Slashdot Mirror
The New Yorker On Spam
aqk notes an article in the Aug. 6th New Yorker surveying the spam problem up-to-date. The New Yorker may not be exactly the MSM, but it is pretty influential. The author got only one fact wrong that I noticed: Canter and Siegel's seminal spam was propagated through Usenet and not email. Still, it's a good look at the history of spam and the scale of the problem today. The amount of spam that "spam king" Robert Alan Soloway, indicted under the CAN-SPAM Act, is accused of sending over a period of four years is now pumped out about every 30 seconds, around the clock, around the world.
This article is a great short history on spam but no new information was presented to me here (and judging from the summary neither did it shed light on anything new to you).
I laugh at either of these hopes because the average person already deals with spam daily (my relatives began reaching out for me on ways to censor that from my younger cousins years ago) and we have a different mindset than businessmen & marketers.
The article mentions the epic article by Paul Graham entitled "A Plan for Spam." It may look long and arduous but I heavily recommend you read that. I will not forget reading that article nor will Slashdot. I think it helps more for the "mainstream media" to publish things like this for their readers.
Yes, it has code in it. Yes, it requires a bit of a priori knowledge in some places (pun intended). But, you know, a lot of times the best stuff comes from outsiders and I personally think that newspapers should develop a 'tech section' where they can throw off the mittens & grade school knowledge that need to be on in order to handle your average reader. I know many newspapers have entire sections devoted to sports--sometimes even just one particular sport if it's in season! I've seen many newspapers have 'articles/ads' for new automobiles, why not new technology? I know Popular Mechanics is
Which brings me back to an important point, you're not going to change anyone's mind. Everyone knows about it and if you think that Wallstreet businessmen are going to pick up the New Yorker & their jaw will drop when they read this article, you're sadly mistaken. If you think marketers will read this and say "My God, I need to start thinking about what I'm doing to the networks of the world," you're deluding yourself.
What we need is an article that causes people to seriously ask themselves how we can keep e-mail free and uncensored while at the same time stopping spam. When I was asked by my aunt, they were concerned for their daughter using the internet and opening a spam message to see a guy with his legs split around a phallic-looking cactus in an ad for Viagra. I showed them how to use Thunderbird instead of Outlook Express and how to turn on junk mail filter. I also pointed out how vulnerable you leave yourself to spam if you print your e-mail in plain text on the internet. They never had a problem with it again.
So while this article is informational, it does nothing practical for the reader. I realize--and I think a lot of people will agree with me--that the best way to stop spam is to stop clicking on it and show others how to do the same. The 0.001% response will dry up and spammers will drop off. Articles on how to configure yourself to spot spam would probably be the best thing mainstream media could print--sure would have helped my relatives!
My work here is dung.
Spam wouldn't be such a problem if we had proper verification of senders. Whether that's through some central identity or whatever. I realize this idea is extremely unpopular and is not in the spirit of the original Internet, but heck, if you had to essentially have an ID that verified who you were and if you sent out spam, you'd lose it, how much less spam would there be?
My blog
How is the New Yorker *NOT* MSM? it's practically on every newsstand from here to Moscow (and yes, I have traveled that far, and seen it there) It's lasted for over 80 years so far and has won more than just a handful of nationally and internationally recognized awards for journalism.
If anything the New Yorker is a good way to reach people that might not be quite as technically proficient or knowledgeable.
I will not give in to the terrorists. I will not become fearful.
An I.T. motto in the hands of an idiot is a dangerous thing...
I run a mail server for our 5 person business. I left at 8pm last night and got in at 6:45am this morning. During that time, 191 messages where blocked due to the content of the headers. 1,799 connection attempts where rejected due to being on rbls or part of my block list(182,910 entries). 351 pieces of spam still got through that and got caught by the filter which I went through by hand to verify that none of it was valid for users. I just finished going through everyones inboxes to make sure nothing got through. Wanna know how many valid pieces of mail for all 5 users? 17. 17 out of the potential 2,341 attempted mail deliveries within a 11 hour time span.
Just because your inbox doesn't have a lot of spam doesn't mean someone out there isn't making sure you see it that way.
