IBM Unveils Anti-Spam Services to Stop Spammers 443
bblazer writes "CNN Money is running a story about a new IBM service that spams the spammers. The idea behind the technology is that when a spam email is received, it is immediately sent back to the originating computer - not an email account. From the article, ""We're doing it to shut this guy down," Stuart McIrvine, IBM's director of corporate security strategy, told the paper. "Every time he tries to send, he gets slammed again."""
Woah! (Score:2, Funny)
What will they think of next?
Now the teeth come out. (Score:2, Interesting)
spamd (Score:3, Insightful)
agreed (Score:3, Interesting)
Isn't that sort of like cutting off your legs to run faster?
Re:agreed (Score:5, Insightful)
Or so I've heard, anyhow.
Re:agreed (Score:5, Interesting)
I went through chemo and radiation last year. The idea of chemo is that it kills cancerous cells, but it's completely untargetted, so you end up poisoning the whole body.
Without the chemo, I'd likely be dead now. I traded a few months of extreme weakness in exchange for near perfect health now.
Lies in the CNN story title. (Score:5, Informative)
I think not. This is from CNN after all. They publicly admit they lie often. This is true here.
http://www.alphaworks.ibm.com/tech/fairuce/faq
Take note to what this system actually does. Not what the (lying) press tells you.
1. Isn't this just another challenge/response system?
No. Challenge/response (C/R) systems challenge everybody; FairUCE sends a challenge only when the mail appears to be spoofed.
2. Other anti-spam technologies work well. Why should I switch?
FairUCE eliminates any need for a "probable spam" folder, as well as the necessity of keeping up with the latest version of antispam software.
3. Will it run on Windows®, or with QMail, or with Sendmail, etc.?
No, the current release does not.
4. Is it fast?
No real performance testing has been done, but speed is expected. The code basically consists of a few if/then statements and some DNS look-ups (which are cached in memory as well as on the DNS server). The mail server will probably bog down before FairUCE does.
5. Don't all those challenges take up unnecessary bandwidth?
A little bit, but it takes the server much less time to send out a small challenge than it does for the user to look at it in the spam folder, no matter how fast he presses the delete key. Legitimate senders know immediately that a user hasn't received their email, and they can click a button to have it delivered. Meanwhile, the emails sit in the queue for only an hour if they can't be delivered.
Re:Lies in the CNN story title. (Score:5, Insightful)
The problem with this scheme is the "click a button" aspect. This would require HTML mail.
The spam problem would be 80% solved if HTML mail were not used at all.
1. Spammers wouldn't be able to track mail opening with tagged image links.
2. Spammers wouldn't be able to propagate their custom programmed spamming trojans and viruses nearly as effectively.
3. HTML mail is not needed. When was the last time you got email with a remote loaded picture in it (not attached) that actually interested you? Almost never in my case.
Hey! I got it, the FUSSP! Just ban HTML mail!
Re:To save bandwidth, how about being pro-active? (Score:3, Informative)
Re:spamd (Score:3, Insightful)
Re:spamd (Score:4, Funny)
Oh, wait. (Score:5, Informative)
Yet another challenge response system (Score:5, Informative)
In other words, it's as utterly useless and counterproductive as any other challenge-response system. See http://www.xciv.org/~meta/2005/02/15/ [xciv.org] for more discussion (from me) of why CR won't work.
Re:Yet another challenge response system (Score:3, Informative)
Read why this is different. [ibm.com]
With all the spam zombies, how will this help? (Score:4, Insightful)
Or do they plan to DDoS the spam-zombies?
Re:With all the spam zombies, how will this help? (Score:5, Informative)
As someone else pointed out, this could be used to DDOS someone by using a zombie net sending spam purporting to come from them. They'd then get innundated with challenge/reponse emails. Not nice.
That will get the user of FairUCE blacklisted (Score:3, Informative)
That will get the user of FairUCE blacklisted. It's called backscatter. The email address provided in the SMTP transaction, or the message headers, should ABSOLUTELY NOT be considered valid unless, and until, the IP is verified as designated by the domain of the RHS of that email address. And then even that won't work very well if spammers start forging addresses within the same domain as the zombied machine. Don't forget that spammers do have a list of lots of email addresses within all the major domai
Re:With all the spam zombies, how will this help? (Score:3, Funny)
Wow, kdjfuusidow@lerlkdfudfo.org is gonna be mighty upset when they see all their spam coming back at them.
It will also challenge all legit mail from my site (Score:4, Informative)
Great:
My site administers its own mail. But direct SMTP outbound mail uses a DSL line whose reverse translation points to our DSL provider, while outbound mail through the local mail servers goes through a mailserver site at a different ISP whose reverse translation will also point to them rather than us.
