Slashdot Mirror
Spam Doubles, Finding New Ways to Deliver Itself
An anonymous reader noted that the times is running a piece on the rise in spam that you might have noticed in your inbox over the last 6 months. Gates promised the end of spam by 2006, but they figure it's doubled in the last few months. And best of all, a huge percentage of spam is now images that circumvent traditional text analysis.
Competent sysadmins are expensive, and the idea of, say blocking outbound port 25 would never occur to them, or is brushed-off for stupid reasons.
The only way out is to exerce pressure on those network owners and the best way to do so is by simply blocking them left and right until they are left with nothing but their huge intranets.
Good for you. Personally I'd rather just email one or two images to the inlaws instead of dicking around with a web based system.
Now, dropping emails that contain images as inline attachments might be a good idea. As would droping any and all emails with a Content-Type of text/html.
Interesting how things come to pass. Websites like this one and many others have used text-in-image capchas for a couple of years to avoid spam bots. Now, spam bots are using text in images to avoid filters. The spammers have caught up for now, but just wait another couple months/year and anti-spam technology will catch up
Yeah, cuz it's not enough that I can no longer relay e-mail directly from my machine. It's not enough that I now have to have reverse DNS otherwise my e-mail gets rejected. It's not enough that e-mails that aren't SPAM get dropped/flagged. It's not enough that many e-mail providers drop useful attachments and scan so intrusively into them that I need to encrypt them if I want the e-mail delivered.
Let's take away yet more functionality due to spam! That's a great idea. Seriously, I hate SPAM but the zeal to stop it has ruined many useful features of SMTP.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Who's "they," and how exactly is this ban going to be enforced?
If I really want to share pictures I'll put them on a website or Flickr or something.
At which point, we might as well go back to taking pictures on film and sending copies through the mail. [rolls eyes] Practically all the picture-sharing services are an enormous PITA, and not everyone wants to put up every picture they want to show someone on their personal site.
For corporate servers, I agree, the idea of a no-image-attachments policy makes a lot of sense. For personal use, it's not going to happen, nor should it.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
A huge percentage of legitimate email is random sentences with buzz words and a picture.
Maybe it would be possible to OCR every image as it comes through but then you'll just have spammers sending you CAPTCHA'd messages.
Username taken, please choose another one.
Why not use email for what it was meant for?
...
If clients weren't so friendly to "auto show" images this spam would never had existed.
I too send attachments to folks but usually only source files and/or patches (e.g. really small things).
I want my email client to read/write messages, not the "web". It's bad that HTML emails exist
Tom
Someday, I'll have a real sig.
Since about two weeks I am using the image-spam repositories of MSRBL, and of Sanesecurity. Using a cron script to fetch the data and keep Clama's database up-to-date works quite well!
They already are sending me CAPTCHA'd images.
We have people who work from home. But I've set them up with email authentication. They can send anything, from anywhere, to anyone, providing that they have signed on with their username and password.
You do it differently?
I know people like to rant about the "spam problem" a lot, but for all practical purposes, the problem has been largely solved for several years now.
If you run reasonable spam filters, including many open source ones, you will not end up with much spam in your inbox. Yeah, there will be lots of spam still being sent, but the real, significant, cost of spam is really mostly people's time, not machines. Any ISP, company or person who gets "too much spam" is simply being penny wise and pound foolish. The same goes for systems that get too may "false positives", that is, legitimate emails being rejected. Almost all of that is due to trying to run "cheap" spam filters, or buying snake-oil systems. Upgrade your mail servers or switch to someone who runs reasonable spam filters.
The "spam problem" of today is really the "you can't do anything about spam" problem. Too many people are convinced that you can't stop spam, so you shouldn't try harder. The problem is low expectations. The problem is people cutting corners.
For email senders having problems getting caught in spam filters, some of this is due to people running bogus spam filters and that is the receiver's problem more than yours. Most of the rest is due to either you not running a standard-compliant mail server on a static IP address that can have a reputation built up for you being a good server, or because you really do send out spam, either due to "bad" customers or backscatter (bogus bounces, challenge/repsonse systems, autoresponders, etc.). Don't be cheap and think you can get away with not running spam filters on your outbound email and catching your "bad" customers. Don't be cheap and spew backscatter. Don't be cheap and say you can't afford to do port 25 blocking of dynamic IP addresses, or not allow customers to configure their reverse DNS.
The vast majority of knowledgable people in the area of spam do not munge their email addresses. The vast majority do not suffer either lots of spam in their inbox nor lots of false positives.
SPF support for most open source mail servers can be found at libspf2.
Huh, so everyone who wants to send pictures through e-mail is either an "ignorant fuck," a high-school kid, or a "tool?" Ooookay. I'm not sure there's much point in continuing this discussion, but I'll give it another shot.
