Spamming Becoming Financially Infeasible

itwbennett writes "Making money in spam isn't as easy as it used to be. 'It's not something financially feasible for anyone to even consider,' said Robert Soloway, who in his heyday made $20,000/day as a spammer. 'Spam — the Internet's original sin — dropped for the first time ever at the end of 2010,' writes IDG News Service's Robert McMillan. 'In September, Cisco System's IronPort group was tracking 300 billion spam messages per day. By April, the volume had shrunk to 34 billion per day, a remarkable decline.' Soloway says spam filters have become too good."

Comments

I don’t buy it

[Anrego]

It may have hit a slump, but it’ll be back.

People en-masse haven’t gotten any smarter. There are still enough people who will fall for scams and do business with the kind of people who advertise via spam. Some good tech is currently making an effective barrier between the idiots and the spammers, but the idiots are still there, so the profitability is still there. Give the bad guys a little time. They’ll come up with new ways of getting around our current filters.

Of course the other theory is that spam has become “less interesting” in light of other new and exciting ways of screwing with people. Once those dry up though, I think the guys with the suits will fall back on classic reliable spam to make their money.

Re:I don’t buy it

[socz]

You're right, spam will come back once other avenues of attack are no longer of viable. There are still several ways I can think of that spam can easily get past the filters (I was inspired by the company I work for - they miss some spam that is very questionably border line legit). As long as the spammers don't know think of those things we're good! Spam filters have come a long way!

Re:I don’t buy it

[_Sprocket_]

Of course the other theory is that spam has become “less interesting” in light of other new and exciting ways of screwing with people. Once those dry up though, I think the guys with the suits will fall back on classic reliable spam to make their money.

Like most get-rich-quick industries, this just means its become more profitable to get out of the game and sell people kits to spam their way to fabulous over-night wealth. Not that its anything new in itself; that scam has been going on almost as long as spam itself.

Re:I don’t buy it

[poetmatt]

it's humorous, but it's just a market change.

social engineering, and pfishing are probably a whole lot more "financially feasible", much more results for less effort.

I mean would profits from info gleaned via a SQL injection be really considered a "hack" these days if it was a script kiddie?

Re:I don’t buy it

[XiaoMing]

The people using the internet might be just as dumb, but who said the majority of the spam is getting through to these people anymore?

You have to keep in mind that the bright people who've made most of today's everyday technology possible (to those who don't appreciate this point, maybe teach yourself general relativity prior the next time you poke your TomTom) are also writing spam filters on the server side too nowadays (with great financial incentive for the providers via reduced overhead), not just the client side.

I remember in this asshole's "heyday" when I had to manually block send-from addresses in hotmail, and now only the most grammatically well-crafted emails get through, and are still reported fishy.

Re:I don’t buy it

[Moryath]

It's not that spamming is not lucrative. It's that they keep redefining the definition of "spam."

"Spam" back in the day? People trying to sell things. Sometimes legit, sometimes not. That kind of crap IS starting to die down now, though not as much as you might think. But to be legit you have to run your own servers, have your own IPs, and so you can be shut down rather quickly.

The new "Spam" is adding people to every fucking mailing list they can buy, and scraping for email addresses everywhere. "Business Papers: ERP, CRM, Phone Systems", and so on and so forth keep popping up. Advertising crap for various places trying to make a vacation destination of themselves. A lot of it filtering through linkfarms and pay-per-click referral sites that actually go to legit businesses.

And then there's the political crap, mostly from right-wing shit-for-brains groups like the Tea Tardiers, spamming out screeds about how "if you don't think what we think and hate those brownskinned people then Yer Not A Real Amurrikkan!" Stuff that doesn't look like the traditional "hey I'm selling viagra" spam, but still annoys the crap out of people who don't want it.

And then there's all the phishing crap, which they're not defining as "spam." That stuff runs on botnets.

Re:I don’t buy it

[MobileTatsu-NJG]

There are still enough people who will fall for scams and do business with the kind of people who advertise via spam.

You don't even need that, really. You just need people with something to sell. You're right, though, that'll always be the case.

Re:I don’t buy it

[rtfa-troll]

My theory is that the idiots are using Facebook, and to some extent other social/instant media so that's where the spam is moving. (not saying that all Facebook users are idiots, in fact some of my more friendly than not acquaintances are Facebook users, just saying that most idiots are Facebook users).

Re:I don’t buy it

[yarnosh]

People en-masse haven’t gotten any smarter.

No, but filters have. If people don't get the spam, they can't fall for it.

but the idiots are still there, so the profitability is still there. Give the bad guys a little time. They’ll come up with new ways of getting around our current filters.

Well, they haven't so far. Unlike other areas like viruses and trojans, spam filters have pretty consistently stayed one step ahead of spammers once people took spam filtering seriously.. I remember maybe 4 years ago there were a couple months where spammers figured out how to embed their messages in images in such a way as to pass filters, but that was fixed and since then filters have been so good that I haven't seen a single spam message in my gmail inbox in months. I did get a couple messages through poorly maintained mailing lists. So I just unsubscribed from the lists.

Sure, someone is going to find a way to slip by, but it definitly won't last long and it definitely won't be all spammers. Seriously, there's no reason why anyone should still be receiving SPAM these days. We've won.

Of course the other theory is that spam has become “less interesting” in light of other new and exciting ways of screwing with people. Once those dry up though, I think the guys with the suits will fall back on classic reliable spam to make their money.

The guys with the suits are using "legit" channels to screw with us. THere's just no way to make spam look professional these days. It will continue to be the domain of the gray market scumbags, not the suits.

Re:I don’t buy it

[countertrolling]

It's like when the cops chase the hookers off of one corner, they just move to the next...

Re:I don’t buy it

[MightyMartian]

My thoughts exactly. Why bother with the iffy strategy of getting people to buy your crap when you can steal their credit card and just steal their money directly?

Re:I don’t buy it

[Kjella]

Smarter as in intelligence, no. But people are more Internet-savvy than they used to be. And young people meet the spam barrage before they have a life savings to give to a Nigerian prince. Just like people have gotten quite used to the horseless carriages (read: cars), even though I doubt our IQ is that different from 100 years ago.

Re:I don’t buy it

[chimpo13]

One of the benefits about FB is that everyone is on your white list. I'd still rather get email than FB email so I can keep them for future reference.

Re:I don’t buy it

[wagnerrp]

"if you don't think what we think and hate those brownskinned people then Yer Not A Real Amurrikkan!"

I would love to have someone say that to me in person. I wonder what their response would be when informed that brownskinned Mexicans are from America.

Re:I don’t buy it

[Anonymous Coward]

And then there's the political crap, mostly from right-wing shit-for-brains groups like the Tea Tardiers, spamming out screeds about how "if you don't think what we think and hate those brownskinned people then Yer Not A Real Amurrikkan!" Stuff that doesn't look like the traditional "hey I'm selling viagra" spam, but still annoys the crap out of people who don't want it.

There goes your posts credibility. You could have left out the political statement, you know.

Re:I don’t buy it

[Attila Dimedici]

Considering that one of the two favorite candidate of the Tea Party participants is Herman Caine, I wonder what group you are talking about that wants people to hate "those brownskinned people". Or maybe you have formed your opinion of the tea parties based on the reporting of people who always vote for the political party that wrote the Jim Crow laws and formed the KKK.

Re:I don’t buy it

[yarnosh]

I think you have it backwards. Other avenues of attack will come back now that spam is no longer viable. As far as knowing how to get past filters, the thing is that not all filters are the same. Maybe your company's filter had a hole, but not everyone uses the same techniques. Also, good filters look at more than content. Greylisting, for example, cuts out 80% of spam simply because successful spamming depends on incredibly high volumes and performing the retries required by greylisting is just not feasible. Hell, if you simply block unauthenticated SMTP access to all broadband IPs, you can cut out the majority of SPAM. Bulk of spam depends on botnets. You just can't push the necessary amount of spam through legit channels on a consistent basis. If you abuse someone else's system, they will shut you out. And by the time you build up your own resources to delivery that kind of volume, you'll be blacklisted.

Re:I don’t buy it

[Ephemeriis]

People en-masse haven’t gotten any smarter.

People haven't gotten any smarter, but technology has.

Outlook has junk mail filtering built-in. Gmail has spam filtering built-in. Pretty much every mail server out there has some kind of spam filtering available. Pretty much every endpoint protection package has a spam filter. There are tons of different filtering systems available for purchase.

Relatively little spam actually makes it through to the user's inbox anymore. So there's less for the stupid/gullible folks to click on.

Give the bad guys a little time. They’ll come up with new ways of getting around our current filters.

Well, of course they will... But the good guys are going to keep developing new filters, too.

Of course the other theory is that spam has become “less interesting” in light of other new and exciting ways of screwing with people. Once those dry up though, I think the guys with the suits will fall back on classic reliable spam to make their money.

Spammers go wherever the market is. Right now the market is on the social networks. More people are communicating more often on things like Facebook than through simple SMTP. So there's less profit to be had in spamming SMTP servers.

Sure, if SMTP suddenly becomes crazy-popular again you'll see the spammers head back in that direction... But all our existing filters will still be there to curtail that crap.

the profitability is still there.

I don't know about that...

Sure, it's probably pretty cheap to send out a few thousand emails... But how many of those actually make it in front of somebody's eyes? And how many of those actually get read? And how many of those are actually clicked-on?

The real money these days is in malware. Dropping bots on computers and grabbing their credentials for various websites... Or sending out some kind of fake antivirus scanner that scares people into paying $50 to clean up the fake infection... Or using those bots to hack some big, important website...

I really don't know that there's all that much profit to be made in sending out spam these days.

Re:I don’t buy it

[LordLimecat]

The new "Spam" is adding people to every fucking mailing list they can buy, and scraping for email addresses everywhere.

Microsoft is a huge offender in this regard, and unlike most of the other legitimate spammers, they make it impossible to delist (have to sign up for a live account, adjust spam settings, and they still ignore them).

spamming out screeds about how "if you don't think what we think and hate those brownskinned people then Yer Not A Real Amurrikkan!"

A) possibly watch what lists you sign up for
and B) you just went from "insightful" to "deranged ranting". Ive never heard anyone on any side of the spectrum say anything resembling that. I've certainly heard attacks on irresponsible spending from the "tea party", but if you want to conflate that with racism, carry on i suppose.

Re:I don’t buy it

[LordLimecat]

Just wanted to add-- theres some kind of irony in accusing others of racism while simultaneously ridiculing them for the way they speak (presumably based on their geographic background).

Re:I don’t buy it

[nschubach]

It's a shame that people feel they need to propagate this type of ignorant rhetoric.

