Spam Back Up To 94% of All Email

Thelasko writes "A NYTimes blog reports that the volume of spam has returned to its previous levels, as seen before the McColo was shut down. Here is the report on Google's enterprise blog. Adam Swidler, of Postini Services, says: 'It's unlikely we are going to see another event like McColo where taking out an ISP has that kind of dramatic impact on global spam volumes,' because the spammers' control systems are evolving. This is sad news for us all."

Well, we will just have to

send more _useful_ emails to offset that.

Re:Well, we will just have to

Well, I have this brand new product that increases the size of a body part which 95% of men would prefer larger. Perhaps I should inform people of it?

Re:Well, we will just have to

It's up to you to guess if the product is to be used by men or women.

Re:Well, we will just have to

send more _useful_ emails to offset that.

(With apologies to whomever it was I ripped this off of)

Your post advocates a

( ) technical ( ) legislative (X) market-based (X) vigilante ( ) form-based

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
(X) Microsoft will not put up with it
(X) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
(X) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
(X) The meme is tired and worn out and I'm just as likely to get a -1 troll as a +5 funny.

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
(X) Joe jobs and/or identity theft
(X) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(X) Outlook

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
(X) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatibility with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
(X) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Well, we will just have to

I've said it before- Email Certification.

Want to run a Certified Email server? Go to your ISP (or other such companies that may arise to offer the service). They check you out (Are you who you say you are? Do you have valid contact information? Etc...), then have you produce a Public/Private key pair. You give them the 'Public' key, and keep the 'Private' one to configure your email server with. Your email server must add an additional header with your Certifier's Certification Server (usually their email server), and a header that is encrypted with your Private key.

An email client that is Certification-compatible will, when it receives an email, look to see if it has those two headers. If not, it will handle it according to the user's wishes. This means NON-Certified email might be deleted, or sent to a different folder, or whatever. Whitelists/blacklists are still possible.

If the email has the headers, the email client will connect to the Certification Server listed in the one header, and download the 'Public' key to attempt to decrypt the other header. If the decrypted header is valid, the client treats the email the way it is configured to, usually by placing it in the Inbox. Again, whitelists and blacklists can still be used.

Here's the most important part: If the user receives Spam that is Certified, they can easily report it to the Certifier (email clients would have a 'Report Certified Spam' button that automatically shoots an email off to the Certifier, for instance). The Certifier can then contact the owner of the Certified Server and notify them of the spam. This gives the server owner a chance to stop the spam, in case the server was hacked or the spam was accidental. If the Server owner does not stop the spam, the Certifier simply pulls the Certification, by removing the 'Public' key on their server. From that moment forward, ALL email the Email server in question sends will be NON-certified (and quite frankly, probably deleted by the recipients).

If the Certifier refuses to do anything about the Spamming Server (because they are 'in on it', friendly to spammers, or just incompetent), then ALL Certifications from that Certifier can be marked as 'bad', either on a client-by-client basis, or thru the use of a Certifier black-list.

-There is no 'Central Authority'- your ISP Certifies you for a modest fee.
-You can still send non-certified email, so hobby mailing lists and the like are not affected- the people who receive the mailing list might just need to whitelist it.
-Legit email will (eventually, almost always) be Certified, so Certified emails can be sent straight to the Inbox. Non-certified email will (eventually, almost always) be spam, so it can be trashed.
-Any spam that is sent from a Certified server will quickly be reported by pissed-off recipients, and quick action will be needed to avoid that Certifier (and ALL the servers it has certified) from being put on a blacklist.
-Spam will dwindle as Spammers either move to 'spam-friendly' Certifiers (which are blacklisted so the spam never gets thru anyway), or will spend huge amounts of money switching ISPs every 2-3 days to get re-certified over and over. Of course, ISPs could take a clue from the Las Vegas Casinos, and keep a 'black book' of known spammers, and check new clients against them before Certifying them.
-This system does not need to be adopted all at once. Certified and non-certified emails can be handled both by email clients that are Certification aware and not.

It may not be perfect, but it'd be a good start.

Re:Well, we will just have to

I HATE this stupid form letter thing. Firstly, it really shows lack of imagination on your part. Second, it's WRONG:

(x) It will stop spam for two weeks and then we'll be stuck with it

'Stuck with it'? What's that supposed to mean? Like we're 'stuck' with SMTP or HTTP?

(x) Users of email will not put up with it

What's to 'put up with'? It's virtually invisible to users, except for the filter option regarding what to do with certified email, and a Big Red Button in their email client to automatically report certified spam.

