angryrice tips a blog post by John Resig, lead developer for jQuery, about the failure of Google Groups to manage spam, declaring attempts to use it as a public discussion system "completely futile." Quoting:
"The final straw was placed upon my patience with the Google Groups system a few weeks ago. Spammers are now spoofing the email addresses of existing group participants to sneak their messages through. Previously you would've seen a delightful 'FREE MOVIE DOWNLOADS' spam from 'freemovies123@gmail.com' — but now you'll see it coming from existing group users — or even the group moderators themselves. This cheat completely bypasses the moderation system since the spammers are pretending to be pre-moderated users. The Google Groups system is completely fooled. The spam message comes in claiming to be from an existing group participant — and according to the Google Groups interface there is no difference. If you click the user's name you'll be taken to a full listing of that user's posts (with the spam messages delightfully interspersed)."
I used to be an avid newsgroup participant way back in the day. The flamewars were legendary, and the amount of technical information exchanged on some of those groups was beyond description.
If there were a way to use spammers for fuel, I'd have no qualms solving our energy woes that way...
Yahoo chat as well seems to be overtaken by this spamfest. They have tried to address it with captchas, but the spammers simply go ahead and entire the captcha code and keep spamming. They could require credit card verification to make it harder to open massive numbers of accounts, i suppose. Maybe they could have some sort of scanner that would look for sequences that could identify common patterns in spam messages and flag these messages for moderation. Even moderation itself is ripe for abuse with moderators who abuse that power that they have. Perhaps another solution is a voting system on particular messages like that on slashdot, in this case, simply as to whether the message is spam or not, the messages which are voted to be spam are basically collapsed but could be opened with a click, or can be shown with a show "spam marked messages" feature. Could be useful both on chat and also on message boards.
Google's really dropped the ball on spam blocking with Blogger too. I host a couple of random blogs on there, and they've all been hit with a ridiculous amount of spam in the last year. Blogger doesn't even give you something like Akismet...:(
If this is a Usenet group that Google Groups is just providing an interface to, I guess it's time to bring back the cancelbots. UDP against Google. It's come close before.
If this is one of the Google Groups that's a web forum, then they need to require that you actually log in before posting.
Why the hell haven't they put the same spam filters that they use for Gmail on the discussion lists?
Maybe it's because they want to encourage you to use Gmail, which they control and can extract some income from, instead of Usenet, which they have only a passing acquaintance with and can't squeeze a penny out of.
Google Groups serves as a face to Usenet, yes, but it also advertises itself as a place to create new groups [google.com] which are hosted by Google, as an alternative to setting up your own mailing list. I suspect the jQuery folks are using a Google hosted group. The spam situation is indeed ridiculous, and Google could indeed do something about it. They even have "report spam" buttons on all the messages, but so far as I can tell clicking on those buttons has no effect. At the very least it should hide the messages from me that I mark as spam. But no, it doesn't even remember which messages I've marked as spam from login to login. They've just dropped the ball for some reason.
At the very least it should hide the messages from me that I mark as spam. But no, it doesn't even remember which messages I've marked as spam from login to login. They've just dropped the ball for some reason.
The reason, at least to me, seems abundantly clear: Google has the attention span of a three year old. They fixate heavily on something for a while... then their attention drifts and they are off to the next shiny thing. They've got a lot of products, but no clear vision or effective management.
Bingo. They need a moratorium on new products for 3 years while they chain the engineers to big, burly product managers and get all of their offerings on the same page.
Of course, that's (more or less) what happened at Yahoo!, and Google took the opportunity to fly right past them.
Time to move away from the antiquated system of mailing lists. Web based forums are much easier to control and a far, far better way of sharing information with users. I hate coming across an otherwise useful site and then having to go to a mailing list to see what other users are talking about.
> Time to move away from the antiquated system of mailing lists. Web based > forums are much easier to control and a far, far better way of sharing > information with users.
