Forgot your password?
typodupeerror
Spam

Revolutionary Spam Firewall Developed 507

Posted by CmdrTaco
from the well-that-said-so-anyway dept.
psy writes "physorg has a story on a new spam firewall developed at The University of Queensland. The new technology is the only true spam firewall in existence, according to co-developer Matthew Sullivan. "Existing anti-spam software filters out spam whereas ours puts up a firewall, stopping all email traffic and only allowing real mail through," said Mr Sullivan. "In addition, our technology is accurate and fast. We recently completed a successful trial of a key layer of the spam firewall and it processed the emails at 90 messages per second, misclassifying only one out of 25,000 emails." "It turned out that the software was even better than us, picking up spam we'd incorrectly classified as legitimate emails."
This discussion has been archived. No new comments can be posted.

Revolutionary Spam Firewall Developed

Comments Filter:
  • Spelling (Score:5, Funny)

    by swordboy (472941) on Tuesday August 24, 2004 @11:45AM (#10056919) Journal
    I have a simple algorithm to reject spam: spelling.

    If you can't spell correctly, then I don't want your v1agr4.
    • Re:Spelling (Score:5, Informative)

      by random_culchie (759439) on Tuesday August 24, 2004 @11:51AM (#10057027) Homepage Journal
      Yes and aparently there are 600,426,974,379,824,381,951 different ways to spell viagra! [cockeyed.com]

      Will your algorithm do it with polynomial complexity ;)
      • Re:Spelling (Score:4, Informative)

        by ninewands (105734) on Tuesday August 24, 2004 @12:11PM (#10057334)
        Quoth the poster:
        Yes and aparently there are 600,426,974,379,824,381,951 different ways to spell viagra.

        Actually, the number is 1,300,925,111,156,286,160,896. He missed a couple of possibilities and had to update the page.
      • Re:Spelling (Score:5, Informative)

        by CommanderData (782739) * <.moc.oohay. .ta. .ihnivek.> on Tuesday August 24, 2004 @12:29PM (#10057554)
        His algorithm doesn't need to. All it needs to do is check against an existing dictionary of words. If the word is not on the list, it is assumed to be misspelled. (If the good spelling of Viagra is in the dictionary, simply remove it so that any correctly spelled reference to Viagra counts as a misspelling too). If there are greater than X% misspellings in the e-mail it gets trashed. X can be a smaller percentage if the e-mail has any hyperlinks in it, because it is virtually guaranteed that someone is trying to sell you something...

      • From the site: These three additions change the first equation to (3*13*17*4*3*17) variations, and boost the second equation to ( 192 x 3 x 192 x 13 x 192 x 17 x 192 x 4 x 192 x 3 x 192 x 17 x 192) = 1,300,925,111,156,286,160,896. Thanks Greg, Ryan and SR, you helped push the total into the SEXTILLIONS!

        Please don't tell me I'm the only one who finds it ironic that the number of different ways to spell it comes out as sextillions...
    • Re:Spelling (Score:5, Funny)

      by gowen (141411) <gwowen@gmail.com> on Tuesday August 24, 2004 @11:53AM (#10057077) Homepage Journal
      We should apply the "good spelling" rule to /. posts.

      ( Read More... [slashdot.org] | 2 [slashdot.org] of 1274 [slashdot.org] comments | it.slashdot.org [slashdot.org] )


    • Re:Spelling (Score:5, Interesting)

      by rossz (67331) <ogre AT geekbiker DOT net> on Tuesday August 24, 2004 @12:40PM (#10057674) Homepage Journal
      Spelling doesn't work. The average computer user either can't spell or can't type and doesn't bother to use a spellchecker in email. I did small study on spell checking as an anti-spam tool [vamos-wentworth.org] and was somewhat disappointed by the results.
      • On the contrary (Score:3, Interesting)

        by Julian Morrison (5575)
        Let's configure all SMTP servers to drop mis-spelled email. Then not merely will we have ended the scourge of spam, but also cleared the internet of dumb people. This is not a bug!

