Slashdot Log In
Spam Back Up To 94% of All Email
Posted by
kdawson
on Tue Mar 31, 2009 04:19 PM
from the rust-never-sleeps dept.
from the rust-never-sleeps dept.
Thelasko writes "A NYTimes blog reports that the volume of spam has returned to its previous levels, as seen before the McColo was shut down. Here is the report on Google's enterprise blog. Adam Swidler, of Postini Services, says: 'It's unlikely we are going to see another event like McColo where taking out an ISP has that kind of dramatic impact on global spam volumes,' because the spammers' control systems are evolving. This is sad news for us all."
Related Stories
[+]
Washington Post Blog Shuts Down 75% of Online Spam 335 comments
ESCquire writes "Apparently, the Washington Post Blog 'Security Fix' managed to shut down McColo, a US-based hosting provider facilitating more than 75 percent of global spam. " Now how long before the void is filled by another ISP?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Well, we will just have to (Score:5, Funny)
send more _useful_ emails to offset that.
Re:Well, we will just have to (Score:5, Funny)
Parent
Re:Well, we will just have to (Score:5, Funny)
Parent
Re: (Score:2, Funny)
Well, I have this brand new product that increases the size of a body part which 95% of men would prefer larger. Perhaps I should inform people of it?
95%? What are the other 5% already swinging meat-picks?
Re: (Score:2)
Your solution advocates a
[x] stupid
solution to the problem of spam (might as well get it in now...)
Re:Well, we will just have to (Score:4, Funny)
send more _useful_ emails to offset that.
(With apologies to whomever it was I ripped this off of)
Your post advocates a
( ) technical ( ) legislative (X) market-based (X) vigilante ( ) form-based
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
(X) Microsoft will not put up with it
(X) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
(X) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
(X) The meme is tired and worn out and I'm just as likely to get a -1 troll as a +5 funny.
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
(X) Joe jobs and/or identity theft
(X) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(X) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
(X) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatibility with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
(X) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Parent
Re:Well, we will just have to (Score:5, Interesting)
I've said it before- Email Certification.
Want to run a Certified Email server? Go to your ISP (or other such companies that may arise to offer the service). They check you out (Are you who you say you are? Do you have valid contact information? Etc...), then have you produce a Public/Private key pair. You give them the 'Public' key, and keep the 'Private' one to configure your email server with. Your email server must add an additional header with your Certifier's Certification Server (usually their email server), and a header that is encrypted with your Private key.
An email client that is Certification-compatible will, when it receives an email, look to see if it has those two headers. If not, it will handle it according to the user's wishes. This means NON-Certified email might be deleted, or sent to a different folder, or whatever. Whitelists/blacklists are still possible.
If the email has the headers, the email client will connect to the Certification Server listed in the one header, and download the 'Public' key to attempt to decrypt the other header. If the decrypted header is valid, the client treats the email the way it is configured to, usually by placing it in the Inbox. Again, whitelists and blacklists can still be used.
Here's the most important part: If the user receives Spam that is Certified, they can easily report it to the Certifier (email clients would have a 'Report Certified Spam' button that automatically shoots an email off to the Certifier, for instance). The Certifier can then contact the owner of the Certified Server and notify them of the spam. This gives the server owner a chance to stop the spam, in case the server was hacked or the spam was accidental. If the Server owner does not stop the spam, the Certifier simply pulls the Certification, by removing the 'Public' key on their server. From that moment forward, ALL email the Email server in question sends will be NON-certified (and quite frankly, probably deleted by the recipients).
If the Certifier refuses to do anything about the Spamming Server (because they are 'in on it', friendly to spammers, or just incompetent), then ALL Certifications from that Certifier can be marked as 'bad', either on a client-by-client basis, or thru the use of a Certifier black-list.
-There is no 'Central Authority'- your ISP Certifies you for a modest fee.
-You can still send non-certified email, so hobby mailing lists and the like are not affected- the people who receive the mailing list might just need to whitelist it.
-Legit email will (eventually, almost always) be Certified, so Certified emails can be sent straight to the Inbox. Non-certified email will (eventually, almost always) be spam, so it can be trashed.
