Slashdot Mirror
Spammers Choose GMail
EdwardLAN writes "A study by Roaring Penguin has discovered that during the past three weeks, the amount of spam originating from Gmail has risen sharply." My spam has been pretty ridiculously high for the last few weeks, although I have no idea if this is part of it. It really does seem like gmail's spam filters are declining these days.
Maybe they should have just kept the system invite-only, instead of opening it up to everyone -- that would help, the way I see it.
How does spammers creating gmail accounts to send spam from imply that gmail's spam filters for inbound mail are declining? (if that is indeed what the summary is supposed to say).
Stop using you Gmail address when signing upto porn, warez and cracks forums?
Half of the spam I get on my gmail account that actually gets past the filter is in some language other than English... in fact its almost always in Cyrillic as well.
Give me a damn drop down that says "I speak English, anything not in English is not to me".
Won't solve their outgoing problem, but adding "this is my language" support would be a big help on the incoming, at least with my spam patterns.
Funny considering my gmail is relatively spam free!
The irony is, hotmail and yahoo will be getting spammed instead of being the spammers.
The IT staff at my dad's company blocked all communication with Gmail servers a few months ago, on the grounds that it was 'insecure'. Locking down an MS shop (XP/Exchange/etc) from the 'insecurity' of Google (while still accepting hotmail.com emails) still strikes me as a bit odd, but I've been hearing more reports of lax Google security with respect to spam/spammers. Perhaps they (dad's company) were on to something?
Anyone else having issues with people blocking Gmail?
creation science book
Last 3 weeks my spam on Gmail has been in very large quantities. Exceedingly irritating! I wonder what has caused this?
I've got maybe 3 a week, which is up from the normal of 1 per month, but it's not really too big of a deal.
IIRC, marking an email as spam or moving the message to the spam folder (if you're using Gmail's IMAP function as I am) helps to train the filter.
I want an option to have spam be deleted upon receipt instead of being placed into the spam section. After all of these years Gmail has never once mistaken a real email for spam so I would like this.
Gmail used to be touted as the best spam filtering service. Certainly it's good, but apparently they only feel the need to filtering incoming messages. Why not filter outgoing messages as well? Can't quite be a CPU problem, because outgoing has be be just a small fraction of incoming, right?
Is it just tradition? People never expect anything they send to ever have anything done to it? Google could set another precedent in webmail by introducing outgoing filters which would block or slow down mail appearing to be 'spammy'.
creation science book
When will we see spam mails that advertise free GMail invites?
(I know it's open registration nowadays but CMON!)
Yeah I've thought the same thing, too. It wouldn't be that hard to filter. You could just select a charset (like Latin-1) and if less than 90% of the characters in a given message aren't representable in your chosen charset, automatically kill it. That wouldn't require figuring out the actual human language it was written in; it's a pretty trivial automatic test.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
That option shouldn't be on by default though. I review my spam folder about once every month, and I *occasionally* find something from someone that is truly real email. Granted, we're talking about 1-2 emails per 10,000 or more, but I'd still prefer the default of just labelling them 'spam', not deleting.
creation science book
I have noticed this in the signups to my mailing list. I'm not sure why they are signing up, maybe they think they are leaving comment spam? Anyway all the addresses have the same format, a long first and last name followed by 2 numbers eg: EleftheriosZhytup84@gmail.com . Strange.
ccalam - acoustic versions of new songs.
Someone must have busted the captcha again, that prevents autonatic sign-up
Time to stop hiring people on the basis of being able to quickly answer standard undergraduate compsci problems and memorise specs that are available at the click of a mouse.
Microsoft (I worked there a couple of years, please don't crucify me) has taken many more years to not learn that they suffer the same problem. A college star is not an excellent engineer with a track record of solving real-world problems. And this is why Google, like Microsoft, keeps trying to branch out of its core competence (search / office respectively) and keeps failing. These companies can only afford a stream of loss-making projects because of their one or two hugely profitable ventures.
No spam message made it to my inbox in the past weeks.
When they say free porn, just enter you e-mail, it's a trap.
It's the outgoing spam from Gmail that's the problem, not the incoming spam, and there's been messages on the Gmail forums about Gmail servers being blocked for spam. If Google doesn't do something about it, then Gmail accounts will end up "read only".
And having Google themselves impose outgoing spam filtering is something else to worry about, if you're a Gmail user.
They'll close the holes when it is out of beta.
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
I haven't noticed any particular trouble with spam originating from Gmail, and Gmail has still been pretty good at filtering most of my spam.
But if you really want Google to do something about spam, go after them for their negligence on google groups. They've allowed the service to become almost unusable due to the amount of spam they allow through. For actual Google Groups it's not a big problem, but for USENET groups it is. Most people on USENET are just dropping anything coming from Google Groups outright. Any legitimate posts from Google Groups are considered an "acceptable loss" given the amount of godawful spam they allow through. It really cheeses me off that Google won't do something about it.
The article here http://tech.slashdot.org/tech/08/07/16/2220232.shtml may have a somthing to do with this. Just a thought?
who the hell cares about spam!?! So some russian kids are trying to sell you viagra pills! It is not the end of the world that hours of programing leaves you impotent!
In Wednesday's article, it was revealed that through a bug in Gmails software is was possible to send personalized spam. I guess it's true.
Crikey, you leaf through 200 pages of emails and manage to find the 1 or 2 false positives? That must take a while.
"Wise men talk because they have something to say; fools, because they have to say something" - Plato
The summary implies that there's something wrong with the GMail spam filters. Actually, the problem is with the GMail spammer filters... the CAPTCHA.
Also, both Google and spammers are being overly complacent about people blocking GMail:
Actually, several sites have blocked Google SMTP hosts that show large spam outflow (it seems to be specific hosts, as if specific accounts are allocated to specific servers or clusters of servers). Including, and I know the irony is thick enough to cut with a knife, MSN Hotmail. There have even been a number of posts to Google's help forums complaining about mail not being sent because Google servers are being blacklisted.
The fact that more spam is originating from Gmail is not indicative of Gmails spam filters being less effective, I think they only scam mail sent to Gmail accounts.
We know that the Gmail Captcha was broken a few months back. It's more likely that a variant of that tool has become more widely distributed and/or cheaper and has found it's way into the hands of script-kiddies.
bad news about Google will be: *insert fingers in ears* NA NA NA NA NA NA NA NA NA! I can't hear you! NA NA NA NA NA NA!
I'm baffled why it's so hard to put some dropdown on gmail (or a set of checkboxes) that say "Here are the languages I can speak/read:", and let me pick English. I'm getting a ton of Russian spam coming in with a character set I don't even know, ... seems like that would be incredibly easy way to filter some of this stuff.