No local control over filtering and sorting, forced to use your weird UI and editor instead of my own? "Forums" suck. And "easier to control" is not a feature.
by Anonymous Coward
on Wednesday October 28, @10:40AM (#29898135)
No local control over filtering and sorting, forced to use your weird UI and editor instead of my own? "Forums" suck. And "easier to control" is not a feature.
Nope. I belong to the AVS (audio-visual science) forum for awhile, and stated matter-of-factly that digital TV has reception problems and the converter boxes from Dish are junk. I was banned.
You can't have free speech in a system where the Sysop is like a dictator - deciding what can or can not be said. Even a benevolent dictator can be bad. Usenet offers a place that is libertarian in nature - people police themselves - and nobody gets censored even if they are whackjob KKK members.
This is an issue that really bugged me. The move to web based forums from Usenet and mailing list was a giant step backwards in functionally.
Advantages of Usenet and mailing lists over web based forums:
The user can control the interface killfiles threading discussion on issues where centralized in one place rather then across multiple web forums better searching better archiving less bandwidth
More advanced web forums, like Slashdot, do a better job of supporting these features, but most people still use very primitive forums.
Killfiles and regex-controlled score files that can both sort and enhance/block messages based on reader-defined criteria. Very very powerful, something the DOS-based SOUP reader I used to use (Yarn) did back in the early 90's, and something which I've not yet seen even roughly approximated in a web-based forum.
Folks who say that USENET is "antiquated" have no idea of its potential, or how experienced users were able to utilize it in practice.
USENET has always been far more than a "mailing list", and I could do things to control/filter/sort messages to my liking with Yarn and slrn that I can't even touch with the web-based forum software I've seen (and I've seen a lot of it).
I really wish web-based forum software would catch up. Even USENET in the early 90's far surpassed it in many respects. Most web forums are nice for posting pictures, but horrible in terms of threading and controlling what actually shows up in your reading list.
Google has some of the weakest around. And whats more is becaue Google uses domain keys it is a desired domain because that stuff gets through the spam filters better.
I wish Google had an automated honey pot system where you could drop a google address, and any google account would instantly get shut off for sending mail to it. The idea is you plant the email address in a place where automated spambots will harvest it and poof! no more spammer.
Of course it could be used for abuse and if passed off as a legit account, so there needs to be some registration and tying of spam honey pot accounts to their owners for accountability.
Google Mail has a feature in Labs whereby they identify social groups within your email contact so that if you exchange a lot of emails between a certain group of people and suddenly add a new recipient it will flag a possible problem. Surely it would be possible to apply a similar methodology to Google Groups only with the IP addresses messages originate from - send from a new IP assignment and the message gets moderated, no matter how many successful posts you've made from elsewhere.
I see a lot of Google's products needing the oh so familiar Beta label again.
Seriously, Google's offering is not without it's serious drawbacks, and I suspect that the good stuff is to be had from actual paid services. However, this kind of letting crap slip where people can spoof the name of a valid member is a serious Alpha quality flaw. What's the point of identifying anyone, if everyone can pretend to be everyone else? I mean that is the actually concept of identity, to uniquely label something as different as other things.
I think Google is trying to take on more than it can handle and it is beginning to really show now that they've removed the excuse of "Beta".
Google Groups was a good idea with a bad implementation. Last time I checked, there was no fast way to report a spammer, you have to click 3 or 4 times and be redirected to different pages before having just one message successfully reported.
I created and admin a Google group for my son's high school team. We have coaches about 120 parents in the group.
Even though it's a pain in the ass, I chose to moderate messages for new members. Still, spam gets through. As the group's admin, it's embarrassing to see graphic messages and know that all the parent's on my kid's team are seeing it. Also, moderation means that some messages may not get through in a timely manner.
I'm looking to migrate the group to an alternative now.
I manage a moderated google group and I have received spam "from the group" from someone who is not a member. This makes me think that they sent it directly to me and just spoofed the headers to make it appear to come from google to get past my local spam filter. I wonder if this is what is really happening?