Re:I don’t buy it

[itsenrique]

Because there is a lot more at risk when you're committing straight up theft, vs soliciting them to buy your shoddy merchandise.

Re:I don’t buy it

[smooth wombat]

Considering that one of the two favorite candidate of the Tea Party participants is Herman Caine,

And considering he said he would want any muslim person in his administration, and only muslims, to take a loyalty oath, that says all you need to know about him and the Tea Party.

For reference

Of course he retracted his statement, two months later, but he said what he said so obviously he means it.

Re:I don’t buy it

[poetmatt]

Pretty easy to go from CC -> untrackable currencies in a variety of forms. So not really.

Re:I don’t buy it

[nschubach]

If you signed up for Chrome OS, even Google did this with a set of services under the Gilt Group umbrella. It took a threat to file with my attorney general before they'd delete my information. I got all kinds of kickback on how they couldn't delete my information, but they'd disable it. Of course, they shared it with everyone in their "network" which was actually what prompted me to pursue getting it actually deleted. Took about five emails over the span of two weeks to get someone to admit that they could and will delete my info. eHarmony is just as bad with their magazine offer. I never signed up, but I started getting them and I still (after 6 months) cannot get them to stop sending me that crap even after demanding a refund and cancellation of account.

Re:I don’t buy it

[itsenrique]

He may be identified with the right wing. I just get stuff asking for more money from the prez's crew. I don't see how this blows his credibility. He's not saying much about politics unless your in the tea party, but that's just a vocal, and easy to make fun of minority. He's really talking about a shift in the kind of spam we're seeing overall, and he seems as credible as anyone else telling anecdotal stories on slashdot. Thanks, have a good one.

Re:I don’t buy it

[RsG]

spamming out screeds about how "if you don't think what we think and hate those brownskinned people then Yer Not A Real Amurrikkan!"

A) possibly watch what lists you sign up for

Or are signed up for.

At least one of my mail accounts got put on a number of (legitimate) political/religious mailing lists by a well meaning idiot. This particular idiot was not notified when I switched email services; for all I know my old account name might still be getting it.

It wasn't "spam" - the messages weren't commercial, what they were selling was ideology. It was, as far as the groups sending it out knew, solicited. I got one very nice email back from the admin of one such list after I requested my email be taken off, and received no further junk from them.

Betcha that's what happened here. Some idiot (well meaning or otherwise, relatives are an obvious culprit) signed up the GP's account for some list. GP is so used to being spammed, (s)he assumes the emails are being sent en masse to anyone, and therefor never bothers to try and delist their account, because actual spammers never pay attention to such requests.

I receive zero spam in my actual inbox, but on the rare occasions I've seen what the filters caught (usually looking to see if something I was expecting got flagged as a false positive), absolutely nothing has been political. Possibly because anyone with an agenda knows that mass email is a good way to drive moderates to the opposition.

Re:I don’t buy it

[RsG]

Except it isn't zero. Time is money. If a spammer spends time setting up an email scam, and makes a pittance out of it, then it isn't worth it for them.

Of course, not all spammers are created equal. Some will get more out of an hour of work than others. But most spammers aren't very good at what they do; if they had the skills to make it they'd be doing something less degrading. It may well be the unskilled ones have a choice between sending out spam emails or working in a sweatshop, and spam is the lesser evil for them.

But make it so that they have to spend hours learning their way around filters just to make a buck, and they'll up and quit. Why expend so much effort to earn so little?

Re:I don’t buy it

[secretcurse]

I'm sure your well-reasoned argument would immediately win over their heart and mind and they would be forever changed.

Re:I don’t buy it

[goose-incarnated]

I do buy it - spam has to hit an equilibrium sooner or later, and the equilibrium is always reached after a final peak,

Re:I don’t buy it

[wagnerrp]

I figured I would get lynched, or at least punched really hard. Might beats right.

Re:I don’t buy it

[pixelpusher220]

Actual spammers never make any significant money, just like gold diggers in the gold rush never made money.

The money is in selling the shovels - or in this case, the tools, email lists, etc. by which the suckers attempt to 'hit it big'.

Re:I don’t buy it

[elsurexiste]

I don't buy it

Almost no one buys SPAM-advertised products. That's the cause of SPAM's decline.

Re:I don’t buy it

[Attila Dimedici]

You are aware that Herman Cain is black, aren't you? It is hard to argue that someone who supports Herman Caine for President is a racist because they oppose Obama. Which is what the poster I replied to seemed to claiming, unless you are contending that blacks are not in the same category as "brownskinned people."
On the other hand, it is easy to argue that a person that supports the party of segregation, Jim Crow laws and the KKK is a racist.

Re:I don’t buy it

[asdf7890]

I have a sub-domain which has a catch-all account. Every form I will out gets a different address on that subdomain (usually with something in the name that identified the entity I gave the address to and why, with something random so they can't claim a spammer just guessed the address - something like slashdot4808signup@sub.domain.tld). Then if someone flogs on my address or I otherwise get crap I don't want down it after asking to be taken off their lists I can just set that address to forward to /dev/null. Of course that means I'm probably getting a pile of junk delivered each day that just gets discarded, but the volume is not high enough that it even starts to figure on any cost radar. My main addresses have managed to leak out over time, and my primary address is forename@surname.net so it sees a lot of junk sent to commonname@anydomain.tld, so my system isn't perfect. But it did keep junk to a manageable level even before the recent drop in volume (which made me run tests to make sure my mail server was still working fine for accepting mail!).

Re:I don’t buy it

[InsectOverlord]

Political statements usually come not in the form of spam, but even worse, in chain emails (though of course they are designed and originated to harvest email addresses for spam purposes).

Re:I don’t buy it

[jjoelc]

Spam is no longer profitable! Tell Everyone! Failure to forward this story to at least 15 people will result in... more spam! But if you add your name to the bottom of this story, and send one dollar to each person whose name appears above yours you will make millions! And have a larger penis too!

Re:I don’t buy it

[Coren22]

Generally what is meant by "brownskinned people" is people from the Arabian peninsula who worship Allah, not people who came over on slave ships from Africa, those are generally just called black people.

Re:I don’t buy it

[Anonymous Coward]

And then there's the political crap, mostly from right-wing shit-for-brains groups like the Tea Tardiers, spamming out screeds about how "if you don't think what we think and hate those brownskinned people then Yer Not A Real Amurrikkan!" Stuff that doesn't look like the traditional "hey I'm selling viagra" spam, but still annoys the crap out of people who don't want it.

Shit for brains liberals don't e-mail me very often, but they sure post their spam on slashdot a lot. (Hint: This article had NOTHING to do with politics until you brought it up.)

Re:I don’t buy it

[Attila Dimedici]

In most conversations I have heard, "brownskinned people" has been used to refer to anybody who was not of European descent (sometimes further constricted to exclude East Asians). I can conceive of using the term "brownskinned people" to refer to Hispanics, Arabs and South Asians while excluding Africans. However, it makes no sense to use the term to refer exclusively to Arab Muslims (which seems to be what you are saying it refers to). Considering that not all Arabs are Muslim (although the Muslims are working to extinguish the exceptions) and not all Muslims are Arab, being anti-Muslim is not an example of racism.

Re:I don’t buy it

[madprof]

Let me get this straight, it is easy to argue Democrat supporters are racist because of what some Democrats supported decades and decades ago?
Would you find it easy to argue white is black and night is day too?

Re:I don’t buy it

[Attila Dimedici]

Considering that Senator Robert Byrd only died last year and while he was alive Democrats considered him the "Dean of the Senate", yes. In case you were unaware, Robert Byrd started his political career as a recruiter for the KKK. He left the KKK (or at least stopped openly being a member) when it stopped being a political asset.
What have the Democrats ever done that was beneficial for anyone other than rich, white people?

Re:I don’t buy it

[froggymana]

Just require everyone to pay with BitCoins!

Re:I don’t buy it

[EdIII]

I already went down have the page and nobody has pointed this out at all........

Most spam filters suck. Even the good ones. False positives and false negatives all over the place.

The best it can do is just add to the point system and hopefully, if the spammers are not really smart (which some of them are very smart), it will score high enough to get to the junk mail filter.

Filters have nothing to do with it. IPv4 address space limitations and hosting difficulties are what is causing SPAM levels to drop.

I can't believe nobody pointed this out in the article or a post yet. Spamhause, SpamCop, and the plethera of other RBLs. Not to mention the PBLs and other block lists where you can block entire countries.

99% of all my SPAM is blocked with a simple DNS lookup. That does not happen with filters either. RBLs inspect and ruthlessly keep track of spamming organizations and their movements. SPAM friendly network ranges get blocked all the time.

Last, but hardly least, the PBL. Hard for a botnet to send you email from a SMTP communication on a residential IP address huh? Especially when the ISP itself might block it by policy (Cox in the South West is infamous for it), and well maintained PBLs mean that I will add 100 to the score just for being on one. I only need 4.5 to block.

That's why. IP Addresses are not easy to come by anymore and when you keep moving around and your entire block keeps getting a value added to the score that by itself classifies it as SPAM it does not matter how good the SPAM'r is, or how good the filters are, but *where* the SPAM is sent from.

We have got pretty damn good at identifying the networks and IP addresses of where SPAM is originating it from.

IPv6 being implemented will cause a resurgence. A spectacular one I think, because I know firsthand from several different filters that they are not actually that good. I can see it because when the RBL does not flag it, it lets through about 4/10 SPAM messages with a score *just* below 4.5. Which is not the default for the filter I am using right now. I lowered it. Those are smart spammers. I have seen SPAM messages that are so obvious, yet get scores in the 2-3 range. Those are the ones "in it to win it".

Don't get me started on Yahoo, or any other free email provider. They suck balls. I have a test GMail account and some friends on it and they tell me it is the best so far.

The reason the big guys don't use RBLs as much? The managers are cheap bastards because querying Spamhause 100k in 5 minutes they have this quite unreasonable position of wanting to be compensated. Yet the big ones, to my knowledge, don't put together their own RBLs. Mabye Google does, but Yahoo lets in over half the crap all the time.

Re:I don’t buy it

[poetmatt]

Okay comedy troll who said bitcoin is the only form? Cash is basically unable to be traced, too.

This has been the strategy for a while

[hedwards]

People have been working on increasing the cost and decreasing the reward from spamming for some time now. From discouraging people from buying from spam messages to grey listing, to shutting down botnets, all of that has been largely for the purposes of making it less attractive to spam.

I'm just a bit surprised that it's starting to have an effect, it's hard to compete with basically free server capacity and bandwidth.

Re:This has been the strategy for a while

[TheRaven64]

I suspect that it's not so much that these techniques are effective as that they are largely concentrated on email. This means that they drive the relative cost of email spam up and make message board and put-your-face-in-the-book spam a lot more attractive. The latter, of course, is designed to send targeted spam and for a small fee will actively target your spam for you to the most gullible, sorry, appropriate audience.

