Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Spam The Media

The New Yorker On Spam 132

aqk notes an article in the Aug. 6th New Yorker surveying the spam problem up-to-date. The New Yorker may not be exactly the MSM, but it is pretty influential. The author got only one fact wrong that I noticed: Canter and Siegel's seminal spam was propagated through Usenet and not email. Still, it's a good look at the history of spam and the scale of the problem today. The amount of spam that "spam king" Robert Alan Soloway, indicted under the CAN-SPAM Act, is accused of sending over a period of four years is now pumped out about every 30 seconds, around the clock, around the world.
This discussion has been archived. No new comments can be posted.

The New Yorker On Spam

Comments Filter:
  • by eldavojohn ( 898314 ) * <eldavojohn@noSpAM.gmail.com> on Tuesday August 07, 2007 @08:22AM (#20140437) Journal

    The New Yorker may not be exactly the MSM, but it is pretty influential.
    What were you hoping? That if it were mainstream media (MSM), it would bring to light the problems of spam? That it would influence the businessmen & marketers that make the spam?

    This article is a great short history on spam but no new information was presented to me here (and judging from the summary neither did it shed light on anything new to you).

    I laugh at either of these hopes because the average person already deals with spam daily (my relatives began reaching out for me on ways to censor that from my younger cousins years ago) and we have a different mindset than businessmen & marketers.

    The article mentions the epic article [paulgraham.com] by Paul Graham entitled "A Plan for Spam." It may look long and arduous but I heavily recommend you read that. I will not forget reading that article nor will Slashdot [slashdot.org]. I think it helps more for the "mainstream media" to publish things like this for their readers.

    Yes, it has code in it. Yes, it requires a bit of a priori knowledge in some places (pun intended). But, you know, a lot of times the best stuff comes from outsiders and I personally think that newspapers should develop a 'tech section' where they can throw off the mittens & grade school knowledge that need to be on in order to handle your average reader. I know many newspapers have entire sections devoted to sports--sometimes even just one particular sport if it's in season! I've seen many newspapers have 'articles/ads' for new automobiles, why not new technology? I know Popular Mechanics is ... well, popular for lack of a better word so why aren't newspapers picking up on this and printing more tech-heavy articles? I guess all I can do is bitch about it because I don't have the same mindset as the people trying to sell the news.

    Which brings me back to an important point, you're not going to change anyone's mind. Everyone knows about it and if you think that Wallstreet businessmen are going to pick up the New Yorker & their jaw will drop when they read this article, you're sadly mistaken. If you think marketers will read this and say "My God, I need to start thinking about what I'm doing to the networks of the world," you're deluding yourself.

    What we need is an article that causes people to seriously ask themselves how we can keep e-mail free and uncensored while at the same time stopping spam. When I was asked by my aunt, they were concerned for their daughter using the internet and opening a spam message to see a guy with his legs split around a phallic-looking cactus in an ad for Viagra. I showed them how to use Thunderbird instead of Outlook Express and how to turn on junk mail filter. I also pointed out how vulnerable you leave yourself to spam if you print your e-mail in plain text on the internet. They never had a problem with it again.

    So while this article is informational, it does nothing practical for the reader. I realize--and I think a lot of people will agree with me--that the best way to stop spam is to stop clicking on it and show others how to do the same. The 0.001% response will dry up and spammers will drop off. Articles on how to configure yourself to spot spam would probably be the best thing mainstream media could print--sure would have helped my relatives!
    • by morgan_greywolf ( 835522 ) on Tuesday August 07, 2007 @08:31AM (#20140495) Homepage Journal

      I know Popular Mechanics is ... well, popular for lack of a better word so why aren't newspapers picking up on this and printing more tech-heavy articles? I


      Because such articles don't sell advertising. Popular Mechanics, Popular Science, Scientific American, etc., can sell ads because they have nothing but tech-heavy, jargon-laiden articles, and so the advertisers know exactly who they are targeting.

      Newspapers are general-purpose publications, written for the widest audience possible. It's hard enough for them to sell ads these days without having to have specialized sections for the tech reader.