We were having some problems with this on the wimax hacking google group.
About a month ago I set all posting options to members only (read is still public, the group is listed in the directory, and there is no moderation). I then set it so people need to request an invite to join. The signup page says "Sorry, about the inconvenience, but spam was starting to ramp up, so now users have to request membership manually. Anyone who is human is welcome, and encouraged to join."
There has been zero spam since the change.
It would be nice if there was an option to just let people solve a captcha to join the group, but until then this solution is working fine.
Maybe the answer is to block posts to USENET that come in via Google. That seems to be the source of the trouble.
Looking at the newsgroup "comp.lang.python", all the spam seems to be coming in via "posting.google.com" with GMail return addresses. Bulk-created phony gmail accounts [gmailaccountcreator.com] are such a source of spam that they should be blocked until Google gets their act together. At this point, we have to view GMail like Hotmail, another free email account system made useless by spammers.
At this point, we have to view GMail like Hotmail, another free email account system made useless by spammers.
Hotmail is widely blocked. Next, Gmail?
I have 2 Gmail accounts but access them via POP3. Gmail's spam filters work perfectly. I get zero spam. Although there are hundreds of spam messages in the spam folder none of them get through to me. Why can't they do the same thing to newsgroups?
This is more to do with Yahoo Groups than Google Groups but they seem similar. Recently I've joined several Yahoo Groups about specialized ham radio topics. Nearly all of them keep their archives private. I have apply to join (basically push a button and say who I am) and then wait for approval from the admin. Once approved I can read the archives and also post. Posting from members is usually unmoderated. It's painless enough but still very frustrating when I'm just searching around for information and a quick look at the archives is probably all I want.
I don't mind having to join if I want to post but do they achieve anything by keeping the archives private? Yahoo obscure the email addresses so spammers' 'bots are not going to get much from them. I've asked several admins "why do you keep the archives private?" and have not received a convincing answer. It usually goes something like "I understand your frustration but we have a lot of trouble with spam" and sometimes goes on to imply what a silly question I asked. Well... I still don't see how keeping the archives private helps to reduce spam. I haven't been a group admin so maybe I'm missing something.
I can understand keeping archives private or non-existent for a group on a personal or private subject but that doesn't apply to these groups.
My guess is that this is Yahoo's default setting when a group is created and few admins really think about it. Of course Yahoo want as many people as possible to join.
Back in the day of 2 kbit/s modems, yes it was a pain because it would take a full minute to download a single message, but in today's 1000+ kbit/s world, these messages just ziiiiip right past.
1. Spam is theft of service. 2. Spam is theft of service. 3. The spam in Google Groups absolutely ruins many groups because the boards are inundated with spam to the point that a real message is like a needle in a haystack. The stock discussion boards have gone to hell in the last few months.
1. How can you steal a service that's provided to you for free?
My internet service is not provided to me for free. I pay for it. I reserve the right to accept or reject advertising as I see fit. People who not only force advertising on me, but do it in a deceitful manner, deserve nothing more than forcible, unlubed sodomy during the half time show of the Super Bowl. Spammers are roaches and should be treated as such.
People who not only force advertising on me, but do it in a deceitful manner, deserve nothing more than forcible, unlubed sodomy during the half time show of the Super Bowl.
So if your local library's cork board has individual citizens pinning up advertising deceitfully, will you unleash your gay sexual fantasies on the library staff since you pay for the library with your tax dollars?
You really truly honestly believe the spammers are paying for their own bandwidth? They're riding on bot-nets and open relays costing someone else their bandwidth. Most of the spam I see on the filters at work comes from residential networks.
When you have 10x more spam than relevant material in a topic, it's easy to miss the relevant material.
That, and some spam subjects are just painfully horrible, and nobody should be subjected to the horror of even glancing at them.
Then again, when I saw one suggesting I could own my own Bionic Turtle (I kid you not), spam did rise *a little bit* in my opinion. I still deleted it, but I loved that title.
