It looks to me like microsoft isn't even using their own caller-id standard? IE: no TXT records published for microsoft.com? Lame. It took me all of about a minute to publish dns spf records for my domains.
I haven't heard of a single case being brought against a spammer. WTF are the FTC and FCC doing?!? A few high profile cases should scare the bejeezus out of most spammers...
I'm hugely disappointed that there's been no sign of the FTC or any other government entity attempting to prosecute spammers or people advertising/selling products via spammers. You'd think a dozen or so cases would make people think twice about sending spam...
Sounds like you might want to implement spf as well (spf.pobox.com)...
Again, if the spammers are accepting credit cards, it should be fairly easy to track them down.
I'm a bit advocate of TMDA and other challenge response e-mail systems (I used ASK - Active Spam Killer and get zero spams as well). One of the main complaints I usually hear about this is that it's too easy to "Joe Job" someone with these systems. It just occured to me that if spf is widely impletemented, this will no longer be a problem.
Well it would increase your bandwidth usage but it wouldn't be THAT bad. Of 1,000,000 emails:
- how many would be from people/addresses that were already on your whitelist? For the "average" user, probably a lot (Yeah, I know - I don't have numbers to back this up).
- using a "pre-processor" like SpamAssassin to just trash stuff that's blatant spam would further reduce the number of verification requests you'd need to send (Real life example: I get about 100 spams per day, and SpamAssassin with a "reasonable" (for me) setting of 5 generally gets all but 3-4 of these. Not bad, IMHO and pretty tweakable.
I've been using a similar system for about 6 months (SpamAssassin first, then using a whitelist/sender verification process with Active Spam Killer (ASK)). It works very, very well - zero false positives, and zero spam (with an account that had been getting ~100 spams per day).
It seems like most people who don't like whitelist systems generally don't understand them ("it'll loop if the sender and the reciepient both use whitelisting!". uhhh, no).
Replacing SMTP with another protocol and widely implementing that protocol is never going to happen in our lifetimes. Just look at IPv6. Get a clue. Whitelisting with something like TMDA or ASK (active spam killer) is the way to go. (And no, two systems properly implementing whitelisting won't loop.)
Just wanted to plug iRate (irate.sourceforge.net).
iRATE radio is a collaborative filtering client/server mp3 player/downloader. The iRATE server has a large database of music. You rate the tracks and it uses your ratings and other people's to guess what you'll like. The tracks are downloaded from websites which allow free and legal downloads of their music.
Not really iTunes related, but it's still a young project (version 0.2), but I think it has a lot of promise...
Yeah, I've been using "Active Spam Killer" (ASK www.paganini.net/ask), which has similar functionality. In the 2.5 months I've been using it, NONE of the 2000+ spams I've recieved have gotten to my inbox. Works great with procmail, as I don't control my mail server. I still use spamassassin to trash the stuff that's obviously spam. TMDA style software seems to be the way to go... I don't see anything else helping to obliterate spam any time soon (IE: "replace SMTP on every mail server on the planet with something better that hasn't been invented yet". Not gonna happen in our lifetimes).
Yeah, we're doing the spamassassin/exchange thing where I work too, and it works very well. An added bonus is that you can choose to use/not to use it on an individual basis, so if a co-worker tries it and doesn't like it, they can just turn it off.
I've also been screwing around with Active Spam Killer on my e-mail account (in combination with spamassassin, to block the blatantly obvious spam). This combination has blocked all but two spams in three months I've been using it - and I used to get 50+ spams a day. I was able to track down the originators of both of the offending spams very easily because they had to reveal their valid IP addresses. I'd say ASK / TMDA is tantilizingly close to being the perfect anti-spam system. Getting the whitelists set up was slightly painful, and one of the mailing lists I subscribe to recently changed their "From:" address without warning, which caused some problems (VERY sorry guys). If someone could just come up with a standard for ASK/TMDA and mailing list interaction (like ignoring out of office messages posted to mailing lists) things would be GREAT.
I've seen a lot of slashdot posts from people saying "dump the SMTP protocol and invent something new". I don't think that's going to happen in our lifetimes (just like IPv6 may never be widely adopted). This seems like a much more workable solution, and something that could be implemented relatively quickly. Granted, the spam would still take up bandwith and disk space with this method, but if the messages don't get through then economics takes over (IE: if it's not profitable, people won't spam).
What we really need is a way to just buy parts of songs. Like the chorus or the verse. Hell, I'd just like to buy the first four measures of a couple of songs. That's worth probably $.05 or $.10, right?
I just read your post, and I wanted to check out some songs off the Type O Negative album.
Forget about trying to listen to it at the local music store - everything's shrinkwrapped (some stores around here are getting systems to let you preview any cd in the store, but it should be standard for every record store, at least the ones that charge a premium!).
Forget about hearing it on the local Clear Channel radio station - they all suck. No preview clips on Sam Goody, Tower, or Amazon (yet).
So leaves me with the option of paying $$$ for a CD I've never heard, or using p2p to check out a few tracks. What do you think I'm going to choose? (Yes, I realize there's always the option of giving up and not listening to or purchasing this album at all). How the fsck do you expect people to but your album if they can't hear the music?!?
Slashdot Mirror
It looks to me like microsoft isn't even using their own caller-id standard? IE: no TXT records published for microsoft.com? Lame. It took me all of about a minute to publish dns spf records for my domains.