      That being said, newspapers should be trying to innovate, because if they don't, well...it's the death knoll for newspapers.
      • by Logic and Reason ( 952833 ) on Tuesday August 07, 2007 @11:20AM (#20142327)
        A "death knoll"? Are the newspapers going to roll down it and hit their heads?
      • Sorry, but I'm a little confused. Wouldn't having more focused sections HELP sell advertising? Maybe it's so hard for the newspapers to sell advertising because they're trying to cater to everyone. Why not pitch tech companies to put their ads in the Tech section -- they'll know who they're advertising to. Similarly, sell the ad space in the Celeb section to a demographic most inclined to read it.
        • I think they'd probably alienate their existing advertisers and lose that income, but it would take a while before the people interested in such content started purchasing the paper, and even longer before advertisers interested in running adverts in their newly formatted publication were convinced that it would be of much value.

          Actually probably a better approach would be if newspapers started having a real tech section (and not just a "here are the latest gadgets" which some papers are doing now), maybe s
      • The "death knoll" is about 100 yards away from "the grassy knoll" - but nobody knows about it because it was removed from the Warren Commission report before it was published.
    • by iknownuttin ( 1099999 ) on Tuesday August 07, 2007 @08:54AM (#20140669)
      Which brings me back to an important point, you're not going to change anyone's mind.

      I'm in the middle of starting up a small business and was talking to someone about marketing. This individual (Not an in-duh-vidual - a Ph.D.) suggested that I send out mass emails. I told him that I can't do that because I'll be a spammer and my ISP will yank my account. He then mentioned that they're are ways to mask my origins. I said if I get caught doing that, I'll be in even more trouble. Besides, I DON'T want to be a spammer.

      My point? Spamming has become so standard and everyday that people don't even give it a second look now and just consider it an annoyance at worst. The only people who really care are those of us in IT.

      • Re: (Score:1, Offtopic)

        by gsslay ( 807818 )

        I'm in the middle of starting up a small business and was talking to someone about marketing. This individual (Not an in-duh-vidual - a Ph.D.) suggested that I send out mass emails.
        Please tell us you weren't paying this individual for this advice. Please tell us you haven't paid him anything since.
      • Re: (Score:1, Offtopic)

        by KlomDark ( 6370 )
        Dude, you need SalesGenie [salesgenie.com]!

      • Re: (Score:3, Insightful)

        by RobBebop ( 947356 )

        I hope your friend's Ph.D isn't in a computer science related field. It seems logical that an acceptance of this would infect the rest of the world, though. Many businesses have enjoyed moderate success by sending out "mass-mail" through the USPS for years.

        In regards to your other point...

        Spamming has become so standard and everyday that people don't even give it a second look now and just consider it an annoyance at worst.

        I have found it increasingly annoying dealing with people who run pirated software because "they couldn't afford to pay for it". This "don't give it a second thought" mentality is, IMHO, something that should be reve

        • by cliffski ( 65094 )
          "I have found it increasingly annoying dealing with people who run pirated software because "they couldn't afford to pay for it". This "don't give it a second thought" mentality is, IMHO, something that should be reversed. Just because technology enables somebody to do something... it doesn't mean they should."

          Amen brother. I am interested in your ideas and wish to subscribe etc etc,
        • by mqduck ( 232646 )

          I have found it increasingly annoying dealing with people who run pirated software because "they couldn't afford to pay for it". This "don't give it a second thought" mentality is, IMHO, something that should be reversed. Just because technology enables somebody to do something... it doesn't mean they should.
          What about those people who say "they couldn't afford to pay for it" because they couldn't afford to pay for it?
          • Re: (Score:2, Insightful)

            by gnunick ( 701343 )
            Stealing bread when you can't afford it (and no one's giving it away) is difficult to condemn.

            Running pirated software because you can't afford it? Well, since you can get almost any software you could possibly need both free and legally, you're apparently either uninformed or not the sort of person to take responsibility for your own actions and choices (just like a spammer).

      • There's a fine line between mass mailing and spamming. I believe it has much to do with allowing people to unsubscribe.
        • Unsolicited e-mail, regardless of origin, is spam. It may not be legally actionable spam, but it remains spam.
        • by greed ( 112493 )

          I sure hope you meant "with allowing people to subscribe." Hopefully, your subscription mechanism also has an unsubscribe, but at that point, at least you're only annoying people who asked you to. (Assuming properly confirmed subscriptions....)

          It is, by definition, unsolicited if I didn't ask for it.

      • by judd ( 3212 )
        Those are pretty weak weak objections. You need shame.

