Actually that made me realize... "Militia" is by definition an army which is not professional. In fact, dictionary.com uses the definition "1. An army composed of ordinary citizens rather than professional soldiers." So the whole 2nd ammendment issue is certainly not the same as the issue in this case.
It doesn't take a rocket scientist to trace back a spammer, where is it coming from?
To an IP address, sure, but how does that help me? You can't sue an IP address.
If that isn't good enough and you are getting an in ordinate amount of mail, either change emails (sure it isn't fair, but what can you do), do you own the domain that is getting spammed?
To use someone else's analogy (which I don't agree with), that's like asking a rape victim to stop walking down a certain street.
As for needing money to sue, you really don't, you can go to court without a huge lawyer, you just need to follwo protocol, there are many books on representing yourself in court.
If you know of any books on obtaining a subpeona when suing a John Doe defendant, let me know. I've looked around on the internet and the library, but I couldn't find anything.
In conclustion, at least from my experiance, passport really wouldn't help, since the majority of my spam doesn't come from sites I have signed up from.
First of all, let me reiterate that I don't think passport is a good thing. I just think it attempts to solve a problem which is useful to solve.
In any case, I do the same thing as you do (although I've been forced to block postmaster@ and abuse@ since I get hundreds of viruses, spam, and people complaining about the idiot who put my domain in the from address every day. But my point about passport is that passport allows this to be done by the masses, without owning a domain name, and without maintaining allow/block lists. You just set up one email address once, get yourself authenticated, and never check that email account again.
In any case, I think you misunderstood me. I'm not complaining about spam. I was simply pointing out that laws against spam are not effective.
Reading your replies is the internet's version of rape. Nobody wants your replies. They're forced upon us. They frequently offend us. We are forced to pay for it either directly or indirectly in higher slashdot subscription, bigger fucking ads, lower slashdot performance, your time dealing with it, etc.
The chastity belt is akin to slashdot's karma system. It is a pain where legit posts can get blocked and some shit like what you post still gets through. It's something WE have to deal with because of the lack of morals of YOU.
Since there is no law, we have no recourse. I want recourse. I KNOW it won't stop all stupid idiotic posts, but at the current rate that it is increasing, slashdot will be unusable in 2 years. In the past 6 months I've logged a 10 times increase in idiot posts.
There are those that think that we should just improve the karma system. When should we do this? How long of grace period do we let the old karma system work? 2 years? Look how fast IPv6 is being implemented...
To suggest that we can implement a new secure karma system in less than several years shows a major lack of understanding of business, economics, IT infrastructure, etc.
Where are there laws against spam? I belive there is some minor state level legislation in Oregon or Washington or something?
Here's a list. There are also laws against trademark infringement (which many spammers engage in), trespass to chattel (which many ISPs could use against certain methods of spamming), ponzi schemes (I still get a lot of those), etc. I currently have a spammer using my email address as the From address in his/her spams. So I get all the bounces, not to mention many of the angry complaints. That's clearly illegal, as it is trespass to chattel at the very least (probably many other laws). But I don't have the money to sue them in court, and you can't sue John Does in small claims court, and you can't even begin investigating who the spammer is without a subpeona. Then on top of that, they're probably using computers outside the U.S. jurisdiction anyway. I really don't think laws are going to help. But at this point I'm willing to let the government waste my tax money trying. Then maybe after a few years of that failure we can start spending our time and efforts on solutions which will actually fix the problem.
But just says there are laws and we need passport doesn't make it so.
Wait a second... We don't need passport. Passport is a bad implementation. It's a horrible implementation. But we do need a better way to sign up for things over the web. We shouldn't be using email addresses as a unique identifier for people. It's just not a good solution.
As for examples of what I am talking about, I live in Texas which resently enacted an "Opt out telemarketing" approach, basically for a couple bucks you can get on a state conrtolled "do not call list" which ALL telemarketers are required to buy, if they call you and you are on the list, they get like a 500 dollar fine, suffice to say I used to get several calls a day, now I get NONE!!!