Yes, just "reverse the email architecture on the 'net". The whole net. Yeah, THAT will happen in our lifetimes...
I haven't heard of a single case being brought against a spammer. WTF are the FTC and FCC doing?!? A few high profile cases should scare the bejeezus out of most spammers...
I'm hugely disappointed that there's been no sign of the FTC or any other government entity attempting to prosecute spammers or people advertising/selling products via spammers. You'd think a dozen or so cases would make people think twice about sending spam...
Couldn't they also limit the number of requests from a given IP address/netblock for a certain time period?
Sounds like you might want to implement spf as well (spf.pobox.com)... Again, if the spammers are accepting credit cards, it should be fairly easy to track them down.
I'm a bit advocate of TMDA and other challenge response e-mail systems (I used ASK - Active Spam Killer and get zero spams as well). One of the main complaints I usually hear about this is that it's too easy to "Joe Job" someone with these systems. It just occured to me that if spf is widely impletemented, this will no longer be a problem.
Well it would increase your bandwidth usage but it wouldn't be THAT bad. Of 1,000,000 emails: - how many would be from people/addresses that were already on your whitelist? For the "average" user, probably a lot (Yeah, I know - I don't have numbers to back this up). - using a "pre-processor" like SpamAssassin to just trash stuff that's blatant spam would further reduce the number of verification requests you'd need to send (Real life example: I get about 100 spams per day, and SpamAssassin with a "reasonable" (for me) setting of 5 generally gets all but 3-4 of these. Not bad, IMHO and pretty tweakable.
I've been using a similar system for about 6 months (SpamAssassin first, then using a whitelist/sender verification process with Active Spam Killer (ASK)). It works very, very well - zero false positives, and zero spam (with an account that had been getting ~100 spams per day). It seems like most people who don't like whitelist systems generally don't understand them ("it'll loop if the sender and the reciepient both use whitelisting!". uhhh, no).
Replacing SMTP with another protocol and widely implementing that protocol is never going to happen in our lifetimes. Just look at IPv6. Get a clue. Whitelisting with something like TMDA or ASK (active spam killer) is the way to go. (And no, two systems properly implementing whitelisting won't loop.)
Just wanted to plug iRate (irate.sourceforge.net). iRATE radio is a collaborative filtering client/server mp3 player/downloader. The iRATE server has a large database of music. You rate the tracks and it uses your ratings and other people's to guess what you'll like. The tracks are downloaded from websites which allow free and legal downloads of their music. Not really iTunes related, but it's still a young project (version 0.2), but I think it has a lot of promise...
Yeah, I've been using "Active Spam Killer" (ASK www.paganini.net/ask), which has similar functionality. In the 2.5 months I've been using it, NONE of the 2000+ spams I've recieved have gotten to my inbox. Works great with procmail, as I don't control my mail server. I still use spamassassin to trash the stuff that's obviously spam. TMDA style software seems to be the way to go... I don't see anything else helping to obliterate spam any time soon (IE: "replace SMTP on every mail server on the planet with something better that hasn't been invented yet". Not gonna happen in our lifetimes).
Does anyone know if Earthlink has actually rolled out it's challenge/response system yet? I'm curious to know how well it is/isn't working...
Yeah, we're doing the spamassassin/exchange thing where I work too, and it works very well. An added bonus is that you can choose to use/not to use it on an individual basis, so if a co-worker tries it and doesn't like it, they can just turn it off. I've also been screwing around with Active Spam Killer on my e-mail account (in combination with spamassassin, to block the blatantly obvious spam). This combination has blocked all but two spams in three months I've been using it - and I used to get 50+ spams a day. I was able to track down the originators of both of the offending spams very easily because they had to reveal their valid IP addresses. I'd say ASK / TMDA is tantilizingly close to being the perfect anti-spam system. Getting the whitelists set up was slightly painful, and one of the mailing lists I subscribe to recently changed their "From:" address without warning, which caused some problems (VERY sorry guys). If someone could just come up with a standard for ASK/TMDA and mailing list interaction (like ignoring out of office messages posted to mailing lists) things would be GREAT. I've seen a lot of slashdot posts from people saying "dump the SMTP protocol and invent something new". I don't think that's going to happen in our lifetimes (just like IPv6 may never be widely adopted). This seems like a much more workable solution, and something that could be implemented relatively quickly. Granted, the spam would still take up bandwith and disk space with this method, but if the messages don't get through then economics takes over (IE: if it's not profitable, people won't spam).
What we really need is a way to just buy parts of songs. Like the chorus or the verse. Hell, I'd just like to buy the first four measures of a couple of songs. That's worth probably $.05 or $.10, right?
How much of this $1 goes to payola for Clear Channel..?
I just read your post, and I wanted to check out some songs off the Type O Negative album. Forget about trying to listen to it at the local music store - everything's shrinkwrapped (some stores around here are getting systems to let you preview any cd in the store, but it should be standard for every record store, at least the ones that charge a premium!). Forget about hearing it on the local Clear Channel radio station - they all suck. No preview clips on Sam Goody, Tower, or Amazon (yet). So leaves me with the option of paying $$$ for a CD I've never heard, or using p2p to check out a few tracks. What do you think I'm going to choose? (Yes, I realize there's always the option of giving up and not listening to or purchasing this album at all). How the fsck do you expect people to but your album if they can't hear the music?!?