Forgot your password?
typodupeerror
Networking Spam The Internet

Stopping Spam Before It Hits the Mail Server 157

Posted by Soulskill
from the napalm-would-catch-it-even-earlier dept.
Al writes "A team of researchers at the Georgia Institute for Technology say they have developed a way to catch spam before it even arrives on the mail server. Instead of bothering to analyze the contents of a spam message, their software, called SNARE (Spatio-temporal Network-level Automatic Reputation Engine), examines key aspects of individual packets of data to determine whether it might be spam. The team, led by assistant professor Nick Feamster, analyzed 2.5 million emails collected by McAfee in order to determine the key packet characteristics of spam. These include the geodesic proximity of end mail servers and the number of ports open on the sending machine. The approach catches spam 70 percent of the time, with a 0.3 false positive rate. Of course, revealing these characteristics could also allow spammers to fake their packets to avoid filtering."
This discussion has been archived. No new comments can be posted.

Stopping Spam Before It Hits the Mail Server

Comments Filter:
  • by MrCrassic (994046) <deprecated AT ema DOT il> on Wednesday July 29, 2009 @12:35PM (#28868395) Journal

    I'll go first.

    All spammers have to do is change the characteristics of the message. It's always going to be a cat and mouse game, just like antivirus and antispyware, so saying that they've found THE solution to blocking spam from hitting the server is slightly irresponsible.

    • Re: (Score:3, Interesting)

      by ByOhTek (1181381)

      Unless they use a truly novel approach of stopping spam before it hits the server.

      I suggest an AK-47.

    • by jammindice (786569) on Wednesday July 29, 2009 @01:11PM (#28869137) Homepage
      Your post advocates a

      ( X ) technical ( ) legislative ( ) market-based ( ) vigilante

      approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

      ( ) Spammers can easily use it to harvest email addresses
      ( ) Mailing lists and other legitimate email uses would be affected
      ( ) No one will be able to find the guy or collect the money
      ( ) It is defenseless against brute force attacks
      ( X ) It will stop spam for two weeks and then we'll be stuck with it
      ( ) Users of email will not put up with it
      ( ) Microsoft will not put up with it
      ( ) The police will not put up with it
      ( ) Requires too much cooperation from spammers
      ( ) Requires immediate total cooperation from everybody at once
      ( ) Many email users cannot afford to lose business or alienate potential employers
      ( ) Spammers don't care about invalid addresses in their lists
      ( ) Anyone could anonymously destroy anyone else's career or business

      Specifically, your plan fails to account for

      ( ) Laws expressly prohibiting it
      ( ) Lack of centrally controlling authority for email
      ( ) Open relays in foreign countries
      ( ) Ease of searching tiny alphanumeric address space of all email addresses
      ( X ) Asshats
      ( ) Jurisdictional problems
      ( ) Unpopularity of weird new taxes
      ( ) Public reluctance to accept weird new forms of money
      ( ) Huge existing software investment in SMTP
      ( ) Susceptibility of protocols other than SMTP to attack
      ( ) Willingness of users to install OS patches received by email
      ( ) Armies of worm riddled broadband-connected Windows boxes
      ( X ) Eternal arms race involved in all filtering approaches
      ( ) Extreme profitability of spam
      ( ) Joe jobs and/or identity theft
      ( ) Technically illiterate politicians
      ( ) Extreme stupidity on the part of people who do business with spammers
      ( X ) Dishonesty on the part of spammers themselves
      ( ) Bandwidth costs that are unaffected by client filtering
      ( ) Outlook

      and the following philosophical objections may also apply:

      ( X ) Ideas similar to yours are easy to come up with, yet none have ever
      been shown practical
      ( ) Any scheme based on opt-out is unacceptable
      ( ) SMTP headers should not be the subject of legislation
      ( ) Blacklists suck
      ( ) Whitelists suck
      ( ) We should be able to talk about Viagra without being censored
      ( ) Countermeasures should not involve wire fraud or credit card fraud
      ( ) Countermeasures should not involve sabotage of public networks
      ( ) Countermeasures must work if phased in gradually
      ( ) Sending email should be free
      ( ) Why should we have to trust you and your servers?
      ( ) Incompatiblity with open source or open source licenses
      ( ) Feel-good measures do nothing to solve the problem
      ( ) Temporary/one-time email addresses are cumbersome
      ( ) I don't want the government reading my email ( X ) Killing them that way is not slow and painful enough Furthermore, this is what I think about you: ( X ) Sorry dude, but I don't think it would work. ( ) This is a stupid idea, and you're a stupid person for suggesting it. ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
    • You are right, it is a cat and mouse game. The problem is that the solution being employed is looking at the wrong mouse and the wrong cat.

      In this case the mice are the spammers themselves - the people - not the messages. And the cat shouldn't be anti-spam software, at least not in the sense of detect and eliminate software. The cat should be a bounty on the spammers themselves. There are always people who know who the spammers are. Those people are likely just as unscrupulous as the spammers so they can

    • by Alarash (746254)

      You are, of course, correct. The main flaw of such techniques is that you just need to hold the packets. What matters is that you deliver the packets, not the rate at which you deliver them. Instead of sending all the packets of a spam at the same time, the spammer will send the first packet of the first spam, then the first packet of the second, and so on. When they reached the first packet of the 100th spam, they'll send the second packet of the first spam, and so on.

      This technique is used by Layer-7 atta

    • I still don't understand why they don't regulate SMTP servers on the net just like other business areas. These have a real financial impact on other's operating costs. If they required all SMTP servers on the net to be closed and regulated, I think it would be a good start.

      I'm talking fines and the ability to cut off any rogue SMTP servers. They also need a better method to validate connecting servers and it needs to be an industry wide adopted standard, whether that is done via certificate authority or
    • by sqldr (838964)
      nah.. I mean, how can anyone defeat ANYTHING called "Spatio-temporal Network-level Automatic Reputation Engine"? I can barely even say it. When the machines finally take over, the human race will probably be wiped out by a Spatio-temporal Network-level Automatic Reputation Engine. It probably has its own gravity field. ZOMG! The Spatio-temporal Network-level Automatic Reputation Engines are coming!
    • I have a 100% guaranteed way to stop spam from reaching the mail sever.

      Unplug the dam thing!

  • RFC 3514 (Score:4, Funny)

    by Anonymous Coward on Wednesday July 29, 2009 @12:35PM (#28868407)

    Problem already solved back in 2003, I don't get any spam now.

    • Re:RFC 3514 (Score:5, Informative)

      by darpo (5213) on Wednesday July 29, 2009 @12:46PM (#28868639) Homepage
      For those who don't feel inclined to Google for it:

      "The evil bit is a fictional IPv4 packet header field proposed in RFC 3514, a humorous April Fools' Day RFC from 2003 authored by Steve Bellovin. The RFC recommended that the last remaining unused bit in the IPv4 packet header be used to indicate whether a packet had been sent with malicious intent, thus making computer security engineering an easy problem."
  • I don't get it... (Score:1, Interesting)

    by KC7GR (473279)

    Why do we need a crazily complex scheme like this when a simple entry in your router's 'Deny' list (for the source IP of the spam) has the same end effect?

    Given the spew pouring out of the IP space of China, LACNIC, and Russia, blocking in such a manner appears to be near-lossless compression.

    • Re: (Score:3, Insightful)

      by BlueKitties (1541613)
      Many spam messages are propagated by botnets, spoofed IPs, etc, so that isn't a perfect solution. Really, we need to combine different approaches, instead of trying to find a holy-grail.
    • by JoeBuck (7947)
      Spam is almost exclusively produced by botnets. Vulnerable computers exist all over the world, so it shouldn't be surprising that more spam comes from outside your country (wherever you live) than inside. You, personally, have no one in China or Russia that you correspond with, but a debtor nation like the US is in a rather poor position to f*ck with the legitimate mail traffic of its main creditor. The most effective way to kill spam would be to aggressively eliminate botnets, wherever they are. A machi
      • Re: (Score:3, Interesting)

        by Lennie (16154)

        Many have found, if your outside the US, blocking US is much more effective then blocking China and Russia.