I've explained this in another one of my posts, but I'll briefly get into it again. These laws work for telephone calls because it's easy to trace telephone calls. They won't work for email because it's very difficult and expensive (and in many cases impossible) to trace email. Most of my spam doesn't come from legitimate companies. Next time I get a chance I'll go through my mail and put up a website with statistics on exactly where my spam does come from.
I think that the designers of SMTP got it just about right. I've read a few proposed solutions and they all seem imperfect in their own way.
The things that is wrong is that there's absolutely no authentication. Anyone can send anyone else any message completely anonymously. Even if you get rid of open relays, you're left with a single IP address as your only authenticated value. That's a ridiculously faulty system.
There are tons of solutions to the problem if you could get people to agree on them. If you're going to get the government involved in anything, do that. Give out free government key signing at the local DMV. That alone would solve the problem of spam. And this time I'll even explain.
Each DMV has its own public/private keypair, which changes daily and the private key destroyed, blah blah blah lots of stuff to make it secure.
Anyone who wants to run a mail server gets their public key signed by the government. The government verifies their name and address, or company name and address, whatever. Each server then is responsible for policing its own users. In essence, you don't let them send out 5000 messages to different people without posting being bonded. Other governments which want to offer similar systems may, and a whole web of trust of government keys can be established. If your government doesn't play, well, then it's up to the ISPs to decide if they want to block email from your ISPs. If your mail server promotes spam, then it's blocked, temporarily, permanently, whatever, it's up to the receiving mail server. It doesn't matter because your ISP can't just use a different IP address. They'd have to form a whole new corporation, and that costs a good deal of money.
As a bonus we've just implemented a good part of passport, and no central server holds the information (at least none which didn't already have it in the first place).
I've simplified parts and probably was unclear about other parts, but if you're willing to spend taxpayer money to solve spam, there are much more effective ways than enforcing laws against it.
Maybe the flaws of SMTP are outweighed by the things that's right about it.
What are these things? The advantages and the disadvantages of SMTP seem to be the same thing. Anonymity. Which is great to have for certain situations, but isn't very useful for personal correspondence and unique user identification (signing up for services).
So I guess when I say email is broken, I really mean that it doesn't do the things that people are using it for. Things which to some extent were not part of the initial design.
I need to get some of this stuff down in a form where I can just say "see my url here". It seems I've had these same conversations over and over.
The only difference is the "highly regarded ACLU" will stand up to fight this as opposed to "a bunch of right wing gun nuts" in the case of the second ammendment.
That and the darn phrase "being necessary to the security of a free state." This case has a lot more to do with the 14th ammendment than the first.
Oh, I see what you're saying. Yeah, that'd work fairly well. Except of course for signing up for websites, which is probably the biggest impediment to implementing most of these systems.
You can use different email addresses for every site, and maintain them all, like I do, but I don't think most people are going to go through all that trouble just to save a few minutes a day of hitting the delete key.
finally I get your point, you should have expanded to start with;)
Yeah, I do tend to do that too often - assume that the other person can read my mind and everything. Sorry about that.
I tried TMDA but I needed to be running my own SMTP server but I'm not on a fixed IP and getting my ISP to put TMDA in place at their end is a no-no too.
It could also be done quite easily using a website. The only problem is that most people aren't used to seeing "email me at http://youmightbeaspammer/so/use/this.form". Well, that and the fact that you can't sign up for any services. I really need to modify my phpnuke to make email address optional. But first I need to get rid of all the ugly security holes.
Can't see as its much different from my telco having my number. They publish opt-outable directories etc. They sell them in electronic form to cold-callers.
But laws against telephone solicitations do work. Ever since I've gotten my cell phone I've used it to sign up for everything. I've gotten 2 phone solicitations so far (in a year and a half), from companies which I already had a pre-existing business relationship (one was my credit card company, I forget who the other was). I told them both that I was on a cell phone, and not to call me any more, and I haven't gotten any phone solicitations since.
I don't think laws against spam would be effective though. For one thing, calling people costs money, so you have to be a somewhat reputable business to engage in phone solicitations. Secondly, as I mentioned earlier, telephone calls are by their very nature easy to trace. Email is not.
It's no more ridiculous than saying I should start to write my own Messenger client because I want to communicate with my MSN Messenger contacts but disagree with the Messenger EULA.