(x) Requires immediate total cooperation from everybody at once

Simply WRONG. I addressed this in my post:

An email client that is Certification-compatible will, when it receives an email, look to see if it has those two headers. If not, it will handle it according to the user's wishes. This means NON-Certified email might be deleted, or sent to a different folder, or whatever. Whitelists/blacklists are still possible. ...
You can still send non-certified email, so hobby mailing lists and the like are not affected- the people who receive the mailing list might just need to whitelist it. ...
This system does not need to be adopted all at once. Certified and non-certified emails can be handled both by email clients that are Certification aware and not.

(x) Many email users cannot afford to lose business or alienate potential employers

They wouldn't.

(x) Open relays in foreign countries

What about them? If the server is Certified, they'll get reported. If they're not, they'll probably be ignored.

(x) Asshats

?

(x) Huge existing software investment in SMTP

This is still SMTP, just with additional Headers to the email, and an additional protocol to request/retrieve the Key.

(x) Armies of worm riddled broadband-connected Windows boxes

Again, If the server they use is Certified, they'll get reported. This results in the ISP cutting off the "worm riddled" boxes, and forcing the user to clean the box before allowing internet access (or at least email access) again. OR, if the ISP ignores the problem, they get their Certificate pulled. This is a bad thing?

(x) Eternal arms race involved in all filtering approaches

The only way to 'beat' Certification is to Certify yourself (you'll get blacklisted for failign to deal with spam reports), or have a 'spam friendly' ISP Certifiy you. (and then they'll get blacklisted.) Or ISP-hop constantly.

(x) Extreme profitability of spam

It's not profitable if no one replies. No one can reply if they don't see the spam. They can't see the spam if their client trashes it. Their client trashs it if it's not certified. (probably- this is user settable for normal email clients, or server-settable for webmail.)

(x) Extreme stupidity on the part of people who do business with spammers

See above.

(x) Dishonesty on the part of spammers themselves

It doesn't matter if you can't get a ISP to certify you.

(x) Bandwidth costs that are unaffected by client filtering

Not at first. But when they get NO replies, they'll stop spamming.

(x) Outlook

Why is this a problem?

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical

None have ever been tried.

(x) Blacklists suck

Despite my saying 'no one will get the non-certified emails', this is not technically true. Certification is not a blacklist. It is a one of several criteria that can be used to filter email. For instance, a email filter like SpamAssasin looks at many factors to decide if an email is spam ot not. 'is it from a real domain?' 'Does it contain the word 'viagra''? 'is it CC'd to more than a few people?'... and a lot of other criteria. "Is it C

More data please

The article seems to be counting whole e-mails, but what about bytes? And what percent of global IP traffic is E-mail? I'm just wanting to get a feel for how much spam is clogging the backbones and not just how much it is clogging the mailservers.

Mail servers

I'm personally glad I don't have to run my own mail server anymore. Having to fight the constant battle against spam can seem like an uphill battle. I'm happy enough with Google Apps, very little spam gets through the filters and it's very rare to get a false positive.

Despite the fact that my mail email address is not published online anywhere and I'm very careful who I give it to (I use different addresses for completing forms online) the amount of spam that Google filters out is still amazing.

There must be a lot of stupid people out there that respond to this stuff, it wouldn't exist if it wasn't profitable.

Re:Mail servers

Sad thing is, our users have grown accoustom to the hard work we do to prevent spam that when they get a single spam message in their inbox, they pick up the phone and call the help desk, who then create a ticket and forward it to me so that I can "check the spam filter to make sure its working".

Seriously? Fuck you... press the delete button and get on with your life. How about I just create a catchall and forward it to your inbox - then you can see all the crap we're blocking first hand.

There is a worse spam mail problem

When can we filter out all the paper junk mails stuffed in my real mailbox?

Re:There is a worse spam mail problem

You can go to your post office and request a form to have spam snail mail stopped. There was a story several years ago about a postal working got fired for telling people about the form. I would have given him a raise.

Raise your hand if you're surprised by this...

...so I can come and smack you upside the head.

Obviously, shutting down an ISP would have a negligible long-term effect on spam. Intelligent people realize that the people behind spam are themselves intelligent (at least intelligent enough to almost never get caught). Obviously they have contingency plans. If you shut down one mail relay they go to another. If you shut down one ISP they go to another. If you shut down one web hosting company they go to another.

If you shut down their favorite registrar they go find another.