Re:This has been the strategy for a while

[yarnosh]

I'm just a bit surprised that it's starting to have an effect, it's hard to compete with basically free server capacity and bandwidth.

It still takes resources to secure those resources. Botnets are not free. Lists are not free. Spammer time is not free.

I'm surprised it has taken this long. There's no reason why the average person should even be getting spam in their inbox at all. If you're still getting spam, you need a new email provider. My gmail address is published all over the goddamn place, including usenet of all places, and I haven't seen spam in months. Even if the cost of sending me spam is next to nothing, it is still wasted.

Re:This has been the strategy for a while

[wintercolby]

I think your success story about spam is actually Gmail, which seems to be better than a lot of COTS and OSS spam filters. It's amazing how well you can filter out spam based on that broad of a user base's opinion of what is spam. On the other hand, I'm running a well known commercial email product with an equally well known spam filter at work, and it isn't blocking spam nearly as well.

Re:This has been the strategy for a while

[olau]

The first line of defense in Gmail is some kind of filtering of the server sending the spam. We used to run email through another server first, then route it to Gmail. When we stopped doing that and just let it go straight through to Gmail, the number of spam messages fell an order of magnitude.

Still, I don't trust the Gmail filter. I still sometimes find legit messages labeled spam. But it's so good at the server filtering that I only have to skim through a pageful of spam per day, so it's not bad.

Damn!! Spam = ~4yrs in the Federal Pen?

[killfixx]

That's significant! 4 years in a federal prison (ass rape, etc...) for what amounts to a computer crime.

Definitely not hitting "replay all" ever again!!

Re:Damn!! Spam = ~4yrs in the Federal Pen?

[fuzzyfuzzyfungus]

My thought was exactly the opposite: When I saw that TFS had a quotation from the guy "Why is he still in a state capable of speech?" was what lept immediately to mind.

Spammers should be serving life sentences, shackled to the production lines and making the real thing...

Re:Damn!! Spam = ~4yrs in the Federal Pen?

[Issarlk]

Oh the irony. The spammer must regret having sent all those "penis enlargement" ads when landing in prison.

Re:Damn!! Spam = ~4yrs in the Federal Pen?

[v1]

Oh the irony. The spammer must regret having sent all those "penis enlargement" ads when landing in prison.

Or at least, praying they didn't work anywhere near as well as was advertised

Of course its financially feasible.

[Kenja]

Not everyone needs $20,000 a day. Average income in China for example is only a couple thousand dollars US. Costs are lower over sea and profits can be lower while still maintaining financial feasibility.

Re:Of course its financially feasible.

[M. Baranczak]

Not if the profits are negative. The thing is, spammers are already operating on a really thin profit margin; so even a small rise in the cost of spamming could have a devastating effect.

Re:Of course its financially feasible.

[Anonymous Coward]

That's be a shame...

Re:Of course its financially feasible.

[memyselfandeye]

No kidding. Could have fooled me about the decrease in SPAM.

I run my own MTA for my vanity domain. I check spam twice, once before accept to reject outright SPAM and once after accept to take into account user preferences. My aggressive ACL checks against forged and black addresses, I have an up to date spamassassin and custom rules, and use greylisting services and such. SPAM to my mailboxes has not declined by the massive amount Cisco is reporting. It has gown decreased slightly, about 7% since January, but no where near that 7x decrease. I wonder if this isn't just Cisco trying to sell some kind of spam filtering appliance.

Here's a perfect example of something that cropped up last week: "Pi ckOutYo urPr ef er enceTa bl etsEs sen ti alsWe bsto re" (Pick Out Your Preference Tablets Essentials Webstore) Writing a regex pattern to match those broken words and not tag things like eBay and iPod was a freaking PITA.

That $20 a day is a very good job in China. That's $7k a year (spam is a 24/7 business after all) compared to the $3k you'd get working in Foxconn, for example.

Re:Of course its financially feasible.

[yarnosh]

I suggest you save yourself the hassle and just host your mail domain with Google. It is free and they have excellent filters and support IMAP. While it is neat to tinker with filters and see the tactics first hand, it s really not worth your time.

That $20 a day is a very good job in China. That's $7k a year (spam is a 24/7 business after all) compared to the $3k you'd get working in Foxconn [telegraph.co.uk], for example.

Even $20 is pretty optimistic. You're certainly not going to make that as a casual spammer.

Re:Of course its financially feasible.

[plover]

"Pi ckOutYo urPr ef er enceTa bl etsEs sen ti alsWe bsto re" (Pick Out Your Preference Tablets Essentials Webstore)

Here's the thing, I don't even initially understand what they're trying to sell with that message. It takes a few seconds of thought to parse the words, but before that time my internal mental gibberish recognition filter has kicked in, and my brain is already saying "gibberish == spam, hit delete".

I suppose if someone is desperate to figure out every word that's emailed to them, they'd spend the time, but what kind of person responds?

Re:Of course its financially feasible.

[yarnosh]

Have you seen the content of spam? They're not F 001ing Any0n 3!! !!

Re:Of course its financially feasible.

[Ectospheno]

Part of the reason the average income in China is low is because 36% of the population makes less than $2 per day.

Re:Of course its financially feasible.

[jimicus]

Here's the thing, I don't even initially understand what they're trying to sell with that message. It takes a few seconds of thought to parse the words, but before that time my internal mental gibberish recognition filter has kicked in, and my brain is already saying "gibberish == spam, hit delete".

I suppose if someone is desperate to figure out every word that's emailed to them, they'd spend the time, but what kind of person responds?

I heard a rumour some time ago - don't know how true it is - that they aren't selling anything. The whole thing is essentially a big scam, which works like this:

1. Company advertises a "way to make money fast". What the victim is buying is an application to send bulk email, a list of email addresses and a list of companies willing to dropship generic viagra. The list of email addresses may or may not be any good, ditto the list of companies - I daresay many have already gone to the wall or aren't even prepared to acknowledge anyone asking them to dropship viagra.
2. Victim falls for it. Installs software and start sending out spam. They probably don't make any money at all; if they get any orders in those orders as likely as not aren't honoured by the dropshipper so they don't carry the business out for very long, but it's long enough for others to notice the spam and sure as eggs is eggs, at least one or two others think "My goodness, that must work or they wouldn't do it." People who think that are setting themselves up to be the next victim.
3. The only person making a profit is the person selling the bulk mail app and the list of email addresses

(Seriously, slashcode? No ordered list support?)

Re:Of course its financially feasible.

[yarnosh]

It isn't common because it is a stupid waste of time. Real spam filters will stop those messages from reaching your inbox in the first place, saving you the time and effort. But hey, if you want to do it manually, whatever..

Re:Of course its financially feasible.

[memyselfandeye]

I suggest you save yourself the hassle and just host your mail domain with Google. It is free and they have excellent filters and support IMAP. While it is neat to tinker with filters and see the tactics first hand, it s really not worth your time.

I'm the paranoid sort though. I have a tin foil hat and everything :P

To be fair, it's a vanity domain for me, but several dozen other people seem to enjoy it as well. Years ago I used the typical one in a million freebie hosting for $5/month, but hours and days of "IMAP error" and "server could not connect" changed that tune. Now Google sounded like a great idea to me as well, and I was ready to make the plunge a couple months ago. But Google is $5/user for over 10 users and it just wasn't financially viable.

So we many not be Helen of Troy (IO.com), but I don't plan on leaving my buddies flapping in the wind either. MTA's are a hassle, I'll grant that, but I will not be going back to the unlimited e-mails for $5/month anytime soon.

Even $20 is pretty optimistic. You're certainly not going to make that as a casual spammer.

That's what the guy said he was making. Hell if I know. I'm not trying to champion spam, but someone is doing it and I don't think it's because they like writing about free watches. One thing is for sure, over the last few years spam has gotten to the point were inboxes are mostly full of ham, and junk boxes are mostly full of spam. I'll not complain. But in a world where people will, and can, work for peanuts whose to say how valuable spam is and isn't?

Re:Of course its financially feasible.

[rot26]

I've had the same email address for about 15 years now and I get around 800 spam emails a day.

Your method would be a full time job.

Re:Of course its financially feasible.

[memyselfandeye]

"Pi ckOutYo urPr ef er enceTa bl etsEs sen ti alsWe bsto re" (Pick Out Your Preference Tablets Essentials Webstore)

Here's the thing, I don't even initially understand what they're trying to sell with that message. It takes a few seconds of thought to parse the words, but before that time my internal mental gibberish recognition filter has kicked in, and my brain is already saying "gibberish == spam, hit delete".

I suppose if someone is desperate to figure out every word that's emailed to them, they'd spend the time, but what kind of person responds?

I didn't really feel like going into details as it's not all that clever except it gets around spam filters easy enough. All the spammer does is generate a typical spam and break up the words. The user who brought this to my attention wanted an alias forwarded to his personal mailbox I host because Hotmail doesn't even try to catch it. The poor SOB gets about 17 a day, and on a netbook it can get hard to read your e-mail in a browser full of advertisements and such when the tiny little window that actually shows your inbox is full of spammy text like that.

And since this user is my father in law... erm, sure daddy whatever you want. It took a bit of work, and a ton of help, but I did manage to fanagle a rule that catches the broken words, and so far has had a 100% positive to false-positive rating. Good enough for me :P I thought about rejecting the mail outright with a polite message containing my rule's Regex expression, but I thought it would be rude to reject an auto-forwarded e-mail as spam.

The text in incomprehensible, but the message body has an link that always points to a yahoo group message that is nothing but an advertisement. Hotmail, in it's infinite wisdom, will automatically display that page inline for some reason. Oh well, problem solved. Inboxes are full of delicious ham, and junk boxes are full of tasteless spam.

Re:Of course its financially feasible.

[Eponymous Hero]

wow, you get around 800 spam emails that slip past your filters? sucks to be you, i'd change email providers if i were you. sounds like their filters are virtually non-existant. i check my email (also had it for 15 years) once every ~4-10 days, and only have to manually remove about ~5-8 spam emails. i also don't aggregate tons of other accounts into my main one, that would be stupid. i use my other accounts as spam traps for dumb shit i have to sign up for. e.g., if i were to make a youtube account to watch censored videos it would be with my spam email account.

tell me you've heard of this before. i can't help but think you must be one of those morons that falls for phishing attempts, or fills out those surveys so you can watch pirated sports streams or answers those stupid facebook app requests. 800 spam emails a day after filters, you are Robert Soloway's wet dream. wipe your chin, it's dripping.

Re:Of course its financially feasible.