-Any spam that is sent from a Certified server will quickly be reported by pissed-off recipients, and quick action will be needed to avoid that Certifier (and ALL the servers it has certified) from being put on a blacklist.
-Spam will dwindle as Spammers either move to 'spam-friendly' Certifiers (which are blacklisted so the spam never gets thru anyway), or will spend huge amounts of money switching ISPs every 2-3 days to get re-certified over and over. Of course, ISPs could take a clue from the Las Vegas Casinos, and keep a 'black book' of known spammers, and check new clients against them before Certifying them.
-This system does not need to be adopted all at once. Certified and non-certified emails can be handled both by email clients that are Certification aware and not.
It may not be perfect, but it'd be a good start.
Parent
Re: (Score:3, Funny)
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the mone
Re:Well, we will just have to (Score:5, Insightful)
I HATE this stupid form letter thing. Firstly, it really shows lack of imagination on your part. Second, it's WRONG:
(x) It will stop spam for two weeks and then we'll be stuck with it
'Stuck with it'? What's that supposed to mean? Like we're 'stuck' with SMTP or HTTP?
(x) Users of email will not put up with it
What's to 'put up with'? It's virtually invisible to users, except for the filter option regarding what to do with certified email, and a Big Red Button in their email client to automatically report certified spam.
(x) Requires immediate total cooperation from everybody at once
Simply WRONG. I addressed this in my post:
An email client that is Certification-compatible will, when it receives an email, look to see if it has those two headers. If not, it will handle it according to the user's wishes. This means NON-Certified email might be deleted, or sent to a different folder, or whatever. Whitelists/blacklists are still possible. ... ...
You can still send non-certified email, so hobby mailing lists and the like are not affected- the people who receive the mailing list might just need to whitelist it.
This system does not need to be adopted all at once. Certified and non-certified emails can be handled both by email clients that are Certification aware and not.
(x) Many email users cannot afford to lose business or alienate potential employers
They wouldn't.
(x) Open relays in foreign countries
What about them? If the server is Certified, they'll get reported. If they're not, they'll probably be ignored.
(x) Asshats
?
(x) Huge existing software investment in SMTP
This is still SMTP, just with additional Headers to the email, and an additional protocol to request/retrieve the Key.
(x) Armies of worm riddled broadband-connected Windows boxes
Again, If the server they use is Certified, they'll get reported. This results in the ISP cutting off the "worm riddled" boxes, and forcing the user to clean the box before allowing internet access (or at least email access) again. OR, if the ISP ignores the problem, they get their Certificate pulled. This is a bad thing?
(x) Eternal arms race involved in all filtering approaches
The only way to 'beat' Certification is to Certify yourself (you'll get blacklisted for failign to deal with spam reports), or have a 'spam friendly' ISP Certifiy you. (and then they'll get blacklisted.) Or ISP-hop constantly.
(x) Extreme profitability of spam
It's not profitable if no one replies. No one can reply if they don't see the spam. They can't see the spam if their client trashes it. Their client trashs it if it's not certified. (probably- this is user settable for normal email clients, or server-settable for webmail.)
(x) Extreme stupidity on the part of people who do business with spammers
See above.
(x) Dishonesty on the part of spammers themselves
It doesn't matter if you can't get a ISP to certify you.
(x) Bandwidth costs that are unaffected by client filtering
Not at first. But when they get NO replies, they'll stop spamming.
(x) Outlook
Why is this a problem?
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
None have ever been tried.
(x) Blacklists suck
Despite my saying 'no one will get the non-certified emails', this is not technically true. Certification is not a blacklist. It is a one of several criteria that can be used to filter email. For instance, a email filter like SpamAssasin looks at many factors to decide if an email is spam ot not. 'is it from a real domain?' 'Does it contain the word 'viagra''? 'is it CC'd to more than a few people?'... and a lot of other criteria. "Is it C
Parent
Re:Well, we will just have to (Score:4, Interesting)
This model works for large ISP's but creates a problem for all the smaller companies out there running their own email servers. I would object to having to relay all my email through the major providers for good reasons.
You don't have to relay any mail. Just ask you ISP for Certification. They Certify your server, and you can send all the mail you want without relaying a piece.