I wrote to them about this during the early Beta. They were not interested.
My mistake was signing up for a Spanish (Spamish?) site. I don't speak Spanish but I guessed the form fields for username, password, email address. The floodgates opened afer that.
Back to the topic, why doesn't Google just change their CAPTCHA? It sounds too simple a solution...
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
We really need to make a change in the way e-mail is done, but I don't know how. While white-listing seems like a good approach, there's always the catch 22 where somebody changes their e-mail address. I know public/private keys would also help, but I think that's too far over the head of most non-tech savvy individuals.
Taking guns away from the 99% gives the 1% 100% of the power.
You don't say? I own a few domain names and to make life easier for me, I have setup 'catch all' e-mail forwards. I get about 30-40 spam messages a day. Gmail catches all of them with the exception of one every few weeks.
This has nothing to do with spam *to* GMail users, it's about spam *from* GMail users.
No, actually I've found them on the first couple pages. There might be a few more that get through, but I don't normally go back but a day or so (3-4 pages maybe).
If I see a false positive, I'll do searches in the spam folder for mail from people I was corresponding with lately, just to make sure nothing's in there. It's a rarity, but does happen.
creation science book
TFA is talking about the popularity of gmail accounts for sending spam now that Google's CAPTCHA has been cracked. This has nothing to do with how effective your gmail is filtered.
body massage!
Most of the comments on this page are about *incoming* spam to google, when the article itself is about *outgoing* spam from google.
Yeah thats why I mentioned the Cyrillic thing.
In reality doing it via language matching should be pretty trivial. I'd hazard a guess if you had a list of 30 languages and you pulled out the top 50 most common words in each language you'd probably have near 100% success in detecting the primary language in an e-mail. I'm sure an algorithm either purely based on that word set or based on a larger dictionary choosen based on that matching could be done to determine with a very high confidence what language an e-mail is in and if there's more than one or two languages in it.
They also know my white list of contacts. In my case I'd bet 90% of my e-mail comes from them so those can be immediately put in the inbox, reducing the number that need to be scanned at all.
Or how about providing this option "I dont expect email from senders outside of the USA. Put all foreign mail into junk."
Can't they do one of the multi-country coordinated sweeps and arrest like the top 100 spammers all at once?
I know the little guys will fill in eventually and take over but at least it will be calm for a few weeks.
CAPTCHA is broken: it's not just various implementations that are compromised, but the entire theory.
If you haven't been down-modded lately, you aren't trying.
Sacred cows make the best hamburger.
Perhaps the GMail mailadmins will try to stop some, but they probably won't get it all. And they too will rely on GMail being "too big to block" for most mail recepients.
This just highlights how the burden of anti-spam efforts often gets transferred to legitimate email senders by simplistic blocking. The unacknowledged false-positive problem. I have seen these come to a sudden stop when the company loses an important order because it false-positived the prospect.
Unless I've missed something this doesn't affect sending outgoing spam.
It may attract spammers in that they can compose personalised messages that you are more likely to read. It may be useful to phishing scams as many people will use real names, but I don't think it will aid bulk sending.
It makes it much easier to find out their spammees' names with Google Calender!
Google already does that for their ads. I'm an American living in Germany who also has friends in Japan that I coorespond with in Japanese. I get ads in English, German, and Japanese(in fact I get ads in Japanese offering to teach me English and/or German....) so if they can determine the language for the ads, then they should be able to use it for spam.... at least if you get an email in a language that isn't in your outbox it should trigger something..
Monstar L
So what's going to happen? Is google going to require that gmail users fill out the script-check for out-bound messages?
The Gmail captcha has been cracked, spam will of course follow.
Here's a quick way to solve the problem: require digital signatures for "important" emails. Want to sign up for Facebook? Digitally sign your reply to the "verify" email. It is quick, effective, and people who don't know what signing is will catch on really fast.
Palm trees and 8
Are these emails actually originating from a Google Mail system, or are the hackers just plugging in spoofed origin email addresses in the Google system? There was the recent article where a Calendar entry could disclose all current Gmail userID's.
Start assassinating some of these fucking degenerate spammer asshole motherfuckers and watch the junk disappear. Seriously, these cocksuckers need to be burned at the stake. Blackwater would prally do it.
"I disapprove of what you say, but I will defend to the death your right to say it." - Evelyn Beatrice Hall, re Voltaire
Actually, you can create that filter using gmail's filter system.
It would look something along the lines of:
Matches: from:-(*.edu OR *.com OR *.net OR *.org)
Do this: delete it. (or if you want to be sure you don't accidentally delete real mail, give it a label and skip inbox)
is this for real ? i use gmail since it was released to the public in that april fools day, and the past two months have been the ones with the least spam i ever had in my entire life... last time i trashed my spam box was last friday (July 11th), and since then i only got less than 40 spam messages... this is way less than the amount of valid emails i got in the same time frame.
"life is a joke, and someone is laughing at me"
I just wanted to add something interesting, I forwarded an account to my gmail in order to use gmail's filters to rid me of most of the "sorting" work, periodically I log into the original account to clean it up.
After about 6 months of doing this, I notice when I log into the original account there is almost no spam in it these days.
I guess they lost interest in that email since I never actually look at anything in it.
"If any question why we died, Tell them because our fathers lied."
http://youtube.com/watch?v=lSnWhsmlGec&feature=rec-fresh
is this english?
I take my children to see Madonna(..), but I never for once ever thought I was in the same business.Chris Rea.
Give me a damn drop down that says "I speak English, anything not in English is not to me".
Won't solve their outgoing problem, but adding "this is my language" support would be a big help on the incoming, at least with my spam patterns.
1) Tell them about it. Companies actually listen to large volumes of feature requests (like voting, except that each one counts). I already suggested this very thing (though I suggested it by way of allowing regexes in the tagging)
2) This would help greatly with their outgoing problem. The reason gmail is preferred by spammers is that it has a special standing with gmail spam filters, in other words, they can easily bypass otherwise top notch spam filters by using gmail. If, however, your (and my) plan were put into place then gmail has a convenient way to say things like ">50% of this users emails are tagged spam, don't accept any more outgoing from him"
Well, I did this study and our results are here.
We in no way imply that Gmail's inbound spam filtering is bad. It's probably excellent. It's just difficult or impractical for Google to filter outbound mail without either human review or complaints because of false-positives.