Fine, use one of the freely available ones created by someone else.
The EULA says that one can't use an unauthorised client to access the service. The ultimate recourse for non-compliance is criminal prosecution.
That's simply not true. Besides, you definately don't have to agree to the EULA if you don't use the software, and arguably even if you do.
The rest is up to the ISPs and as more and more struggle they might find that reducing bandwidth consumption by eliminating spam is a winner all round.
They'd be much better off hiring fewer people to read the complaints about their user's spamming. Bandwidth is cheap compared to labor.
Here's the public domain version of the story, for those of you who want true freedom. I still haven't figured out why freedom of speech doesn't apply in this case. Maybe because he wasn't "talking"?
There are audio capatchas, or you could just give your blind friends a special address.
I was thinking of a simalar system, first time senders are sent a confirmation url they must open, and if it's not opened I get sent a mail saying email@dress tried to send you a message with a subject of 'subject', do you wish to discard, deliver, or deliver and whitelist?
Yeah. I don't like that particular solution, because it requires waiting round-trip for the reply and everything, it eliminates anonymous sending, it bothers the people whose addresses were faked in the From:, etc. Most importantly, it's not scalable. Once the confirmation url method becomes widespread, so will automated spam systems which confirm. You have to use some form of capatcha, or put some cost on the sending of the email. Or you have to make email non-anonymous, which is what the folks pushing the spam laws in congress want the solution to be.
A good analogy would be to tell a woman that she can expect to get raped and have no legal recourse.
Actually, that's a terrible analogy.
But you know what. I've changed my opinion. I hope they do pass a spam law. Just so everyone can see that it won't do a single bit to stop spam. And then I can say "I told you so".
However, I hardly think that the way one registers with web sites has *any* bearing on replacing SMTP with a system that hinders spamming and spoofing.
The problem is that web site registrations are automated. It's really easy for me to block spam from automated senders. I just set up a capatcha for first time senders, and put people with whom I have ongoing correspondence into an allow list. Mailing lists could be set up the same way, or even better mailing lists could be done by only pushing the notification of the new message, and then downloading the actual content from a well-known server (either in advance or at the time you read it).
Any more than not giving your phone number to your doctor will stop double-glazing salespeople calling.
It's much easier to regulate the phone system, because phone calls are by their very nature non-anonymous. Giving a central authority access to the identity of every single caller and call receiver would enable laws to be useful, but who wants that?
This is saying that cars are broken because there are car theifs.
No it's like saying that cars are broken because the doors don't lock.
SPAM will stop when SPAMMERS are jailed and bankrupted!
No it won't. No law will stop spam. You have to lock the doors first.
If you track down a few spammers, get large judgments against them, and take their houses, they may realize spamming is not cheap.
Nor is tracking down spammers and getting judgements against them. Spammers are stupid. Do you think they're actually raking in the money from their "Enlarge your penis" ads? No. They're stupid idiots trying to make a quick buck the easy way.
Seems that what we do on the planet may have more effect than we may ever know.
Of course we have an effect. The question is, is that effect positive, negative, or chaotic. I suspect it's chaotic. Three days worth of data is surely not enough to do anything but convince everyone that what they originally suspected was already correct.
Spam will not stop until the current SMTP system is replaced. The main reason the current SMTP system can't be eliminated is all the current registration systems which send an email confirmation. Admittedly, my own site is part of the problem in this regard.
A system like passport would go a long way toward stopping spam. But I honestly don't see how to convince both consumers and content providers to join in on that system.
Slashdot Mirror
Actually that made me realize... "Militia" is by definition an army which is not professional. In fact, dictionary.com uses the definition "1. An army composed of ordinary citizens rather than professional soldiers." So the whole 2nd ammendment issue is certainly not the same as the issue in this case.
It doesn't take a rocket scientist to trace back a spammer, where is it coming from?
To an IP address, sure, but how does that help me? You can't sue an IP address.
If that isn't good enough and you are getting an in ordinate amount of mail, either change emails (sure it isn't fair, but what can you do), do you own the domain that is getting spammed?
To use someone else's analogy (which I don't agree with), that's like asking a rape victim to stop walking down a certain street.