Personally I feel that a good way to get arid of spam is to have a central authority with a white list. You have to pay a fee to be on the list. It can't be free. Tax the spammers and you put them out of business. You spam you get delisted if proven and you don't fix it. Everything not on the whitelist gets rejected.
That might very well be what happens- Certain certifiers are known to be reliable, and they are added to a whitelist. (A certified list of Certifiers.) Any email server they certify is considered 'good'. Newcomers to the Cerification game would have to have a proven track record (say, one year with no complaints) before they are added.
Problem is with people having figured ways around captcha, public email providers like hotmail and gmail are always going to be a source of some spam.
With Certification, people can report spam with the click of a button. If google/yahoo/hotmail don't figure out how to stop spamer accounts, then they risk getting their certs pulled, and no one will get their user's emails. Thus, their users will leave, and they will go out of business.
OR, they can come up with a better way to stop spammers.
Either way, we win!
Parent
Anyone Still Have Spam? (Score:3, Interesting)
Maybe I am a freak, but to quote Davork, I get no spam. Gmail's filter catches pretty much everything. Once on a blue moon one will slip through, but I can tolerate one penis pump add every month or two. It might be true that a lot of spam is passing back and forth across the networks, but from a user point of view, it never makes it to me.
Re:Anyone Still Have Spam? (Score:5, Insightful)
If it's slowing down networks, then it does effect you.
Parent
Re: (Score:3, Insightful)
If the slowdown isn't noticible, it doesn't.
Re: (Score:3, Interesting)
Spam effects me in real life. My fax machine gets an offer nearly everyday. Considering the toner to this combo color scanner/fax/printer is rather expensive, it's downright insulting. I wish I knew how to get rid of these idiots, or at least find a cheap, real life digital service or device where I could log into and view the faxes and retain my existing fax number.
Re:Anyone Still Have Spam? (Score:4, Informative)
I know it's illegal, by the TCPA from 1991, although the amendments from 2005 turned it into a nightmare (political and prior business association exemptions). It just seems they loophole around or ignore court orders/judgements because they are out of state, out of jurisdiction:
http://www.junkfax.org/_vti_bin/shtml.exe/fax/action/stop.html [junkfax.org]
Like email spammers, they just find ways around every discovered solution. One day, a version 2.0 has to come out and they have to be addressed on a technological level, perhaps protocol. I know that someone probably wants to reply with "Your solution will not work because..." list, but all it requires is critical mass on the part of companies tired of spending money and resources on this crap. Even a legislative solution of no caller id blocking would help tremendously (if you're going to communicate with the person, what's the legitimate use of hiding the number right up to the call/fax?)
Parent
Re:Anyone Still Have Spam? (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
Maybe I am a freak, but to quote Davork, I get no spam. Gmail's filter catches pretty much everything.
Yet Google (and all other email systems) are paying for 17x as much bandwidth and infrastructure as they would otherwise need (plus filtering costs)
Re:Anyone Still Have Spam? (Score:4, Insightful)
Not really. Yes, e-mail systems are paying for way too much bandwidth, but how big a percentage of Google's bandwidth do you think is used handling e-mail? And if you compare e-mail bandwidth to Internet traffic overall, I'd imagine it's pretty trivial (if anyone has actual numbers, I'm curious). Those 50 1kB ads getting filtered out by my ISP are laughable compared to the traffic I generate watching 1 show on Hulu.
It's an unnecessary expense and it's aggravating, but no way is Google paying for 17x as much bandwidth as they need because of e-mail spam.
Parent
Re:Anyone Still Have Spam? (Score:5, Insightful)
Parent
Re:Anyone Still Have Spam? (Score:5, Insightful)
Also, let's say that your ISP does catch all the spam. What valid emails aren't you getting because of false positives? What valid emails are you sending that the recipients aren't getting because of false positives?
Not getting spam is only half the battle. Getting all valid email is the other half. Winning the war decisively is an additional problem on top of that.