        • Not in my experience, for however much or little that's worth.

          I found that the bulk of UCE that hit my mail server came from either China or Korea. After I began blocking all IP addresses from either of those two countries, I found the amount of spam hitting my inbox was almost nil.

          Of course, it was my personal mail server, and I don't have any contacts in either of those countries, so the SNR from China and Korea was essentially zero (no signal, all noise). YMMV, however.
      • A machine determined to be a member of a botnet could be isolated, blocked from sending email any place other than the support address of its ISP. Access could be restored when the machine is disinfected.

        That's what we did at the ISP I used to work at.We ticked off a few customers but not as many as were ticked off at us before we implemented that policy. I was amazed at how vocal our customers could be when AOL started rejecting our e-mails...

    • by Drakin020 (980931)
      Because many spam emails are generated from open relay servers.
    • I hear this suggestion a lot. However, many of us work for global companies that deal with legitimate email from these countries. We can't just reject IP blocks for countries when we have dealings in them. China and Russia are huge for international companies.

    • Good plan, block the countries sending the most spam. Currently, most spam is sent from the USA. I notice that your mail server is in the USA, so unfortunately this means you won't be able to contact anyone adopting this plan, but I don't think it's too high a price to pay for reducing the total amount of spam.
      • > Good plan, block the countries sending the most spam.

        No, just block countries that send a lot of spam and in which you have no correspondents. Obviously this will work well for some and poorly for others. If it won't work well for you don't do it.

  • by pearl298 (1585049) <mikewatersaz@@@gmail...com> on Wednesday July 29, 2009 @12:39PM (#28868483)

    Just like other criminals, spammers must quickly respond to what actually works. In essence this is the flaw in any "security by obscurity" scheme, the bad guys simply respond to whatever works. If you get to try several billion times a day then you can try a whole lot of combinations.

  • by Dynedain (141758) <slashdot2&anthonymclin,com> on Wednesday July 29, 2009 @12:40PM (#28868503) Homepage

    That means that in my office of 50 people, with an average of 50 emails per day (a very very low estimate), we'd get 7-8 false positives daily. I'd hear bloody murder if that was the case.

    We get a lot more mail than that per day, and our spamassassin without autolearning (simply flag anything higher than 5.0) does a hell of a lot better job than that... down in the range of 1-2 false positives a month. Assuming a low daily average of emails (like my example), that's .002% false positives.

    • by Sockatume (732728)

      And of course, if you want to actually spot the false positives, you have to let all the spam hit the mail server anyway. Unless you're willing to just ignore all the spam packets and put up with all those false positives being lost to the ether, this won't reduce your mail processing load at all.

    • It is somewhat ambiguous, but I had read it 0.3%, not 3%, which implies that you'd lose 0-1 emails/day if you were averaging 50 total a day. Still higher that way than your current method, but nowhere near as bad as 7-8 daily.
      • by Sockatume (732728)

        50 a day * 50 people = 2500 messages, 2500 messages * 0.3% = 7.5 emails.

        • Ah, right. For some reason, I was reading 50 emails a day total. I seem to have taken my stupid pills today.
        • But do those 2500 messages include spam or are they just the mails that get through the existing spam filters?

          Otherwise my understanding of the 0.3% false positive is where 100% = the total number of emails.

          Which is rather unacceptable given the handling of false positives, and the total number of emails could be very high when you include spam.
          • by Tony Hoyle (11698)

            If you assume that 90% of all email is spam, and 2500 is the legit number, that's 250000 emails hitting the mailserver and being rejected.. a .3% false positive means 750 emails a day being dropped.

            IMO that's pretty useless.