        You should re-run your study, and correlate against average IQ before and after...
  • filter out mesages from my x ;-)
  • by Anonymous Coward on Tuesday August 24, 2004 @11:46AM (#10056925)
    I think Barracuda Networks [barracudanetworks.com] would rather disagree with the idea that this is the "only true spam firewall in existence," considering that Barracuda's entire product line consists of spam firewalls.

    Damn fine spam firewalls, too, I might add. They handle around 115 messages per second, and can run up to eight filtering steps (including Bayesian analysis, which is similarly efficient to SVM, which the one in the article uses). Plus Barracuda's can do virus scanning.

    I'm not sure how this is revolutionary.
    • Ciphertrust, too... (Score:5, Informative)

      by TrebleJunkie (208060) <ezahurakNO@SPAMatlanticbb.net> on Tuesday August 24, 2004 @11:49AM (#10056995) Homepage Journal
      I know! Ciphertrust's Ironmail works the same way... It stops ALL mail inbound, runs it through about a dozen different detection queues, only letting legitimate stuff through. I'd really like to see how this new one is otherwise unique.
    • by micromoog (206608) on Tuesday August 24, 2004 @11:49AM (#10056996)
      Isn't "spam firewall" just a marketing term for "filter"?
      • by Rikus (765448) on Tuesday August 24, 2004 @11:53AM (#10057056)
        Isn't "spam firewall" just a marketing term for "filter"?

        Isn't "revolutionary" just a marketing term for any stupid new product?
      • by Greyfox (87712) on Tuesday August 24, 2004 @11:57AM (#10057129) Homepage Journal
        I believe the distinction is when the filtering takes place. If you wait for the spam to be placed on your hard drive and filter it out when you start your mail client, then it's filtering. If you reject the spam before the remote MTA drops the connection, then it's a firewall.

        I'm using Postfix at home and it's got some nifty features to allow you to do this sort of thing. You can write a simple SMTP server that listens on some port of 127.0.0.1 and configure postfix to send the mail though that. Your server scans the E-Mail and sends a reject or accept message back to postfix, which sends it on to the remote MTA. Your SMTP server then feeds the mail into another postfix server which listens on an odd port of 127.0.0.1 and doesn't have the restrictions that your publically accessable postix server does. There are packages available for all sorts of scanning based on this ability. Since you reject the message at MTA time, you don't have to bother with sending a bounce message, either.

        • Your definition is a good one. But it still doesn't make this product the first - or revolutionary. Sendmail created the 'milter' interface many years ago precisely to make this kind of rejection of unwanted mail possible. There are many sendmail milters written in many languages. The most popular being C, Perl, Python in that order. I run a Python milter [bmsi.com] which removes Windows executables (except DOC and XLS), checks SPF [pobox.com], and checks content with DSPAM [nuclearelephant.com] wrapped for Python [bmsi.com]. Of the 40000 spams a day we g
      • by isorox (205688) on Tuesday August 24, 2004 @12:09PM (#10057301) Homepage Journal
        I understand a "spam firewall" to close the connection as soon as it recognises spam, rather then let the whole email download. In the case of those "Windows service pack" emails, you can save a lot of bandwidth.
        • we do the same here with sendmail + mimedefang. The reject/drop occurs as soon as spammage is detected. Combined with spamassassin, it is a good system.

          For example, here is a list of messages that we completely discarded yesterday (in other words, they were dumped before we even bothered invoking our spamass or antivirus routines):

          Completely discarded: 6373
          Reject 554 total: 30885
          Reject 550 total: 33796
          Reject 501 total: 9702
          Suspicious Header total: 3
          Partial MIME type total: 1
          Non-multipart total: 2
          Forbid

    • They handle around 115 messages per second, and can run up to eight filtering steps

      Is this the next nerd measuring stick?

      Nerd #1: I overclocked my spam firewall, i'm getting 119 MPS now!

      Nerd #2: Sweet! My mom promised I'd get a new spam firewall accelerator card for Christmas, I'll pwn your 119 MPS!

