Slashdot Log In
Are Spam Blockers Too Strict?
Posted by
Zonk
on Fri May 05, 2006 02:23 PM
from the unequivocal-no dept.
from the unequivocal-no dept.
Myrte writes "Wired.com has a long piece on whether spam blockers are blocking wanted messages." From the article: "For years, e-mail users complained that torrents of unwanted messages clogged their inboxes and crimped their productivity. Now, e-mail users, marketers and mailing list operators are more worried that spam filters are blocking out too many wanted messages. AOL isn't the only company to face charges that it improperly blocks legitimate messages. But, as the world's largest ISP for years, it has long borne the brunt of complaints from mass e-mailers over the problem."
Related Stories
[+]
Pay-per-email and the "Market Myth" 295 comments
Bennett Haselton has written a thoughtful piece on the latest developments in the pay-for-email schemes making the rounds from some of the big players in the world of AOL. This one is really worth your time, so please click on and read what he has to say.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Spam blockers ruined my life. (Score:5, Funny)
Re:Spam blockers ruined my life. (Score:3, Funny)
Re:Spam blockers ruined my life. (Score:2)
Re:Spam blockers ruined my life. (Score:4, Funny)
Parent
As Hermann Pasquale so eloquently put it... (Score:2, Interesting)
comfortable-looking light, as it might be a fire or torches twinkling.
When they had looked at it for some while, they fell to arguing. Some
said no and some said yes. Some said they could but go and see, and
anything was better than little supper, less breakfast, and wet clothes
all the night. Others said: These parts are none too well known, and
are too near the mountains. Travellers seldom come this way now. The old
maps are no use: things have changed for the wors
Norton Antispam (Score:5, Informative)
And then they call and abuse their ISP support personnel for days on end of "I'm not getting any of my damned email!!"
And it's all right there in their 'Deleted Items' folder.
Obvious? (Score:3)
What's news here?
I don't understand (Score:4, Insightful)
Re:I don't understand (Score:2)
Anyone who regularly sends email to multiple other people is a 'mass mailer'. I'm on at least a dozen different disscusion or announcement lists that I have signed up for.
Re:I don't understand (Score:3, Interesting)
I don't either that is why I use http://www.spamgourmet.com/ [spamgourmet.com] and create a new account for every online purchase.
From the FA, "False positives have been a problem with e-mail marketing for a very long time".
I run a small mail server, use SpamAssassin, and I check for false positives periodically, and the only thing close to false positives that I get are marketing mails, and I don't care (nor do my users).
When I look
Re:I don't understand (Score:3, Insightful)
That's an invalid assumption.
People sign up for newsletters. There are 300,000+ who've subscribed to ServerSide, for example (mostly Java developers). That's mass e-mailing.
Re:I don't understand (Score:3, Interesting)
Although I agree with you in general (I get far too many advertisements from companies with whom I may once-upon-a-time have chosen to do business)... Believe it or not, I get no spam from Amazon. None. Not a bit.
They send me order confirmations and shipping notifications (which may include a few brief text blurbs that would count as an ad),
Eh... (Score:3, Informative)
I couldn't get them to undo the change... But it is a free service and I figured I won't get anywhere if I push it and these days I just send any emails with links to my hotmail account.
Everything is proceeding as they have forseen (Score:2)
Well, then. You can simply pay a fee if you want to continue that Lord of the Rings Mailing List! (http://www.out-law.com/page-6611)
I'd like it if my spam filter could "mod up"... (Score:5, Interesting)
most of my email correspondance isn't in english, while most of my spam is in english... I've instructed my dad to delete ANY mail with an english subject if he doesn't know the sender before opening it, and that seems to work out fine, english is his 3rd/4th language and only has 2 contacts using it. If something is important enough, he'll get at call about it
Re:I'd like it if my spam filter could "mod up"... (Score:3, Informative)
Not trying to put out famebait but... (Score:2, Insightful)
Not trying to put out a flame but really guys...
