Slashdot Mirror
New Opt-Out Clause Makes CAN-SPAM Worse
snydeq writes "Three years of mulling, and the FTC has made the CAN-SPAM Act worse, writes Gripe Line's Ed Foster. Chief among the offenses in the FTC's updated rules is an even worse approach to opt-out procedures. In the future, in scenarios where multiple marketers use a single email message to spam you, 'only one of the senders — the one in the From: field — need be designated the official sender who is responsible for honoring opt-outs,' Foster writes. Translation? 'Other "marketers" who used that spam message, not to mention the spamming service that actually provided the email address list, don't need to honor opt-outs. So try as you might to get yourself off a list, the real spammer can just keep changing the designated sender in the From: field and legally keep on spamming you.' The irony of the CAN-SPAM moniker gets thicker."
At least the accuracy of the moniker is increasing. Better than PATRIOT act, digital rights management, etc.
They should have named it "MAY-SPAM"
Come on folks you've got to admire sheer dumb ass brilliance of this level. This isn't a matter of minor incompetence this is world class stupidity. Checking my SPAM folder at the moment I picked out a few that looked similar and everyone had a different email address
So in other words this brilliant change in the rules now means that SPAM isn't SPAM. Maybe that is the real way to get rid of it... just define that it doesn't exist.
There is no poverty in North Korea either apparently.
An Eye for an Eye will make the whole world blind - Gandhi
Just think I can have all kinds of people who had a dead uncle leave me millions of dollars in a Nepal lottery and now can't touch the money without offering me a job processing money orders for 50% of the take and a free bottle of Viagr14!!!!
Like arts? Like cheesy little Indie mags? Check out www.artwerkmag.com, and don't laugh at the bad coding please.
2. Things that are done for money are good. Corollary: people wouldn't do good things but for being given money. Well, we wouldn't, and we have no problem extrapolating to everybody.
3. Spamming is done for money.
4. Therefore spamming is good.
Other "marketers" who used that spam message, not to mention the spamming service that actually provided the email address list, don't need to honor opt-outs
Damn! I guess this means an end to the three wonderful years of relief we've all enjoyed from spam thanks to the oh-so-effective initial rules.
Seriously, this change really doesn't matter, except it will let the FTC claim success due to a massive drop in the number of "valid" complaints against spammers. Whining that it weakens the existing law strikes me as similar to complaining that a serial killer violated a restraining order.
I fully expect within the next few years we will see average Joe hacker ... as in a person who likes to fool with technology ... begin a personal and secret computer assault against any business or organization who uses the services of spammers.
In other words, if those in power won't protect me, why should I feel I am doing anything wrong to try and protect myself?
If using the services of a spammer gets your network shot down with any sort of reliable regularity, it seems logical that using them is going to become a harder and harder decision to justify. Make 40G's using the spammer, spend 37G's fixing the network damage that follows.
In the long run, I see this fight as one that cannot go any other way.
In B.C., our fascism is green.
It seems that they managed to take a completely toothless act, and make it even less helpful.
I guess it is no wonder that congress has managed to somehow attain an even lower approval rating than our current commander-in-chief, seeing as they managed to squirt out something like this instead of dealing with important national issues.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
This can work. After all, most spammers comply with the rest of the act and are legitimate, honest and upright business owners, right?
I mean, such good people would surely include a visible and operable unsubscribe mechanism, honored quickly and used only for compliance purposes.
And they would provide relevant subject lines, legitimate physical addresses, and adult-content labels on their "value-added, pre-solicited sales invitation messages."
And, of course, never falsify header information, use open relays, or send messages to a harvested email address. Right?
Seriously, what are they really hoping to accomplish with this act? Has it done any significant good?
Who do these lawmakers use as expert advisors on technical issues? Members of the Geek Squad that worked for Best Buy for a month, before being let go?