[Geminii]

Thin profit margin?

Buy virus; use virus to create self-increasing botnet; use botnet to send spam. Where's the expense?

Re:Of course its financially feasible.

[rot26]

I know this thread is long dead but I just saw your reply. You actually missed my point completely. I was pointing out the futility of manually weeding out spam when the volume increases in response to the parent who claimed not to need filters because he had eyes and fingers. I AM my own mail provider, and the 800 per day figure is BEFORE despamming. After using RBL's, baysian filters, etc etc etc I'm down to about 6 or 8 spam messages per day leaking though, which is acceptable (to me and my users.)

Re:Of course its financially feasible.

[Eponymous Hero]

we both misunderstood then. i am the parent, but i never claimed to not need filters because i have eyes and fingers. i claimed that my "best" filter was weeding them out myself. this was a bit of joke, since it seemed obvious (at least to me) that the only spam i'm looking at are the post-filter infiltrators. after all, filtered spam is already gone, right?

i misunderstood you when you said you got 800 spam emails a day, but didn't qualify that as prior to filtering.

when i say my best spam filter is myself, i'm referring to those 6-8 spam emails you get per day, which we both find acceptable.

Good news, but...

[milbournosphere]

While this is great news, I really think that reducing the volume of physical spam needs to be a high priority as well. I get nothing but junk in my physical mailbox these days. Well, that and bills. I should have the option of automatically refusing anything sent to me that is addressed to 'Our friend at' or 'Resident'.

Re:Good news, but...

[thebian]

Don't forget the junk phone calls. They're the worst. Don't call lists are minimally effective.

Re:Good news, but...

[ByOhTek]

I'm still surprised at all the scam commercials I see on tv, and am amazed they are still around, and haven't been persecuted (i.e. MyCleanPc which has been running for over a year now at least).

Re:Good news, but...

[Octorian]

And have exemptions for the types of calls that make up the majority of your junk call volume anyways.

Re:Good news, but...

[glwtta]

http://www.ecocycle.org/junkmail/index.cfm

Works surprisingly well.

Re:Good news, but...

[memyselfandeye]

That is totally possible. For example, I will outright reject mail that is 99.9999% guaranteed spam (10 times the "spam score" threshold) before even attempting to deliver it to my user's mailbox. It doesn't save on bandwidth or anything, but it cuts down on SPAM by close to 60%.

Most mail admins aren't going to do that by default however, because there is that one in a million chance it isn't SPAM.

The war is still ongoing, and I don't care what the "Spam King" says. Spammers from the 3rd world are perfectly happy to keep it up knowing they are making twice as much as some guy laying it on the line in a crummy factory.

Re:Good news, but...

[milbournosphere]

Yes, cold calls are a waste of my time and theirs. But the sheer volume of spam propping up the USPS and various printing companies just oozes waste. Waste of paper, waste of time, waste of money. Pretty much the only positive thing about spam is that it keeps somebody, somewhere, employed. I wonder just how much money goes into the junk mail business.

Re:Good news, but...

[jfengel]

At this point, the junk is subsidizing the bills. You don't like the bills, but you need to get them.

Unlike spam, the cost of sending a piece of mail is very high, and the Post Office is always broke. As long as they're going out, though, carrying the extra junk mail is a small marginal cost, and their willingness to carry the junk means that the price of stamps remains relatively low. (It astonishes me that you can send a letter thousands of miles in a day or two for less than half a buck.)

The "Resident" mail is designed to make it cheaper for them. It's not just that they want to reach somebody, though that's nice, too. It means the Post Office doesn't have to drag it back if refused, and they give the sender a break on that.

It's not great for the environment, obviously, but at least at the moment they're still required to offer mail service to everybody. It's less like spam and more like Google AdWords: irritating, but a bit less irritating if you know why it's there. If it wasn't, some good things would disappear.

Those good things may disappear anyway: more and more bills are switching online, and the Post Office may one day knuckle under. You'll probably spend more for a letter, but you'll get (and send) even less physical mail than you do now. That will probably happen only after they decide that internet service, like mail, is a right rather than a privilege.

Re:Good news, but...

[yarnosh]

The do not call listhas been extremely effective for me.

Re:Good news, but...

[plover]

I've heard that 'spam' subsidizes the entire USPS. Without the revenue generated by 3rd class bulk rate, first class postage would probably be about $2 USD per letter (allegedly.) Thus spam keeps your letter carriers coming around every day, except Sundays.

Of course, that was several years ago. I've also heard that email has decimated the first class postage business, so the proportional subsidy is now probably much higher than that.

Re:Good news, but...

[couchslug]

Dead tree spam provides desperately needed money to the US Post Office, which is is bad financial shape. Junk mailers PAY postage to get eyeballs.

I'd rather use junk mail (desanitized of personal info) for packing what I ship USPS than pay more for postage.

Re:Good news, but...

[rsborg]

The post office should just offer a service like Earth Class Mail for a similar price and an extra bonus - no "resident" mail.

It's too bad the post office is still stuck in the 19th century; if they offered mail->digital at a reasonable premium, that alone could pay their bills and subsidize the letter carriers until we no longer need them.

Re:Good news, but...

[hubie]

(i.e. MyCleanPc which has been running for over a year now at least)

Yeah, well just wait until it takes more than three seconds for your email to load, then who will be sorry?

Easier Ways

[Kamiza Ikioi]

It's not that they've gone legit. It's that there are easier ways to scam people out of their money for higher profit returns, such as spear-phishing.

SPAM filters too good?

[ShavedOrangutan]

Yeah. Half my email ends up in a SPAM bucket. Thanks, you bastard. If I want someone to actually receive a message I have to send it through Facebook or SMS.

Re:SPAM filters too good?

[tgd]

Tell your friends to stop talking about your penis and talking in MiX3d c4SE l33t 5p34k.

Or get a new spam filter? I may have one false positive a month on my GMail account.

Re:SPAM filters too good?

[SmilingBoy]

Half my email ends up in a SPAM bucket.

What kind of e-mail service do you use? Or what kind of e-mails do you get?

I'm using Gmail, and maybe 2 or 3 spam emails per month get through to the inbox (of around 1000 spam emails per month in the spam folder). On top of that maybe 1 or 2 legit e-mails are classified as spam per month. With one exception from two years ago (flight confirmation e-mails), none of these false positives are critical; they are usually just advertising from companies I bought something at some point.

Re:SPAM filters too good?

[yarnosh]

What service are you using? I know gmail's filter is good. I haven't lost any email that I'm aware of. Or do you mean the messages you're sending end up in spam buckets? Do you run your own MTA or something?

Stop Patting Yourself On The Back

[damn_registrars]

This has nothing to do with filters. I repeat, nothing. Filters are just an act of throwing good money after bad money, in the hopes that the good money will somehow stop the flow of the bad money. It's like saying that installing a new toilet in your house in the suburbs will stop homeless people from pissing on the street downtown.

Spam volume naturally rises and falls. Anytime someone congratulates themselves for a reduction in spam volume, they are proven wrong shortly later when it comes back up. If anything, a few of the prominent relays that were pushing spam out went down. More likely it's just been a slow week.

The only thing approaching reasonable in the summary is that indeed economic factors are at play. As I've said before, the only way to stop spam is with economic action; spam is so prevalent today because it is so cheap and profitable, which is why filtering will never lead to a permanent solution.

Re:Stop Patting Yourself On The Back

[SmilingBoy]

But better filters have a big impact on the economics. If you cut down the number of spam e-mails that reach the inbox, you cut down the number of readers, which in turn cuts down the number of customers. This means lower or even negative profits.

Re:Stop Patting Yourself On The Back

[damn_registrars]

But better filters have a big impact on the economics.

No, they don't. Filters don't help, for several reasons:

• Many users don't use filters anyways
• The cost of sending an email is so trivial that it doesn't matter how many get through
• The people most likely to use filters are the least likely to buy from spam anyways
• The filters have to be maintained to be relevant, which only increases the cost of internet access for everyone

So in the end, filtering does not help the problem. Indeed an argument could be made that it makes it worse because we just end up throwing more resources into filtering techniques in the form of filter rule updates, new hardware, more storage, more power consumption, more bandwidth required, etc. Even if gmail is your only email, you are still paying for google to do it for you in one way or another.

cuts down the number of customers. This means lower or even negative profits

Extremely unlikely. As I mentioned the people who use filters are the least likely to buy anyways. Spam still gets through and the spammers keep working on ways to get around filters; its just an arms race that nobody can win.

The only solution that will ever be able to work is to deal with the economic factors behind the spam. Reduce the profitability of it by making it more difficult for the spammers to get paid. This can and has been done, and it works well. Filtering is a waste of time and resources by comparison because it will never bring about a permanent solution.

Re:Stop Patting Yourself On The Back

[yarnosh]

You have no idea what you're talking about. Very few spammers of any volume use a single relay. Any known relay of spam gets blacklisted in a matter of hours. Bulk of spam is delivered through botnets and between greylisting and SPF, most of that spam doesn't even get through to end users. Less and and spam is getting to end users. Meanwhile, botnets don't come cheap. While this kind of decrease in such a short period of time probably isn't due solely to filtering, I would expect rates to begin a decline.

Filtering works and it is a great long term solution. It is the only solution. You can't stop people from responding to spam. All you can do is stop end users from getting the spam. This has the effect of increasing the cost of sending spam.

spam is so prevalent today because it is so cheap and profitable,

Read TFA. It USED TO BE cheap and profitable. Not so much anymore. The economic incentive is being removed by both saturation and filtering. Do you have any idea how much a decent botnet costs spammers? Gone are the days when you could simply run a couple MTAs and pump out your own spam with little to no cost.

Re:Stop Patting Yourself On The Back

[w_dragon]

Most users aren't even aware of the filters. Gmail, Hotmail, and Yahoo all have good enough filters that seeing a true spam message is rare. Even ISPs filter for their normal users without an opt-in. Maintenance of filters is not an issue, just give people a 'spam' button to press and the filter can learn. I was using spamassassin about 10 years ago, it's free and feeding it a few days' worth of spam messages got it to the level where it was correctly identifying over 99.9% of the spam coming into the account.

For some reason I feel like I'm feeding the troll here...

Re:Stop Patting Yourself On The Back

[damn_registrars]

Filtering works and it is a great long term solution. It is the only solution

I can't even imagine a way for you to be more wrong. Filtering consumes money, time, and resources. It only encourages spammers to further obfuscate their email to find ways around filtering rules. Eventually spam becomes obfuscated enough that the false positive rate for filtering reaches completely unacceptable levels and then people who cling to filtering will have to wake up and realize that they didn't solve the problem, and that with filtering alone they never had any hope to doing so.