Spammers can use mail fiters as weapons (Score:4, Interesting)
Your argument makes sense but there is more to it than that. Spammers are starting to catch on that their techniques to thwart mail filters can be used to manipulate those filters to block other people's emails. THAT is still pretty inceniary. Let me explain what I mean:
Some time ago I signed onto the "bluesecurity" website as I was intereste in their counter-spam efforts. As we all know here on
Besides annoying the heck out of those unfortunate enough to be on the target list, the thought came to me that this could be a crude attempt to train email filters to block out any (legitimate) correspondence affiliated with bluesecurity.com. I think we're going to see a lot more of this in the future: Spammers for whatever reason select a victim (anti-spam organisations, Microsoft, Symantec, etc) and start sending out massive spams that either repeatedly mention the victim's name, website address domain, etc, or are crafted to look like legitimate correspondence from the victim. The scummy vermin that send out the spam are the same types that go on phishing expeditions so they've had practice imitating others.
Since so many people run email filters, once these filters intercept and mark those messages as spam then legitimate email from their victims are more likely to be blocked as spam. That's all I need is for a spammer to send a few dozen emails that look like Microsoft correspondence, only to have the email filter get trained to filter out REAL email from Microsoft about my MSDN subscription for example.
Parent
It's not that they're too strict (Score:5, Insightful)
Re:It's not that they're too strict (Score:5, Insightful)
People say this from time to time, but they conclude that its still best the way it is. I value mailing lists, and making people pay or whatever proposed mechanism there is simply does not cut it.
I get spam sent via email. I get spam in my snail mailbox. I get spam on my fax machine. I get spammed by cold calls from sales drones/marketers. I've never had this happen (yet), but I've seen someone's phone get spammed with hundreds of porn text messages over a 10 or 15 minute time period. The user was initially billed for the porn spams and had to call the phone company to get them taken off of there bill.
It just seems as though open communication is just going to be subject to spam. Don't want it? Use your own private network to communicate.
Parent
Re:It's not that they're too strict (Score:3, Insightful)
senderID is dead. domainkeys is deprecated. (Score:4, Informative)
"senderID" was an unsuccessful non-standard created by Microsoft hijacking SPFv2 with submarine patents [wikipedia.org] and other deceits [iab.org]. Read up on MARID [groklaw.net] and see what I mean. senderID is dead, do not try to implement it, do SPFv1 or domainkeys if you want the current gold standard.
DKIM is the successor to domainkeys, and it's looking pretty good.
There is no "easy" involved in crypto, however. If you want "easy" do SPFv1... spoofing prevention with 5 minutes of work by any competent DNS administrator.
Parent
Re:It's not that they're too strict (Score:3, Funny)
Shakespeare got it wrong - The first thing we must do is kill all the marketing department.
SILENT spam-blocking is the worst kind (Score:3, Insightful)
AOL is rumored to do most of its spam-blocking without notification to the sender or recipient, and that's a big problem and they're h
Never too strict (Score:2)
Not even if they let you reach through the internet and castrate the spammer. With a spoon. Full of lemon juice. And margarita salt.
How is this a "gray area" (Score:5, Insightful)
It's like inviting someone to a party & you agree that they can bring their "affiliates" along. Your invitee shows up with 20 strangers & whoever you have working the door says "I don't know all these people, they aren't allowed in."
The solution isn't to cry about the "gray" area, it's to explicitly tell people who the fark these affiliates are & what they'll be sending.
Confirmation challenge (Score:5, Insightful)
The only time it doesn't work is when the sender's spam blocker dumps the confirmation request or when the sender doesn't understand what to do.
Re:Confirmation challenge (Score:3, Insightful)
Re:Confirmation challenge (Score:3, Interesting)
There is another time when they fail.
I went away last weekend. The last thing that I did before I left on Friday was to send off to my church the files required for the Sunday services seeing as I wouldn't be there.
When I returned from on Tuesday there was the e-mail requesting confirmation before it would forward the messages...
I had sent the e-mail....and didn'
Re:Confirmation challenge -- Thank you so much! (Score:4, Insightful)
> When I get a message with a moderate probability of being spam, my
> spam blocker sends a message back requesting that the sender confirm the
> message. Works great. Those few legitimate senders stuck on a
> problematic server can still get their messages to me and so far no
> spammer has attempted to bypass it.
Well thank you so much!
Since the lowlifes started forging "from" addresses using my domain, I am getting several such "confirmation" messages every day. And while my spam filter is doing its job pretty well, I have not found a way to filter out your smug verifications without getting rid of the legitimate ones.