PGP/GPG is overkill. Just drop messages that fail an SPF check. Spoofing is part of the problem here, and SPF was tailor-made to address spoofing.
If you do use PGP/GPG, you don't need an extra header for the signature; it's usually added as a small attachment, and better mail clients already pick up on that for verification.
But you can set your "from" address in your mail client, and send mail as if it were from your gmail account from your work place, your home ISP's smtp server, etc. In order for that all to work, google would have to allow smtp.yourisp.net to send mail as if it were from google in the SPF records - basically, if it were done, then nothing would have changed 'cause they'd have to allow a metric buttload of ISPs to send.
Changing to web only, or smtpauth, or similar (as we both point out) would do the job tho
It won't help at all in this case. For instance, nothing stops a spammer from signing up for a GMail account that generates such a header, and sending out spam that your spam filter happily allows through.
Thats trivial to solve, just hold any message whose key is younger then a few days or which isn't trusted enough for moderation.
And it would be trivial for a spammer to spoof a legitimate user's signature.
Unless they hack into a users account it will be pretty much impossible to fake a signature.
The only way that'll happen is if people stop buying products advertised that way.
Good luck with that. Sending spam is virtually free and making a free thing unprofitable ain't gonna work.
The only way to solve the spam problem is to add accountability into the system and PGP signatures would be one way to do it.
If a spammer can easily spoof a legitimate user's cryptographic signature on a given block of text I would be very surprised. The only practical way that could happen would be if the user's private key was compromised - if that's the case you just issue a revocation certificate for the compromised key.
Requiring users to sign up using their public key and then requiring all posts to be signed isn't completely ridiculous. It may be a OTT for most groups and possibly beyond the ken of a lot of users, but it could be done. You would just have to parse the all incoming mail to make sure they had a valid signature and that the signature was made using a key that matched a register group member. Although I couldn't comment on how much processing overhead that would create.
For instance, nothing stops a spammer from signing up for a GMail account that generates such a header, and sending out spam that your spam filter happily allows through.
That's why, while authentication is an excellent thing to do, it's only half of a solution. The other half is to have reputations tied to identities. Sign your spam, get known as a spammer, and now people know to ignore your messages just like they ignore unsigned messages.
Slightly less than half (48 percent) said that they have never clicked on a spam e-mail. That's the good news, but that means the other half have clicked on or responded to spam. But why? The answers will undoubtedly horrify you. A full 12 percent said that they were interested in the product or service being offered—those erection drug and mail order bride ads do reach a certain market, it appears.
Seventeen percent said that they made a mistake when they did so—understandable—but another 13 percent said they simply had no idea why they did it; they just did. Another six percent "wanted to see what would happen."
It's that, and also a collection of mailing lists that are not mirrored to Usenet. People interact with those mailing lists using email (the group discussed in the summary is a mailing list that is not mirrored to Usenet...).
The problem is that the trail of money ends at a Western Union or Moneygram branch.
That's not a problem! We can safely assume that said spammer lives in a 10 KM range of said branch office. A small tactical nuke should take care of it. Sure, it'll cause some collateral damage, but we're talking about spammers here.
Your post advocates a
( ) technical ( ) legislative ( ) market-based (x) vigilante
approach to fighting spam. Your idea will not work......aah never mind.
Why don't you just sign your messages and verify based on signature, rather than something completely meaningless like email-address?
And once again: Why the hell does google not sign all messages which pass through gmail as "really did come from this address"?
(x) technical ( ) legislative ( ) market-based ( ) vigilante (x) Requires immediate total cooperation from everybody at once (x) Lack of centrally controlling authority for email (x) Why should we have to trust you and your servers? (I'm using the short-form.)
What I mean to say is, you don't have to have a Gmail account to be a member of a Google Group. Your approach might keep people from spoofing Gmail addresses and be completely painless for Gmail users, but non-Gmail users would have to manually configure their mail clients to digitally sign their messages and some (web-based) e-mail clients might not even support this.