    • One of the nice things about the Barracuda is that I can configure it as a spam filter or a firewall.[1] I can decide whether to have certain mails stopped at the border, or dumped in a special box, or passed through (and optionally tagged).

      In fact, you can do all this with free software as well. It's just that the free software was freaking out on us, and requiring way too much handholding. We were losing email, and having huge delays.

      The Barracuda (which we found through a /. ad, so /. isn't a comple
    • I'm reminded of the legend of DWIM. For those that don't know, it was basically an automated error-correction program - Do What I Mean. If it thought you'd typed something in wrong, it would replace it with what it thought you meant.

      Somebody tried to delete their backup files, which had $s appended. There were no backup files, so DWIM thought that somehow they'd mistakenly hit the $ key just after pressing *, and in fact meant to delete everything on the disk. And no, heaven forbid that it confirmed this a
    • The academic literature search is pretty much dead these days - there's just so much stuff going on in the world that it's well nigh impossible to be completely up to date on your field. There're entire communities of researchers that have no idea what other, similar groups are up to.
  • Sourcecode? (Score:2, Insightful)

    by peterprior (319967)
    Sourceode would be nice....
  • What the hell is one of these? There seems no substance to this report, bar some TLAs as above and a load of hype. Where is the proof? How was it tested? Etc.
  • 1/25000 (Score:2, Insightful)

    by Laivincolmo (778355)
    Although this is a great new technology, for a business setting, I don't know if even missing one e-mail is acceptable...
    • Re:1/25000 (Score:5, Insightful)

      by Shakrai (717556) on Tuesday August 24, 2004 @11:50AM (#10056997) Journal

      Although this is a great new technology, for a business setting, I don't know if even missing one e-mail is acceptable...

      That's what everybody says but what's the other option? Letting all the SPAM come in? Do you really think that fed-up employee who gets hundreds of SPAMs a day is really going to do a better job of just mashing down the delete key then a SPAM filter with a 1/25000 error rate?

      Of course I doubt this technology would perform that well but the point still stands -- if you don't have a computer flagging them then chances are you have a human flagging them. Who do you trust more?

    • Re:1/25000 (Score:5, Interesting)

      by stienman (51024) <<moc.scisabu> <ta> <sivada>> on Tuesday August 24, 2004 @11:50AM (#10057012) Homepage Journal
      Most users of email are now treating it as a lossy messaging system, and the users themselves accept that some messages simply don't make it. Critical business is always followed up with a call.

      -Adam
      • Re:1/25000 (Score:3, Insightful)

        by nkntr (583297)
        I support among other people, a marketing staff. When people are interested in buying things, they may only send one email. That one email is all you are going to get, and not getting it is the same as not getting the sale. I know the marketing staff is extremely skeptical about any sort of spam filtering, as they are always concerned about missing important emails that may lead to sales, and ultimately, revinue. I don't know how this fits in with spam filtering, but suggesting that all important email
        • Re:1/25000 (Score:3, Insightful)

          by Politburo (640618)
          When people are interested in buying things, they may only send one email.

          Assuming you give them multiple avenues to contact you, then they simply aren't that interested if they only send one email and drop it after that. Now, I can certainly see trying to make the email system as hardened as possible to prevent any missed email, but the idea that youre going to lose out on some huge sale because of one email being dropped is silly. The grandparent is correct. If you're at all serious in your business, im
    • Re:1/25000 (Score:5, Interesting)

      by Quarters (18322) on Tuesday August 24, 2004 @11:50AM (#10057013)
      If you are sending something so critical then you shouldn't be using email. FedEx with signature required delivery and certified/return-receipt USPS mail exist for a reason.
    • You're right - one in 25,000 is completely unacceptable. My company gets 4x that amount of email a day through our exchange server, and if we missed 4 legit client emails a day... that would be lost business, and that's just unacceptable no matter how you look at it.
      • Re:1/25000 (Score:4, Insightful)

        by rjstanford (69735) on Tuesday August 24, 2004 @11:53AM (#10057064) Homepage Journal
        and if we missed 4 legit client emails a day... that would be lost business, and that's just unacceptable no matter how you look at it.