As for needing money to sue, you really don't, you can go to court without a huge lawyer, you just need to follwo protocol, there are many books on representing yourself in court.
If you know of any books on obtaining a subpeona when suing a John Doe defendant, let me know. I've looked around on the internet and the library, but I couldn't find anything.
In conclustion, at least from my experiance, passport really wouldn't help, since the majority of my spam doesn't come from sites I have signed up from.
First of all, let me reiterate that I don't think passport is a good thing. I just think it attempts to solve a problem which is useful to solve.
In any case, I do the same thing as you do (although I've been forced to block postmaster@ and abuse@ since I get hundreds of viruses, spam, and people complaining about the idiot who put my domain in the from address every day. But my point about passport is that passport allows this to be done by the masses, without owning a domain name, and without maintaining allow/block lists. You just set up one email address once, get yourself authenticated, and never check that email account again.
In any case, I think you misunderstood me. I'm not complaining about spam. I was simply pointing out that laws against spam are not effective.
Reading your replies is the internet's version of rape. Nobody wants your replies. They're forced upon us. They frequently offend us. We are forced to pay for it either directly or indirectly in higher slashdot subscription, bigger fucking ads, lower slashdot performance, your time dealing with it, etc.
The chastity belt is akin to slashdot's karma system. It is a pain where legit posts can get blocked and some shit like what you post still gets through. It's something WE have to deal with because of the lack of morals of YOU.
Since there is no law, we have no recourse. I want recourse. I KNOW it won't stop all stupid idiotic posts, but at the current rate that it is increasing, slashdot will be unusable in 2 years. In the past 6 months I've logged a 10 times increase in idiot posts.
There are those that think that we should just improve the karma system. When should we do this? How long of grace period do we let the old karma system work? 2 years? Look how fast IPv6 is being implemented...
To suggest that we can implement a new secure karma system in less than several years shows a major lack of understanding of business, economics, IT infrastructure, etc.
Where are there laws against spam? I belive there is some minor state level legislation in Oregon or Washington or something?
Here's a list. There are also laws against trademark infringement (which many spammers engage in), trespass to chattel (which many ISPs could use against certain methods of spamming), ponzi schemes (I still get a lot of those), etc. I currently have a spammer using my email address as the From address in his/her spams. So I get all the bounces, not to mention many of the angry complaints. That's clearly illegal, as it is trespass to chattel at the very least (probably many other laws). But I don't have the money to sue them in court, and you can't sue John Does in small claims court, and you can't even begin investigating who the spammer is without a subpeona. Then on top of that, they're probably using computers outside the U.S. jurisdiction anyway. I really don't think laws are going to help. But at this point I'm willing to let the government waste my tax money trying. Then maybe after a few years of that failure we can start spending our time and efforts on solutions which will actually fix the problem.
But just says there are laws and we need passport doesn't make it so.
Wait a second... We don't need passport. Passport is a bad implementation. It's a horrible implementation. But we do need a better way to sign up for things over the web. We shouldn't be using email addresses as a unique identifier for people. It's just not a good solution.
As for examples of what I am talking about, I live in Texas which resently enacted an "Opt out telemarketing" approach, basically for a couple bucks you can get on a state conrtolled "do not call list" which ALL telemarketers are required to buy, if they call you and you are on the list, they get like a 500 dollar fine, suffice to say I used to get several calls a day, now I get NONE!!!
I've explained this in another one of my posts, but I'll briefly get into it again. These laws work for telephone calls because it's easy to trace telephone calls. They won't work for email because it's very difficult and expensive (and in many cases impossible) to trace email. Most of my spam doesn't come from legitimate companies. Next time I get a chance I'll go through my mail and put up a website with statistics on exactly where my spam does come from.
I think that the designers of SMTP got it just about right. I've read a few proposed solutions and they all seem imperfect in their own way.
The things that is wrong is that there's absolutely no authentication. Anyone can send anyone else any message completely anonymously. Even if you get rid of open relays, you're left with a single IP address as your only authenticated value. That's a ridiculously faulty system.
There are tons of solutions to the problem if you could get people to agree on them. If you're going to get the government involved in anything, do that. Give out free government key signing at the local DMV. That alone would solve the problem of spam. And this time I'll even explain.