Tragedy of the Commons (Score:5, Interesting)
I used to be an avid newsgroup participant way back in the day. The flamewars were legendary, and the amount of technical information exchanged on some of those groups was beyond description.
If there were a way to use spammers for fuel, I'd have no qualms solving our energy woes that way ...
Re: (Score:3, Interesting)
> I used to be an avid newsgroup participant way back in the day.
I still am. Competent news services such as Newsguy are able to remove enough of the spam to make it tolerable.
Re: (Score:3, Interesting)
Yahoo chats have had similar syndromes (Score:3, Interesting)
Yahoo chat as well seems to be overtaken by this spamfest. They have tried to address it with captchas, but the spammers simply go ahead and entire the captcha code and keep spamming. They could require credit card verification to make it harder to open massive numbers of accounts, i suppose. Maybe they could have some sort of scanner that would look for sequences that could identify common patterns in spam messages and flag these messages for moderation. Even moderation itself is ripe for abuse with moderators who abuse that power that they have. Perhaps another solution is a voting system on particular messages like that on slashdot, in this case, simply as to whether the message is spam or not, the messages which are voted to be spam are basically collapsed but could be opened with a click, or can be shown with a show "spam marked messages" feature. Could be useful both on chat and also on message boards.
and Blogger too (Score:4, Interesting)
Re: (Score:3, Interesting)
Blogs ARE spam 99 times out of 100, its hard to implement spam filtering when the content in and of itself might as well be spam.
Time to bring back the cancelbots? (Score:5, Interesting)
If this is a Usenet group that Google Groups is just providing an interface to, I guess it's time to bring back the cancelbots. UDP against Google. It's come close before.
If this is one of the Google Groups that's a web forum, then they need to require that you actually log in before posting.
Finally, someone important points out the obvious! (Score:5, Insightful)
Re:Finally, someone important points out the obvio (Score:4, Interesting)
Maybe it's because they want to encourage you to use Gmail, which they control and can extract some income from, instead of Usenet, which they have only a passing acquaintance with and can't squeeze a penny out of.
Parent
Re:Finally, someone important points out the obvio (Score:5, Interesting)
Parent
Re:Finally, someone important points out the obvio (Score:5, Insightful)
The reason, at least to me, seems abundantly clear: Google has the attention span of a three year old. They fixate heavily on something for a while... then their attention drifts and they are off to the next shiny thing. They've got a lot of products, but no clear vision or effective management.
Parent
Re: (Score:3, Interesting)
Bingo. They need a moratorium on new products for 3 years while they chain the engineers to big, burly product managers and get all of their offerings on the same page.
Of course, that's (more or less) what happened at Yahoo!, and Google took the opportunity to fly right past them.
Join the 21st Century (Score:4, Insightful)
Re:Join the 21st Century (Score:5, Insightful)
> Time to move away from the antiquated system of mailing lists. Web based
> forums are much easier to control and a far, far better way of sharing
> information with users.
No local control over filtering and sorting, forced to use your weird UI and editor instead of my own? "Forums" suck. And "easier to control" is not a feature.
Parent
Re:Join the 21st Century (Score:5, Funny)
No local control over filtering and sorting, forced to use your weird UI and editor instead of my own? "Forums" suck. And "easier to control" is not a feature.
Uhm - then why are you posting on Slashdot?
Parent
Re: (Score:3, Interesting)
I'm not the OP, but I use Slashdot's web UI because they haven't created an nntp gateway for me yet. :-)
Once that is done, you won't see me using this web-based interface, believe me. I'd be using Yarn here, or maybe slrn with slrnpull.
The content here is decent for the most part (STN ratio is often quite good). It's the interface that sucks.
Re: (Score:3, Interesting)
Nope. I belong to the AVS (audio-visual science) forum for awhile, and stated matter-of-factly that digital TV has reception problems and the converter boxes from Dish are junk. I was banned.