Who died and elected him Spam King? (Not objecting, just hopeful that the previous Spam King died.)
One line blog. I hear that they're called Twitters now.
I'm in the middle of starting up a small business and was talking to someone about marketing. This individual (Not an in-duh-vidual - a Ph.D.) suggested that I send out mass emails. I told him that I can't do that because I'll be a spammer and my ISP will yank my account. He then mentioned that they're are ways to mask my origins. I said if I get caught doing that, I'll be in even more trouble. Besides, I DON'T want to be a spammer.
My point? Spamming has become so standard and everyday that people don't even give it a second look now and just consider it an annoyance at worst. The only people who really care are those of us in IT.
I prefer Flambe as apposed flamebait.
Well, they're trying to send a lot, but with a proper setup at and around your mail server, you will not be seeing much of it anyway.
Simple greylisting helps a lot, supplemented with greytrapping-generated blacklists (with 24 hour expiry) it's even fun to watch. The last 2-3 percent that actually makes it through to be seen by content filtering gets converted back to free electrons.
I've had a series of blog entries over at bsdly.blogspot.com about this and the conclusion is clear - with a competent system administrator, Spam is a solved problem (Links to other refs inside, follow links).
-- That grumpy BSD guy - http://bsdly.blogspot.com/
This comes up every single time there is a discussion about spam.
... that will not also allow the spammers to grab fake addresses whenever they want to.
It is simply impossible to have a system that will identify EVERYONE in the world
Now, the first time ANY SINGLE ONE of those people get infected, anything that appears to be an email address will be uploaded to the spammer's computer.
From the spammer's perspective, that is the whole purpose of those "scams". To get more LEGITIMATE email addresses on more people's machines so that the spammer only needs to infect ONE machine to get ALL the addresses.
Just the other day I ran across an old thread on the linux security audit mailing list where a few of us were bitching about the second spam in a month! In the end, they elected to leave it an open, unmoderated list so that non-subscribing developers could continue to post responses to things they may have been cc'd on.
Seven short years later and our current spam catch rate (at a regional CLEC) is over 98% and far from perfect...
A couple of 30-somethings embark on the ultimate roadtrip
there is no free lunch. Spam is the latest iteration of the Tragedy of the Commons, and will persist as long as email is "free".
Yet about half the spam that gets through my system comes from HotMail and GMail.
And let's not forget the cute ads that Microsoft appends to outgoing Hotmail messages. So, someone sends spam through Hotmail, which ends up with the ad attached
That's great. The spam gets through and the legitimate messages are blocked. Maybe Microsoft could have put a bit more thought into their process? No? Getting the ads out is too important?
Here's a thought. How about Microsoft and Google throttle the outbound connections on their servers? One message every 5 seconds? And take an account off-line AND ALL ITS PENDING MESSAGES if they get a complaint? Google has smart people. I'm sure they could work out an automatic arrangement with the larger anti-spam sites.
The only "web of trust" you can really trust is your own white list.
I'd rather focus on the opposite. Identifying ranges that are 99.9%+ likely to be spammers. Like most of the home accounts on Comcast and Verizon and such.
Oh man, I wish I had your optimism. But I'm a geezer, I'm beyond hope.
I personally think that newspapers should develop a 'tech section' where they can throw off the mittens & grade school knowledge that need to be on in order to handle your average reader.
Not me, I cringe every time I see the single weekly article by some so-called "tech guy" in a mainstream newspaper where someone (a non-nerd, obviously) says something like "my internet stopped working, what do I do?" and the answer starts with "first, open Internet Explorer. That's the program that lets you get on the internet"... GAH!!!! Someone will complain about viruses, does the guy ever mention Firefox? The fucktard doesn't seem to have ever HEARD of firefox, Linux, or OSS. Thankfully, the guy linked has retired. Hooray!
I know many newspapers have entire sections devoted to sports--sometimes even just one particular sport if it's in season!
That's because 48% of Americans (99% of males, probably not just Americans but men world-wide) are sometimes jocks and usually overweight wannabe jocks who love nothing better than to sit in front of the boob tube watching sports, memorizing meaningless statistics, and believing that it actually matters whether or not "their" team won the "big game" while not giving two shits or even knowing about warrantless wiretapping, limitless copyrights, the inability to make backups of DVDs they've bought, etc.