        Well... how much money would it take to have the staff necessary to do the filtering manually (at a better rate - even humans are fallible), and how much would the potential business loss cost you? Assuming that the business was very profitable, and that the senders wouldn't call or send a follow-up email of course.
      • Re:1/25000 (Score:5, Interesting)

        by biglig2 (89374) on Tuesday August 24, 2004 @12:14PM (#10057377) Homepage Journal
        Then you're stuffed anyway, because internet e-mail is not guaranteed.

        It is difficult. We're swatting away a million of the damn things a week and still our users complain. They also complain when we get false positives. And when, next week, we turn on the system that lets them see what we have blocked that was addressed to them, they'll complain too.

        I think the one solution they would find acceptable is for me to personally read every one of those million messages and mark it as good or bad. I hope our VP doens't read slashdot....
        • Re:1/25000 (Score:3, Insightful)

          I don't mean to be a prick, but maybe those are all different users complaining? Maybe give them some options. It sounds like you have:

          - Some people that want no spam and can accept losing real email.

          - Some people that want as little spam as possible without losing any real email.

          This is what I like to call "normal."
    • Re:1/25000 (Score:2, Insightful)

      by Mononoke (88668)
      Although this is a great new technology, for a business setting, I don't know if even missing one e-mail is acceptable...
      I would guess that's right in line with USPS, UPS, FedEx, or even faxing directly.

    • When I read that it misclassifies one out of 25000 emails, my first thought was "I hope that doesn't mean it throws out 1/25000 of all legitimate messages." If it really does this, I will not be using it. I'd rather have my 5-10 spams per day (which I could filter easily if I cared) than miss an email every few months.
    • Re:1/25000 (Score:5, Insightful)

      by cyngus (753668) on Tuesday August 24, 2004 @11:56AM (#10057108)
      One of two conditions exists in this case.
      1) The e-mail is vitally important and your business will be seriously damaged by its failed delivery.

      2) The e-mail was somewhat important, but not something large enough to materially change your revenue/profits.

      If the first is the case, you probably shouldn't be using e-mail in the first place and/or whoever sent it is probably going to follow up with a FedEx or phone call.

      In the case of number 2 (ha ha, number two), you've saved so much time not having to wade through spam that the losses are negated.
    • I'd guess that if you put the firewall up against your average email user, the average user would shitcan legitimate messages at a much higher rate than the firewall thanks to the fact that the user can get frustrated while the firewall can't. I know my boss accidentally deletes mail from me at least 3 times per week because he's careless while mass-deleting spam in the morning.

      Since the firewall functions based upon code rather than emotion and intuition, the firewall's error rate is going to look better
    • Re:1/25000 (Score:5, Insightful)

      by Alioth (221270) <no@spam> on Tuesday August 24, 2004 @12:03PM (#10057224) Journal
      1/25000 is significantly better than a human being. If you use no automatic spam filtering at all, and you get a typical geek's email load (about 100 spam a day with 10 legitimate emails a day), you will still delete mail as spam when it wasn't spam.

      That's why I use SpamAssassin - it does a good job, and is no worse at making false positives than I am. If I'm just as liable to make a false positive than an automatic filter, I'm better off saving my time.
    • Re:1/25000 (Score:4, Informative)

      by ColdGrits (204506) on Tuesday August 24, 2004 @12:42PM (#10057702)
      If missing one email is not acceptible to your business, then your business should not be using email ever anyway - email is not, nor has it ever been, a guaranteed delivery mechanism.

      At our company, current just over 50% of all inbound email is detected as spam. Thus more than 50% of all our inbound email is spam, and the true figure (allowing for the false negatives which slip through) is probably in excess of 60% (and rising)

      With a failure rate of 1 in 25,000, AND assuming that means a false positive rather than a false negative, then for our company taking into acount the volume of spam we receive it means 1 email in > 55,000 is wrongly identified.

      I can assure you that our business is capable of coping with 1 missed email in > 55,000.