So all our outgoing mail will receive the challenge. Mail is handled by polling, so every outgoing letter to a site using their tool will now require two extra email transactions, two extra wait-for-poll delays, plus an extra wait-for-sender-to-read-email delay. (No more "fire and forget - now email accounts have to be checked several times a day.)
"Click a button"? On a mail reader without HTML or with it disabled? More like "copy and edit, and hope you don't screw it up".
Yuck!
This absolutely sucks!!! (Score:3, Insightful)
While my mail server doesn't see
Re:With all the spam zombies, how will this help? (Score:3, Insightful)
If this description of how IBM built their system is accurate, they'll DOS themselves.
My bet is one week, or until the first spammer gets ticked off by their zombies being slowed down, whichever comes first.
AOL and MSN (Score:4, Insightful)
What about the zombie PCs (Score:4, Interesting)
Re:What about the zombie PCs (Score:5, Insightful)
Re:What about the zombie PCs (Score:3, Insightful)
If your car stopped running because of some complicated issue in the engine, you don't have to understand the problem or the solution to take it to a mechanic.
Re:What about the zombie PCs (Score:4, Funny)
jokes writing themselves... (Score:5, Funny)
Anti-Spam services that STOP spam?!? You don't say? Now there's a novel idea...
This joke was brought to you by the Department of Redundancy Department.
Hmmm (Score:2)
I will be interested to see if this significantly limits the amount of spam at all.
Any idea what this actually means? (Score:3, Interesting)
Re:Any idea what this actually means? (Score:2)
It means this recognizes the spam and initiates the counter attack from the mail server, not the client.
Re:Any idea what this actually means? (Score:4, Interesting)
Re:Any idea what this actually means? (Score:2)
Re:Any idea what this actually means? (Score:2, Informative)
Re:Any idea what this actually means? (Score:3, Informative)
If you have somebody opening a TCP connection to your mail server, you already *know* what IP address is on the other end. And, as IBM has realized, that's *all* you know, so that's the place to start applying pressure.
Re:Any idea what this actually means? (Score:3, Informative)
try reading the SMTP RFC's sometime,
the *only* part one can trust is the IP of the machine sending the message
I'm rubber, you're glue... (Score:4, Funny)
Re:I'm rubber, you're glue... (Score:3, Insightful)
No more calls, we have a winner.
Why not just offer a service that acknowledges to spammers that they have reached a viable recipient? This is better than the old "Click here if you want to get off this mailing list".
For every 3 spam messages, I get a user saying they aren't getting their legitimate mail because the spam filter is blocking it.
The British had the right idea. Find the spam
Great... (Score:3, Interesting)
Re:Great... (Score:3, Funny)
Yes, but it's already a waste of bandwidth to let spammers spew trillions of emails at our /dev/nulls.
Not to mention what are we supposed to do when our /dev/nulls fill up.
Not a good idea. (Score:2, Informative)
Rather than adding yet more traffic to the net I think it'd be far better if more places ran OpenBSD's spamd [openbsd.org] package. It tarpit's mail connections from spammer machines thus consuming the remote machine's resources rather than generating more traffic in a misguided game of "fight fire with fire".
Re:Not a good idea. (Score:2)
Re:Not a good idea. (Score:4, Insightful)
Can RSS Solve The Spam Problem? (Score:3, Interesting)
Interesting that the figure has dropped so significantly in a year's time. The mere fact that email has been so thoroughly polluted as a medium by spamvertisers prompts me to think that RSS could be a way to circumvent email and its problems entirely. Imagine if people had pass-protected RSS feeds for all their contacts, as well as group feeds and a public feed. Then, when it's time to email someone, you just insert a new entry in that person's feed. A mechanism that checks feeds 10 times an hour should be sufficient. In terms of end-user interface, it would be identical to email in every significant way. Just seems to me that there's no room for spammers in a system like that, since in order to be "spammed" you'd have to subscribe specifically to a spammers feed.
There would be a lot of traffic overhead with a system like that, but it couldn't possibly be worse than the 75% spam overhead of email.
Re:Can RSS Solve The Spam Problem? (Score:5, Interesting)
http://cr.yp.to/im2000.html [cr.yp.to]
The basic idea is to reverse the concept of how mail is handled today. If you want to send an email, you store it on your site until someone comes and picks it up from you. It is never delivered, all mail must be picked up. Instead of pulling your mail from a single Inbox, you pull your incoming mail from hundreds of repositories, depending on who is mailing you.
One advantage is that if someone wants to send out a million emails, it is up to THEM to store it, not you. Blacklisting becomes easier, as does whitelisting, etc.