..." etc.: Can I figure out how to use Flickr et al.? Sure. Do I want to? No, because their interface sucks. I made my living designing database-driven web applications for seven years, and I can honestly say that by the time I left my last job to return to grad school, I and a team of three other people (count 'em: three) had created a web app that subsumed all the functionality of nearly every DB-driven site I've ever seen (er, with the exception of Google) and looked a hell of a lot better doing it. Making a site for the express purpose of allowing users to post pictures is easy, or at least it ought to be. There is no excuse for the shittiness of sites made for this purpose, or for other single-purpose apps. And there is no reason why I should put myself through the pain of dealing with that shittiness just to send someone a picture of my dog, ferchrissakes.
* The executable ban: another PITA, and one that's occasionally caused me real problems. Is it a good idea generally? Sure, but that's the problem with blanket policies that seem like "generally a good idea" -- when they fail, they fail badly.
* The "no images" option: this is a great idea. Would enough people turn it on to make it useful in stopping the flow of spam? Not a chance. And I guarantee you that any ISP which instituted a blanket ban on images would find itself bleeding customers they way people bleed from a severed artery.
* "Frankly if you can't figure out how
Destroying functionality is not the answer to the spam problem (or almost any problem, really.) People want the functionality -- that's why it's there in the first place. What we need to do is come up with solutions that work in the existing framework, or they aren't solutions at all.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
It's not up to the recipient, it's up to the recipient's service provider; most recipients have no idea what is or isn't happening to their email before they get it.
And we have lost a tremendous amount of functionality due to SPAM. There was a time not so long ago when I could send to a family member: email with an attached photo, email with an attached document, email sent from my own PC and handled with my own SMTP daemon, email that was only two or three lines long, etc.
Now all of these are likely to be rejected. Even plain text email sent with a large subscription SMTP server is now getting blocked by some friends and family members' service providers simply because the domain of the address (my personal web domain) is not whitelisted and this hits the SPAM score where it hurts. A phone call is great... unless you were hoping to do one of the many useful things you used to be able to accomplish by sending attachments (i.e. send an article you're working on to a friend to have them read it and mark it up with revisions before sending it back).
So I suppose your answer is that we should all get an @gmail.com account, have to use it via the Web interface to send plain-text only email with zero attachments that's at least five but no more than twenty sentences long and doesn't use the words "sex," "free," or "mortgage."
Fine, but don't pretend that email hasn't lost a significant amount of functionality due to SPAM or that these restrictions are being imposed democratically by the consensus of common users. Functionality has indeed been lost and the decisions are made by admins at major email providers trying to save costs and manage the tremendous problem that SPAM has become.
The proper solution isn't to filter more. The proper solution is the death penalty for SPAMmers. I'm quite serious. We execute far too many blue collar criminals in this world and not nearly enough white collar ones. SPAMmers should be first among these.
STOP . AMERICA . NOW
If everyone turned off images, html and anything else, we'd get text only spam instead.
The real problem is authentication in email. While mail servers accept email with any arbitrary 'from' address, this problem will persist.
Actually many scanners will not deliver encrypted attachments for this reason. It's a setting you can change in MailScanner, but it's defaulted to block them.
Everybody delivers e-mail messages through the SMTP server of their ISP. What is wrong with that?
Network administrators get thousands of connections from infected machines. They drop those connections, except the connection from the official SMTP server of that IP-block. If someone can't put aside their blind determination to ignore the SMTP of their ISP, or lack a damn good reason to send email directly, their deserve to get rejected by recipients. Politely sending a reject message back would double the bandwidth wasted on spam, nobody is waiting for that either.
The best way to accelerate a windows server is by 9.81 m/s2
" It wasn't the servers job to care about what was in the message -- it was the clients."
And it still should be.
As you point out, the admins have not solved this problem. Mostly because most solutions go after a specific 'attack' and not the problem.
AS I see it, the best way to help this problem is personal whitelist autogenerated be demanding a one time responce from the sender. No response in 30 days(or whatever) it gets trashed.
Once an email address has been authorized, then it's golden. If it is authorized, but not used in 90 (whatever) days, it gets deauthorized.
Content no longer matters, on a valid emails.
If they have a domain that they keep to be avle to respond, then you can find out who is sending and get their ISP to deal with them.
Also, telcoms need to stop selling large pieces of bandwidth to bulk senders.
The Kruger Dunning explains most post on
You could always try sending spams for free penis pills, and sending cyanide capsules to everyone who responds...
I am TheRaven on Soylent News
I get so much spam that if I just deleted all my email, my false positive vs number of emails 'rate' would be pretty low too.
ipv6 is my vpn
This is going to sound awful, but I've almost stopped trying to come up with solutions. I've implemented some that others have tried and like, but I don't go out of my way. Nothing works well without serious compromises.
:)
Honestly, I'm glad spam has doubled in the last six months. I say pile it on... but not because I'm some sort of masochist. It became clear to me a long time ago that the current technology for sending email just don't cut it anymore, and we need to move to something new. Anything new is going to be painful, and it has to be ubiquitous. The only way to get people to make a huge shift like that is to make it the obvious decision.
So, if spam levels are so bad that email isn't even useful anymore, people would consider switching. Now we need some smart people to come to a sweeping consensus on what we should move to so we can all hop on board.