      We certainly do not to business-threatening-essential transactions via insecure, non-guaranteeded publicly-transported email, and nor shoudl your business!
    • Re:1/25000 (Score:4, Interesting)

      by tiger99 (725715) on Tuesday August 24, 2004 @01:29PM (#10058360)
      The email system as we know it and the underlying protocols do not guarantee delivery, therefore any business absolutely relying on email is very stupid indeed.

      It is in principle possible to produce a reliable email system, but only if a receipt is returned to the sender when the recipient actually reads the mail, not when it arrives at his ISP for example.

      Sadly some businesses do rely implicitly on things that usually, but not always, work, such as mobile phones, pagers, and text messaging. It may have been the same with pigeons, a predator might get the bird! Businesses should set up foolproof systems if they want to do well, a quick phone call to confirm receipt of critical items, for example. The occasional email, even now, takes many hours or even several days to arrive, there is no guarantee whatsoever of time of arrival, but again some seem to think it is "instant", because it very often is. Managers should be aware of these issues, sadly some are not.

      But I hope this anti-spam firewall is a brilliant success, and that if it has minor shortcomings there will be satisfactory work-arounds. I am sick of spam, but the ultimate answer must be to ensure that it does not pay, i.e. that the probability of being caught multiplied by the fine greatly exceeds the potential profit. That requires legislation worldwide and some conceptually simple additions to existing mail servers, with care taken to protect the privacy of normal users. Given the political will, and some competent leaders (not Dubya or B. Liar, for a start) it should be easy.

  • by jjares (141954)
    The words revolutionary and spam in the same phrase... frightens me.
  • Not a firewall (Score:4, Informative)

    by BarryNorton (778694) on Tuesday August 24, 2004 @11:47AM (#10056941)
    This isn't a firewall as it doesn't filter based on addressing. Furthermore, the use of SVMs (support vector machines) to classify text is not new...
  • Fetchmail? (Score:4, Insightful)

    by TheLoneCabbage (323135) on Tuesday August 24, 2004 @11:48AM (#10056957) Homepage

    Fetchmail + SpamAssassin?

    What am I missing here?

    Doesn't save B/W: you need to run in INSIDE your network.

    Don't care how fast it is: It's a dedicated server.

    1/25,000 failure rate with no false positives: OK, that's good. But still not amazing.

    How are their servers? /.?

  • Deployment (Score:3, Interesting)

    by Rikus (765448) on Tuesday August 24, 2004 @11:48AM (#10056958)
    Well, this certainly sounds like a good thing for many people, but because it's been described as "firewall" and not a "server-side filter", I certainly hope it wouldn't be set up at major ISPs to intercept all smtp traffic going through.
  • Yes... (Score:2, Funny)

    by phosphorous (545719)
    Hopefully their spam firewall is more robust than their web server.
  • Uh yeah, OK... (Score:5, Insightful)

    by Tony Hoyle (11698) <tmh@nodomain.org> on Tuesday August 24, 2004 @11:48AM (#10056965) Homepage
    It's easy to produce these kind of results in trials - you just tune the spam filter to handle a certain set of emails, then you feed it those emails again and you get a near 100% success rate.

    Heck, why not do it with a million emails? Makes better headlines that way.

    I don't see how this is any different to SpamAssassin (the term 'Mail Firewall' is pure marketing bullshit. It's a spam filter. Get over it.) except I bet it costs a hell of a lot more...
  • by Thrymm (662097) on Tuesday August 24, 2004 @11:48AM (#10056973)
    1 out of 25k is impressive, but what happens to these spam mails? Are they bounced back as an error "no user account found"? Or done like a blackhole where the spammer doesnt know if it reeached its intended recipiant? I like my SpamBayes :)
  • There were 3 comments when I first tried to load the article, but alas ... The server was /. --ed already ..
  • Useless (Score:3, Insightful)

    by trans_err (606306) <ebenoist&gmail,com> on Tuesday August 24, 2004 @11:50AM (#10056998) Homepage
    Until there is a 0% fail misclassification rate such a method is useless. Filtering was one thing, if you misfiltered a message you always had the oppertunity of occasionally scanning your SPAM box and making sure everything was about penis enlargement and not about the meeting you have next week. However, with this method email is stopped and never delivered, thus your misclassified email is now gone- forever.