Anyone who thought that shutting down one ISP would have any meaningful, long-term effect on the spam problem needs to read up on how spam works, and why it exists. In short, spam works because it is profitable. Spammers don't sent out spam just because it annoys people, they send it out because they make money off the products that they push through spam. Hence they will find new ways to push out spam, as long as they can still make money.

Re:Raise your hand if you're surprised by this...

In short, spam works because it is profitable. Spammers don't sent out spam just because it annoys people, they send it out because they make money off the products that they push through spam.

While this is partly true, it's definitely not the only way spammers make money. Spammers also make money by 1) selling their services to businesses who want to sell products, collecting their fee in advance regardless of any products sold; 2) running penny stock pump&dump schemes; 3) Nigerian 419 scams; 4) Phishing; 5) selling mailing lists to other spammers; 6) other creative ideas I haven't thought of.

Thank you Google and Yahoo!

Google and Yahoo have inadvertently created a goldmine of email addresses. While I get a lot of spam from various domains, it is these two sites that I have a problem with. See, they use domain keys, which elevates the message above spam filters (or at least helps to). So spammers have cracked the google chacpta (sp?). There is no easy way to report these addresses for abuse. The providers need to somehow only allow domain keys on VERIFIED accounts, or have multi-level domain keys.

I think that a craigs-list moderation style of X spam reports and you're cut off is the way to go. Of course, these reports should only be counted from existing VERIFIED accounts, with the reporting mechanism built into the interface.

Re:Thank you Google and Yahoo!

I think that a craigs-list moderation style of X spam reports and you're cut off is the way to go. Of course, these reports should only be counted from existing VERIFIED accounts, with the reporting mechanism built into the interface.

That currently gets abused. I have heard that anybody trying to sell an animal, for example, gets flagged as abuse by PETA assholes. Could the same happen to mailing lists? If one wants to sink a mailing list, they subscribe to it with all their e-mail addresses, and tell each e-mail provider that it is spam...

What about fighting back?

What about short term pain for long term gain?

When someone as massive as google gets a confirmed spam address, simply respond back with many replies that are as good as genuine replies. Spam them with a few thousand and finding one becomes too difficult, therefore the business model falls away.

I know this is increasing spam short term, but remove the business model and it should stop long term. If other sites (yahoo etc) pick up a similar system for a coordinated effort can't spam be stopped?

Re:The enigma is..

As near as I can figure, every email address with my actual name in it has gotten about 500 spam / month after just a few weeks of existence--usually it goes to the spam folder and is not really noticed. Since they took down the spam server, I have noticed an increase in spam in my inbox... spam I notice has become a problem.

Every email address that is not an actual word doesn't seem to have any problem with spam for a number of years until I inadvertently have myself logged in when visiting one of those cookie catcher sites... generally with lots of chinese letters and related to a recently released mainstream movie... stopped doing that when I realized if I started being patient I could just get it at redbox.

Re:The enigma is..

Just because your ISP is filtering the email sent to your inbox, doesn't mean that it's not been sent. Spam messages are congesting the ISP -> ISP links, and that hurts the companies delivering the email services.

Re:Anyone Still Have Spam?

If it's slowing down networks, then it does effect you.

Re:Anyone Still Have Spam?

affect

Re:Anyone Still Have Spam?

That you aren't actually receiving the spam doesn't mean it's not still being sent to your address. The fact that your ISP or Google or anyone else is having to spend a huge amount of resources to combat all this spam is the problem.

Re:Anyone Still Have Spam?

Also, let's say that your ISP does catch all the spam. What valid emails aren't you getting because of false positives? What valid emails are you sending that the recipients aren't getting because of false positives?

Not getting spam is only half the battle. Getting all valid email is the other half. Winning the war decisively is an additional problem on top of that.

Re:Anyone Still Have Spam?

I get no spam.

I've never had malaria. What's the fuss?

filters will never win...

Spam filtration is an arms race

That part I agree with.

However, I still say that spam filters will never solve the problem. Spammers will just keep finding new ways around them, and all the while we will continue having to pay the costs of transporting and filtering the junk email (in terms of bandwidth and cpu costs, in particular).

The only way to stop spam is to remove the reason why it exists in the first place:

• Profit

If spammers can't make money off of sending out spam, they won't send it out to begin with.

Re:Who is John Galt?

"There are two novels that can change a bookish fourteen-year oldâ(TM)s life: âoeThe Lord of the Ringsâ and âoeAtlas Shrugged.â One is a childish fantasy that often engenders a lifelong obsession with its unbelievable heroes, leading to an emotionally stunted, socially crippled adulthood, unable to deal with the real world. The other, of course, involves orcs."