What we're saying is that spammers are trying to evade IP reputation systems by hijacking organizations with good reputations or which would be impractical to block. There will be a CAPTCHA-cracking arms-race, but unfortunately I think the system will reach equilibrium with spammers quickly breaking CAPTCHAs and continuing to abuse free e-mail systems.
Most people don't like jumping through meaningless (to them) hoops.
Obama likes poor people so much, he wants to make more of them.
Or, what if you write poetry? A lot of modern poetry reads like seriously fucked up spam. Also, scripts read as nonsense, and nonsensical scripts, even more so. Example, from "Waiting for Godot":
(with magnanimous gesture). Let's say no more about it. (He jerks the rope.) Up pig! (Pause.) Every time he drops he falls asleep. (Jerks the rope.) Up hog! (Noise of Lucky getting up and picking up his baggage. Pozzo jerks the rope.) Back! (Enter Lucky backwards.) Stop! (Lucky stops.) Turn! (Lucky turns. To Vladimir and Estragon, affably.) Gentlemen, I am happy to have met you. (Before their incredulous expression.)
So, if I were discussing that, or simply emailing a friend or group of friends saying "Here's the passage you were looking for / we were discussing", it would get flagged as spam.
So, no, hindering outgoing mail is NOT the answer, or part of an answer. One poster above noted that opting for (Language X) charsets only (such as Roman only) would help get rid of all the cyrillic and chinese/korean spam. That would be good, and VERY simple to set up. As far as the rest of it goes, heuristic filters do work, if you use them. But, you always have to use them...
RS
Shoes for Industry. Shoes for the Dead.
What happens if one of your correspondences is simply a horrible speller? Does it simply blanket filter them out too?
On second thought, let's not go to the internet. 'Tis a silly place.
Doesn't help me. Most of my gmail spam is in Portuguese which uses the same character set as English. At some point I was hoping they'd cross pollinate translate.google.com with gmail so the spam filters could learn that if the message is in Portuguese to me it's spam.
CAPTCHA is broken: it's not just various implementations that are compromised, but the entire theory.
The turing test theory to identify humans from machines is broken?
Nay. It's the implementation that is broken. Image analysis and pattern recognition do NOT make artificial intelligence.
My solution is to make entire phrases out of captcha'ed characters. Decyphering a single character can be difficult, but it's much easier to deduce the meaning of an entire phrase even if some characters were wrong (except the numbers):
"Please add the numbers except the one with purple dots behind it, and then substract from the result, the second digit of the one with an orange background: 723, 934, 21, 5".
Note that the questions don't have to be math related.
"Alice broke up with her boyfriend James. She was so mad that she forgot where she left the car keys, and got late to work. If only she hadn't seen him kissing the other girl, she wouldn't have had a bad day.
Question:
What did Alice lose that made her arrive late to her job? (three words)"
(Yes, all the sentence was captchaed).
With most big name email players like gmail, yahoo, etc, now using DomainKeys, the value of having an email address on any such system has skyrocketed. Gmail addresses are also usually even more respectable addresses. So being on gmail and a getting through because DomainKeys work makes it is a privileged domain.
What the proper response should be:
What should really happen is SenderKeys, which augments DomainKeys. You will get your own domain key when you can become "verified" like at Ebay and elsewhere. SenderKeys is implied by DomainKeys.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Yeah, but they will tolerate it for certain purposes. For example, my bank insists upon verifying "unknown" computers by sending text messages to my phone. It is annoying, but they haven't seen a drop in traffic on their website, because people are willing to deal with the annoyance, even if they have no understanding of why it was imposed on them. Likewise, if we started forcing people to sign messages in order to gain access to the latest Internet fad, we would see a vast increase in the number of people digitally signing their email, and a very sharp decline in the amount of spam.
Palm trees and 8
And besides, Netcraft confirmed it.
"We shall grapple with the ineffable, and see if we may not eff it after all." - Douglas Adams
If free mail services limited mail to X/day based on the user's reputation this would make them a lot less attractive.
Some ideas:
Notarized or other highly reliable means of identity confirmation: very very high
Driver's license, passport, or purchasing paid services with major credit card, or identity confirmed by somewhat reliable means: very high
Established user with good abuse history: high
New user or idle account: medium
User with poor abuse history: low
Limit "medium" users to something like 10 messages a day + 1 more message for every day in the past 30 days they logged in to check their mail.
Limit "high" users to 100 outgoing messages a day.
This will at least make the spammers work harder.
Web-based mail should also check for "robotic activity" like sending too many messages in a short period of time, or messaging around-the-clock. Real people sleep or stay up all night playing WoW.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
They do. And its a pain in the butt if you want to send a newsletter to people in your org/company/group.
Maybe I just look like a spammer for some reason.
Mod me down and I will become more powerful than you can possibly imagine!
Outgoing Email filters are becoming more and more popular on the internet. My company pays for hosting and email, we were recently switched from Postini to Can-It. Postini had no outgoing mail filtering, Can-It does, once we learned the rules of outgoing mail everything was fine. I would not be suprised if this was the way google took. Maybe not switching to Can-It, but outgoing mail filtering.
Here I stand, I can do no other, God help me. - Martin Luther
Seems to me that Google could simply use its own (quite excellent) spam filters to identify GMail accounts that generate spam. Then, it could send a warning message to those accounts and if no reply is received within 2-3 days, shut down the accounts (or at least disable them)
That would just be an unplanned bonus.
The problem major problem with spam filters is the false positives, and with outgoing e-mail this problem is worse, because if Google thinks the e-mail you're sending is spam, google is caught in a dead end with two options, neither good:
I think outgoing filtering is not the way to go. I don't have a better solution either, the best for now is probably improving their current filter for incoming messages, and make it harder for spammers to get an account on GMail.
just use filtering rules to auto assign spam to the trash...
I don't understand why "a vast increase in the number of people digitally signing their email" would cause any reduction in spam, unless you are saying that only signed emails should be allowed on the internet.
Obama likes poor people so much, he wants to make more of them.
bad spelling should be a crime, there is no excuse! ... it should be 'punished' by mandatory use of the built in firefox spell checker.
Well, as you increase the level of intelligence meeded to go through the CAPTCHA, you start to leave humans out. And this only gets worst as CAPTCHA breakers get better and better, so in that sense, the CAPTCHA is broken, and also in that sense, we have artificial intelligence that is at least as good as the worst humans.
When his defense asked, "Which computer has Jon Johansen trespassed upon?" the answer was: "His own."