    I'd rather get 5 extra spam if it meant I also recieved every real email.
    • Re:Useless (Score:2, Insightful)

      by leperkuhn (634833)
      if it's just bounced back then how is that bad? there will never be a perfect system - even whitelisting involves a bounceback. I'd be more than happy with 1 out of 25,000 e-mails being incorrect. I bet more mail gets lost by the post office.
    • >> I'd rather get 5 extra spam if it meant I also recieved every real email.

      I'll arrange your extra spam, sir.

  • by calypso15 (767323) on Tuesday August 24, 2004 @11:50AM (#10057015) Homepage
    "...companies losing valuable employee time to deleting spam..."

    Maybe they should be working on a Slashdot-Firewall. Damn, I really should get back to work.

    Oh, and since the linked article got /.ed, here:
    http://www.uq.edu.au/news/index.phtml?article=5833 [uq.edu.au]
  • Spin doctors (Score:4, Insightful)

    by sean23007 (143364) on Tuesday August 24, 2004 @11:51AM (#10057024) Homepage Journal
    "It turned out that the software was even better than us, picking up spam we'd incorrectly classified as legitimate emails."

    Heh. Does anyone else see that as a good way to downplay false positives?

    "Oh, good point, Computer. That email from my boss actually was spam. I didn't realize that until you mentioned it."
  • Could it be count as spam? In that case, will users behind that spam firewall receive it by mail?
  • by MustardMan (52102) on Tuesday August 24, 2004 @11:52AM (#10057043)
    I submitted this as an ask slashdot and was promptly rejected, so I'm going to put this here as a slightly on-topic post.

    What I want to see is a software hard drive "firewall." If you're not sure what I mean, think of what a product like zone alarm does when spyware.exe tries to access the internet on your pc. It pops up a window saying "do you want to allow this program..." Now, why can't we have the same thing for hard drive access? So, I download fungame.exe, and when I go to run it, my "firewall" tells me fungame.exe is trying to write to fifteen different directories to install different spyware products. It could only give a popup on the first time a program tries to write to a given directory, and have an option to not show any new notices for this program, to limit the annoyance factor. I think this would be a great tool to help lessen spyware/trojan problems. If the program interacted with spybot or a similar product, it could even automatically prevent writing of files that are known to be adware. Is there anything like this out there? Anyone who would be willing to help make it?
  • For those who belive this software actually can do this well in real-life environment, I have this bridge that might interest you ...

  • "Existing anti-spam software filters out spam whereas ours puts up a firewall, stopping all email traffic and only allowing real mail through"

    Slashdotting has made it impossible to check for more meaning in the article, so can anyone tell me what the difference is supposed to be here. How does stopping mail and then allowing non-spam through differer from a spam filter? It sounds like pretty much what the qmail/spamassassin boxes I've set up as mail gateways do.

  • pretty simple.. filtering out html email (99.9% of which for me is spam) and then all the pen1s and v1agr4 (misspelled words, particularly in small concentrations) combined with a URL.

    one bad thing about all the misspellings is that the spam poetry project got messed up..

  • by burgburgburg (574866) <splisken06@email . c om> on Tuesday August 24, 2004 @11:54AM (#10057087)
    Unconsciously Desired Email Industry (Our slogan: You opted in in your heart!), I'd like to strongly protest the continuing escalation of technology against us. We provide the opportunity for hundreds of thousands of people to spend freely on products unburdened by simple heuristics of "they work" or "they won't make you ill" or "we'll actually send them". Why are you so intent on interfering with the consumer ethos?
  • Big deal (Score:3, Funny)

    by n6kuy (172098) on Tuesday August 24, 2004 @11:55AM (#10057093)
    You mean it blocks all email, and the one ligitimate email among the 25000 is the "misclassed" one...
  • by lokedhs (672255) on Tuesday August 24, 2004 @11:59AM (#10057158)
    I heard about this new technique before. Apparently it works trmendously well.