You can't have free speech in a system where the Sysop is like a dictator - deciding what can or can not be said. Even a benevolent dictator can be bad. Usenet offers a place that is libertarian in nature - people police themselves - and nobody gets censored even if they are whackjob KKK members.
Re:Join the 21st Century (Score:5, Insightful)
This is an issue that really bugged me. The move to web based forums from Usenet and mailing list was a giant step backwards in functionally.
Advantages of Usenet and mailing lists over web based forums:
The user can control the interface
killfiles
threading
discussion on issues where centralized in one place rather then across multiple web forums
better searching
better archiving
less bandwidth
More advanced web forums, like Slashdot, do a better job of supporting these features, but most people still use very primitive forums.
Parent
Re:Join the 21st Century (Score:4, Informative)
Killfiles and regex-controlled score files that can both sort and enhance/block messages based on reader-defined criteria. Very very powerful, something the DOS-based SOUP reader I used to use (Yarn) did back in the early 90's, and something which I've not yet seen even roughly approximated in a web-based forum.
Folks who say that USENET is "antiquated" have no idea of its potential, or how experienced users were able to utilize it in practice.
Parent
Re:Join the 21st Century (Score:4, Insightful)
USENET has always been far more than a "mailing list", and I could do things to control/filter/sort messages to my liking with Yarn and slrn that I can't even touch with the web-based forum software I've seen (and I've seen a lot of it).
I really wish web-based forum software would catch up. Even USENET in the early 90's far surpassed it in many respects. Most web forums are nice for posting pictures, but horrible in terms of threading and controlling what actually shows up in your reading list.
Parent
Upgrade the Captchas (Score:3, Insightful)
Google has some of the weakest around. And whats more is becaue Google uses domain keys it is a desired domain because that stuff gets through the spam filters better.
I wish Google had an automated honey pot system where you could drop a google address, and any google account would instantly get shut off for sending mail to it. The idea is you plant the email address in a place where automated spambots will harvest it and poof! no more spammer.
Of course it could be used for abuse and if passed off as a legit account, so there needs to be some registration and tying of spam honey pot accounts to their owners for accountability.
Google already has a solution in Labs (Score:3, Informative)
Google Beta (Score:5, Insightful)
Seriously, Google's offering is not without it's serious drawbacks, and I suspect that the good stuff is to be had from actual paid services. However, this kind of letting crap slip where people can spoof the name of a valid member is a serious Alpha quality flaw. What's the point of identifying anyone, if everyone can pretend to be everyone else? I mean that is the actually concept of identity, to uniquely label something as different as other things.
I think Google is trying to take on more than it can handle and it is beginning to really show now that they've removed the excuse of "Beta".
Report spam (Score:3, Informative)
Ebarassing for group admins (Score:5, Interesting)
I created and admin a Google group for my son's high school team. We have coaches about 120 parents in the group.
Even though it's a pain in the ass, I chose to moderate messages for new members. Still, spam gets through. As the group's admin, it's embarrassing to see graphic messages and know that all the parent's on my kid's team are seeing it. Also, moderation means that some messages may not get through in a timely manner.
I'm looking to migrate the group to an alternative now.
Spammers are spoofing Google Groups (Score:3, Interesting)
my settings (Score:5, Informative)
We were having some problems with this on the wimax hacking google group.
About a month ago I set all posting options to members only (read is still public, the group is listed in the directory, and there is no moderation). I then set it so people need to request an invite to join. The signup page says "Sorry, about the inconvenience, but spam was starting to ramp up, so now users have to request membership manually. Anyone who is human is welcome, and encouraged to join."
There has been zero spam since the change.
It would be nice if there was an option to just let people solve a captcha to join the group, but until then this solution is working fine.
Block posts to Usenet via Google (Score:4, Informative)
Maybe the answer is to block posts to USENET that come in via Google. That seems to be the source of the trouble.