Steve Richter, father and lawyer to "SPAM KING" Scott Richter helped write the CAN-SPAM act. The act is a joke.
and make it easier to transport, for a wider audience.
two more changes, and they can change the name of the bill as well, to "MUST spam."
if this is supposed to be a new economy, how come they still want my old fashioned money?
Stone cold dead.
If you mod me down, I shall become more powerful than you could possibly imagine.
Why not just cut out the middleman and write the spammers directly, giving them my address and asking them to please stop sending me anything, or not to do so in the future if they didn't already have it?
Wish I hadn't just used my mod points today, that was damn funny. I guess some mod just got his first points and doesn't understand humor very well.
0x09F911029D74E35BD84156C5635688C0
First let me qualify by saying that I am not only a lawyer in the Internet and anti-spam industry, but I helped author the "affiliate spam" section of CAN-SPAM, to which this clause is a natural extension. We are also fresh from a teleseminar which we provided on this very subject.
The following is an excerpt from our CAN-SPAM compliance page, which is at http://www.isipp.com/can-spam.php:
In large part, this requirement is an effort to hold affiliate programs responsible for how their affiliates promote them. If the affiliate is honest about who they are, and their "From address", and if they put something in the email about themselves, then the user will be able to unsubscribe from the affiliate's list. But if the affiliate is dishonest, and hides their true identity, then the affiliate program for the product featured in the email (which will be the product being sold under the affiliate program) becomes responsible. In other words, if you are advertised in the affiliate's email, and the affiliate cloaks who they are, you become responsible. By shifting responsiblity for mislabled email to the companies being advertised in the email, there is an incentive for affiliate program managers to more tightly police their affiliates.
Anne P. Mitchell, Esq.
CEO/President
Institute for Spam and Internet Public Policy
http://www.isipp.com/
SO if i opt out of the gripe-line newletter the other 393473 infoworld divisions won't be affected......
wait...what was the gripe again?
ok, not really a problem with them but it does make a nice example
Don't forget fake MX records, greylists, adaptive filters, RTBLs, checksum lists, magic fairies, and leprechauns, at least if you want to maintain a public address. (Can we please drop SMTP already? Just looking at my inbox is vomit-inducing.)
I just read Slashdot for the articles.
Find the spammers, and impale them. DEATH TO SPAMMERS!
I write sci-fi for metalheads
imagine if I obfuscate all my emails, but always mention an item avaialble from amazon.
every day http://en.wikipedia.org/wiki/Special:Random
English is not my first language. Corrections and suggestions are welcome.
The whole opt-out procedure is not practical, unless you could check the certificate of the spammer website maybe :)
Just click on the opt-out link to assure spammers of an active email address (in the best case).
Oh great, more junk on my mail server. Someone lobbied the heck out of the FTC to allow more people to spam us. We need to start with an clean sheet so no one in the USA is on any mailing list then opt in to any list one may like. Opting out of every mailing list is nearly impossible since most of the mailing list "we signed up for" were either stolen from legitimate companies or companies that gone bye-bye and people have "acquired" these list. Most spammer may put a "opt-out" link or email address but reality are just another "sign up" for more spam. Also most spam come from other countries where FTC has no jurisdiction.
Please FTC, start us with the "clean sheet" method so we can properly opt-in to the mailing we want from legitimate USA companies since already get tons of spam from foreign countries in which you have no control over.
Your post advocates a
( ) technical (X) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
(X) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(X) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
(X) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Kayamon
Spam lacks sufficient definition. While there are certain things that most of us can agree are spam, there is a sufficiently large gray area that it's not really possible to define clearly as law.
However, some things are absurdly easy to define -- take freedom of speech. You are allowed to say pretty much what you want, where you want, short of "Fire!" in a crowded theater. No one has yet found a way to twist the First Amendment into meaning something it doesn't -- into somehow meaning, for example, that all speech except blasphemy is protected.
Murder is another one. Killing someone on purpose is murder, short of self-defense or actual war.