Each DMV has its own public/private keypair, which changes daily and the private key destroyed, blah blah blah lots of stuff to make it secure.
Anyone who wants to run a mail server gets their public key signed by the government. The government verifies their name and address, or company name and address, whatever. Each server then is responsible for policing its own users. In essence, you don't let them send out 5000 messages to different people without posting being bonded. Other governments which want to offer similar systems may, and a whole web of trust of government keys can be established. If your government doesn't play, well, then it's up to the ISPs to decide if they want to block email from your ISPs. If your mail server promotes spam, then it's blocked, temporarily, permanently, whatever, it's up to the receiving mail server. It doesn't matter because your ISP can't just use a different IP address. They'd have to form a whole new corporation, and that costs a good deal of money.
As a bonus we've just implemented a good part of passport, and no central server holds the information (at least none which didn't already have it in the first place).
I've simplified parts and probably was unclear about other parts, but if you're willing to spend taxpayer money to solve spam, there are much more effective ways than enforcing laws against it.
Maybe the flaws of SMTP are outweighed by the things that's right about it.
What are these things? The advantages and the disadvantages of SMTP seem to be the same thing. Anonymity. Which is great to have for certain situations, but isn't very useful for personal correspondence and unique user identification (signing up for services).
So I guess when I say email is broken, I really mean that it doesn't do the things that people are using it for. Things which to some extent were not part of the initial design.
I need to get some of this stuff down in a form where I can just say "see my url here". It seems I've had these same conversations over and over.
Once it becomes unprofitable to send spam, via legislation to control or outlaw it, SPAM will slowly stop.
It already is unprofitable to send spam. There already are laws against sending spam. Nothing has changed.
In any case, it doesn't change the fact that email is broken.
Glad you explained WHY it's a bad analogy.
It's not worth wasting my time explaining why. Being raped and receiving spam are two completely different things.
The only difference is the "highly regarded ACLU" will stand up to fight this as opposed to "a bunch of right wing gun nuts" in the case of the second ammendment.
That and the darn phrase "being necessary to the security of a free state." This case has a lot more to do with the 14th ammendment than the first.
Oh, I see what you're saying. Yeah, that'd work fairly well. Except of course for signing up for websites, which is probably the biggest impediment to implementing most of these systems.
You can use different email addresses for every site, and maintain them all, like I do, but I don't think most people are going to go through all that trouble just to save a few minutes a day of hitting the delete key.
finally I get your point, you should have expanded to start with ;)
Yeah, I do tend to do that too often - assume that the other person can read my mind and everything. Sorry about that.
I tried TMDA but I needed to be running my own SMTP server but I'm not on a fixed IP and getting my ISP to put TMDA in place at their end is a no-no too.
It could also be done quite easily using a website. The only problem is that most people aren't used to seeing "email me at http://youmightbeaspammer/so/use/this.form". Well, that and the fact that you can't sign up for any services. I really need to modify my phpnuke to make email address optional. But first I need to get rid of all the ugly security holes.
Can't see as its much different from my telco having my number. They publish opt-outable directories etc. They sell them in electronic form to cold-callers.
But laws against telephone solicitations do work. Ever since I've gotten my cell phone I've used it to sign up for everything. I've gotten 2 phone solicitations so far (in a year and a half), from companies which I already had a pre-existing business relationship (one was my credit card company, I forget who the other was). I told them both that I was on a cell phone, and not to call me any more, and I haven't gotten any phone solicitations since.
I don't think laws against spam would be effective though. For one thing, calling people costs money, so you have to be a somewhat reputable business to engage in phone solicitations. Secondly, as I mentioned earlier, telephone calls are by their very nature easy to trace. Email is not.
It's no more ridiculous than saying I should start to write my own Messenger client because I want to communicate with my MSN Messenger contacts but disagree with the Messenger EULA.
Fine, use one of the freely available ones created by someone else.
The EULA says that one can't use an unauthorised client to access the service. The ultimate recourse for non-compliance is criminal prosecution.
That's simply not true. Besides, you definately don't have to agree to the EULA if you don't use the software, and arguably even if you do.