    The idea is that the mail server keeps a whitelist of "allowed" addresses which are always accepted. If a mail comes from an address which is not known, the mail server will reply with a "server unavailable, try later" error message. All real mail servers will try to send the message a little later (I don't know the exact time, but it's probably less than an hour. Someone else might know better).

    The second time the remote mail server tries to connect, the server accepts the mail and adds the address to the whitelist.

    However, mass mailers for spam don't do this but simply go on to the next address in the list if this happens. This way the spam message is filtered out.

    Note that this method doesn't require any analysis of the actual content of the messgae, nor does it involve any manual actions from neither the sender nor the receiever. Currently it's porbably the best spam blocking method that exists.

    • by Santana (103744) on Tuesday August 24, 2004 @12:15PM (#10057378) Homepage

      That's how spamd [openbsd.org] works, and yes, it works tremendously well. I used to get 300 spam messages daily. I receive now one or two every week.

    • The second time the remote mail server tries to connect, the server accepts the mail and adds the address to the whitelist. Currently it's porbably the best spam blocking method that exists.

      Until the spammers catch on and start to resend their requests. This seems like a stop-gap solution.
      • Until the spammers catch on and start to resend their requests. This seems like a stop-gap solution.

        It is, but it's a GOOD stop-gap. In order to resend the bounced greylisted message, you'd have to be resending ALL soft bounced messages the number of which, assuming you're sending millions of emails a day, is not insignificant.

        It makes the cost of doing business higher for spammers, which ideally cuts down on their profits, making spamming less attractive.

    • by hedronist (233240) * on Tuesday August 24, 2004 @12:38PM (#10057652)
      I think you're trying to describe greylisting [puremagic.com]. Although greylisting is amazingly effective, I don't believe that's what is being discussed here (the site is slashdotted).

      Our experience with greylisting has been (1) an 90%+ reduction in passed-through email (with no complaints from users about lost mail (yet)), (2) a dramatic decrease in server load because SpamAssassin doesn't see the message until after it gets past greylisting, and (3) people rediscover how useful email is once you get all of the crap out of their inbox.

      Marketing Guy: What's the worst that could happen?
      Dilbert: Our beta product could turn into an evil robot that annihilates the galaxy.

    • You just described greylisting. And it works extremely well. It is something all ISPs should be forced to implment immediately.

      And for those that say this is a stop gap and won't be effective for very long, they are wrong.

      The whole idea is to increase the cost to the spammer of sending out millions of emails. By greylisting they have to resend the same message at least twice, possibly multiple times, since they don't know how long the delay is.

      On top of that if you combine greylisting with an RBL
  • by koinu (472851) on Tuesday August 24, 2004 @12:00PM (#10057185)
    I'm a.l-wa-ys wr|?|-ng l|-ke ðißs 2 m.y f-iends

    amidoacetic platymyoid granomerite nonacceptant dorsoposteriad uninclined unshocked zibet intercity lornness

  • by Deep Fried Geekboy (807607) on Tuesday August 24, 2004 @12:05PM (#10057244)
    Thanks to spam, I have been able to remortgage my house online seventeen times to pay for diet pills, pirated software, false identity cards and bogus certificates proving I am a minister of religion.

    Not to mention my enormous, permanently erect p3N1s.

    Just say NO to spam-blocking!
  • by sdxxx (471771) on Tuesday August 24, 2004 @12:05PM (#10057252)
    Well, the site is slashdotted, so I can't read their claims. However, it doesn't seem like there is any benefit to doing spam filtering at the firewall layer.

    For example, Mail Avenger [mailavenger.org] allows you to filter spam based on network characteristics like SYN fingerprints and routes. It even integrates with the kernel firewall to filter out aggressive spammers and mail bombers. However, because it runs as an ordinary user-level process, it also has much more flexibility, for example allowing individual users to set different policies on different email addresses. What can a spam "firewall" do that you can't do with a system like Mail Avenger.

  • by hndrcks (39873) on Tuesday August 24, 2004 @12:06PM (#10057263) Homepage
    Here's a nice How-To [flackshack.com] that covers building an SMTP mail relay with SpamAssassin, Amavisd, DCC, Razor, and Clam AntiVirus all running chrooted on OpenBSD.