I think net neutrality is sufficiently easy to define that if we can get any law right, it should be this one. ISPs should transfer all packets to where they are addressed, with no preference given to one packet over another -- except for a specific customer, at their explicit request (if I ask for a spamfilter, they may intercept port 25.)
Granted, telcos may subvert the process, but I'd rather at least try than have no legislation at all.
Don't thank God, thank a doctor!
I have never seen a viable alternative to SMTP, period. And I've never seen a system which is sufficiently open as to replace SMTP, without also allowing spam.
I get at least a few hundred spams a day -- I wouldn't be surprised if it's approaching 500-1000 -- at the email address I use here, which is in public, in plaintext, in a few places. Last time I really checked, I got no false positives -- nowdays, I barely touch the Spam folder, and mostly sort through the Unsure folder.
No more than 10 spams per day, and usually about 5, make it to Unsure. Maybe one or two false positives, occasionally.
And maybe one, once a week or so, makes it to my Inbox.
For the record, I use Bogofilter. That's it, aside from a custom retraining script over IMAP.
And I get no more than one spam a day, at one of my two Gmail addresses -- and Gmail does automatically mark them as spam.
Don't thank God, thank a doctor!
Did anyone actually think CAN-SPAM would actually help?
I want to delete my account but Slashdot doesn't allow it.
How about we just allow fucking Viagra to be sold over the counter, without a prescription at any drug store? Pick up a hot dog, slurpee, the latest issue of Low Rider, oh, yeah, and a vial of Viagra.
Shouldn't that at least cut out the Viagra spam?
CAN-SPAM is a farce, anyone who believes otherwise either does not have an inbox or thinks the Internet is made of tubes.
This change essentially has no effect for me or anyone with half a brain. You should never respond to the "remove me" link in spam. It only serves to tell the sender that a human actually read the message and confirms your existence. This is dealing-with-spam 101.
You apparently don't have to handle mail to 'postmaster' or 'admin'. It gets pretty hard to let the real email through.
Don't thank God, thank a doctor!
I have outlined an open, spam-proof system here: http://mobile.slashdot.org/comments.pl?sid=549310&cid=23368790
Technically it is doable, the problem is adoption (chicken vs egg).
On a side note: I get tired of people bragging about the efficiency of their spam-filters.
The situation is not acceptable no matter how good we get at hiding the problem.
Spam constantly wastes a huge amount of technical and mental ressources worldwide
and drastically reduces the usefulness of E-Mail as a whole.
There are possible technical and legislative solutions and I can't stop wondering why nobody with sufficient ressources has taken on the challenge, yet. This is not something an individual or a small group can solve in a realistic timeframe, due to the adoption and/or legal barriers. But a bigger entity with a large audience (google, yahoo, microsoft) could very well make a start and solve the technical part by enabling a SMTP-replacement like the one I outlined in the other post.
It is clear to all sufficiently-experienced observers that the CAN-SPAM act was designed and intended to provide a legal pretext for spam. The earnest support and widespread participation of some of the largest and most notorious spammers provided ample evidence of that, even before the precise language was agreed to. Everyone who is actually anti-spam opposed CAN-SPAM and continues to do so -- they recognize that the bill is utterly worthless, e.g., it fails to even use the correct definition of spam. (To wit, "unsolicited bulk email"; all other definitions are put forth by ignorant newbies or spammers; there are no exceptions.) Best practice is to instantly and permanently blacklist anyone or anything citing CAN-SPAM compliance for their actions: they are the enemy.
I've spent a lot of time training SpamAssassin and exim with RBLDNS lists of known spammers. And feeding spamassassin with corpuses of spam on a regular basis. I've reduced the spam incoming to peoples boxes from 1000's to 18 per day throught the whole organisation. The boss hasn't given em a promotion yet but I deserve one for being the SPAMINATOR!! SO CAN-SPAM VERSUS THE SPAMINATOR, lets get ready to ruuuuuummmmmbbbbblllllleeeeee!