The rest is up to the ISPs and as more and more struggle they might find that reducing bandwidth consumption by eliminating spam is a winner all round.
They'd be much better off hiring fewer people to read the complaints about their user's spamming. Bandwidth is cheap compared to labor.
Here's the public domain version of the story, for those of you who want true freedom. I still haven't figured out why freedom of speech doesn't apply in this case. Maybe because he wasn't "talking"?
Too bad if you're blind....
There are audio capatchas, or you could just give your blind friends a special address.
I was thinking of a simalar system, first time senders are sent a confirmation url they must open, and if it's not opened I get sent a mail saying email@dress tried to send you a message with a subject of 'subject', do you wish to discard, deliver, or deliver and whitelist?
Yeah. I don't like that particular solution, because it requires waiting round-trip for the reply and everything, it eliminates anonymous sending, it bothers the people whose addresses were faked in the From:, etc. Most importantly, it's not scalable. Once the confirmation url method becomes widespread, so will automated spam systems which confirm. You have to use some form of capatcha, or put some cost on the sending of the email. Or you have to make email non-anonymous, which is what the folks pushing the spam laws in congress want the solution to be.
A good analogy would be to tell a woman that she can expect to get raped and have no legal recourse.
Actually, that's a terrible analogy.
But you know what. I've changed my opinion. I hope they do pass a spam law. Just so everyone can see that it won't do a single bit to stop spam. And then I can say "I told you so".
Could you give me the URL of where the RFC for MSN Messenger protocol is please?
I just put a copy of the draft up at http://www.inbox.org/draft-mova-msn-messenger-prot ocol-00.html
So instead of using "dead" email I should run the risk of criminal prosecution?
That's ridiculous.
But MSN Messenger isn't the answer. SMTP isn't either. They each have their own problems.
However, I hardly think that the way one registers with web sites has *any* bearing on replacing SMTP with a system that hinders spamming and spoofing.
The problem is that web site registrations are automated. It's really easy for me to block spam from automated senders. I just set up a capatcha for first time senders, and put people with whom I have ongoing correspondence into an allow list. Mailing lists could be set up the same way, or even better mailing lists could be done by only pushing the notification of the new message, and then downloading the actual content from a well-known server (either in advance or at the time you read it).
Any more than not giving your phone number to your doctor will stop double-glazing salespeople calling.
It's much easier to regulate the phone system, because phone calls are by their very nature non-anonymous. Giving a central authority access to the identity of every single caller and call receiver would enable laws to be useful, but who wants that?
Don't like the EULA for ICQ/AIM/MSNMessenger any more?
Write your own client.
the solution to spam is "don't check your email?"
No. That's not even remotely close to what I said.
This is saying that cars are broken because there are car theifs.
No it's like saying that cars are broken because the doors don't lock.
SPAM will stop when SPAMMERS are jailed and bankrupted!
No it won't. No law will stop spam. You have to lock the doors first.
If you track down a few spammers, get large judgments against them, and take their houses, they may realize spamming is not cheap.
Nor is tracking down spammers and getting judgements against them. Spammers are stupid. Do you think they're actually raking in the money from their "Enlarge your penis" ads? No. They're stupid idiots trying to make a quick buck the easy way.
Apart from "selected partners" of the passport provider.
Well, first of all, I said a system like passport.
But even with passport, you use an email address once, to sign up, then you never have to check it again. Sounds pretty spam-free to me.
How is that ironic?
Seems that what we do on the planet may have more effect than we may ever know.
Of course we have an effect. The question is, is that effect positive, negative, or chaotic. I suspect it's chaotic. Three days worth of data is surely not enough to do anything but convince everyone that what they originally suspected was already correct.
Spam will not stop until the current SMTP system is replaced. The main reason the current SMTP system can't be eliminated is all the current registration systems which send an email confirmation. Admittedly, my own site is part of the problem in this regard.
A system like passport would go a long way toward stopping spam. But I honestly don't see how to convince both consumers and content providers to join in on that system.
Just wanted to remind the trolls out there: *apster is not dying.
Could this be the end for the upstart MP3 indexing service that changed everything?
No, that was March 25, 2002.