Looking at the newsgroup "comp.lang.python", all the spam seems to be coming in via "posting.google.com" with GMail return addresses. Bulk-created phony gmail accounts [gmailaccountcreator.com] are such a source of spam that they should be blocked until Google gets their act together. At this point, we have to view GMail like Hotmail, another free email account system made useless by spammers.
Hotmail is widely blocked. Next, Gmail?
Re: (Score:3, Interesting)
I have 2 Gmail accounts but access them via POP3. Gmail's spam filters work perfectly. I get zero spam. Although there are hundreds of spam messages in the spam folder none of them get through to me. Why can't they do the same thing to newsgroups?
Is there a reason to keep archives private? (Score:5, Interesting)
This is more to do with Yahoo Groups than Google Groups but they seem similar. Recently I've joined several Yahoo Groups about specialized ham radio topics. Nearly all of them keep their archives private. I have apply to join (basically push a button and say who I am) and then wait for approval from the admin. Once approved I can read the archives and also post. Posting from members is usually unmoderated. It's painless enough but still very frustrating when I'm just searching around for information and a quick look at the archives is probably all I want.
I don't mind having to join if I want to post but do they achieve anything by keeping the archives private? Yahoo obscure the email addresses so spammers' 'bots are not going to get much from them. I've asked several admins "why do you keep the archives private?" and have not received a convincing answer. It usually goes something like "I understand your frustration but we have a lot of trouble with spam" and sometimes goes on to imply what a silly question I asked. Well ... I still don't see how keeping the archives private helps to reduce spam. I haven't been a group admin so maybe I'm missing something.
I can understand keeping archives private or non-existent for a group on a personal or private subject but that doesn't apply to these groups.
My guess is that this is Yahoo's default setting when a group is created and few admins really think about it. Of course Yahoo want as many people as possible to join.
What do you expect? (Score:3, Insightful)
Re: (Score:3, Funny)
And then have to deal with spam from Gmail accounts.
Re:Time to DIY (Score:5, Funny)
Back in the day of 2 kbit/s modems, yes it was a pain because it would take a full minute to download a single message, but in today's 1000+ kbit/s world, these messages just ziiiiip right past.
I use Vodafone UK, you insensitive clod!
Parent
Re: (Score:3, Insightful)
1. Spam is theft of service.
2. Spam is theft of service.
3. The spam in Google Groups absolutely ruins many groups because the boards are inundated with spam to the point that a real message is like a needle in a haystack. The stock discussion boards have gone to hell in the last few months.
Re:Time to DIY (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
1. How can you steal a service that's provided to you for free?
My internet service is not provided to me for free. I pay for it. I reserve the right to accept or reject advertising as I see fit. People who not only force advertising on me, but do it in a deceitful manner, deserve nothing more than forcible, unlubed sodomy during the half time show of the Super Bowl. Spammers are roaches and should be treated as such.
Re:Time to DIY (Score:5, Funny)
People who not only force advertising on me, but do it in a deceitful manner, deserve nothing more than forcible, unlubed sodomy during the half time show of the Super Bowl.
So if your local library's cork board has individual citizens pinning up advertising deceitfully, will you unleash your gay sexual fantasies on the library staff since you pay for the library with your tax dollars?
Parent
Re:Time to DIY (Score:4, Informative)
Ha ha ha ha ha ha ha
You really truly honestly believe the spammers are paying for their own bandwidth? They're riding on bot-nets and open relays costing someone else their bandwidth. Most of the spam I see on the filters at work comes from residential networks.
Parent
Re:Time to DIY (Score:5, Funny)
When you have 10x more spam than relevant material in a topic, it's easy to miss the relevant material.
That, and some spam subjects are just painfully horrible, and nobody should be subjected to the horror of even glancing at them.
Then again, when I saw one suggesting I could own my own Bionic Turtle (I kid you not), spam did rise *a little bit* in my opinion. I still deleted it, but I loved that title.
Parent
Re:Perhaps a new mail header? (Score:4, Insightful)
PGP/GPG is overkill. Just drop messages that fail an SPF check. Spoofing is part of the problem here, and SPF was tailor-made to address spoofing.