So, thanks to people like you, I get 5 times more verification requests than actual spam.
You better hope that there is no higher power because if there is, and it decides to grant my wishes just when I get yet another verification, you'll have a bit of a problem removing that sequoia from your rear orifice.
Parent
Don't send mass e-mails (Score:5, Insightful)
Re:Don't send mass e-mails (Score:3, Insightful)
In general, if people want something, they will seek it out for themselves.
People don't want or need to be advertised at in any way via any means. This applies to companies trying to sell products or services, religions trying to amass followers, or political activists trying to rally voters. It's all BS.
If I want something, I'll go seek it out for myself. Leave me the hell alone. It's not your place to constantly bother me.
Oh please (Score:3, Insightful)
If I want something, I'll go seek it out for myself. Leave me the hell alone. It's not your place to constantly bother me.
In general, if people want something, they will seek it out for themselves.
Look, I'm with you. I hate this stuff as much as you. It's usually even a nice safe rant for a few insightful mods, but yours is practically a tr
Gmail (Score:2)
Re:Gmail (Score:3, Funny)
Yes and no (Score:5, Insightful)
If a user has signed up for a mailing list, and doesn't get what they asked for, then that's a false positive, no matter how commercial the mailing list. And this does happen. So in that respect, spam blockers are too strict.
But on the other hand, I fish out a few false positives from my spam dump every month and look to see why they were blocked. In most of the cases, it's because the mailing list operator is doing something dumb. For instance, the last false positive I received - for a legitimate, informative mailing list I deliberately signed up for - triggered my spam filter because of forged headers, two counts of malformed headers, and every other line was in all caps.
The reason why they were caught out was because they used what appears to be a mass mailer designed for sleazy purposes, and they didn't bother with any QA.
Anybody who is running a mailing list should follow a few simple rules:
That's what I consider to be common sense, but apparently common sense is hard to come by these days.
Yes (Score:3, Interesting)
I know it's in their best interest to flag as much stuff as Bulk Mail as possible (which can then be filtered into a bulk mailbox, and removed automatically after 30 days), but until I recently switched hosts, everything I was sending to Yahoo or Hotmail was going into the Bulk Folder. Now, I think this may have been due to my hosting provider, but all the tests I ran seemed to indicate that they weren't on any blacklists, or anything like that.
I even took the time to implement SPF records for my domains. This had a noticeable effect in GMail, which actually adds a header to incoming mail stating whether an SPF record was found and followed; it had no effect in Hotmail, however, which is maddening, since it's Microsoft's stupid initiative!
I don't know what the answer is, but we're not there yet.
SMTP is brain dead and should have never been used (Score:3, Insightful)
Then, we get a bunch of techno-idiots like the US Congress to legislate email relationships, miserably, contributing further to the problem.
The real solution? Simple blockage. Route the bastards to 127.0.0.1. Force authentication of the address and its owner before it can go out of the blocked ACLs. And if it happens again, shunt the address to a different CIDR block. Or re-write SMTP. That's all that's going to work. Nothing is foolproof because fools are so ingenious. Never underestimate the power of a hacker, and locks keep your friends out, your enemies have pick tools.
Re:SMTP is brain dead and should have never been u (Score:3, Insightful)
This would be so trivial to bust thru and automate it isn't funny. What happens to zombie machines? They can authenticate fine, so slip right by this problem. Instead of sending thousands of messages as fast as possible, use thousands of zombies and send just and handful messages each. You'll never trip the thresholds for volume and the spam will be buried in among the legitimate e-mail sent by that user.
Authentic
I've Definitely Had Problems With AOL (Score:5, Informative)
These emails absolutely took "opt-in" to the next level.
Not only did the doctors opt-in to receive these emails, they had to go through a fairly rigorous screening process to be eligible to receive them. On top of that, it actually would have been highly illegal for us to send these emails to others!
So, needless to say, the emails weren't spam and were going to modestly-sized email lists of 100-1,000 total recipients, approx 25% of which were AOL users.
And still, we had countless problems with AOL blocking them. AOL never listened nor responded.
Re:I've Definitely Had Problems With AOL - Be Afra (Score:3, Funny)
So 25% of doctors are AOL users. Now I'm really afraid to go in for my next checkup.