      • by scorp1us (235526)
        Right, you read it wrong, like you were supposed to. 70% = 0.7, 30%= 0.3. Ergo, if it isn't catching spam correctly, its marking the rest as spam, that way you catch all the spam! I wonder at what point in time it'd be better to reject everything and just deal with escalated messages (to phone calls, txts, tweets, etc). Then you can ignore email all together.
        • Re: (Score:3, Informative)

          by Ioldanach (88584)
          From the article, "The end result was a system capable of detecting spam 70 percent of the time, with a 0.3 percent false positive rate." The summary dropped an instance of the word "percent". I wasn't sure how to read it either so I specifically looked for the source of the 0.3 in the original.
          • by scorp1us (235526)
            I was hoping to be modded funny. Ir insightful. hard to tell the difference these days...
        • by ancientt (569920) *

          what point in time it'd be better to reject everything and just deal with escalated messages

          This is in fact, the real solution. Email was not designed for the world we live in and cannot be truly fixed. The convenience and ubiquity of email, however, makes it very difficult to give up. IM, social networking and SMS are taking over the role that email used to reign alone. There will be a natural progression toward obsolescence as email is replaced.* When the consumer does not need email, that will be the tipping point. At that point some of the solutions that cannot hope to be implemented now can b

      • by Ioldanach (88584)
        50 * 50 * .3% = 2500 * .003 = 7.5, so yes 7-8 emails per day. 3% would be 75 false positives per day. Incidentally, the 70% success rate if every person got one spam for every good email means the company would still receive 750 spams per day, or 15 per person per day.
    • I wonder if you could make this technology a plug-in to SA to simply bump up the spam score by, say, a point and continue with your SA filtering anything higher than 5.0?
  • The original is "The end result was a system capable of detecting spam 70 percent of the time, with a 0.3 percent false positive rate."

    • by godrik (1287354)
      Oh yeah. I was thinking a rate of 0.3 was huge. 0.3 percent is much better but still not acceptable.
      • by Tony Hoyle (11698)

        0.3% FP on the total mail input, but 90% is spam anyway.. so that means 3% of legit mail is dropped.

        3$ is way too high.

      • by ajs (35943)

        Not even remotely. At best this system could only be used as input to a secondary system that then uses this information along with other sources. See, e.g., SpamAssassin's scoring approach.

  • by johndiii (229824) * on Wednesday July 29, 2009 @12:43PM (#28868577) Journal

    0.3 would be terrible - three out of ten false positives. 0.3 percent - what the article actually says - is not too bad. But current techniques allow me to check the spam bin for such messages. This technique would pretty much preclude that capability, since the mail would never arrive at the server. I'm not sure that a rate of 0.003 would be acceptable under those circumstances.

    • by santax (1541065)
      Help me here... Personally I would think that if 10 is 100% 0.3 is less than 1 mail. And not 3 out of 10. Personally I'd rather deal with spam than mis out one 1 legitimate mail. My own personal anti-spam filter is quite rough but I don't mis that many mails. And when my mail filters blocks spam, it sends out a message with redirections to an alternative gsm-number telling them to call me so I can whitelist the adres. I had about 4 times people calling me. Not one of those was a spamwhore :) So the granted
      • by amorsen (7485)

        Personally I would think that if 10 is 100%

        10 isn't 100%. 1 is 100%. That's how % is defined.

        • Personally I would think that if 10 is 100%

          10 isn't 100%. 1 is 100%. That's how % is defined.

          Trying to follow all of the numbers without any context is making my head hurt.

          Neither TFS, GPP nor you were very clear on the key aspect of percentages: they are a ratio. You said, " 10 isn't 100%" but that's not necessarily true. Ten out of how many? 10 out of 10 is 100%. However, expressed as a ratio, 10/10 = 1, which is what you said is how 100% is defined (100 per cent, i.e., 100 per 100, or 100/100 = 1 = 100%). Since no one specified ten out of how many total, 10 could be 1%, 100%,

      • Re: (Score:3, Interesting)

        by raju1kabir (251972)

        Help me here... Personally I would think that if 10 is 100% 0.3 is less than 1 mail. And not 3 out of 10.

        .3 is 300 out of 1000.

        .3% is 3 out of 1000.

        It's similar to the confusion created when idiots write "It only costs me .25 cents to make a phone call" when they really mean ".25" or "25 cents".