"Opera's revolutionary new email client."
or
FROM MR PHILLIPS ODUOZA
EXCUTTIVE DIRECTOR ELECTRONIC TRANSACTION BANKING
While my dspam has noticed a substantial amount of misses, most of the ones it's missing are the Opera ones, because they contain so few tokens similar to most other spam. They seem to be using absurd titles "Obama killed in bathroom luncheon" or "40,000 Troops die in Iraq" Oh well, retrain FTW!
find ~your -name '*base* | xargs chown
I have mail accounts which are filtered by SpamAssassin, which does a fairly good job, and it looks like the actual text content of the email can only contribute so much to the spam score. I tried sending myself emails from a different account with text like "president nigeria $8,000,000 viagra penis enlargement rolex' and it stayed below the spam threshold: each spammy subject gives one point, so that is only 4 points while the spam cutoff is at 5. Blacklisted IP addresses have much more weight, and in addition there are plenty of technical issues that are are spam indicators, such as dynamic IP addresses, forged header lines, HTML-only mail with inline images, and so on.
I don't know what Gmail exactly uses for spam filtering, but the above message sent to my gmail account made it to the inbox with no problem.
Avantslash: low-bandwidth mobile slashdot.
Ah, forgot to mention that part. Yes, presumably, if the overwhelming majority of legitimate emails were digitally signed, spam filtering would be a lot easier, at least if there was a good PKI in place. Even if spammers managed to get trusted signatures on their certificates, the amount of CPU time required to digitally sign a message would decrease the volume of spam they could send out (and those trusted signatures could be quickly revoked when if became clear they were used for spam).
Palm trees and 8
Give me a damn drop down that says "I speak English, anything not in English is not to me".
god yes. i have wished for this constantly.
no longer working for cnet
Dear admin@gmail.com
Do you want enlarge your penis upto 4 inches?
Amazing, PERMANENT RESULTS that will last.
Å¥ Gain 3+ Inches In Length.
Å¥ Increase Your P3nls Width (Girth) By up\to 20%.
Thanks
Jennifer Cassidy
What did Alice lose that made her arrive late to her job? (three words)
"her x-boyfriend's virginity" ?
Posting as Ac because I moderated...
Your idea doesn't address one of the main avenues of CAPTCHA breakage, which is the mechanical turk approach that has been used - swiping the CAPCTHA graphic, showing it to a real human to get them to fill it in in exchange for free porn/MP3's or whatever.
In the spam arms race, this missile has been downed.
"The email you are sending appears to be spam. Are you sure you want to send this email?"
I had the same idea but on second thought it would be a hard strategy to enforce.... they'd have to set up an extra call center just to handle the flood of complaints: "Hey you guys say my email is spam, WTF... it's an email newsletter I send out to my men's club about the benefits of Viagra!"
Not to mention the instant killing of any type of email meme jokes...
A fool throws a stone into a well and a thousand sages can not remove it.
I'm not concerned with recieving spam - as you noted - spam filters work well, and I also noted that. I am much more concerned with labeling outgoing email as spam, as it is a fast and slippery slope from halting viagra adverts to straight censorship. My concern isn't technical - it's conceptual.
cheers!
RS
Shoes for Industry. Shoes for the Dead.
There's a big difference between filtering incoming spam and filtering outgoing spam. When spam comes in, it doesn't get blocked, it just gets put into your spam folder, which you should check periodically to make sure it hasn't collected any real mail by accident. There is not, however, any protocol by which an outbound server can place spam in your spam folder, they would have to block it outright. This means that certain, totally acceptable emails will be blocked, not a good thing. Moreover, most spam filters, including Google's, have a very important feature by which you can set particular senders as "not spam," this would also be impossible for an outbound server to allow you to do. Moral of the story, if you don't like having your mail randomly blocked, and you expect to ever get legitimate emails from someone using gmail, having gmail filter outgoing mail is a bad idea.
To properly filter such mail you really need to filter on the Received: lines, and even then you would need to filter by IP to be able to accurately identify what is coming from outside the US. Many smaller mail systems for example will actually filter out the entire Asia-Pacific IP range due to the large amounts of spam originating there.
September 2008 /. headline:
/. headline (3 months later):
Google launches new "unbreakable" Captcha-Phrase validation system
December 2008
Spammers in Nigeria beat scientists to creating world's first sentient AI
Subsequent comments read:
I for one...
Welcome our new CaptchaPhrase-cracking artificial overlords!
Frist Post?
First post!
The path to enlightenment is truly through homemade drugs!
That wouldn't work for me. I regularly send emails in Frenglish. I'm a Quebecer who frequently switches back and forth between French and English in emails with my friends and family.
Si tu te basais sur le contenu de mes courriels pour déterminer s'il est en franÃais ou en anglais, ton algorithme échouerait parce qu'il est ni en anglais, ni en franÃais.
CAPTCHA is broken: it's not just various implementations that are compromised, but the entire theory.
The turing test theory to identify humans from machines is broken?
I would have to say yes--because (in the case of automated sign-ups) it is implemented by computers to computers.
The only thing your example does is add a layer of complexity. Standard CAPTCHA techniques rely on a single dimension of perception--the ability to recognize and reproduce text. Your examples rely on multiple channels of perception (recognition of text and comprehension of language), and as such adds a layer of complexity to the issue--one that's currently not within a computer's capability, but is theoretically possible.
Any process that can be automated will eventually be developed as an algorithm: currently, computers are capable of recognizing CAPTCHAed text (within a certain failure percentage). Computers currently cannot reliably understand complex phrases in natural language ... but they can understand simple phrases, and complex phrases are only an additional layer of complexity.
I'm not saying that the theory is unsound (though I suspect it is--I simply don't have enough proof to make the argument). What I'm saying is that the test cannot be automated--and adding layers of complexity is not the cure.
If you haven't been down-modded lately, you aren't trying.
Sacred cows make the best hamburger.
this would have had more credibility if it came from a more neutral party.. study by anti-spam vendor concludes: spam is on the rise. google responds: we know. vendor insists: we're still 98%+ effective!
Good people go to bed earlier.
Google is not in the Email business. They sell online ads.
My solution is to make entire phrases out of captcha'ed characters.
Like this one (solve differential equations), or perhaps this one (calculate resistor network values)?
Please, you're all worrying too much, all of these problems and more will be solved by Email 2.0.
This is a joke. I am joking. Joke joke joke.
I also see some ads that match the language actually used in e-mails. However, I suspect that the current system Google uses to make decisions about ads is rather unsophisticated, since I also get ads in Japanese (or what I think might be Japanese) simply because a thread mentions Japan multiple times.
Spelling checkers is not the compete salutation.
Nerd rage is the funniest rage.
I could understand its efficiency declining or its effectiveness declining, but the filter itself ?