And for you whiners who love bitching about how Dan Bernstein is behind it so it MUST be bad, please don't bother. That horse has been beaten to death hundreds of times before.
FairUCE (Score:5, Informative)
Doesn't sound very effective (Score:3, Insightful)
Yes, but what about the network traffic? (Score:2, Interesting)
Doesn' this just... (Score:2, Interesting)
Nevermind the fact that most spammers don't use a real e-mail address (shocker) -- but my IT department doesn't have funds to waste attacking spammers.
Useless article AND dupe (Score:5, Informative)
However, the CNN story referenced seems to be utterly clueless as to how this technology, known as FairUCE, actually works. It really is nothing like they have described it. For real information go to IBM's page: http://www.alphaworks.ibm.com/tech/fairuce
This system does not try to DDOS the spammers, or anything stupid like that. It attempts to link the IP address of the sender to the senders domain name using DNS and WHOIS lookups. If that fails, it sends a challenge/response email to the sender.
The net result is quite similar (Score:4, Interesting)
Re:The net result is quite similar (Score:3, Insightful)
but it will almost always bring the spammer down as a (nice) side-effect.
No, it will bring whoever is in the From: address down. It's extremely rare that that is an address that the spammer has anything to do with.
Re:The net result is quite similar (Score:4, Insightful)
when a spam email is received, it is immediately sent back to the originating computer - not an email account
Unless you know of a way to mass spoof TCP handshaking, that is...
Why challenge/response won't work either. (Score:3, Insightful)
a) spammers give a rat's ass about receiving e-mail, and thus actually *have* incoming mail servers, and
b) that spammers aren't spamming through botnets.
Since both these assumptions are false, this suddenly becomes a spectacularly stupid idea.
e-mails coming from a computer on the spam list (Score:5, Insightful)
Re:e-mails coming from a computer on the spam list (Score:3, Informative)
It says the mails will be returned immediately. The effect of innocent users should be minimal and short term, Once there's no more mail going out, the problem will clear up.
Why don't we dump the email architecture? (Score:2)
postmaster? (Score:2)
Half of a spammer's bandwidth is still a lot (Score:2)
And that's just until they figure out how to set up a packet filtering rule.
Not a big improvement.
More me too bullshit (Score:3, Interesting)
1. Not use SMTP, sounds like a shocker but like the doctor says "if it hurts don't do it".
2. honeypots can be used to waste spammers time
3. Absolutely don't reply to spam in any form
But the real problem is SMTP is not a reliable or robust protocol for the problem it tries to solve. The fact that people keep pushing it shows they're lazy.
But you don't have to abandon SMTP completely. Something as simple as hashcash could essentially eliminate spam.
Just nobody wants to actually implement it [re: think about a mozilla/thunderbird plugin that uses X-HEADERS to put/read hashcashes].
Tom
Re:More me too bullshit (Score:4, Insightful)
Actually, you don't have to abandon SMTP at all. The protocol has already undergone a fairly major revision with the change to ESMTP and there are very few servers left that are still SMTP only. Technically, it wouldn't be very hard to bolt a much more robust mail transfer mechanism onto SMTP in the same manner we use to deliniate SMTP and ESMTP - the mail server banner and client "HELO/EHLO". For instance you could change the ESMTP banner to include the string "ESMTP v2" instead of just "ESMTP" and compliant servers could sign on with "ALLO", while older clients can still resort to "EHLO" or even "HELO" while the deployment is underway.
Simple, huh? Unfortunately not, because politically, it would probably be a complete nightmare to actually do anything like this. The whole idea would almost certainly break apart under the weight of competing agendas from the various parties involved. I think the whole MARID fiasco [circleid.com] proved that beyond any doubt.
Heres what happens in order (Score:5, Insightful)
2) starts sending out spam to say IBM
3) IBM sends back spam to the zombie
4) IBM gets put on every RBL list because it actually is sending spam, think about it
5) comcast and every major company using that RBL and every user in comcast can no longer get mail from IBM
6) IBM yells and screams to RBL list owner that they really arent sending spam, just well sending back email to people who didn't ask for it, or didn't want it or didn't sign up for it. OK they are sending spam... just not bad spam.
Only positive I see is maybe ISPs like comcast might wake the hell up and start cleaning up the problems and stop ignoring their users.
Re:Heres what happens in order (Score:3, Funny)
How does it hurt spammers? (Score:3, Insightful)
useless tactic (Score:3, Insightful)
Yeah, that will be impossible to avoid... (Score:3, Informative)
ipchains -A input -s $MYNETWORKS -j ACCEPT
ipchains -A input -p tcp -dport 25 -j DENY
I mean, I suppose in theory IBM could DOS my ipchains, but this is rate-limited by what I'm capable of sending out, which is significantly less than ipchains could handle.