All you can do is stop end users from getting the spam

Except filtering eventually won't do that either.

The economic incentive is being removed by both saturation and filtering

Wrong. You can repeat yourself, but you won't become right by repetition. Why do people who insist on filtering have to continually spend more time, money, and resources on filtering? Because you're only taking part in an arms race with the spammers. And you cannot win that arms race, not with filtering anyways. You can make yourself feel better, but you won't stop spam that way. Not today, not tomorrow, not ever.

Re:Stop Patting Yourself On The Back

[damn_registrars]

Maintenance of filters is not an issue, just give people a 'spam' button to press and the filter can learn

That is a poor choice, depending on the users to identify the spam that the filters couldn't find on their own. Filters shoudl waste less human and CPU time, not more.

I was using spamassassin about 10 years ago, it's free and feeding it a few days' worth of spam messages got it to the level where it was correctly identifying over 99.9% of the spam coming into the account.

If it works for your own application, great. I hope you're content with the FP level. But don't fool yourself into thinking that it is somehow a long-term or permanent solution. You already told us how you had to train it, and how it needs to be periodically retrained. You didn't mention the FP rate, which will go up over time unless you are going back and checking the messages it filtered for you to find the ones that don't belong in the spam bucket.

And what you completely ignored is that filtering only starts an arms race with the spammers. Your filter autojunks certain messgaes, so they change the body of their messages to get around it. Then you adjust your filter again, and they adjust their email bodies again. They just increase the obfuscation of their messages to get around more filtering rules and pretty soon your FP rate goes up to try to keep up with them; eventually you have to stop filtering in order to see anything useful.

In the meantime, the spammers were still making money, and you were still paying to try to keep their spam away from you. Who won? Not you.

For some reason I feel like I'm feeding the troll here...

I am not familiar with this strange new meaning of troll you are employing here. Perhaps you need to adjust your filter...

Re:Stop Patting Yourself On The Back

[yarnosh]

I can't even imagine a way for you to be more wrong. Filtering consumes money, time, and resources. It only encourages spammers to further obfuscate their email to find ways around filtering rules.

But it works. They spend time and money figuring out how get around filters while I make a minimal investment in filtering on my end. What solution do ou suggest that doesn't involve any kind of investment?

. Eventually spam becomes obfuscated enough that the false positive rate for filtering reaches completely unacceptable levels

Ah, but that's where you're wrong. The thing about spam is that the more you try to obfusctate it, the less it looks like legitimate email and the easier it sot filter out!

and then people who cling to filtering will have to wake up and realize that they didn't solve the problem, and that with filtering alone they never had any hope to doing so.

But for all intents an purposes, the problem is solved at least for me. I don't get spam anymore. I suppose I would like it if more legitimate senders used an opt-in model, but at least I never have to see the Viagra and porn garbage.

Except filtering eventually won't do that either

All indicators point to the contrary. Filtering is getting better, not worse.

Wrong. You can repeat yourself, but you won't become right by repetition. Why do people who insist on filtering have to continually spend more time, money, and resources on filtering?

Do they? Maybe Google is, but I'm not seeing the cost since it is a free service. When I worked as a sysadmin, I was able to use free tools to filter out spam for a college. It added a bit to my workload, but it wasn't anything that required any significant increase in resources.

Because you're only taking part in an arms race with the spammers.

Be that as it may, we've been one step ahead of them for years now. At this point spammers are surviving off of the providers that have no yet jumped on the filtering bandwagon or have not been very good at it.

And you cannot win that arms race, not with filtering anyways.

But I have. I haven't gotten more than a handful of spam message in YEARS and my email address is published all over the place. There's no indication that filters will just stop working. They've only gotten better. You have absolutely no basis for any of your predictions other than the idea that "arms races" don't work. You're not applying any reasoning to this particular issue. You're making generalizations. You dont' know what you're talking about.

Re:Stop Patting Yourself On The Back

[damn_registrars]

I can't even imagine a way for you to be more wrong. Filtering consumes money, time, and resources. It only encourages spammers to further obfuscate their email to find ways around filtering rules.

They spend time and money figuring out how get around filters while I make a minimal investment in filtering on my end

Multiply your "minimal investment" by all the other users around the world making the same "minimal investment", and add in all the money spent on hardware, storage, bandwidth, and power for the same, and it is no longer a "minimal investment", is it?

What solution do ou suggest that doesn't involve any kind of investment?

Well, if we consider time to be free, or trivially inexpensive enough to be called a "minimal investment", then we should put our time into disrupting the payment system. Spam is sent out because people are paying spammers to send it. Filtering won't stop that, but if the spammers aren't getting paid, they have no incentive to send out the spam. After all, they aren't generally selling the goods themselves - someone else has that duty - nor are they sending out spam just to piss people off (in spite of various claims to the contrary).

The thing about spam is that the more you try to obfusctate it, the less it looks like legitimate email and the easier it sot filter out!

Perhaps we are looking at obfuscation differently. Spam isn't obfuscated with random jibberish; it is obfuscated by adding in commonly used phrases. It may be trying to sell you counterfeit viagra, but it is using common discussion phrases to evade your filtering rules.

Filtering is getting better, not worse.

Resource consumption, and FR rates, point to the contrary.

Why do people who insist on filtering have to continually spend more time, money, and resources on filtering?

Do they? Maybe Google is, but I'm not seeing the cost since it is a free service

Just because you don't write a check to Google doesn't mean their service costs you nothing. There is no free lunch, even on the internet.

When I worked as a sysadmin, I was able to use free tools to filter out spam for a college. It added a bit to my workload, but it wasn't anything that required any significant increase in resources.

It doesn't matter how much the software cost, it still required time to set up, consumed CPU time, required storage space, needed to be retrained periodically, and still missed spam, incorrectly tagged legitimate email, or both.

Be that as it may, we've been one step ahead of them for years now

I'm afraid you're wrong on that. If filtering was "one stop ahead" then why does it need to be retrained? The spammers will always find ways around filtering rules. Filters are a band-aid for a massive gushing head wound.

There's no indication that filters will just stop working

That statement only makes sense if you ignore the fact that filters have to be continually adjusted. Eventually they will no longer be useful as the FP rates will become unacceptable. In the meantime they do nothing whatsoever to discourage spammers from sending out spam.

You're not applying any reasoning to this particular issue

I've laid out my reasoning for you. Just because it doesn't fit your own assumptions about how reality works does not mean it is not reasoning.

You're making generalizations.

You keep pointing to your own experiences - where you repeatedly ignore the big picture - and try to extrapolate the experience of the rest of the known universe from that. How on earth you arrive at the assertion that generalizations are coming from my end I do not see.

You dont' know what you're talking about.

Your narrow assumptions won't help you against spam, and they aren't helping you in this discussion, either.

Re:Stop Patting Yourself On The Back

[yarnosh]

Multiply your "minimal investment" by all the other users around the world making the same "minimal investment", and add in all the money spent on hardware, storage, bandwidth, and power for the same, and it is no longer a "minimal investment", is it?

Does it matter? It had to be done anyway. It wasn't like people were going to just live with the spam because someone like you says it won't solve the problem.

Well, if we consider time to be free, or trivially inexpensive enough to be called a "minimal investment", then we should put our time into disrupting the payment system. Spam is sent out because people are paying spammers to send it. Filtering won't stop that, but if the spammers aren't getting paid, they have no incentive to send out the spam. After all, they aren't generally selling the goods themselves - someone else has that duty - nor are they sending out spam just to piss people off (in spite of various claims to the contrary).

If nobody is getting the spam, people won't bother to have it delivered or they won't pay enough to make ti worth anyone to send. At worst, they're just going to find other avenues to get their advertising out there. You know, like blog spam and whatnot. What can you do besides filter it out and try to prosecute egregious offenders when you can?

Perhaps we are looking at obfuscation differently. Spam isn't obfuscated with random jibberish; it is obfuscated by adding in commonly used phrases. It may be trying to sell you counterfeit viagra, but it is using common discussion phrases to evade your filtering rules.

Yeah, they tried that years ago and it worked for filters that were primarily dictionary/token based, but nowadays we rely primarily on sender verification and greylisting. There are many other indicators that a message is spam. You're a little behind.

Filtering is getting better, not worse.

Resource consumption, and FR rates, point to the contrary.

Whatever. I don't get spam and I don't have a problem with false positives. I see no reason to believe that will change.

It doesn't matter how much the software cost, it still required time to set up, consumed CPU time, required storage space, needed to be retrained periodically, and still missed spam, incorrectly tagged legitimate email, or both.

Ok, so what? It isn't like we can NOT use the filters. I dont' really understand what your issue is.

I'm afraid you're wrong on that. If filtering was "one stop ahead" then why does it need to be retrained? The spammers will always find ways around filtering rules. Filters are a band-aid for a massive gushing head wound.

And yet, somehow, mysteriously, the filters work. I don't get spam.

There's no indication that filters will just stop working

That statement only makes sense if you ignore the fact that filters have to be continually adjusted. Eventually they will no longer be useful as the FP rates will become unacceptable.

But FP rates aren't increasing! If anyting, they're much better than when i first started filtering spam 6 years ago.

In the meantime they do nothing whatsoever to discourage spammers from sending out spam.

Read TFA. Spamming is getting less and less profitable every day. If that isnt' discouragement, I don't know what is.

I've laid out my reasoning for you. Just because it doesn't fit your own assumptions about how reality works does not mean it is not reasoning.

Your "reasoning" is entirely based on the general idea that arms races don't/can't work, which I don't entirely disagree with, but you completely ignore the fact that filters are better than they were years ago and spamming is not as profitable as it once was.

You k

Re:Stop Patting Yourself On The Back

[epine]

Forcing the spammers to turn their missives into alphabet gibberish is ultimately the dominant game-theoretic strategy, unless you believe there are legions of people out there determined to puzzle out the alphabetic mess with great intellect and determination and lip movement in order to obtain their beloved superunplasticizers, which they're too dumb to obtain by less tortuous means.

Present company excluded, I think there's a long term shortage of people who are intelligent, determined, and clueless all at the same time (everyone can now pause momentarily to see if that works out as a compliment; basically I'm saying we're a select group here.)

Filtering works a heck of a lot better than your average bike lock, and most people still lug around one of those.

What you can argue successfully is that there is a game theoretic incentive to defect from the expense of maintaining your own filter on your own ISP, and freeload on the coattails of the spam reduction achieved by everyone else working hard to tilt the economics against spam profit.

Just because there's a psychopathic element to your argument doesn't make it wrong. On the other hand, some of this debate is being carried out among people who aren't stuck at "what's in it for MEEEEEEEEEEE!!!!!" and we're not buying your argument from where we sit.