        No, I won't spam because it is antisocial, and you would have to be a jerk to do that.
    • by KingSkippus ( 799657 ) * on Tuesday August 07, 2007 @09:16AM (#20140873) Homepage Journal

      So while this article is informational, it does nothing practical for the reader. I realize--and I think a lot of people will agree with me--that the best way to stop spam is to stop clicking on it and show others how to do the same.

      This is definitely a start in the right direction, but it's not the whole story. I'm convinced that a massive part of the problem is that there's a widespread belief that spammers make millions of dollars.

      No doubt, a very few do. A very few have mansions and island retreats in the Bahamas. But these people are like the Michael Jordans of spammers, the people who have spent an incredible amount of time and effort into honing their spamming skills not just into an art, but a lucrative profession.

      The problem is that most spammers aren't the Michael Jordans of spam. They're just people who have heard that spammers make millions of dollars, and they want in on that action. They go out and download the latest scripts and fire off a few million e-mails. No one responds. So they fire off a few million more. After enough times, someone will respond, and they've made $20 bucks. Flush with the thought of new mansions, they fire off millions more. Whoops, that $20 was charged to a stolen card, so they're back to zero.

      The point is that the world has changed. Back in the day, there was a lot of money to be made from spam. Now, though, you have a very few scummy individuals who have made massive amounts of money. You have thousands of scummy individuals who think they can do they same thing, but fail miserably. It doesn't matter, though, all you need are the few who do make millions to keep the perception alive that spam = TONS of money, and you'll have people lining up to do it.

      What need to happen is that they need to stop focusing so much on the spam "kings" and go after the regular guys who send it out. The people without the million-dollar houses. The people who think that it doesn't hurt anything to fire off a few million e-mails to try to sell some Vigara (yes, I misspelled it deliberately). The press need to cover those stories too. (They really need to cover them more.) People stop seeing Bill the multi-millionaire spam king and start seeing Ted the worthless loser who was so desperate that he thought he could make a million dollars by sending spam.

      It's not enough to make spam unprofitable. People have to know it's unprofitable, and that when caught, they'll end up in jail for nothing.

      • by Philotechnia ( 1131943 ) on Tuesday August 07, 2007 @09:52AM (#20141255)
        Let's step back from spam a second. If prostitution is the world's oldest profession, being a con artist is a close second. Before spam, these people were jumping out in front of cars to collect a paycheck, enticing people through telephone calls into shady business transactions, and so on. Spam is only a new form of an old trade. These people are always going to feed off the ignorant, the naive, the bleeding hearts, and the foolish. You will never regulate this kind of predatory behavior out of existence. All of us make bad choices. Some of those bad choices involve being the con artist, and some of those bad choices involve letting ourselves be duped. You can't stop this, you can only hope to contain it. That being said, the most effective approaches to spam are going to be those that assume the existence of the problem going forward - i.e. we can not stop nor get rid of spam - and manage it effectively while educating people against the tricks of the trade. I think spam is largely an overblown issue, that most competent sysadmins have tool sets that manage it very well, and that the average user is much more educated then us slashdotters assume. To put it briefly - spam is an overblown issue that just gives the government an excuse to get their grubby hands on our tubes. In Soviet Russia, the internet surfs you!
      • Re: (Score:3, Interesting)

        by Kadin2048 ( 468275 ) *

        This is definitely a start in the right direction, but it's not the whole story. I'm convinced that a massive part of the problem is that there's a widespread belief that spammers make millions of dollars.

        No doubt, a very few do. A very few have mansions and island retreats in the Bahamas. But these people are like the Michael Jordans of spammers, the people who have spent an incredible amount of time and effort into honing their spamming skills not just into an art, but a lucrative profession.

        Replace "spammers" with "drug dealers" and the statement is still true.

        In fact, I think many, if not most, illegal activities are driven by the same motivation. It's a lottery; people rationally know that their chances of 'winning big' (being the multi-millionaire spammer sitting in the Bahamas, or the drug dealer who becomes a rap star, or whatever) are ridiculously small. But they do it anyway, because they think they can be that one in ten million.