      • by vux984 (928602) on Wednesday July 29, 2009 @01:18PM (#28869287)

        And when my mail filters blocks spam, it sends out a message with redirections to an alternative gsm-number telling them to call me so I can whitelist the adres.

        That's called back scatter and its as bad as spam.

        Think about it, my mail servers block about 35,000 spam per day. If they sent a message to each failed recipient with alternative instructions, that would be 35,000 messages I sent out. Some 34,990 of those messages would either be undeliverable or would get delivered to people who had nothing to do with the original message. You are effectively clogging up a bunch of innocent peoples mail systems with your messages.

        Put it another way, suppose some spammer sends 1,000,000 messages with your email address spoofed as the sender. If everyone else did what you do, you would then receive 1,000,000 messages back to your inbox giving you alternate instructions to contact these people.

        You wouldn't want that. Nobody else does either. So please stop.

        • Mod parent up!

          Back scatter spam has been a known issue for a long time now. There's no more excuse for anyone still operating a mail server this way than there is for anyone still knowingly operating an open relay (since for all intents and purposes, that's what this is).
      • by u38cg (607297)
        Thanks. Half the spam I receive is backscatter of various sorts.
    • 0.3 percent false positive

      They predicted something around 97 billion e-mails per day sent in 2007. I wouldn't want to guess what it's at today, but it's probably higher. Regardless, 0.3% of the emails equates to about 291 million legitimate emails per day black holing. No errors. No "marked return to sender". It just vanishes, eaten by the shub internet. Oops. And we can be pretty sure those numbers are higher -- this is a back of the envelope analysis.

      • by amorsen (7485)

        No errors. No "marked return to sender".

        If the box just dumps the packets on the floor, the sender will eventually get an error message from their mail server. Of course the mail server will have tried uselessly quite a lot of times (for days, usually) before giving up.

  • by amorsen (7485) <benny+slashdot@amorsen.dk> on Wednesday July 29, 2009 @12:47PM (#28868685)

    IP addresses, he notes, are easy to fake.

    Sure, you can fake your IP address so you get past this filtering, because it just looks at the first packet. It won't help you though, because you can't complete a TCP 3-way handshake from a fake address, and without doing that you can't actually send spam.

    • You can't complete a TCP 3-way handshake from a fake address...

      Oh ye of little faith....

      • Re: (Score:3, Insightful)

        by Anonymous Coward
        oh ye of little knowledge.
        • by Minwee (522556) <dcr@neverwhen.org> on Wednesday July 29, 2009 @01:12PM (#28869161) Homepage

          It's easy, really. All you need to do is use a fake address which happens to be exactly the same as your real address.

          It's as simple as closing a user's browser window without using Javascript [thedailywtf.com].

        • Re: (Score:3, Interesting)

          oh ye of little knowledge.

          If I compromise any layer 2 device on any network between you and the destination, not only can I fake the address, I can have it doing 480 spins in a pink tutu. Have you read any of the reports from the major network access points around the world? Bogus packets pass through them all the time. They even have a name for them -- martian packets.

        • Research before slamming others, please.

          It is possible to spoof an IP address and fake a TCP three-way handshake from a fake address. The trick is that any modern OS randomizes TCP sequence numbers to make it difficult to "complete" the three-way handshake without actually receiving part 2 of the three-way handshake. However, if you have the analytical tools to guess the correct sequence number to send back in part 3 of the three-way handshake, you're golden.

          It's not exactly trivial, but g
    • by ajs (35943)

      IP addresses, he notes, are easy to fake.

      Sure, you can fake your IP address so you get past this filtering, because it just looks at the first packet. It won't help you though, because you can't complete a TCP 3-way handshake from a fake address, and without doing that you can't actually send spam.

      Not true. When we say "fake", we don't always mean "not your valid IP address right now." For example, you might send your spam from a van that drives slowly through a large city, taking advantage of any open corporate wireless networks it finds on the way. That's one way. Another is to simply bribe your way in to a different ISP or corporate network every night (this has been done). You drive your van up to the back door at 3AM, pay the NOC guy on duty $1000 to hand you a live RJ45 jack and you pump out a

      • by amorsen (7485)

        I really think "breaking into other people's networks" shouldn't be called "faking your IP address". They are very different concepts.