It seems to me that we could do a lot better just by taking a few smaller, more realistic steps.
For example, "e-mail 2.0" could provide a standardised way of identifying legitimate sending relays for given domain names, the kind of technique currently used (but in a non-standard, loophole-ridden, poorly-supported fashion) by SenderID, DomainKeys et al.
We could improve the error message system, as well. Just this week, a domain I administer got hit with hundreds of bounce messages per minute for a while, because someone kindly sent out a mass spam run with "webmaster@my.domain" as the From: address and a zillion lemming sysadmins kindly bounced it back to me. This is not a commercial set-up and beyond a certain threshold I have to pay for the bandwidth I use, so this did not amuse me: I have decent spam filtering myself, and I don't need thousands of systems who don't to wrap up the spam in a nice, relatively filter-proof way and send it right back to me!
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Your "solution" has one problem: it assumes a real-time interactive channel. How, for instance, is it going to ask the sender to respond to a captcha when the mail's being handled by an intermediate relay (ISP smart-host) and the sender isn't connected anymore? And if it asks you to authorize the mail, how is it going to do that without having to make you look at each and every incoming mail, spam or not, so you can decide?
and doesn't have to.
I'm not going to bother getting into the specifics again, but if you want no spam and no lost email - just write a program that does the same thing with your email that you do. It's really not that hard, you can even do with using just a series of cascading filters. The only spam I've gotten in the last *decade* was 2 instances of a clueless spammer who was manually verifying himself to my system. And I've never had anyone tell me they sent me an email that I didn't get.
Spam is a *very* easy problem to fix, because all spammers know about you is your email address - whereas anyone you'd actually want to hear from either knows a wee bit more, or can pass a simple challenge-response sent to the reply to address(because real people don't use fake ones).
The only pisser is that automating it ain't cheap, because you have to do a lot of processing to really simulate how you do things. Oh, and you can get your web host black listed if you try to process more than 2 high spam accounts because it sends out so many non-deliverable challenge response emails. You won't have the problem if you write it on the client side though - and trust me, it takes less time than dealing with spam.
That's a matter of protocol design, you're still thinking in terms of SMTP.
There are various approaches to this but it boils down to: The challenges take place between the sending MUA and the receiving MTA. They happen in realtime whenever possible but can also be timeshifted when necessary. I see 2 possible scenarios in your intermediate hop example:
a) Relay can reach the final destination immediately. In that case I would propose to simply make the relay act as a proxy between the two endpoints.
b) Relay cannot reach the destination immediately (e.g. dialup). In that case I would fallback to store & forward like SMTP. The challenge can not be presented
immediately in that case but remember: if you're expecting a challenge then this is your very first contact to the recipient. I don't think the tiny
introductionary effort [of being presented with the challenge the next hour or day] is unreasonable.
There's an alternate option to make scenario b) even more comfortable: 3rd party challenge providers, like ReCaptcha. Even when you (i.e. your receiving MTA) is not directly reachable you, as a recipient, may choose to trust messages signed by such a 3rd party for these cases.
Remember, the challenge happens before the e-mail will even be accepted for delivery.
So there is no incoming mail to look at. Instead I would allow a short challenge message of maybe 60 characters or so.
Sure, spammers would try to drown us in bogus challenges with advertising content but I think they would soon starve due to ineffectivity...
And if they don't - well. Then forget about the manual confirmation and rely on captcha alone. Cracking a captcha for each individual recipient simply does not scale, no matter how you do it.
