knew there was in incoming threat to your house and you switched the numbers and someone in the oher house was killed you would be arrested and charged as an accomplice to murder or charged with manslaughter.

Re:DDoS of SixApart

[babanada]

Yes, I would share some responsibility, I agree. How much responsibility depends on how aware I was about the dangers of that switch in my analogy. Ditto for Blue Security. BTW, I am now a little clearer on what the free DNS guy meant. Or, more significantly, I am clearer on the issues involved with this kind of escalation in the war. I could go on and on, but, well, this is a pretty old thread at this point. out

When is a DDOS not a DDOS?

[RedToad]

Let's get this straight. Over one day a spammer sends 5 million invitations to go to a web site to buy a product. Over one day 5 million recipients visit the web site and in compliance with the CAN-SPAM Act request to be removed from the mailing list.

A DDOS is an illegal act. 5 million responses to an invitation is a CAN-SPAM compliant act.

Why do so many people not understand the difference? Is it from ignorance, or from vested interests in spreading spam?

---
nostalgia ain't what it used to be

Re:When is a DDOS not a DDOS?

[Spy der Mann]

The term DDOS is used by the spammers to spread FUD. There are much more effective techniques to DDOS a website, that just send useless traffic.

But an opt-out request is not useless in any way. It's valuable information. In this case, the spammer would see "500,000 people want me to remove them from my mailing list". It's not just traffic.

MOD PARENT UP!

[MLease]

He's absolutely right, and his post is not "Flamebait"! Mod points are not intended to be used to express disagreement. The grandparent made some good points, and I can even go along with the "insightful" moderation; but the remark, "I have no mod points, so I must respond" was uncalled for. If that's what he thinks they're for, it would be better if he didn't participate in moderating.

-Mike

Re:MOD PARENT UP!

[linvir]

The best part is that I got modded down myself for saying it. I guess my point hit some other moderator a little too close to home.

Oh, and you're absolutely right about the rest of his post. He made some good points, but highlighted the big problem with the moderation here.

On Windows? Ignore Spam(mers). I do. Since 2004.

[iamcf13]

Disclaimer: I wrote it. I use it. It's 100% free (keep your money).

It was available at my website (more info here if you want to read it) but it got 'Slashdotted' and was 'removed'. So I finally got around to updating it with statistics logging to 'prove' it's effectiveness, to accommodate 'flakey' mailservers that might not like a highly efficient POP3 client accessing them, and to treat 'highbit' email the same as file attachments (email is historically a 7-bit protocol) and posting it on http://rapidshare.de/ at the 'sig' URL above. Download and enjoy! :)

P.S. see

http://slashdot.org/comments.pl?sid=184696&cid=152 59932

and

http://slashdot.org/comments.pl?sid=171793&cid=143 07815

for more info.

In short, my approach uses the venerated, time tested SMTP protocol and character set AGAINST spammers....

weenieism

[Anonymous Coward]

I noticed you had no option for YOU to go deal with the mom beater. To me, that is a better option, or even better than THAT, is that your mom gets the training and the tools needed to protect herself. I know a lot of women-including "grandmaw" age women, who have "opted out" of the "professional victim in advance" mindset. Perhaps it is the crowd of adults I hang out with, maybe you don't know anyone but professional victims, or perhaps you live someplace where "the police" insist that you be a victim to maintain "societal norms" or something. Either way, you left out the best options in your list.

With this SPAM deal, people getting spammed opt out automatically, and in large numbers, that's it, all it does is speed up the process and further protect against a backlash from the scumbag spam scammers. There is nothing illogical or unethical about it that I can see, and it doesn't even come close to being a vigilante effort, it is pure self defense. Only real spam in real people's inboxes gets reacted to, so there ya go. And "your competitor" you are going to poison the system with? You mean some OTHER spammer? Another cut rate mortgage/bank info stealer or diluted drug or counterfeit watch or dick lengthening merchant? HAHAHAHAH! WHO CARES! The only "competitors" for bogus spammed crap are OTHER SPAMMERS.

We need to get rid of this bogus institutionalized and brainwashed politically correct weenieism in our society, you ARE allowed self defense, at least in the US anyway (outside of strange foreign nations like NYC and chicago where the bill of rights don't seem to matter), following some basic common sense criteria, and I assure you, from a "been there, done that, the bad guy lost hard" personal level (several times actually) it can and does work every single day of the year, even if the MSM won't report on it.

Re:weenieism

[99BottlesOfBeerInMyF]

I noticed you had no option for YOU to go deal with the mom beater.

Unless this is direct action, then it is a subset of vigilantism. Maybe your mom is just using you as unwitting muscle for her extortion scam. Give me $100 or I'll tell my son to beat you up.