If you do use PGP/GPG, you don't need an extra header for the signature; it's usually added as a small attachment, and better mail clients already pick up on that for verification.
Parent
Re: (Score:3, Insightful)
But you can set your "from" address in your mail client, and send mail as if it were from your gmail account from your work place, your home ISP's smtp server, etc. In order for that all to work, google would have to allow smtp.yourisp.net to send mail as if it were from google in the SPF records - basically, if it were done, then nothing would have changed 'cause they'd have to allow a metric buttload of ISPs to send.
Changing to web only, or smtpauth, or similar (as we both point out) would do the job tho
Re: (Score:3, Insightful)
It won't help at all in this case. For instance, nothing stops a spammer from signing up for a GMail account that generates such a header, and sending out spam that your spam filter happily allows through.
Thats trivial to solve, just hold any message whose key is younger then a few days or which isn't trusted enough for moderation.
And it would be trivial for a spammer to spoof a legitimate user's signature.
Unless they hack into a users account it will be pretty much impossible to fake a signature.
The only way that'll happen is if people stop buying products advertised that way.
Good luck with that. Sending spam is virtually free and making a free thing unprofitable ain't gonna work.
The only way to solve the spam problem is to add accountability into the system and PGP signatures would be one way to do it.
Re:Perhaps a new mail header? (Score:5, Interesting)
If a spammer can easily spoof a legitimate user's cryptographic signature on a given block of text I would be very surprised. The only practical way that could happen would be if the user's private key was compromised - if that's the case you just issue a revocation certificate for the compromised key.
Requiring users to sign up using their public key and then requiring all posts to be signed isn't completely ridiculous. It may be a OTT for most groups and possibly beyond the ken of a lot of users, but it could be done. You would just have to parse the all incoming mail to make sure they had a valid signature and that the signature was made using a key that matched a register group member. Although I couldn't comment on how much processing overhead that would create.
Parent
Re: (Score:3, Insightful)
That's why, while authentication is an excellent thing to do, it's only half of a solution. The other half is to have reputations tied to identities. Sign your spam, get known as a spammer, and now people know to ignore your messages just like they ignore unsigned messages.
Re:Perhaps a new mail header? (Score:5, Informative)
An amazingly common misconception. People don't actually buy things advertised by spam. Err, [citation needed]?
Here's mine: http://arstechnica.com/web/news/2009/07/12-of-e-mail-users-try-to-buy-stuff-from-spam-e-mail.ars [arstechnica.com]
Parent
Re: (Score:3, Informative)
It's that, and also a collection of mailing lists that are not mirrored to Usenet. People interact with those mailing lists using email (the group discussed in the summary is a mailing list that is not mirrored to Usenet...).
Re: (Score:3, Insightful)
The problem is that the trail of money ends at a Western Union or Moneygram branch.
Re:Do more about spam (Score:5, Funny)
The problem is that the trail of money ends at a Western Union or Moneygram branch.
That's not a problem! We can safely assume that said spammer lives in a 10 KM range of said branch office. A small tactical nuke should take care of it. Sure, it'll cause some collateral damage, but we're talking about spammers here.
Parent
Re: (Score:3, Insightful)
Re:What's the problem again? (Score:4, Insightful)
Why don't you just sign your messages and verify based on signature, rather than something completely meaningless like email-address?
And once again: Why the hell does google not sign all messages which pass through gmail as "really did come from this address"?
(x) technical ( ) legislative ( ) market-based ( ) vigilante
(x) Requires immediate total cooperation from everybody at once
(x) Lack of centrally controlling authority for email
(x) Why should we have to trust you and your servers? (I'm using the short-form.)
What I mean to say is, you don't have to have a Gmail account to be a member of a Google Group. Your approach might keep people from spoofing Gmail addresses and be completely painless for Gmail users, but non-Gmail users would have to manually configure their mail clients to digitally sign their messages and some (web-based) e-mail clients might not even support this.
Parent