Time to find an English translation I think.
No matter, the summary and the actual article are talking about 2 different things anyway.
And while all you mods are reaching for the troll option, just bear in mind that if no-one publicly questions the inappropriate use of language, then it is seen as acceptable and copied by others, until there are no rules being followed at all. Let me know how that works out for you.
I care because I learned English, and to ignore blatant and sometimes deliberate mistakes is to do a disservice to future speakers. Is it fair for someone who is not a native English speaker to learn English, only to find that when they make a mistake it is ignored, causing them to think they got it right ? And then later on they are taken to task over a misuse of the language which nobody ever corrected them on.
Everybody has the right to make mistakes, that's how we learn. But in denying the possibility of correction, you are denying the act of learning itself.
And that is pretty self centred IMHO.
It really does seem like gmail's spam filters are declining these days.
Yahoo's filter has been pretty bad for a week or two now also.....
Just remember - if the world didn't suck, we would all fall off.
I have had a Gmail account since the first month of "Beta testing" years ago, and would get maybe 1 spam per month. In the past 2 months however, I seem to get about 3 per day. Always Canadian pharmacies trying to get me to have great sex. Those damn Canadians are out to kill us all I say...
Every time you call tech support, a little kitten dies.
We had something similar in our company years ago (the mail server added *nameofthecompany-spam* to the subject of suspect email) for both incoming AND outgoing mail. It's not very professional when people of a company you are doing business with read *nameofthecompany-spam* as the first word of an email.
But maybe it's better than not receiving the email at all as you suggest (I've my work email forwarded to gmail, and sometimes is classified as spam, so the filter is not 100% infallible)
Today was the first in a long time that a spam email on GMail made it to my inbox; could be just randomflux but seems to correlate.
Power corrupts the few, while weakness corrupts the many.
Indeed. While you can specify a language tag in searching your mail, which works great, there seems to be no way to hook that criteria to a filter.
To save you some time in the future, I believe the GMail spam filter automatically whitelists anybody that you have sent e-mail too. The assumption being that if you're sending them e-mail, they're not likely to be sending you spam
Nothing is impossible. We just haven't quite worked out how to do it yet.
Blaming Google and claiming it's because of broken captcha begs the question of how the spammers really operate. Anything open to the public is open to abuse as you say. Invite systems only invite spammers to do more of what normal people do. Spammers can't be doing this from a single IP address, or even a small collection of them, without being blocked so we know they are somehow obfuscating their communications. I can only think of two ways:
The history of spam shows that a combination of the two is at work. Spam has traditionally come from exploited computers on cable modems and that has not changed only the means. Now that every ISP blocks port 25 and forces you to use their SMTP server, the spammers have targeted that and webmail.
The real solution to the spam problem is to attack the root cause, the continued failure of M$ to protect their customers. The spam problem is directly proportional to the number of Windows machines on the Internet and the speed of their connection.
Friends don't help friends install M$ junk.
It's funny you say all your spam is Cyrillic, all of my gmail correspondence is in Bulgarian and all the spam I get is in English. I suspect it would even be unnecessary to examine the content, just dump everything that is Latin-1 in the spam folder. The gmail filter already works flawlessly for me, though. But I'm also very careful in giving out my email address.
I hope it will take into consideration those of us that speak jive.
CommentBot 0.7a running with args "-module irritate,disagree -target random"
I don't think CAPTCHA's are being machine broken. I've seen ads outsourcing the typing in of CAPTCHA bidding $1 per 1,000. Try looking at http://www.getafreelancer.com/projects/Data-Entry/Captcha-PROJECT.html to get an idea of what is going on.
So it's a win-win situation; you get fewer bots, and fewer dumbasses signing up. Heyyy, I've just thought of a great voting eligibility test...
== Jez ==
Do you miss Firefox? Try Pale Moon.
And that's a bad thing? ;-)
It's a bit of a nonsense argument to just say, 'computers will get smarter and figure out how to fool your test /eventually/'. So what? They can't *now*. By that logic, NO test will EVER be good enough because eventually we'll have developed an android that's completely indistinguishable from a human, and for all intents and purposes it will be a human. Like, eventually.
== Jez ==
Do you miss Firefox? Try Pale Moon.
I don't think that the problem is that GMail's spam filters are declining, it's that the spammers are getting better at avoiding them.
That said, in the last three years, I've had maybe five or ten spam messages sneak through the net. Pretty good, if you ask me, and the fact that it can 'learn' is even better, unlike rival offerings (or at least, where they were before I converted to Google)
Now a feature that I would like, is the ability to set up your own filters (black/whitelists) of domains, or even better, regexes, that should summarily be rejected. In other words, the sender should receive a "550 unknown recipient" reply >:-]
Free, as in your money being freed from the confines of your account.
you're from quebec. all emails from you should be in the spam box by default anyway.
I used to NEVER get spam mail in gmail. In the last month, I have been receiving at least 10 spam emails a day. It's mostly nasty pron stuff. What the heck is goin on? I don't want it anymore.
Nuttier Than A Squirrel Turd
Why doesn't google just put a cap on how much outbound email you can send? Say 100 / hr, 500 /day? Or something along those lines? Then if you need to send more than that you could just fill outa form requesting it, then those people are on an easily monitored list. Anyone that is found spamming gets their account suspended until they can prove that they were not, in fact, spamming.
You guys see ads?
No Firefox+Adblock Plus?
WTH? I thought this was Slashdot?!?!?!?
Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
It might work, but I get email in English from Greek friends (for example) with a Greek signature. Often this is added by their webmail provider and is the equivalent of 'get a free hotmail account, click here!' in Greek. It will also have 'TheRaven wrote:' above quotes in greek, since this is the language their client is configured to use. The character set of the email is set to allow these characters, even if the main body of the email is English.
I am TheRaven on Soylent News
It's a bit of a nonsense argument to just say, 'computers will get smarter and figure out how to fool your test /eventually/'.
That's actually not my argument (and I agree that it's not a good argument at all). My argument is that CAPTCHA specifically is already broken, that adding layers of complexity is nothing but a short-term cure, and that the "Turing-test security" concept may not be a sound theory.
If you haven't been down-modded lately, you aren't trying.
Sacred cows make the best hamburger.
right, as if 'johnsmith@gmail.com' isn't going to reach *somebody*. And no, he didn't give it to me.
What a load of crock. Spammers don't care about the exact person they reach, as long as the message gets read by a live body they're happy as can be.
So, consider every combination of firstnamelastname , initiallastname, firstnamefirstletteroflastname to be spammed to the hilt.