Re:Stop Patting Yourself On The Back

[damn_registrars]

Does it matter? It had to be done anyway. It wasn't like people were going to just live with the spam because someone like you says it won't solve the problem.

They could have instead chosen to invest in something that is capable of solving the problem. Instead a number of people like yourself selected the response to spam that was most convenient, without concern for its long-term consequences, or its ultimate lack of effectiveness at actually solving the problem.

If nobody is getting the spam, people won't bother to have it delivered or they won't pay enough to make ti worth anyone to send.

You're making the inaccurate assumption that you can actually filter out all the spam from all the email. Even if you were able to get every email address on the planet to consent, you still would not be able to filter out all the spam, 100% of the time, with zero FP.

What can you do besides filter it out and try to prosecute egregious offenders when you can?

I have answered that question multiple times now. There is no point in repeating what you deliberately decide not to read.

It doesn't matter how much the software cost, it still required time to set up, consumed CPU time, required storage space, needed to be retrained periodically, and still missed spam, incorrectly tagged legitimate email, or both.

I dont' really understand what your issue is.

If you are willing to accept those costs, then say so. But don't keep running around pretending that filtering is somehow without cost.

Ok, so what? It isn't like we can NOT use the filters.

Actually, we can. We can skip the filters, and invest time and energy in real solutions. There is no law that we have to use the filters, and in some cases we may be better off without them.

I'm afraid you're wrong on that. If filtering was "one stop ahead" then why does it need to be retrained? The spammers will always find ways around filtering rules. Filters are a band-aid for a massive gushing head wound.

And yet, somehow, mysteriously, the filters work. I don't get spam.

You've already said you have to retrain your filters. Contradicting yourself, you also claimed the filters to be "one step ahead" of the spammers. Both cannot be true. Hence you are either oblivious or a liar - which is it?

In the meantime they do nothing whatsoever to discourage spammers from sending out spam.

Read TFA. Spamming is getting less and less profitable every day. If that isnt' discouragement, I don't know what is.

There is no mention of the fact that the three credit card processing outfits who handle >90% of all business for the spamvertised domains were recently identified and have been pressured to stop dealing with their often criminal customers.

Of course, since you refuse to acknowledge the answer to spam that I have repeatedly supported, you probably won't consider that this would have an impact on the cost of spam, either.

You don't even have a solution of your own.

I don't know if you have a reading disability, or if you are intentionally not reading the solution that I have repeatedly proposed. I won't propose it again to you since you won't bother reading it even if I do. The important point is that here on planet earth we realize that we cannot filter our way out of the spamming epidemic.

Re:Stop Patting Yourself On The Back

[yarnosh]

They could have instead chosen to invest in something that is capable of solving the problem.

Who is "they?" You don't get it. Not filtering the spam is simply not an option. If there is something else that can be done, it has to be on top of filtering. I'm not going to sit around wading through spam waiting for idealists like you to work out your solution.

Instead a number of people like yourself selected the response to spam that was most convenient, without concern for its long-term consequences, or its ultimate lack of effectiveness at actually solving the problem.

You dont' get it. For many people the problem is solved. I'm sorry that you're too stubborn to filter your email, but the technology is there and it works.

You're making the inaccurate assumption that you can actually filter out all the spam from all the email.

99% is pretty damn good. Good enough for me. It isn't like any solution you could come up with woudl prevent anyone for sending spam, ever.

Even if you were able to get every email address on the planet to consent, you still would not be able to filter out all the spam, 100% of the time, with zero FP.

So? I'm happy with current solutions.

I have answered that question multiple times now. There is no point in repeating what you deliberately decide not to read.

You gave a very general answer. I want a very specific solution from you.

If you are willing to accept those costs, then say so. But don't keep running around pretending that filtering is somehow without cost.

You lie. I never once said it was without cost. I already said the costs, as I have experienced them, are acceptable.

Ok, so what? It isn't like we can NOT use the filters.

Actually, we can. We can skip the filters, and invest time and energy in real solutions.

Who is "we" and what are these "real" solutions? Please, I'm waiting. Name one specific solution to the problem that I can invest in.

There is no law that we have to use the filters, and in some cases we may be better off without them.

No laws, but me and my users are not going to sift through the deluge of spam while you, in your fantasy land, work something out.

And yet, somehow, mysteriously, the filters work. I don't get spam.

You've already said you have to retrain your filters. Contradicting yourself, you also claimed the filters to be "one step ahead" of the spammers. Both cannot be true. Hence you are either oblivious or a liar - which is it?

We're one step ahead of the average spammer. We're one step ahead in the sense that if some spam does get through, it is just a small percentage of the total. It is an exception. It isn't like the filters are working one day and the next morning, suddenly we find that all the spam is coming through and we have to adapt. We retrain to stay ahead.

There is no mention of the fact that the three credit card processing outfits who handle >90% of all business for the spamvertised domains were recently identified and have been pressured to stop dealing with their often criminal customers.

So? What are you going to do about it? What can i do about it? What do I do while I wait for someone else use that information? I filter, that's what I do. If you want to take down those 3 credit card processign outfits, be my guest, but that' snot really anything I can do, now is it?

Of course, since you refuse to acknowledge the answer to spam that I have repeatedly supported, you probably won't consider that this would have an impact on the cost of spam, either.

You gave no specific answer. Give me a *specific* solution to spam. Stop speaking in generali

Re:Stop Patting Yourself On The Back

[damn_registrars]

You don't get it.

No, you don't get it. You cling to your filters as a solution, when at best they kick the can down the road for someone else to solve the real problem. You could be honest and realize that filtering will not solve the real problem, but instead you keep lying to yourself - and everyone else - that somehow filters will magically make spam go away.

For many people the problem is solved

The people who believe the problem to be solved either don't recognize the full problem, or they are compulsive liars such as yourself.

I have answered that question multiple times now. There is no point in repeating what you deliberately decide not to read.

You gave a very general answer. I want a very specific solution from you.

You didn't read the answer well enough to know if it was general or specific. And your filters are sure as hell not a general solution to spam.

If you are willing to accept those costs, then say so. But don't keep running around pretending that filtering is somehow without cost.

You lie. I never once said it was without cost.

Except you did. You specifically mentioned free email services, and ISPs who don't give opt-in. You stated that did not cost the user anything.

You really should stop lying about what you say, because your lies are too transparent. If you would have just stopped at admitting to be a filtering ideologue that would have been OK. Instead you are trying to paint filtering as a solution that it is never capable of being.

We're one step ahead of the average spammer.

That is simply a lie. You are exactly one step behind the average spammer. If you were one step ahead, you would never need to adjust filtering rules, ever, because you would already know ahead of time what they will do to get around your filtering rules. Instead you are always adjusting your filtering rules to adapt for their latest obfuscation.

In other words, you are one step behind the spammers. Stop lying to yourself - and everyone else - about that. If you're content with being one step behind, then great for you. But you are being utterly dishonest (at best) when you claim to be "one step ahead".

You have some general proposal that we need to make spamming more expensive but you have no idea how to do that, do you?

If you weren't an illiterate liar you would know the answer to that. There is no point in answering your question since you won't read the answer to it anyways, since it doesn't agree with your view of the world.

Re:Stop Patting Yourself On The Back

[yarnosh]

No, you don't get it. You cling to your filters as a solution, when at best they kick the can down the road for someone else to solve the real problem. You could be honest and realize that filtering will not solve the real problem, but instead you keep lying to yourself - and everyone else - that somehow filters will magically make spam go away.

WTF are you talking about? You're the one sitting around (I assume in a deluge of spam because you're too stubborn to filter it out) wishing someone else would start doing things your way even though you can't really say what, specifically, your way would be. The filters don't magically make spam go away. I can explain the process, if you like. The bottom line is that I don't get spam in my inbox. Maybe that doesn't solve the root problem, but it works well enough for to keep email a usable service for me and my users.

You didn't read the answer well enough to know if it was general or specific. And your filters are sure as hell not a general solution to spam.

Yada yada yada. Repeated refusal to answer a simple question noted.

Except you did. You specifically mentioned free email services, and ISPs who don't give opt-in. You stated that did not cost the user anything.

"ISPs who don't give opt-in?" What the fuck are you talking about? Do you even know?

You really should stop lying about what you say, because your lies are too transparent. If you would have just stopped at admitting to be a filtering ideologue that would have been OK.

A "filtering idealogue." Nice.

Instead you are trying to paint filtering as a solution that it is never capable of being.

Except that I already said that 99% is good enough for me. Hmm....

If you weren't an illiterate liar you would know the answer to that.

Oh shut up, troll. You dont' have a specific solution and you know it.

since it doesn't agree with your view of the world.

My "view of the world." That's a bit dramatic, don't you think? Anyway, thanks for the entertainment. Hope you enjoy wading through your spam, wishing someone else would make it go away for you. Meanwhile, I'll filter it and get on with my life. Jesus Christ, man. Get a grip.

Re:Stop Patting Yourself On The Back

[damn_registrars]

A "filtering idealogue." Nice.

You earned that label. Wear it with pride.

Oh shut up, troll.

I'm not familiar with this new meaning of troll. I actually stated what needs to be done to stop spam, and you insist on sticking to what will never be a permanent solution. You then cherry pick whatever lines of my comments you like, and outright ignore other parts if they don't fit your beliefs. If anyone has earned the label of troll, it is you.

You dont' have a specific solution and you know it.

You wouldn't read it if I shared it. Isn't it time you go adjust your spam filter settings again?

Re:Stop Patting Yourself On The Back

[yarnosh]

I'm not familiar with this new meaning of troll. I actually stated what needs to be done to stop spam

In very general terms. Come back when you have something we can actually implement.

and you insist on sticking to what will never be a permanent solution.

I insist on doing what works now. You can go off in your fantasy land and implement whatever unspecified permanent solution you want. I'm not stopping you. Although from your highly emotional reaction here, you'd think I was not only preventing you from stopping spam, but also choking your mother.

You then cherry pick whatever lines of my comments you like, and outright ignore other parts if they don't fit your beliefs. If anyone has earned the label of troll, it is you.

Let's settle this right now. You quote me your specific solution to the problem of spam that I supposedly ignored, and I'll take the title of troll. Don't restate it or try to make something up now. I want you to go back and copy and paste your exact words. If you can't, you're the troll. And your comment about making spam too expensive won't cut it. I want your **specific** solution. Something we can actually do. Some action we can take now that will end spam permanently without just pulling the plug on email altogether. And it has to be 100% effective and permanent so that nobody ever spams again, because apparently if anything gets through, the solution is worthless. Bonus points if it is something that I can do myself instead of filtering.

Come on. Humor me. You almost had me doubting myself. I went back and skimmed your comments and I didn't see anything, but maybe my reading comprehension really is that bad. Only you can settle this once and for all.