Parent
Re:Anyone Still Have Spam? (Score:4, Interesting)
I can understand that to some degree, because in reality it is a balancing act, and some people may prefer a different balance. But if I have to go searching through my junk mail all the time to pick out the false positives, then I'm not sure how much better off I am than just sorting through a spam-filled inbox.
The main benefit to avoiding false negatives that I can think of is the notification of new email. I have a smart phone that buzzes every time an email goes into my inbox. If I weren't filtering spam, it would buzz constantly. So in that sense, it's better to deal with false negatives, since I can always sort through my junk when I get back to my computer. But otherwise, I don't really see much benefit.
Parent
Re:Anyone Still Have Spam? (Score:5, Insightful)
I've never had malaria. What's the fuss?
Parent
Re: (Score:3, Interesting)
Others have covered the "big picture" reasons why filtering isn't a perfect answer; but even ignoring that, and conceding that filtering improves the user experience (relative to receiving 94% spam), I would still say that filtering for spam also creates a significant problem with my user experience (relative to not having a spam problem to start with).
Why? Well, I agree that false negatives are relatively rare -- though for me that still means one every couple days, and it seems to be increasing. And rar
More data please (Score:5, Insightful)
The article seems to be counting whole e-mails, but what about bytes? And what percent of global IP traffic is E-mail? I'm just wanting to get a feel for how much spam is clogging the backbones and not just how much it is clogging the mailservers.
Mail servers (Score:5, Interesting)
I'm personally glad I don't have to run my own mail server anymore. Having to fight the constant battle against spam can seem like an uphill battle. I'm happy enough with Google Apps, very little spam gets through the filters and it's very rare to get a false positive.
Despite the fact that my mail email address is not published online anywhere and I'm very careful who I give it to (I use different addresses for completing forms online) the amount of spam that Google filters out is still amazing.
There must be a lot of stupid people out there that respond to this stuff, it wouldn't exist if it wasn't profitable.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:Mail servers (Score:5, Insightful)
Sad thing is, our users have grown accoustom to the hard work we do to prevent spam that when they get a single spam message in their inbox, they pick up the phone and call the help desk, who then create a ticket and forward it to me so that I can "check the spam filter to make sure its working".
Seriously? Fuck you... press the delete button and get on with your life. How about I just create a catchall and forward it to your inbox - then you can see all the crap we're blocking first hand.
Parent
does not need to be (Score:2)
Where I work, we use the IronPort spam filter, and I almost never (once per month?) see spam.
Of course, I don't know if any legit mail is getting filtered, and our spam filter may become worthless if it becomes mainstream (spammers will refine their code against it). Spam filtration is an arms race, but you can buy yourself a seat on the lead arm if you have the money :-)
filters will never win... (Score:5, Insightful)
Spam filtration is an arms race
That part I agree with.
However, I still say that spam filters will never solve the problem. Spammers will just keep finding new ways around them, and all the while we will continue having to pay the costs of transporting and filtering the junk email (in terms of bandwidth and cpu costs, in particular).
The only way to stop spam is to remove the reason why it exists in the first place:
If spammers can't make money off of sending out spam, they won't send it out to begin with.
Parent
There is a worse spam mail problem (Score:4, Interesting)
When can we filter out all the paper junk mails stuffed in my real mailbox?
Re:There is a worse spam mail problem (Score:5, Informative)
Parent
Re: (Score:3, Informative)
Raise your hand if you're surprised by this... (Score:4, Insightful)
Obviously, shutting down an ISP would have a negligible long-term effect on spam. Intelligent people realize that the people behind spam are themselves intelligent (at least intelligent enough to almost never get caught). Obviously they have contingency plans. If you shut down one mail relay they go to another. If you shut down one ISP they go to another. If you shut down one web hosting company they go to another.
If you shut down their favorite registrar they go find another.
Anyone who thought that shutting down one ISP would have any meaningful, long-term effect on the spam problem needs to read up on how spam works, and why it exists. In short, spam works because it is profitable. Spammers don't sent out spam just because it annoys people, they send it out because they make money off the products that they push through spam. Hence they will find new ways to push out spam, as long as they can still make money.
Re:Raise your hand if you're surprised by this... (Score:5, Interesting)
In short, spam works because it is profitable. Spammers don't sent out spam just because it annoys people, they send it out because they make money off the products that they push through spam.