MP3 Search Engine
"Choosy Spammers Choose GMail"
Jive ain't just a language, it be a way of life.
I have some spamassassin rules that do something similar, spam using a non english character set or which sufficiently resembles a foreign language that does use the same charset get flagged... I can declare what languages i receive mail in, and it will flag anything else..
Besides, if a mail is written in a foreign language you can't read you're not gonna read the contents anyway.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Which isn't going to stop spams which are sent by other gmail users.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Just yesterday I got an email from Google asking me to confirm that my GMail address could be used for outgoing mail by @gmail.com. So they're using the "send as.." functionality to spam a crapload of GMail users in the hopes that some of them bite and hence volunteer their personal email addresses for spamming.
I reported it to GMail's phishing reporting service. Hopefully they find a way around this.
Well, as you increase the level of intelligence meeded to go through the CAPTCHA, you start to leave humans out.
If a topic so simple such as reading comprehension gets beyond the average human's intelligence, then spam is the LEAST of our problems.
Unless we start making captchas ask you questions about the personal life of celebrities such as Britney or Paris.
"Welcome to CAPTCHEOPARDY!"
Great, now my mind's scarred :(
How does that help when spammers could abuse the process used to give someone a certificate--an initial or replacement certificate?
This could work as well as a gray-list, but with the same burden of dealing with receiving emails from new people it doesn't seem to be a better system for stopping spam because something or someone still has to decide if messages from new people--certificate-laden or not--are spam or not.
Imagine a PGP model, too: the spammer could say the same thing as a new business client, namely, accept this key to read the message. You accept the key, find it's spam, then discard the key and effectively blacklist a specific email address and signature that the spammer will never use again. This scenario is no different than what currently happens except that there is an extra burden on users, and that spammers must spend 20 seconds to a minute computing a new key for each batch of x00,000 spams. IMHO, it would be great to have many more people use PGP, but not as a way to cull spam.
You linked to the usual "time to pwn" stories, but the reality is that botnets grow nowadays by means of email attachments. Very few (that I know of) trojan attacks are over remotely-exploited vulnerabilities, with patches or not. You are implying that botnets are created when unsuspecting Windows users install nine-year old copies of an unpatched operating system. That's not true, is it?
The previous wave of trojan attacks (with those "admirer has send you a message" subjects) grew botnets dramatically, I think. How do you account for that? Sobig is the fastest spreading trojan ever, and it requires user interaction to infect a machines. It's a proven fact that infections are spread thanks to vulnerabilities with available patches. How do you account for that?
How is that a "continued failure" of "M$" to protected their customers again?
If your Windows machine is in a botnet herd, you probably did something you shouldn't have, or failed to patch your machine. Even the actual remotely-exploitable vulnerabilities like Blaster have had patches available a month before the exploits were seen in wild.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
I think all Quebecois should go into spam anyway...
yeah, spell check + preview tends to get rid of most of the errors. when you + education, then you should be able to avoid most mistakes.
Not quite, my dear AC.
The purpose of CAPTCHAs is to differenciate humans from spambot machines. If another human is filling the captchas for your botnet, then that's an additional problem, but the "bot posting spam" problem has been succesfully solved.
Unless the problem is incorrectly formulated. How about this - make Gmail ask you a captcha for every e-mail addressed to a person not in your contacts (which is not a reply-to, either), or for every 5 contacts that you want to add.
OK, many people seem to be missing the point that this is mail _outbound_ from google. Google accounts are the originator.
Yeah, Google doesn't want to be known as the "source of doom" for spam, but as long as they're seen as making some effort against hosting spammers, they're fine. No more is needed, and in fact is counterproductive. Why? Because they want everyone on the planet to sign up for gmail as their primary email account, and the way they do that is by having the best damned INBOUND filters around! If the spam problem gets worse but they can filter it better than anyone else, then they win twice over. Reducing spam is NOT the goal of any email provider--reducing spam received by their customers is. In this case, it also increases spam to their competitors' customers.
Oh, except that google would never do that, because it's evil! Yeah, right.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
Throw this story to the support at google, they should be listening...especially if they want to keep their stocks selling high.
Personally, I believe that computers will never become as smart as human beings. We just have to find the right questions that computers will never solve.
Perhaps they will involve some kind of interaction. Maybe in a few years we'll end up with VR-based captchas so you'll have to tell a virtual cab driver to take you to the 5th avenue, getting an envelope from your professor, opening it and then typing the contents in the textbox below the VR screen. I just hope we don't have to resort to that.
if only we could remotely administer an empathy test.
This. [/.]
Absurdity: A statement or belief manifestly inconsistent with one's own opinion. -- Ambrose Bierce
To create your new Gmail account, please translate the following equation into a limerick:
(12 + 144 + 20 + 3 * sqrt(4))/7 + 5 * 11 = 9^2 + 0
Answer:
A Dozen, a Gross, and a Score,
plus three times the square root of four,
divided by seven,
plus five times eleven,
equals nine squared and not a bit more.
via: http://www.trottermath.net/humor/limricks.html
Except that even Google's hardware/bandwidth resources are limited. They don't want to waste resources by hosting millions of spammers.
/. stories about XYZ blocks Gmail. Since this hurts good Google users, Google should want to avoid sending spam.
Also, many smtp servers will block Google IPs if the spam percentage rises too high. There have been several
Outbound filtering is MUCH MUCH harder than inbound filtering. On the inbound side they have millions of users labelling mail. For outbound, what kind of feedback do they get except for some bounces?
"That little rat-looking thing just got ATE! Damn, Nature, you Scary!"
Actually, you can do something similar to that by putting a few common Cyrillic letters into a couple filters and telling it to delete/put-in-spam-folder/whatever with the stuff that turns up.
Where I initially read about it.
been getting 5-10 Viagra spam a day!! All to the same site, seems like google could have fixed that by now. the same site over and over. Viagra for $1.20 each? Seriously. They cost much more. I have no idea why I get so much Vi@gra spam, I never go to porn sites etc, I have many dvd pr0nz from a DVD rental store I worked at during night time while I was going to University..ripped em to my HTPC which isn't connected to the net.
I thought the problem was this:
Spambot needs captcha.
Spambot sends image to spammers porn/mp3/warez site.
Human provides captcha to get their goodies.
website provides captcha to spambot.
All 100% automated from the spammers point of view. Bots are still posting spam, at near zero cost to the spammer, with potentially massive throughput.
Man, you really need that seminar!
sure, everyone will catch on fast.
now all you need is some magic that prevents spammers form learning to sign there mail as well.
or force spammers to sign with "I am a spammer", just to make it easy to filer out.