Unfortunately "relay cannot reach the destination immediately" is the standard configuration. On almost every ISP MUAs (or user MTAs) are required to hand mail to an internal MTA. That MTA will then send the mail through processing and hand it to another MTA. That second MTA will handle the actual delivery to the recipient's MTA. And I don't see ISPs changing that setup until after spam and the problems an ISP gets from having customers on it's network used to spam are elimianted, so your protocol will have to contend with this setup if it wants to get adopted. And your system has another problem: what happens if the sender also implements it? I go to send an e-mail to you, the first e-mail I've sent to you. You've never sent one to me either. Your system sends me a challenge. My system sees you sending me an e-mail for the first time, and sends you a challenge. Your system sees a second e-mail from me without me having responded to your challenge (because I haven't been presented with your challenge, and won't be until you respond to my challenge). How do you propose to resolve this deadlock? And no, allowing challenges through won't work, because if you allow that then the spammers will simply wrap their spam up as a challenge. And no, having the sender keep track of which challenges it's sent won't help, because people use more than one computer (work machine, home machine, laptop, and let's not even get into those of us with multiple home machines plus multiple remote servers that we use when the local network policies are too restrictive for our normal e-mail to work). Server-side won't work either, my mail for example goes out via my ISP (because of my ISP's policies) but the mail server that you'll send the challenge to belongs to a completely different ISP (the one who hosts my domain and handles my mail) in a different state.
Well, I can only repeat: Don't think in terms of SMTP.
Once you forget that SMTP ever existed you realize that all the problems you mentioned are simply a matter of engineering the protocol properly.
I did admit in my first post what the big problem with my approach is: adoption.
There is no sane "transition path". If there was then we'd probably already be using something like this...
Anyways, everything you mentioned is solvable.
Multi-hop routing could be done just like I explained in my last post.
Challenge deadlock is not an issue because challenges are not mails and not treated as such.
Mobility and "what about my ISP, multiple accounts, etc." issues seem complicated at a glance but are usually easy to solve, too. The general approach would be to replicate your blacklist, whitelist and settings to all receiving MTAs so they can make the right decisions on your behalf. You trust all your receiving MTAs by definition, thus this is just a matter of delegating various tasks to them - a matter of protocol design.
On a side note: I get tired of people bragging about the efficiency of their spam-filters. The situation is not acceptable no matter how good we get at hiding the problem.
I'm sorry, maybe I wasn't clear. Spam is not a problem for me. If spam is a problem for anyone else, they are doing something wrong.
Spam constantly wastes a huge amount of technical and mental ressources worldwide
Again: It wastes close to zero technical resources, and close to zero mental resources, when I don't count trying to explain the brutal simplicity of my approach to others. It's not even mine -- pretty standard Bogofilter implementation. Add a tarpit, and it wouldn't even waste bandwidth -- but then, I never had a problem with spam wasting bandwidth on 1 mbit DSL, so it's completely off my radar at 100 mbit fiber.
I have outlined an open, spam-proof system here:
Since I can't reply there, I'm replying here:
Your post advocates a
(X) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
(X) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
(X) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(X) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
(X) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(X) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(X) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
(X) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(X) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government
Don't thank God, thank a doctor!
And when the receiving MTA isn't under your control and isn't going to accept configuration from you? Think GMail or Yahoo Mail. How does your sync idea work when you can't sync?
When you brush it off as "easy to solve" without a solution in hand, I'm afraid my response is "OK, talk to me when you've got an implementation we can test.". Cynical and brusque, yes, but you sound exactly like the last two dozen youngsters on the teams at work whose failures I've had to clean up after.
Well, why would the receiving MTA not accept configuration from me?
It'd be in the protocol, remember?
Your config would sync to the MTA (and the other way) as part of the handshake. Versioning is easy to implement here since we're holding a cryptographic identity. The MTA would actually be the primary location where your config and white/blacklists are stored. Sync'ing with your client is merely done so that you can modify the stuff offline and for efficiency.
I'm not going to implement this due to time constraints but I may scribble up a RFC one day. Unless someone presents an insurmountable problem with my approach, ofcourse - but you didn't do that. All your questions (and this one is no different) still assume SMTP roles and semantics. You keep forgetting that backwards compatibility is not part of the idea.
Your question "What if the server doesn't comply" is akin to the question "What if your SMTP server doesn't accept the HELO command?".
The answer is: In that case it is not a SMTP server or it has a bug.