  • Isn't this just pushing the processing back a level, but still arriving at its destination? I guess you could implement bandwidth-provider-level (i.e. before the customer even gets their packets) spam filtering this way, but I'm sure most organizations would prefer to retain control by doing their own filtering.
  • by CopaceticOpus (965603) on Wednesday July 29, 2009 @12:48PM (#28868711)

    So this software functions in both space AND time? Fascinating.

    It's good that they specified that in the name, to avoid questions such as "Will this software work in the universe which we inhabit?"

  • a baseball glove.

    But I'd first have to question why somebody is throwing spam at my mail server in the first place?
  • I've got a device in front the mail server, many people do. These and others work fine. Sorry for folks that don't have one. As long as it is free, it will be abused. Someone already said it was cat and mouse.
  • It sounds like this approach would be fairly CPU intensive; analyzing the characteristics of packets, comparing them to other packets, looking for information on their originating systems, etc... It seems like they are throwing a non-trivial amount of computational time at the problem in order to spare the storage space that would be otherwise taken up by spam.

    And of course as others have already pointed out, this just starts another round of whac-a-mole by pursuing this avenue.
    • I was thinking the same thing, only along a slightly different line:

      These include...the number of ports open on the sending machine.

      WTF? Does the filter nmap the sending mail server before accepting the message?!?!

  • Regardless of how complex you make it, someone will always eventually figure out a way around it.
  • Wrong approach (Score:5, Insightful)

    by Animats (122034) on Wednesday July 29, 2009 @01:02PM (#28868993) Homepage

    The fundamental property of spam is that it involves many similar messages going to a large number of destinations. That's what to look for. Google can do that, because they manage a very large number of mailboxes with a single system. SpamCop used to do that, but they had to be in the mail-forwarding business to do it and that was too expensive.

    Trying to detect spam by looking only at the mail for a single account is inherently a form of guessing. The existing technologies are reasonably good, but not good enough that the spammers give up.

    • by cpghost (719344)

      The fundamental property of spam is that it involves many similar messages going to a large number of destinations.

      It won't be long until the zombies create individual spams for each recipient. Just scramble the catch words, add some random stuff to the gifs so they message-digest differently etc..., and there's not enough similarity in the messages anymore to be statistically detectable. If at all, traffic analysis would help, but here too, botnets are extremely flexible and could spread batch runs in I

      • by ajs (35943)

        It won't be long until the zombies create individual spams for each recipient. Just scramble the catch words, add some random stuff to the gifs so they message-digest differently etc.

        Back when I was in the spam hunting business, we called that 2002. Since then, techniques have become radically more sophisticated.

    • by jonbryce (703250)

      Messagelabs are in the mail-forwarding business, and they seem to manage to make money out of it.

  • by crymeph0 (682581) on Wednesday July 29, 2009 @01:10PM (#28869125)

    Your post advocates a

    (x) technical ( ) legislative ( ) market-based ( ) vigilante

    approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

    ( ) Spammers can easily use it to harvest email addresses
    ( ) Mailing lists and other legitimate email uses would be affected
    ( ) No one will be able to find the guy or collect the money
    ( ) It is defenseless against brute force attacks
    (x) It will stop spam for two weeks and then we'll be stuck with it
    (x) Users of email will not put up with it
    ( ) Microsoft will not put up with it
    ( ) The police will not put up with it
    ( ) Requires too much cooperation from spammers
    ( ) Requires immediate total cooperation from everybody at once
    (x) Many email users cannot afford to lose business or alienate potential employers
    ( ) Spammers don't care about invalid addresses in their lists
    ( ) Anyone could anonymously destroy anyone else's career or business