While this is partly true, it's definitely not the only way spammers make money. Spammers also make money by 1) selling their services to businesses who want to sell products, collecting their fee in advance regardless of any products sold; 2) running penny stock pump&dump schemes; 3) Nigerian 419 scams; 4) Phishing; 5) selling mailing lists to other spammers; 6) other creative ideas I haven't thought of.
Parent
hey nntp, smtp here (Score:2)
could you scoot over in that coffin there? thanks
time to shuffle off this mortal cat cable
Re: (Score:3, Informative)
I work for a university, and for many of my students, Facebook is the only way to send messages, unless you count text messaging.
Thank you Google and Yahoo! (Score:4, Interesting)
Google and Yahoo have inadvertently created a goldmine of email addresses. While I get a lot of spam from various domains, it is these two sites that I have a problem with. See, they use domain keys, which elevates the message above spam filters (or at least helps to). So spammers have cracked the google chacpta (sp?). There is no easy way to report these addresses for abuse. The providers need to somehow only allow domain keys on VERIFIED accounts, or have multi-level domain keys.
I think that a craigs-list moderation style of X spam reports and you're cut off is the way to go. Of course, these reports should only be counted from existing VERIFIED accounts, with the reporting mechanism built into the interface.
Re:Thank you Google and Yahoo! (Score:5, Insightful)
I think that a craigs-list moderation style of X spam reports and you're cut off is the way to go. Of course, these reports should only be counted from existing VERIFIED accounts, with the reporting mechanism built into the interface.
That currently gets abused. I have heard that anybody trying to sell an animal, for example, gets flagged as abuse by PETA assholes. Could the same happen to mailing lists? If one wants to sink a mailing list, they subscribe to it with all their e-mail addresses, and tell each e-mail provider that it is spam...
Parent
Not *ALL* of us... (Score:3, Insightful)
"This is sad news for us all." -- Adam Swidler, of Postini Services
Isn't Postini Services a service that makes money by being an "outsourced" spam filter?
Not a sad day for them...
I get less than 2% - don't even need filters (Score:3, Insightful)
I run my own domain and have about 130 email addresses. Usually I just create a new one for new uses (different hobbies, different interests). Every website that asks for an address gets a disposable one, rather than a "proper" address. The consequence of these small and quick precautions means that last week I saw 8 SPAM emails, from a total of all the personal email, forums and *wanted* stuff of over 600 emails. Occasionally I find a trusted address gets an unexpected and unwelcome flurry of emails - it then gets deleted and a new one set up. Friends and family addresses are sacrosanct.
I simply don't understand how or why people only ever have 1 email address and give it out unconditionally to anyone who asks for it. How can people live like that?
What about fighting back? (Score:5, Interesting)
When someone as massive as google gets a confirmed spam address, simply respond back with many replies that are as good as genuine replies. Spam them with a few thousand and finding one becomes too difficult, therefore the business model falls away.
I know this is increasing spam short term, but remove the business model and it should stop long term. If other sites (yahoo etc) pick up a similar system for a coordinated effort can't spam be stopped?
Re:The enigma is.. (Score:5, Interesting)
Every email address that is not an actual word doesn't seem to have any problem with spam for a number of years until I inadvertently have myself logged in when visiting one of those cookie catcher sites... generally with lots of chinese letters and related to a recently released mainstream movie... stopped doing that when I realized if I started being patient I could just get it at redbox.
Parent
Re:The enigma is.. (Score:5, Interesting)
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
In other news, 94% of Slashdot comments are spam or spam-equivalent.
Oh wait.
Re:Who is John Galt? (Score:4, Funny)
Parent
Re: (Score:3, Funny)
still in middle/high school? (Score:3, Insightful)
Put the Ayn Rand fanboyism to some good use and try to earn some cash:
Ayn Rand Institute Essay Contests [aynrand.org]
Re: (Score:3, Funny)
Put the Ayn Rand fanboyism to some good use and try to earn some cash:
Ayn Rand Institute Essay Contests
Or better still, hang yourself before you grow up to be a libertarian. Preferably with your own bootstraps.