Block and tackle (Score:4, Interesting)
Listen, when you go to your snail-mailbox and get the mail, you can pretty much tell which mail is good and which is junk, right? I mean, it's easy to tell letters and cards from family members and friends from bills and unsolicited junk. It's easy because there's a physical form of recognition taking place.
Email is tougher, because in most cases all you have to go by is a sender's email address/identifier and the subject line. Now I don't knwo if you've looked at those two things closely, but it's usually easy to tell when the email is spam (how many freinds do have named Lemon T. Viceroy?). Now, as reported, phishers are getting more sophisticated and they are making much more convincing emails that are tricking people into believing the email is from their bank. They's be able to save themselves some time and frustration by checking the email address vs. a legit email they've received from the bank.
I think blocking has to start at the user end. You have to put up a wall and say that only these addresses are legit and anything else is suspect. You dump suspect emails into a separate folder and peruse it for emails that are actually legitimate, and add a pass-through for them to your wall. It requires maintenance and vigilance, and cooperation from banks, credit card companies, etc., who have to make sure you know what legitimate addresses they will send emails to you with. Any left over emails you fire back to the senders and alert your ISP
Putting the responsibility for screening mail on the user is problematic, but it's certainly a lot more efficient than having to listen to complaints about legitimate mail getting blocked constantly. I do this very thing constantly with my personal account and by using my ISP's spam filter, I'm doing a pretty good job of screening out the crap. By alerting my ISP of definite frauds, I'm hopefully making things easier for others. Of course, you have to make this system easy to use, or users will get frustrated and it won't work properly.
Maybe snail mail isn't dead yet for a reason.
Start using SPF already (Score:4, Informative)
I know this isn't the final answer, but to me it is by far the most responsible and far reaching.
Will spammers register real domains, yes. Will they send emails with a fake from address that has at least a valid domain, yes. It makes it just that much harder, and makes it harder to use farms. If the SPF record has a huge subnet then the spam blockers can ignore it, and then put it on a watch list. At least we are adding some level of authentication to the process.
The cost of SPF is so little, I don't understand why their is not more push for it, and why we can't just give it a shot. I'd rather do that then go thru some authentication process with a company and then pay for some type of certicificate. Lastly, as a programmer I hate when all of the suden we have to do quadruple opt-outs, when the real problem is people sending gobs of rolex adds from their dorm room with or without their knowledge.
The solution of coruse, is... (Score:3, Informative)
The solution to all of this, is dspam [nuclearelephant.com], of course.
We were previously running SpamAssassin for about 4 years with 13 RBLs and blackholes.us, and we were at 90% accuracy or so, and still seeing 10-20 spams slip through per-day.
I gave dspam a test, and after 3 days, we were already up to 95% accuracy, with ZERO spams slipping through.
Today, about 3 years later, we're now at 99.726% overall accuracy, again, with ZERO spams slipping through to any user's mailbox. For false-positives, the users can go to the web interface, check the "legit" emails getting incorrectly marked as spam, and have those sent to their mailbox, retrained as HAM. After a user receives 'n' number of messages from a specific address, they're auto-whitelisted.
dspam blows away anything I've ever used, ever. We're not seeing a single spam in any user's mailbox in 3 years, and we're at about 85% incoming spam per-day with 1 RBL.
Spammer by reputation (Score:4, Informative)
If a verified sender is sending [lots of] unwanted email, they are a spammer and should be blacklisted. Otherwise, verified senders should probably be trusted.
Re:Not a chance (Score:3, Funny)
Re:Not a chance (Score:2)
Last year my company missed a whole bunch of e-mails from clients because our webhost had installed an overzealous e-mail blacklist that blocked out ALL of the Sympatico ISP. (Canada's 2nd biggest ISP.)
So ya... it sucked. We didn't notice for about 2 weeks. But we got it fixed after a few phone calls.
Re:Not a chance (Score:3, Insightful)
--jeffk++
Re:Not a chance (Score:4, Interesting)
Parent
Re:Not a chance (Score:2)
Email is inherently a buggy form of communication. It could take 3 seconds to get to the person or 3 days. A phone call or letter with return receipt would be a bit more reliable.
Not to mention legal info probably shouldnt be sent in the clear.
Well if you do lose the case, you can always claim incompetent representation and appeal.