Re:Stop Patting Yourself On The Back

[damn_registrars]

from your highly emotional reaction here

Highly emotional? I would love to know how you feel that allegation is justified. Especially in light of the fact that you are the one trying to sell what can never be a real solution as a permanent fix.

I went back and skimmed your comments

That is the single most honest and factual comment you've posted in this entire thread. Thank you for admitting that indeed you do not make a habit of reading my comments in their entirety, it confirms what was already suggested by you fact-deprived posts.

Now why don't you go adjust your spam filter so it prevents you from seeing the rest of my comments. It seems that your blind allegiance to filtering methodologies may well have prevented you from seeing a not-insignificant portion of them already, so you missing the rest would not be a big change.

Re:Stop Patting Yourself On The Back

[yarnosh]

Then it is settled. Thanks.

Re:Stop Patting Yourself On The Back

[damn_registrars]

Yes it is agreed that you won't read what I write, so there is no purpose in continuing this conversation. I will instead support people who work on actual solutions to the spam problem while you run around with your fingers in your ears.

Re:Stop Patting Yourself On The Back

[MaDeR]

> Many users don't use filters anyways
Yes, they are. Ever heard about server-side filtering? With this, entire your argument falls apart.

Re:Stop Patting Yourself On The Back

[damn_registrars]

Many users don't use filters anyways

Yes, they are. Ever heard about server-side filtering?

First of all, minus one point to you for bad grammar.

Second, I didn't say most users, I said many users. There are still users who have the ability to check their email without it being filtered for them beforehand.

With this, entire your argument falls apart.

You're simply wrong on that matter. The number of people who have their email filtered - regardless of whether or not they are aware of it - has nothing to do with the fact that filtering will never actually stop spam.

On paper it might be down...

[toonces33]

but in my accounts it still comes in as a flood. Some of it is clearly malware coming in - others are questionable scans plus the usual Nigerian nonsense.

Re:On paper it might be down...

[yarnosh]

Get a new email provider. It is that simple. Gmail filter is awesome.

spam filters have become too good?

[feedayeen]

Yeah, can't see how that happens. Of course, if I were writing the ultimate spam filter the logic would go something along the lines of this when it receives a new message:

Has the guy emailed you before? (continue test if no)
Is there a reference to a site selling watches, drugs, or online degrees? (continue test if yes)
Is the site from a known legit source, based on popularity of the 'unspam' button for this user? (move to spam folder if no)

Poof, there goes 99% of all the spam that I've ever received in my life. If spammers want me to ever see their product, a product which I still will not be buying on an ethical basis of 'don't feed the spammers' and the financial advice of 'it's a scam', then they are really going to have to diversify their industries.

Re:spam filters have become too good?

[yarnosh]

Has the guy emailed you before? (continue test if no)

Greylisting. THough it is a little more complicated than this. There has to be a way to allow people to email you for the first time. So what a greylisting filter does is deny first delivery once with a temporary failure and it keeps denying until a certain time has elapsed. Then it allows the message in. The idea is that most spammers won't bother retrying the delivery, or at least not with the same "From" field and the same botnet node. It is actually pretty effective. Although the initial delay can be a little annoying for users who expect an email to go through within a couple minutes.

Is there a reference to a site selling watches, drugs, or online degrees? (continue test if yes)

Filters do use blacklisted URLs. But usually you want to make this a last resort. Scanning content is CPU intensive.

Is the site from a known legit source, based on popularity of the 'unspam' button for this user? (move to spam folder if no)

It is too easy to spoof the source and chances are that you won't get the same spoofed source twice. You might, but it is like playing whack-a-mole. Spam filters have gotten away from user ratings. It is too much hassle for users and there's not enough reporting of spam to be terribly effective.

It is more effective to force email providers to implement authentication systems like SPF and Sender ID. With these systems, you can at least validate the the domain of the sender's email address matches the server trying to send you the message. This has a dual effect of blocking botnet nodes and makes the send use a specific return address, which can then be blacklisted if necessary. But yeah, mail providers are way ahead of you. Filters are pretty good these days. There's really no reason why the average person should still be getting spam.

Re:spam filters have become too good?

[mortonda]

Has the guy emailed you before? (continue test if no)

How do you know that this message that claims to be from this guy is actually from this guy?

Is there a reference to a site selling watches, drugs, or online degrees? (continue test if yes)

As shown in a previous comment, this is difficult to test for when they keep mangling text:
    "Pi ckOutYo urPr ef er enceTa bl etsEs sen ti alsWe bsto re"

If you can make a filter that can reliably pick out junk like that.... there's a few people who would like to hire you. ;)

Is the site from a known legit source, based on popularity of the 'unspam' button for this user? (move to spam folder if no)

Somewhat easier, and there are already trust systems in place to help score this in spamasassin. Overall, however, the problem is much more complex.

Re:spam filters have become too good?

[jonbryce]

Email systems quite often have a language setting, and if the majority of the words aren't in the language you speak, that could be a reason to filter it out. It can cause problems sometimes. For example welsh mps at parliament.uk had problems at one point with constituents who emailed them in welsh, because the house of parliament's email system was checking only for the english language. However, in your example, most of the words are not valid in any language, so they can very safely be binned.

Depends on your definition

[wcrowe]

It depends on your definition of "spam". By my definition, I get more spam than ever. The difference is that much of it is from legit companies who comply with the CAN-SPAM law. I can opt out, but I'm getting about 100 or more of them a day, and I can't spend all day opting out of every single one of them. It may be legal, but it's still spam, as far as I'm concerned.

Re:Depends on your definition

[Kjella]

Here's my solution using yahoo, they offer 500 aliases for you. Make a new one, sign up with the alias, redirect that to your "legal spam" folder. If you ever want to get rid of a company and its business partners and whoever else got their hands on that email, delete the alias. That is a very final opt-out. I wished I had done that long ago, because it saves you tons of spam. Of course you need to have a normal email as well and if others get that it can be spammed, but that problem would be a lot smaller.

Re:Depends on your definition

[drb226]

Details: CAN-SPAM

Re:Depends on your definition

[yarnosh]

WTF? 100 a day? That's crazy. You must be very active on the internet, signing up for a lot of services.

Re:Depends on your definition

[wcrowe]

This works for companies you are doing business with, and yes, I do this myself. However, if Google or Facebook are selling your email address, there isn't much you can do about it.

Re:Depends on your definition

[wcrowe]

I imagine that it is coming from my email provider and/or Facebook. For example: I responded to a friend's post about their broken air conditioner and suddenly I started getting spam from companies offering air conditioner repair. I responded to a golf tourney invitation via email, and within hours I started getting solicitations to subscribe to Golf World magazine. It might be coincidence, but the fact that these are legitimate companies who are sending me the email (JC Penney, Radio Shack, Conde Nast, etc), compels me to believe otherwise.

Re:Depends on your definition

[erice]

This works for companies you are doing business with, and yes, I do this myself. However, if Google or Facebook are selling your email address, there isn't much you can do about it.

But they don't. I have separate addresses for google and facebook. They have not been abused. My policy is that if I get spam on an address I terminate that address. If it is someone that I think is likely a victim and someone I want to continue to do business with, I notify them and assign a new address.

The rate at which addresses leak to spammers is still small but increasing rapidly. I attribute this to the recent surge in attacks on customer databases.

BTW, 100 addresses is not enough for the long term unless you can find some way to recycle no longer used addresses. I've been doing this since the 90's and I have over 500 addresses assigned.

Re:Depends on your definition

[Quirkz]

I've been doing this since the 90's and I have over 500 addresses assigned.

That sounds an awful lot like work.

Re:Depends on your definition

[DMUTPeregrine]

Or with gmail use the address+Arbitrarytext@gmail.com format. Everything I sign up for has a different address that I can sort by.

1 Weird Tip

[jellomizer]

Why bother spamming when the cost of advertising threw normal services have gotten so cheap. Back in the spamming hay day the cost for a banner add was thousands of dollars Now it cost as little as a few bucks. Sure we have Add block tools but most of us don't use them. So the previous spammers are going the more legit route and making their adds to look like articles on CNN.

Re:1 Weird Tip

[Bob the Super Hamste]

Or they are just spamming CNN discussions. For a while there was some awful company that kept spamming the discussions for some work from home site with a convoluted URL to make it look it came from CNN or was hosted by CNN. The worst I ever saw it was one time when close to 1/3 of the messages were spam from this company.

Re:1 Weird Tip

[wintercolby]

Mod Parent up!

The best solution to SPAM has to also be the best solution to music/movie piracy. Adjust incentives until it is eliminated.

Re:1 Weird Tip

[yarnosh]

Because the things they're selling in spam are not things most people want advertised on their site.

Re:1 Weird Tip

[Quirkz]

Hate to break it to you, but "hay day" is wrong. It's "heyday."

Re:Paid Work?

[djdanlib]

The term "spam" as used to represent junk e-mail wasn't originally an acronym. They took the term 'spam' from the classic Monty Python sketch about spam, because it represented something unwanted. "I don't like spam!"

Believe me, advertising people will jump on any chance they see to sell some more ads, and there's a sucker born every minute who will pay for those ads to be distributed.

Big corps have stopped tolerating spam

[Medievalist]

Aren't most of the spam kings either dead, retired, or in jail at this point? I hear it's lonely in Boca Raton these days.

And wasn't there a wave of murders in the former Soviet Union when Microsoft and Time-Warner/AOL decided they were no longer going to ignore spammers? Bunch of free-lance software developers with connections to organized crime found dead, as I recall; the rumor was that the spam kings were eliminating people who knew too much.

Well, regardless of the truth or falsehood of any of these tales and rumors, if corporate pressure has made spamming unprofitable, I'm certainly not complaining. It's about time the f***ing invisible hand did something besides j***ng off US Congressmen.

Re:Paid Work?

[bryanp]

The term "spam" as used to represent junk e-mail wasn't originally an acronym.

You mean it doesn't stand for Stuff Posing As Meat?

Meta spammer

[drb226]

So this guy, back in the 90s, spammed people to sell his spamming services. (insert yo dawg joke here)

The botnets are mining bitcoins instead

[ribuck]

I thought the reduction in spam was just because some of the spammers are using their botnets to mine bitcoins instead.

Re:The botnets are mining bitcoins instead

[marcosdumay]

So Bitcoin is in fact usefull for something?!

This is terrible news!

[itchythebear]

If this keeps up this could be the end of western society as we know it. I really hope the powers that be can come up with a reasonable bailout strategy for the spammers. They are to big to allow to fail.

Re:Spam got decimated yet people here thinks spam

[colinrichardday]

because /. has become a place for M$ astroturfing fanbois. Dudes, trash Hotmail

I'd hardly consider myself a Microsoft fanboi, but Hotmail does a decent job of placing junk email in the Junk folder.