Line 1: "Buy Viagra" (in Russian)
Line 2:
Lines 3-50: Surreal computer generated literature in any given language
The point of delivering Russian spam to people who speak English? I've never known.
Fnord.
An online Voight-Kampf test? That'd be interesting, at the least. :-)
HTTP allows browsers to set a preferred language (actually, a prioritized list of preferred languages). Google is probably picking up on this to set a default, and then looking at your language settings in GMail as well. So, if you're getting your ads in English, is probably because you've "requested" them that way.
-JS
Vanity of vanities, all is vanity...
Please be so kind as to reply with the account you originally posted the comment with, not the name troll you created for me, or any of your other 12 accounts.
Also, ad hominems are not particularly useful, they merely tell everyone that your argument was invalid to begin with.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
If there was *any* doubt whatsoever of what you do around here, this post pretty much should end that.
Spamming vs. catching spam, in many ways, has a lot of parallels with the long history of cryptography. A spam filter is a lot like a cryptanalyst, while a spammer is a lot like someone writing an encrypted message. Just like a cryptanalyst looks for recurring clusters of words to pick out "the", "a", and "of" in an encrypted text and work from there, spam filters try to learn what makes an email spammy. There's a number of ways to catch spam with machine learning, but of course, two of the best ways are looking for specific words or variations on them and testing for syntactic coherence. The incorporation of better language models with the use of synonyms makes it harder to catch spam based on its text alone. It's even looking a lot more coherent lately. What's more, we've got bots doing much better at breaking CAPTCHAs these days. But they're not so good at discourse coherence yet, so this might be the next step in catching spam (until they get good at that, too).
"The enemy knows the system" --Claude Shannon
Three weeks? Sheesh. Most email security firms, including the one I work for, stopped whitelisting Google over a month ago. Heck, we're even penalizing some of their IP space. This is old news. Nothing to see here, folks. Move along, move along.
if(failure()) retire(testsubject);
At least if you have some sort of trust infrastructure (web of trust or paid signing like SSL certs), then completely untrusted e-mail gets a bump to its spam score. If such a system were in place long enough, then any real person would have their key signed by a lot of people.
There is a major problem with this idea, though: if spammers can take over computers to send spam from them, it is probably not much more work to sign their key with that user's key. Other users could sign an assertion that that key is being used for spam, but I suspect that would not be effective, especially because spammers have access to a lot of computers.
The other way keys help is that if people usually know their recipient's key, then any e-mail sent to only one person and not encrypted with their key is suspect. Encrypting each message separately would make sending spam a good amount more computationally expensive.
Centralization breaks the internet.
Hey, if your character set (or any of your character sets) is non-Roman, this wouldn't apply -- sorry.
But for me, I can't read Arabic, or Sanscrit, or Farsi, or any language written using Cyrillic ... and gmail's masters should be smart enough to let me exclude character sets I don't want or need. I would imagine that most people could name one, or a small set, of character sets that are likely to apply, and specify exceptions as appropriate. But every time I get Cyrillic spam, I think dark thoughts about easy-to-automate solutions.
Since this is a fantastic and unimpeachable idea, I have decided to create a FAQ about it, consisting only of questions I have just asked myself in the same voice I use to imitate cats and babies:
Q: Would spammers try to get around it?
A: Yes; they are spammers.
Q: Would there be complications and annoyance?
A: Quite possibly; they are the spammers' fault.
A: Should one suffer a spammer to live?
Q: Only at your own peril.
timothy
jrnl: http://tinyurl.com/c2l8yr / foes: http://tinyurl.com/ckjno5
For Google and Hotmail, I used the gmail.com and hotmail.com SPF records respectively. That is, I assumed any mail from an IP address that got an SPF "pass" came from Google or Hotmail.
Yahoo doesn't publish SPF records, so for Yahoo I did a reverse lookup on the IP address and if it contained the string ".yahoo.", I counted it.
Oh. Whomever modded me offtopic probably can't see the post I'm replying to? Here it is. "deadzero" is one of twitter's accounts, and it was created for the same purpose as all the other name trolls he maintains.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Isn't this to be expected? Since gmail has become more popular, more people are using it. Wouldn't it make sense that then spammers would get into the system to try to distribute mail across the gmail platform to other users? I have to say though, if it hits the level of yahoo mail, I'm out. I work at a marketing firm that does entertainment and have signed my adress up on a number of sites that I'm a member of to try to stay current with news(including this one). However, somehow spammers get my address and punish me with an inordinate amount of spam.
I was shocked to check a rarely-used Gmail account today and find 10K emails caught as spam and another 10K NOT caught. This is unlike Gmail. :(
Switch to Excite for your email.. After their upgrade (2 weeks Friday) I haven't received any spam.. of course I haven't received any non spam either.. No incoming emails at all.. other Excite users are pissed, as some use it for business, school, job searches etc.. The excite discussion boards are full of people who are dumping them for Yahoo and Gmail.. and there is absolutely no word from Excite explaining the situation. I have a friend who also uses it, and his finally came online yesterday. 2 weeks to switch over their users seems a bit long to me.
waiting for ad.doubleclick.net
I was shocked to check a rarely-used Gmail account today and find 10K emails caught as spam and another 10K NOT caught. This is unlike Gmail. :(
This is part of why I stopped using GMail within a single month of signing up. I gave out my new email address to a handful of people, but pretty quickly after signing up, I started to get volumes of spam which were ungodly. Given security problems like the recent Calendar issue, I'm not surprised that GMail is such a spam sink -- it seems like they don't do hardly anything to protect your email address from public knowledge.
GMail is useless. I wish I could just delete my account permanently. I should probably look into doing that.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Google could set another precedent in webmail by introducing outgoing filters which would block or slow down mail appearing to be 'spammy'.
The day that happens is the day I never get an e-mail from my grandma again.
Don't trust a bull's horn, a doberman's tooth, a runaway horse or me.
i've had spam from google.com and gmail.com coming in for months. it started immediately after their captcha was broken. since then, i've received practically none from hotmail.com, and that used to be where most (of mine) came from. i still get spam from p0wned broadband boxen, but the majority since google's captcha was broken has come from them.
lately (the past month or so), after reporting to spamcop, i've noticed a lot of google's mail servers are blacklisted by sorbs and/or abuseat.org. i'm not sure what efforts google is taking to thwart it, but you'd think they'd do more now that they're being blacklisted.
When you recognize love in another and realize how precious it is, everything else seems so insignificant.