    Once the relay determines a message is spam, it rejects and drops the message before it is transferred to the 'real' mail server. End users never even know the message was there...

    We set up two of these about 6 months ago and eradicated most of our spam problems. (some still get through, on the order of 5 - 10 false negatives on a mailserver handling about 3k messages per day.)

  • by broothal (186066) <christian@fabel.dk> on Tuesday August 24, 2004 @12:07PM (#10057271) Homepage Journal
    This didn't make it through my bullshit filter. Oh - sorry, I mean bullshit firewall. It's like this new technology that rejects bullshit from the evil internet, so I never have to read it. Thank god, because if I'd read about this "revolutionary spam firewall" I would be forced to make a childish comment on slashdot and burn some karma.
  • False Positives (Score:3, Insightful)

    by ewn (538392) <ernst-udo.wallenborn@freenet.de> on Tuesday August 24, 2004 @12:15PM (#10057388) Homepage
    "It turned out that the software was even better than us, picking up spam we'd incorrectly classified as legitimate emails."

    They are celebrating false positives?

  • Won't work. (Score:3, Funny)

    by pontifier (601767) on Tuesday August 24, 2004 @12:20PM (#10057443) Homepage
    Any sufficiently advanced spam is indistinguishable from ham.

    Fenley's torment.
  • by gvc (167165) on Tuesday August 24, 2004 @12:28PM (#10057542)
    The only true ... followed by some words with nebulous semantics. Successful trial of a key layer ... [as opposed to an actual demonstration]. 1 misclassification in 25,000 [a.k.a 99.996% accuracy].

    All these phrasings automatically trigger my B.S. filter. Or should I say firewall.

  • Vapor (Score:3, Interesting)

    by gone.fishing (213219) on Tuesday August 24, 2004 @12:28PM (#10057548) Journal
    You smell that vapor? Sounds like bullshit to me.

    Someone has figured out how to build a "spam firewall" that is different from everything out there. Yeah right. No details to tell us exactly how it is different.

    My guess is that they took a software based product using baysien filters and some other common anti-spam filtering technology and packaged it in hardware. Won't really improve the function of the machine but could possibly help with performance (process mail faster).

    I won't believe it is anything else until I actually see it. Unfortunately, I don't think that will happen anytime soon.
  • by Titusdot Groan (468949) on Tuesday August 24, 2004 @01:30PM (#10058367) Journal
    Mail Firewalls are an entire business sector with many companies competing in this space. This space is tracked by Gartner [gartner.com] and Meta Group [metagroup.com]. How in the hell is this revolutionary?

    Hell, there's even a product called the Mail Firewall [borderware.com] that pops up if you google for mail firewall [google.com].

  • Old news (Score:3, Informative)

    by Anonymous Coward on Tuesday August 24, 2004 @01:47PM (#10058562)
    They are not the first on the block.

    Heuristic analysis - detects and blocks spam by various email characteristics

    Black lists - checks if the sending server is in RBL (Realtime Blackhole List), dial-up or open-relay servers

    DNS verification - checks if the sender is using a valid mail server

    Keyword blocking - blocks spam according to keywords in subject and body

    Anti-spoofing - blocks email masquerading as coming from within the organization - a common spam technique

    Cookies/web beacons - blocks email cookies which help spammers identify the recipient as a "live" email

    Header verifier - inspects various header signatures and blocks spam

    Textual analysis - categorizes spam according to textual content like mortgages, pornography, dental care, etc

    Spam signatures - an auto-updating spam database allows detection and blocking of spam according to smart signatures

    Spam URL filtering - blocks email with links to spam sources and sponsors

    Spam image filtering - blocks email containing spam associated images

    Auto-updating database - local or remote spam blocking database based on thousands of Spam collecting bots and web crawlers

    http://www.esafe.com/esafe/anti-spam.asp [esafe.com]eSafe

You can do more with a kind word and a gun than with just a kind word. - Al Capone

Working...