To me, that is a better option, or even better than THAT, is that your mom gets the training and the tools needed to protect herself.

Except by its very nature there is no witness to a spam attack, so any retaliation will have to be after the fact. If you're in a cyber-cafe and watch a guy actually send out spam, go ahead and kick him in the nuts. Be my guest. Anything short of that, however, and you're acting on hearsay.

With this SPAM deal, people getting spammed opt out automatically, and in large numbers, that's it, all it does is speed up the process and further protect against a backlash from the scumbag spam scammers.

Provided the e-mail listed is a real opt-out address. If, however, it is your mom's e-mail address then you just helped automatically DDoS her. Why don't you think the police just open each spam and go bust the people whose product is being advertised? The answer is because they have no proof it actually originated with that company and it would be pathetically easy to frame someone. The same goes for this system.

There is nothing illogical or unethical about it that I can see, and it doesn't even come close to being a vigilante effort, it is pure self defense.

In the same sense that rigging a shotgun to automatically shoot anyone stepping onto your front porch is "self-defense" against the guy who painted graffiti your door last week. The problem is, you don't know if the guy getting shot is the mailman, the vandal, or some guy the vandal told to go knock on your door.

Only real spam in real people's inboxes gets reacted to, so there ya go. And "your competitor" you are going to poison the system with?

Okay you're obviously not comprehending so let me try this again in small words. Suppose I run Bob's TV Shop. I'm competing with Sally's Video Emporium. I decide it will be fun to take out Sally's online presence and the e-mail she uses to communicate with customers. So I go on the right IRC channel, buy an hour on a botnet, and send spam that says if you don't buy from Sally, she'll get her congressperson dad to raise taxes. It doesn't matter what the message says, so long as it is not effective advertising and it is clearly spam. Then, I use Sally's e-mail address as the opt-out address.

Now you and your friends automated network detect this spam and responds by sending thousands of messages to Sally. Her mail becomes useless. Her customers can't reach her. They then try the competition, me. Worse, assuming Sally eventually gets real help and talks to her ISP, your automated system's attack gets added to the DDoS signature database and I can later send you spam from myself without the response opt-out messages ever reaching me (assuming Sally and I have the same local ISP). I get to take out a competitor at the same time as I inoculate my ISP against your system.

The net total for me, I make money and steal customers and take out an innocent competitor using your automated system. And you think this is a good idea?

We need to get rid of this bogus institutionalized and brainwashed politically correct weenieism in our society, you ARE allowed self defense, at least in the US anyway...

And you are exactly the reason why some people feel we should no longer have that right, because they abuse it and react violently without the facts. Self defense is shooting the guy about to shoot you. This is legal. Self-defense is not going over to the guy's house who someone told you was the guy who stole your stereo and shooting in the windows. You don't know who sent spam. You don't know if the opt-out address is valid. Thus, reacting predictably and in an automated fashion against anyone whose e-mail address is listed as an opt-out address in spam is bound to lead to abuse. It's like a vigilante organization having a publicly editable hit list. It is dumb.

Re:For clarification, we're *NOT* DDOS'ing the sit

[Anonymous Coward]

So does this system do nothing against spam that does not contain a url (stock tip, 419's, diploma spam that uses phone numbers instead of urls, etc.)?

Errata

[ear1grey]

Mea culpa. No offence taken at Henry's comment. That line was the last thing I wrote, and it should probably have read:

I have no mod points, so I must just respond since I cannot also appropriately mod the article as interesting, reflecting that a wider awareness of the authors comments is an important factor in the airing of the concerns I wish to highlight.

Re:Errata

[linvir]

Ah, ok. In a similar way, I wasn't trying to be an ass to you specifically, but rather trying to grind the axe of "don't mod stuff down just because you disagree". So nobody take any offense at anything.

oh ooo!

[lon3st4r]

"Only the Okopipi administrators will know their locations," the group said on its wiki. This should make a DDoS attack "very difficult", it said.

does this imply, security by obscurity. not a good idea!

* lon3st4r *

Exactly; thank you!

[JavaRob]

100% correct -- all this tool is doing is evening out the balance so that spam becomes more like a normal commercial interaction.

If the spammers were willing to manually type out each spam message and type my address in by hand, THEN it would be balanced when, receiving the spam, I need to manually navigate to the advertised site, find a "remove me" page, and manually type in my address.

Of course they aren't going to do that -- this is the computer age. Computers exist to rapidly accomplish these kind of tedious tasks: hence the obviousness of also automating the complaint/opt-out procedure for the steadily growing amounts of email I don't want. No DDoS, no "attack", no "fighting fire with fire" or "spamming the spammers" -- just carrying out a normal, totally-legal business relationship on the scale the spammers have chosen.