Your post is painfully self-contradictory. You are essentially implying that hooking up an unpatched XP machine to the internet is the root cause of said machine being in a botnet. But the reality is that the number of users who actually install Windows is ridiculously small. Isnt' that the main argument that explains why Linux is not more popular, that Windows only has "superiority" because it's bundled on 99.999% of all new computers sold?
If your theory was correct, then botnets wouldn't be cost-effective for the people who operate them - or simply wouldn't even exist.
Furthermore, I disagree with your assertion that there is a continued failure in the part of Microsoft to protect their customers, based on your provided links. Microsoft regularly patches Windows to prevent remote and local exploits - installing a ca. 2000 copy of Windows XP is no different than, say, installing RedHat 6.2. Do you also object to RedHat's continued failure to protect their customers?
If you keep your machine patched (which is laughably simple with Windows) then you have nothing to worry about, except...
Maybe the moderators should start reading posts before voting them up.
Well, as you increase the level of intelligence meeded to go through the CAPTCHA, you start to leave humans out.
The problem I've observed lately with some sites is they're distorting the CAPTCHA text so much that it's difficult to make out the characters. Is this "5" or "S"? Is that a "I" or just part of the background? Is it a Q or is it an O with a line overlapping in a confusing spot? And so on. It takes several tries to get CAPTCHA right these days, and it's frustrating -- not because it takes intelligence per se, but because it takes trial and error to figure out what the mess on the screen is really supposed to be.
There you have it.. PGP as the answer to spam has been right in front of us all the whole time. How much more of this shit will the "too technical" argument hold up against?
Don't expect google to push PGP or any encryption or signing technology though, no matter how "not evil" they are they still want to read your email and intertoob traffic. And that's why they've been "evil" since day one.
Dude your system can get owned just because you failed to update on patch Tuesday and now it's Thursday. Internet Worms are very much still a viable attack vector. They infect machines that are on with no user in front of them all the time. I know because I have to fix these machines.
Why shouldnt it? If the originating IP is in a foreign netblock then trash it. Its 100% doable.
Blaming Google and claiming it's because of broken captcha begs the question of how the spammers really operate.
No it doesn't
I've learned that they're worthless, so I don't read AC comments anymore.
This is what happens to anyone who dares question twitter. Have a name troll account created for you, be insulted, get modded down if you complain. People like dedazo, Macthorpe, Otter, willyhill, westlake all have to put up with this crap. The rest of us have to be on the lookout for more sockpuppets and hope we can add them to our foes list before they get to posting at +2.
Slashdot is going to hell in a handbasket.
Spam seems to be heavily tied with yahoo, hotmail, and just about every free email service. Maybe we need to introduce some more hoop jumping to get a new (free) email account, or shut it down altogether. The lack of accounting of an email addy to an address/phone # is nice, but it seems to come at a VERY high cost.
Demons I HATE that site. It's the scourge of all website operators, used by noone but spammers to get people in random Indian cities to break CAPTCHAs and make spam software for them. Someone needs to shut that shit down.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
There is no better evidence of all of those accounts belonging to one person than you being able to rattle them off like that. Yes, I checked them against willyhill, that is your, fine journal for correct spelling. You even got the capitalization correct.
There is no better evidence of your abuse of moderation than your confession. Tell me, do you use your foes list to make those accounts stand out so that you can mod them down? Your object is censorship and you just admitted it. That's some serious stalking folks.
I never had a problem with spam on GMail from when I signed up, which was in 2006, fairly soon after it opened. Only lately have I been getting spam through, but while its blocking about 1000 a month, only 2 actually got through in the last couple of months and once I reported it as spam, I haven't got any spam through since.
I was initially really careful with giving out this email address (its my actual name, so I can use it on resumes, etc), but since then, haven't been so careful, using it to signup for many sites.
Ah, like captchas or verification emails? Better not try to explain to them the meaning of a digital signature.
I apparently wasn't clear enough on something. To quote my own post:
"Google doesn't want to be known as the "source of doom" for spam, but as long as they're seen as making some effort against hosting spammers, they're fine."
They're not opening the floodgates because of exactly what you say, but they won't work really hard on filtering outbound email, when it's (a) difficult (as you say), (b) not as useful, and (c) counterproductive.
They'll filter outbound mail enough to keep spam from gmail down to a dull roar, and to maintain their "good internet neighbour" seal of approval, but no more than that.
As for outbound vs. inbound filtering, I know how hard it is (it's related to my work at a major ISP), but there are some things which are pretty easy to implement, and google doesn't do many of 'em. There are other things which could use some research for great benefit, but as long as spam from google hurts their competitors more than it hurts them, they'll put their research into inbound filtering.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
GMail is in beta with its current features, and perhaps it always will be because Google's obviously happy to use it as a beta-style testing environment for some of their relatively new features and ideas.
Older versions of the code-base were stabilised and released from Beta ages ago, and you can easily use a non-beta edition in Google Apps. The difference? Google Apps is targeted at people (often businesses) who have a greater need for the system to stay relatively stable and predictible, and who might even pay for it.
Half of the spam I get on my gmail account that actually gets past the filter is in some language other than English... in fact its almost always in Cyrillic as well.
Give me a damn drop down that says "I speak English, anything not in English is not to me".
Won't solve their outgoing problem, but adding "this is my language" support would be a big help on the incoming, at least with my spam patterns.
Create a filter that targets messages containing non-english letters, and then marks as spam.
^_^ Worked great for me.
I steal signatures. This one used to be yours.
With CAPTCHA's getting more and more complex, all we need is a CAPTCHA that, when entered correctly, proves you are a bot. Can't solve the CAPTCHA? You must be human...
You can use gmail, or you can buy a Barracuda Spam Gateway, set up a *nix IMAP/SMTP box, and hire a sysadmin.
TCO - Roll your own = $10,000k initial + $70k / year
TCo - Gmail = $0.00
Seriously, quit whining.
And the people who justify the cost in sending SPAM by responding to it are complete morons. FUCK SPAMMERS!!!!!!
Email systems that have the "spammer filters" easily tricked are making the costs of doing business as a spammer decline. Thats why spam is increasing. Its an economic formula. As the cost of sending spam goes down, the margins generated by it will get larger. This only increases spam.
but there are some things which are pretty easy to implement, and google doesn't do many of 'em.
I'm quite curious.. which things are easy to implement that Google aren't doing... how can we know for sure?
You never get around to explaining why Mac users never have the same problems.
Do you really want an explanation of why Mac users don't have the same problems as PC users, or even *nix users? How about why CP/M users have different problems than TRS-80 users?
This comment is my opinion and does not represent an official position of Donald Trump or others I do not work for