Smurf (Score:4, Interesting)
nope (Score:5, Funny)
(x) technical ( ) legislative ( ) market-based (x) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
(x) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
(x) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
(x) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
(x) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
(x) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(x) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
The ONLY thing that will stop Spam (Score:4, Insightful)
If there was no Spam senders there would be no problem with Spam. Right? The problem is that we keep going after the carrier, not the beneficiary.
Fine the people for whom and on whose behalf the Spam is sent. Make it for one dollar per spam message received. Instead of sending for free, the messages end up costing more than the Post Office.
That article is completely wrong (Score:3, Interesting)
Sounds like an early version of SpamCop (Score:3, Insightful)
More copmlete WSJ Article (Score:4, Informative)
--
IBM Embraces Bold Method To Trap Spam
By CHARLES FORELLE
Staff Reporter of THE WALL STREET JOURNAL
March 22, 2005; Page B1
Warriors in the battle against junk e-mail are adopting a contentious tactic: Spam the spammers.
The most-common spam defense used to date -- software filters that attempt to identify and block out the unwanted messages -- hasn't stopped the flood of Viagra pitches, cut-rate mortgage offers, and solicitations for foolproof investment schemes swamping many inboxes. Some recent studies say 50% to 75% of e-mails carried over the Internet are spam.
An alternate approach -- counterattacking, in effect -- has been available for some time to users of open-source software, for which code is posted free of charge on the Internet. But adoption in corporate offices has been slow, partly because of fears of exposing companies to certain liabilities -- especially if a target is actually innocent of spamming.
But now the practice is going mainstream. International Business Machines Corp. is expected to unveil today its first major foray into the anti-spam market with a service, based on a new IBM technology called FairUCE, that uses a giant database to identify computers that are sending spam. One key feature: E-mails coming from a computer on the spam list are sent directly back to the machine, not just the e-mail account, that sent them. The more spam that comes out, the more vigorous the response.
"We're doing it to shut this guy down," says Stuart McIrvine, IBM's director of corporate security strategy. "Every time he tries to send, he gets slammed again."
The IBM move follows security giant Symantec Corp., which released a new product in January that uses a similar technology called "traffic shaping" to slow connections from suspected spam computers.
Trapping spammers is sometimes called "teergrubing," from the German word for "tar pit" -- as in, spammers get stuck. It is the equivalent of answering a telemarketer's phone call, "saying 'Hi, how are you,' and setting the phone down and seeing how long he'll talk before realizing there's no one on the other end," says Tom Liston, a computer-security expert.
Teergrubes exploit some convenient features of the Internet, which was designed to be a polite method of communication. Computers -- including e-mail servers -- that chat back and forth in the Internet's electronic protocol will courteously wait to see that their data has been received before sending more. Typically, such acknowledgments come in a matter of milliseconds. A computer set up to teergrube will languorously stretch its responses out to minutes -- effectively tying up the spamming machine and reducing its ability to pump out messages.
How to handle spam -- or, indeed, any other form of unwanted electronic traffic -- is a tricky issue in security circles. Gaining unauthorized entry to a remote system, even in order to stop it from harming yours, is generally illegal under anti-hacking laws. The aggressive new products from IBM and others don't violate those rules, but they can increase the amount of network traffic. Unnecessary traffic increases are generally frowned upon.
But proponents of aggressive antispam tactics say something needs to be done to choke off the supply; simply turning the other cheek and trying to discard spam as quickly as possible isn't enough. IBM says in a new report that in February 76% of all e-mails were spam, down from a summer 2004 peak of nearly 95%, but still well above levels at the same time last year.
"Yes, we are adding more traffic to the network, but it is in an effort to cut down the longer-term traffic," says IBM's Mr. McIrvine. Brian Czarny, vice president of marketing for MessageLabs Ltd., which uses the Symantec product, says traffic shaping doesn't constitute a potentially illegal "denial of service" attack because it is r
Innocent bystanders? (Score:3, Interesting)
The collateral damage to innocent people will be tremendous.. If a spammer is stupid enough to use his own machine, he would drop off line instantly after he broadcasts.. IBM's packets have to go somewhere, flooding out neighbors..
Plus, what if the person spamming has been infected with a virus and isn't knowingly spamming, or IBM's system misidentifies the offending machine? There would be hell to pay..
Yes, spam sux, and it needs to stop, but we need to do it properly..