Sorry man (for me as well as for you) but it ain't gonna happen, not in my lifetime and not even in yours.
What we need is an article that causes people to seriously ask themselves how we can keep e-mail free and uncensored while at the same time stopping spam.
You're not going to see an article like that in the MSM or even in most so-called "tech" rags or sites. There are a lot of people who think they're geeks (Geek Squad anyone?) just because they own a computer!
So while this article is informational, it does nothing practical for the reader.
Informational for Aunt Gussie, not for you or me. And informing Aunt Gussie is practical.
the best way to stop spam is to stop clicking on it and show others how to do the same.
Ignorance is curable, but unfortunately stupidity is not. There are enough people who know better than to click on spam but are stupid enough to do it anyway. Hell, my oldest daughter is brain damaged with an IQ of 65 but even she is smart enough to not click on spam! But college professors do it anyway.
The situation is hopeless. If enough countries (esp. the US where most of the spam comes from) outlawed commercail unsolicited email with serious prison time for offenders, the spam problem would dry up... just like the "drug problem" has dried up.
It's hopeless.
=(
-mcgrew
Sure, and while we're at it, if everyone was required under penalty of death to have their name tattooed in large block letters on their forehead, then I wouldn't have to worry about embarrassing myself forgetting people's names at dinner parties.
Some 'solutions' are worse than the problems they purport to solve.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Nope. They can't fake the IP address if you don't have pipelining turned on. It's coming from their IP's.
That's the problem. You cannot "trust" Hotmail or GMail because they ARE used by spammers.
And there is no technological reason why they could not address that issue. They know that spammers will open accounts with them. Yet they take no steps to mitigate that. Even limiting the outbound emails from each account would help. And having an automated process for reporting and blocking spam from them would pretty much solve the rest of the problem with them.
No kidding. I admin a medium sized ISP. We have 8 (soon to be 9) distributed servers dedicated to email.
3 load balanced e-mail filtering appliances, at the Internet facing edge. (Basically, BSD boxes running postfix, spamassasin, clamav, policyd, DCC checks, RBL and a few other checkers and daemons I'm forgetting.) They get about 90% of our spam.
2 load balanced postfix boxes, running policyd on our outgoing mail, they will greylist any naughty customers with a zombie that have sent to much. Also, they do inbound user verification with LDAP, if spam has BCCed an invalid recipient or two, reject. Add another layer of anti-virus on the way to the customers. This catches another 8-9%. I'm guessing around 1% gets through.
1 DCC server, because we exceeded the threshold for being able to use free DCC long ago. (I'll admit it's a bit under used.)
1 MTA running exim for the hosted domains. This has spamassain, and a few other services, supplementary to everything in front of it. I'd say it gets most of the rest for those with hosted domains.
1 big bad 8x processor pop server that runs webmail and pop for the customers. It does no spam checking, because it could never handle the load, just stores what we think is not spam for the customers, around 25,000 accounts.
By comparison, we need one (1) production, not counting backups, provisioning server. It handles minor things like DHCP for 15,000 customers.
Now you have an idea on what your ISP spends its money and resources on. There is no small industry selling you solutions to fight the SPAM.
Every spam message sent has a business model behind it: Whether it's selling fake pharmaceuticals or convincing gullible people to fly to Amsterdam with suitcases of cash for an imaginary nigerian prince, the point of every Spam mail is to get someone to part with their cash.
That means there always has to be a point of contact, some mechanism by which the victim delivers money to the spammer: Whether it's a paypal account or a bank account or an arrangement to meet the African-looking geezer in the "I am in Ur inb0x steelin Ur muneez" T-shirt down at Skiphol airport, that means there is a trail by which law-enforcement can track these bastards down. Sure, this can be complicated and obfuscated by international boundaries and the spammers' sneakiness, but with sufficient resources every single one of these people ought to be traceable. Couldn't the international law-enforcement community just take some of the 10 billion dollars (or however much TFA stated) spent annually on spam-filtering and spend it instead taking the spam-bait and then using the payment methods to track the bastards down and nail their collective goolies to a wall?