    Specifically, your plan fails to account for

    ( ) Laws expressly prohibiting it
    ( ) Lack of centrally controlling authority for email
    ( ) Open relays in foreign countries
    ( ) Ease of searching tiny alphanumeric address space of all email addresses
    ( ) Asshats
    ( ) Jurisdictional problems
    ( ) Unpopularity of weird new taxes
    ( ) Public reluctance to accept weird new forms of money
    ( ) Huge existing software investment in SMTP
    ( ) Susceptibility of protocols other than SMTP to attack
    ( ) Willingness of users to install OS patches received by email
    (x) Armies of worm riddled broadband-connected Windows boxes
    (x) Eternal arms race involved in all filtering approaches
    ( ) Extreme profitability of spam
    ( ) Joe jobs and/or identity theft
    ( ) Technically illiterate politicians
    ( ) Extreme stupidity on the part of people who do business with spammers
    ( ) Dishonesty on the part of spammers themselves
    ( ) Bandwidth costs that are unaffected by client filtering
    ( ) Outlook

    and the following philosophical objections may also apply:

    ( ) Ideas similar to yours are easy to come up with, yet none have ever
    been shown practical
    ( ) Any scheme based on opt-out is unacceptable
    ( ) SMTP headers should not be the subject of legislation
    ( ) Blacklists suck
    ( ) Whitelists suck
    (x) We should be able to talk about Viagra without being censored
    ( ) Countermeasures should not involve wire fraud or credit card fraud
    ( ) Countermeasures should not involve sabotage of public networks
    ( ) Countermeasures must work if phased in gradually
    ( ) Sending email should be free
    (x) Why should we have to trust you and your servers?
    ( ) Incompatiblity with open source or open source licenses
    ( ) Feel-good measures do nothing to solve the problem
    ( ) Temporary/one-time email addresses are cumbersome
    ( ) I don't want the government reading my email
    ( ) Killing them that way is not slow and painful enough

    Furthermore, this is what I think about you:

    (x) Sorry dude, but I don't think it would work.
    ( ) This is a stupid idea, and you're a stupid person for suggesting it.
    ( ) Nice try, assh0le! I'm going to find out where you live and burn your
    house down!

    • by dkleinsc (563838)

      I think you missed a few:
      (X) Bandwidth costs that are unaffected by client filtering

      (X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical.

  • First: I do not want others to decide what's spam for me.
    Second: I got graylisting, amavisd with spamd & co, and more. Why exactly would I put such a system on every other node of the net too? To throw away resources?

  • What exactly does this mean? A rate is usually a comparison of two values. What two values were compared to get 0.3?
    • Well, 0.3 usually translates to 30%, so that is how I read it. I see McAfee is involved somehow, so that is likely an improvement for them.

  • It's become a source of unending comedy as spammers who aren't very good at English in the first place use a dictionary and thesaurus to get past the filtering software resulting in extremely entertaining subject lines. For example-

    YOU REMEMBER WHEN SEX WAS THE LAST TIME? REFRESH THE MEMORY OF VIA GRA!

    No more hair Rogaining medicine.

    GIRLS DO ANYTHING FOR A BIG HOSE

    It boosts your rod!

    Make two days nailing marathon

    for your delicate advantage

    And all that is just from the most recent page in my spa

  • by cenc (1310167) on Wednesday July 29, 2009 @04:33PM (#28872919) Homepage

    Why does it seem everyone ignores the real source of the majority of spam: Microsoft windows computers infected by viruses running botnets that send spam. Yes, is generated by other systems, but not nearly the amount that is being generated by MS based botnets.

    How about everyone just send their frigen spam bill to MS. How about a class action for everyone to collect for the damage that MS does to networks around the World. Better yet lets just forward all the spam we get to MS. Let them sort it out.

  • Although it is not 100% effective, having a spam filter in front of the email server is the best solution IMHO. Solutions like this let traffic hit the mail server before stopping it as spam. Other than it being annoying to users, the big issue with spam is lots of small connections slowing down the system. Letting a EHLO for each of the spam hits despite filtering it away before completion is not helpful. But then, it might depend on if your an end user that hates getting spam or an admin that hates wh

Those who do things in a noble spirit of self-sacrifice are to be avoided at all costs. -- N. Alexander.

Working...