It won't work (Score:3, Insightful)
Re:It won't work (Score:3, Interesting)
an idea a lot of people have done is: reject ALL first attempts and label them. reject all incomings from that identity for x minutes. then open the gate and let them thru next time.
a valid sender WILL retry and queue up messages. a spammer will rarely queue up and retry.
this also works. downside is that you delay receipt of mail. but most companie
Its a SERVICE, Please read (Score:3, Informative)
Next he's talking about a SERVICE so that if IGS hosts a customer, it's 99% likely that the customer will have a domain of customername.com not ibm.com. The spam fighter will originate from customername.com. So if some other source detects that the spam fighter is spam only that domain will get hammered.
Re:works great for honest spammers (Score:5, Insightful)
Re:works great for honest spammers (Score:4, Insightful)
so.. double the money wasted on spam on total and no cure.
Re:works great for honest spammers (Score:4, Insightful)
My small local ISP sends techs to help their customers when these things happen - and, yes, I realize that's not viable in most cases.
Re:works great for honest spammers (Score:3, Interesting)
Now what if the collective zombie PCs are instructed to spam the anti-spam service?
Re:works great for honest spammers (Score:5, Insightful)
Re:works great for honest spammers (Score:2, Insightful)
Better to slam the websites advertised, like the slashdot effect, I reckon.
-d
Re:works great for honest spammers (Score:3, Informative)
Re:works great for honest spammers (Score:3, Interesting)
Frankly, when you get down to the REAL details, this system addresses MOST of my complaints about C/R systems.
Re:works great for honest spammers (Score:5, Insightful)
And it's not like it's hard to tell who the culprits are. Anyone who has logging enabled on their firewall will know exactly what I mean.
Comment removed (Score:5, Insightful)
Re:works great for honest spammers (Score:5, Insightful)
What's the problem? If you are participating, on purpose or not, you should be stopped.
Being subject to this form of retribution might make people aware of the problems on their machines. It seems to be a Good Thing to me.
Re:works great for honest spammers (Score:3, Interesting)
Re:works great for honest spammers (Score:3, Insightful)
Re:works great for honest spammers (Score:3, Insightful)
Flamebait my ass (Score:3, Insightful)
How the hell do you expect ISPs to react to this kind of retalitory behavior?
You start attacking major networks automatically and you're going to see port blocking come up faster than you can say Postfix.
Re:works great for honest spammers (Score:4, Informative)
Re:works great for honest spammers (Score:5, Insightful)
Re:works great for honest spammers (Score:2)
Well, duh... (Score:2)
I think that was the intent. Almost time to drag out the "Reasons this won't work" list again...
Kjella
Re:Well, duh... (Score:4, Funny)
Your company advocates a
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
(x) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
(x) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
(x) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(x) Extreme stupidity on the part of people who do business with Microsoft
( ) Extreme stupidity on the part of people who do business with Yahoo
( ) Dishonesty on the part of spammers themselves
(x) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
(x) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(x) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid company for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Re:Well, duh... (Score:4, Insightful)
Re:Well, duh... (Score:4, Interesting)
The general form of a "checklist" response is really old. I first saw such a form on USENET more than ten years ago. It originally appeared in in this rec.humor.funny post from December 1994 [google.com] whose author claims to have gotten it from a VAX conferencing system. The general idea of a standardized checklist for blowing someone off is probably even older than that.
I got tired of explaining to people why their cockeyed spam solutions wouldn't work, so I wrote this particular one about spam one evening and posted it here [slashdot.org] and here [slashdot.org]. I'm surprised it took off, actually. Now in every thread about spam I do a search for "technical legislative vigilante" to see if it's reappeared and it's there half the time. I only wish I had included a little dig for challenge-response schemes!
The part at the end about burning your house down is there because someone in the original thread proposed a solution to spam that was so abysmally bad that the poster was suspected to be a spammer himself- hence the "( )spammers could easily use it to harvest email addresses" item.
Judging from Google searches, [google.com] spam researchers seem to have mixed feelings about it. The form wears out its welcome all the time but keeps reappearing. Some like it and use it a lot to quickly dispatch stupid ideas from the peanut gallery. Others hate the form because it gets presented to them all the time when they present their proposals. It has actually appeared in a number of anti-spam research papers. One group of researchers, when proposing their solution, actually prepared a preemptive response to refute each form item.
Re:works great for honest spammers (Score:5, Informative)
http://www.alphaworks.ibm.com/tech/fairuce
I realize you're kidding but, actually, no... (Score:2)
I learned this from reading various military tech manuals that will, on occasion, put something to this effect in their preface.
Interesting (Score:5, Funny)
I'd like to learn more about this. What's your phone number, I'd like to call you to talk further.