Re:I don't buy it

[mikeru22]

----->>>>Cl.ick.Here 4.FREE.V1aGrA ! ! -------

People with unreliable ISP-provided email

[tepples]

Hell, if you simply block unauthenticated SMTP access to all broadband IPs, you can cut out the majority of SPAM.

Say somebody is behind an ISP that fails to provide its own reliable SMTP server to its home subscribers. He can't run his own mail server because it'd be confused with a spam zombie. Nor can he switch to a different ISP without either moving or lowering his monthly transfer cap by a factor of ten. Which mail server do you recommend for this person?

Re:People with unreliable ISP-provided email

[gnarfel]

GMail? SMTP Relay services? It's nearly impossible to actually run your own mail server now-a-days anyways, unless you want to jump through all the hoops required (DNS records, etc). I personally had a need for it not too long ago, I had a connection that was intermittent at best but we needed local e-mail as well. We simply set up our own server on the LAN and paid for an amazon ec2 instance that simply forwarded all incoming and outgoing mail for us.

Re:People with unreliable ISP-provided email

[Tanktalus]

Well, there are a few options.

The one I go with is that my ISP's SMTP servers are sufficient, so my postfix is configured to route all outbound mail to there. However, I've given some consideration to other options. My top one at the moment is to open up an ssh tunnel to a web host provider, and pump my email through their SMTP server. Why not directly? Because my ISP has outbound SMTP blocked, and I suspect that even if that weren't the case, the confusion with a spam zombie would still arise as your external IP address (which is known as a broadband IP address) would be attached as a "Received" header. However, with the ssh tunnel, the Received header would actually be the IP address you're ssh'd into instead of your real address, thus appearing as if it came from the web host instead of a broadband IP address.

Similar options exist if you can VPN to work (though then your employer's IT guys could intercept anything if they wanted to/were directed to), or VPN/SSH to a friend's broadband-connected system to use their ISP's SMTP server.

As for paying for one? Never looked into that. Since my ISP is blocking outbound (but not inbound) SMTP anyway, it's somewhat moot.

Re:People with unreliable ISP-provided email

[icebraining]

It's my case, I'm blocked by Spamhaus' PBL.

Re:People with unreliable ISP-provided email

[yarnosh]

Gmail.

Re:People with unreliable ISP-provided email

[asdf7890]

Say somebody is behind an ISP that fails to provide its own reliable SMTP server to its home subscribers. He can't run his own mail server because it'd be confused with a spam zombie. Nor can he switch to a different ISP without either moving or lowering his monthly transfer cap by a factor of ten. Which mail server do you recommend for this person?

Such an ISP may not provide a static IP address and if they do may not allow the name associated with it via rDNS to be set, so some mail hosts will reject mail from sources hooked up to that ISP anyway (because the PTR record makes the address look dynamic as the name will likely be something like 123.123.123.123.someisp.tld where 123.123.123.123 is the same as the address, or there may be no name set at all). While such a rule is usually not given a high weighting in rule+weight based spam scanning, it is often there with a score that will increase the chance of false positives against you if your mail server is talking from such an address).

One way around this, other than switching ISP which is not always practical (or even possible) or hosting the whole mail server elsewhere, is to use a VPN or tunnel to send the mail via another host where you do have unfettered ability to send stuff via SMTP and have control of the address-to-name mapping (or at least the address(es) have non-dynamic-address looking names). A cheap VPS will do, barely any resources would be needed. Though with really cheap hosts you will have to contend with them maybe being blacklisted due to spammers using their services in the recent past (usually by hacking the account of some fool who didn't care enough about the 2$/month VPS to patch and otherwise secure it properly).

Re:People with unreliable ISP-provided email

[rot26]

At least you can make some attempt to redeem yourself with spamhaus. Cisco's shitty IronPort lists me as having a "poor" reputation because 6 or 8 sites in my A block have a "poor" (and totally unexplained) reputation. Me? Perfect. Not blacklisted on any of the 130 or so lists. But I can't send email to godaddy because they use the ironport abomination. (Godaddy, yeah I know, right? It's the principal of the thing.)

Cisco is Cisco. "Don't blame us, we didn't block anything, we just told THEM not to trust you, go figure."

Godaddy is godaddy. "If you think this block is in error, go fuck yourself".

Anybody else run into this? I didn't think I could hate Cisco any more than I already did but I was wrong.

Re:People with unreliable ISP-provided email

[mortonda]

Any other mail service that can open up authenticated smtp service on port 465, or 587. See RFC's 4409 and 5068.

Re:People with unreliable ISP-provided email

[icebraining]

I don't think there's anything I can do, the PBL is just a list of dynamic IP ranges. But many MTAs block them.

Re:People with unreliable ISP-provided email

[Vrtigo1]

Maybe I've just been lucky, but it is quite easy to run your own SMTP server here in Florida on Road Runner. They don't restrict in/outbound SMTP, so you can pretty do much whatever you want. Even if they did block outbound SMTP (which I think is a halfway decent idea), there are plenty of services out there that will provide SMTP relay service for you, either on nonstandard ports so you can get by firewall rules, or via VPN, so the firewall can't even see the traffic. Last I checked, these services were a few bucks a month or something like $100/year. If you need to run your own mail server for business purposes, this shouldn't be too burdensome, plus you get the benefit of redundant smart hosts, so you don't have to worry about your ISP's mail server going offline.

Re:People with unreliable ISP-provided email

[h0dg3s]

You call setting dns records jumping through hoops? That's how domains work...

Re:People with unreliable ISP-provided email

[mcavic]

I recommend a VPS or a dedicated server. I'd venture to say that 99% of people can either afford the expense, or can live with the ISP's mail server.

Re:People with unreliable ISP-provided email

[Dan541]

Sending mail from home will often get you blacklisted for spam. Unless it's a static ip, even then I don't like the odds.

Re:People with unreliable ISP-provided email

[S.O.B.]

Or you could go to one of a gazillion hosting companies out there, pick a domain name and for $5/month you can have your very own site with a mail server.

Re:People with unreliable ISP-provided email

[Kalriath]

Spamhaus lets you submit your IP to be excluded from the PBL, with the disclaimer that you represent that the IP is static, yours, and you are running a legitimate mail server (and accept responsibility for the consequences).

Literally like blowing my nose.

[blair1q]

Dealing with spam is like dealing with snot. Nothing you can do to stop it, but it's easy to dispose of.

Spammers have moved

[salesgeek]

Apparently the article's author has not used Twitter, Facebook or hosted a WordPress blog. The spammers have just changed from email to focusing on social media, forums and blogs.

Re:Spammers have moved

[ShaunC]

Apparently you didn't read the article.

Scammers have taken this game to Facebook, YouTube, and Twitter too. Sometimes they send @messages to their targets. Other times they hack into an account and use it to send out their messages. That's what happened last week to "Shaun of the Dead" actor Simon Pegg's Twitter account. It was used to spam out a Trojan horse program disguised as a screensaver to his 1.2 million followers.

Financially unfeasible?

[pasv]

I beg to differ. A lot of these crackers and producers of spam flinging malware live in countries where the median monthly income is lower than what I'd make at McDonalds in a day. Poverty begets crime. Idiots beget spam opening. An initial investment is only time. Skills are free but when all you have is time it becomes your #1 resource even if you cant afford a testing lab, QA team, etc. (Btw the big spam rings no doubt function no different than any other software producing company which is why I used those examples).

Nightly Infommercial Rerouted

[retroworks]

The cost of advertising on television has fallen to the point where they can sell penis enlargement in the mainstream media. Spam used to be the only way I could find out how much women prefer a confident man, now they can tell me on TV, on radio. Soon I expect to see Nigerians on History Channel telling me I have won a lottery.

Something DID happen.. at least to my mail server.

[EvilStein]

end of November/early December, I noticed a significant decrease in the number of emails that were blasted to invalid email addresses.

Still getting spam, of course.. and more of it is professional stuff hawking products from American companies like Gevalia, Shari's Berries, etc...

legislation

[Weezul]

Yeah, they'll just buy off legislators to make effective spam prevention illegal.

spammers have switched to text messages

[Khashishi]

It's much harder to filter phone spam, and in America, you often get charged for the pleasure of receiving phone spam.

!legit

[Fujisawa Sensei]

Nothing a spammer sells is legit.

Do ISPs actually block 587 out?

[tepples]

In other words: "Try the SMTP relay that often comes bundled with your web hosting." Thank you for the suggestion.

My top one at the moment is to open up an ssh tunnel to a web host provider, and pump my email through their SMTP server. Why not directly? Because my ISP has outbound SMTP blocked

I know several ISPs block outbound TCP connections on port 25 (SMTP server-to-server communication) outbound, but I've never heard of a notable case of an ISP blocking connections on 587 (SMTP authenticated message submission).

Don't be fooled...

[geekmux]

Yesterdays spam is todays botnets.

Just because your Inbox might be a little cleaner or safer doesn't mean the 'net is...attacks are merely changing vehicles, that's all...

Gullibility will always be profitable.

Re:Paid Work?

[Anne Thwacks]

The Monty Python sketch was a re-make of a previous sketch by Peter Sellers (at least 10 years earlier) from his "Best of Sellers" LP. It was describing how life was in the UK under food rationing.

Now get of my lawn.

Re:countertrolling & the trolltalk.com crew

[monkyyy]

hmmmm how does one join these troll teams -trollface-

Re:I don't buy it

[Coren22]

I always love those types when I am reading the spam logs. So often you read through this mass of meaningless stuff, and they forgot to add the link. :)

Look at the firehose recently?

[antifoidulus]

If they are abandoning email they certainly aren't abandoning /., I would estimate that 90+% of the stories in the firehose are spam..... Obviously slashdot isn't doing a whole lot to prevent that.

Must Be

[TooLazyToLogon]

I have received five spam email in the last five years. I don't run any spam filters, so I am assuming that it has been the ISPs and/or my email providers that have been filtering.

Re:Must Be

[fatimasb]

Our company was being spammed by other companies that were trying to get higher rating. They falsely critiqued our company for providing a horrible service that we don't even offer. What people can do for money! http://www.bbcleaningservice.com/

Re:False comments http://www.bbcleaningservice.com

[neminem]

I know, right? That's just completely ridiculous! Bad enough getting spammed by people who legitimately think it's a good business model, but now I have to get spam from people trying to make people they don't like *look* like they're the bastards who think spamming is a good idea? Fantastic. http://www.microsoft.com

Great to hear

[hesaigo999ca]

Keep up the great work guys, everyone appreciates it, hopefully we can bring that number down into the millions instead of billions...!