Hell, if every frustrated server admin in the world were to donate $1 each I reckon we'd have enough to send some heavies round...
"The amount of harm done by any of the cited 'unfair' things the net has been used for is clearly very small,'' the Internet pioneer Richard Stallman wrote a few days after the DEC e-mail. Stallman opposed any action that would interfere with the aggressive openness that came to define the Web. And he still does. In his message about the DEC spam, Stallman pointed out--three decades before the appearance of Craigs-list and Monster.com--that the network provided a unique opportunity to advertise jobs and an entirely new way to sell products. He went even further: "Would a dating service on the net be 'frowned upon' . . . ? I hope not. But even if it is, don't let that stop you from notifying me via net mail if you start one."
I guess RMS wants spam. Quick! Forward all your spam to RMS! He wants it! He can have it!
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
Have you put both the "From" and the "Reply-To" addresses on the mailing list into your Gmail address book? I've found that seems to keep mail in my Inbox instead of in Spam. (I think it's only the "From" that matters, but you can put both in there to be sure.)
I'm not sure it's an automatic 100% non-spam rating, but it does seem to be worth some points at some point in Google's filtering process.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
I get more spam than ever. And setting up spam filtering on Evolution is much harder than it should be. In fact, I couldn't even find a simple, clear, authoritave instruction for starting it. When it should just be on by default when I first install Evolution.
--
make install -not war
Does anyone for all these 20 years thought that there might be some deficiency in Email protocol itself?
Yet about half the spam that gets through my system comes from HotMail and GMail
... if you're going to be another one of these tedious /. Microsoft basher, you should learn to get it right.
Sigh
Both Hotmail and Gmail do an excellent job of spam filtering.
Try looking at your 'Hotmail' email wrapper sometimes.
You DO know what that is, don't you?
.
- aqk
F U
Good grief!
Is Gates offering a $1000 now?!
When I first got that tracker, it was only $500! Still I dutifully forwarded it to hundreds of people, and eventually Bill sent me $127,000 !!
To this day I still get a residual $500 every few months.
But perhaps it's time I contacted Micro$oft (There! I finally got to use that spelling!) and asked for the full $1000 monty that other people are now getting!
What do you think?
What's so striking is that there are so few different spams that make it through the filters. And most of the top spammers are known; see the ROKSO list. They're all crooks; legitimate businesses haven't been able to spam through filters in years now. With slightly more law enforcement effort, most of those spammers could be put behind bars. Two or three go to jail every year now; if that could be increased to ten or twenty, the problem would drop substantially.
The way to find them is by following the money. The FBI and Treasury have the means in place to do that, developed for money laundering. That's what FinCEN does. It's tough to repeatedly collect money via credit card and hide from FinCEN. Especially when investigators can initiate tranactions themselves, which is easy enough with Viagra spammers. Maybe after Bush is out of office this can be addressed.
Actually, if some anti-spam people wanted to deal with the Viagra spammers, it would be easy enough. Find the order form, and start ordering using a script. Use random credit card numbers that will pass the check digit check, delivery addresses of random buildings or PO boxes, and a broad range of IP addresses via proxies. The orders will all be rejected at credit card check, but their credit card service provider will hit them with a fee for each bogus transaction. Drive them out of business that way.
only old people receive spam
You ARE my boss, you pointy-headed nitwit!
Now go back to sleep, and let me get my job done, you moronic micromanager!
(I refer to your intellect as well as your managerial style)
The author's source material is a great short history of spam, too: I didn't read anything new on the early history of spam in the New Yorker because I'd already read it elsewhere. Yet the New Yorker author only obliquely referenced his source materials when he mentions Brad Templeton (EFF chairman, etc.) via a quote. If I was the editor for that article I'd have pushed for more research credit to be given.
Brad Templeton's collection of essays on spam includes:
Huh!
/. !!
Some guy further up this thread cited Matthew Arnold's "Dover Beach"
I'll bet that's the first time Matthew Arnold ever got play in
.
- aqk
F U
"Those who make peaceful revolution impossible, make violent revolution inevitable" - JFK