        I strongly suspect that if you look at the pay-per-hour

        • by sBox ( 512691 )
          Spammers are more like pamphleteers of old, spreading trash on the streets, FUD about foreigners and land in the Everglades swamp. Pesky, irritating and costly in terms of cleanup. They will continue to exist and we will continue to fight in this media or the next.
      • It's not enough to make spam unprofitable.
        Not just that, it has to be seen as unglamorous. If the image of a typical spammer was changed from being a millionaire playboy to an Earl Hickey [wikipedia.org], that would help tremendously.
      • So to translate to meatspace: We've been overrun by billions of deaf & blind prospectors who never found out the gold rush was over, and that every inch of land is owned. Hey! Watch that pick-axe this isn't a mine!
    • by Otter ( 3800 )
      Yes, it requires a bit of a priori knowledge in some places (pun intended).

      Umm, what pun?

      Incidentally, the New Yorker is one of the most prestigious magazines in the world (albeit prestige derived much more from its past authorial and editorial quality than from anything it has now). I'm not sure why you and the submitter seem to think it's some sort of printed-out blog.

      • albeit prestige derived much more from its past authorial and editorial quality than from anything it has now). I'm not sure why you and the submitter seem to think it's some sort of printed-out blog.
        I suspect for people who can't recall its past editorial quality, it probably does seem about like a printed-out blog...
    • This article is a great short history on spam but no new information was presented to me here...

      How many people here knew that Hormel Span was a contraction of "Spiced ham"?

    • by aqk ( 844307 )
      I have to disagree about educating the dirty "0.001 percenters" that unwittingly support the spam.
      They will never dry up, just as some people will never stop littering.

      There will always be incivists out there, and unless we can somehow impose draconian measures on the whole population (internet or real world) the litter will always be present.

      OK, Singapore appears to have stopped littering. But do we want this policing on the internet?

      Perhaps the only way is to revive that old reprehensible sugg
    • This article is a great short history on spam

      The author's source material is a great short history of spam, too: I didn't read anything new on the early history of spam in the New Yorker because I'd already read it elsewhere. Yet the New Yorker author only obliquely referenced his source materials when he mentions Brad Templeton (EFF chairman, etc.) via a quote. If I was the editor for that article I'd have pushed for more research credit to be given.

      Brad Templeton's collection of essays on spam [templetons.com] includes:
  • by morgan_greywolf ( 835522 ) on Tuesday August 07, 2007 @08:24AM (#20140451) Homepage Journal
    Spam wouldn't be such a problem if we had proper verification of senders. Whether that's through some central identity or whatever. I realize this idea is extremely unpopular and is not in the spirit of the original Internet, but heck, if you had to essentially have an ID that verified who you were and if you sent out spam, you'd lose it, how much less spam would there be?
    • Re: (Score:2, Interesting)

      by gatzke ( 2977 )

      I have friends that automatically bounce emails back for whitelist verification. This annoys me, but helps them. It also keeps them from getting a lot of needed email, like site automated site registration stuff. And the spammers would eventually beat that technology too.

      Get a gmail account. It works. Our university spam filtering quality goes up and down, but I get maybe one spam a week in my inbox in gmail.

      I used to periodically get some crazy communist manifesto spam, all in spanish. I miss that on
      • Re: (Score:3, Insightful)

        If you ask me, nothing less than the total removal of all spamming should be acceptable. Filtering doesn't get it because you still have all of this spam and zombies wasting terabits of bandwidth. And you have spammers pwning all these clueless idiots' Windows boxes, turning them into spam zombies. Remove the ability to send spam without screwing yourself, and you'll solve all of the spam-related problems. Filtering is like putting makeup on a facial wound. Removing the ability to send spam in the first
        • by spikedvodka ( 188722 ) on Tuesday August 07, 2007 @08:59AM (#20140721)

          If you ask me, nothing less than the total removal of all spamming should be acceptable. Filtering doesn't get it because you still have all of this spam and zombies wasting terabits of bandwidth. And you have spammers pwning all these clueless idiots' Windows boxes, turning them into spam zombies. Remove the ability to send spam without screwing yourself, and you'll solve all of the spam-related problems. Filtering is like putting makeup on a facial wound. Removing the ability to send spam in the first place is the cure.
          Sounds great... where do I sign up? but seriously. There are a number of problems with "Removing the ability to send spam in the first place"
          1) What exactly is spam? -- Some people would say that spam is any e-mail they don't want. Others will say any e-mail they didn't ask for. yet others point to the dictionary and say "unsolicited usually commercial e-mail sent to a large number of addresses"
          This brings up the first problem... if we go with the last (and most technical) of those definitions, all a spammer has to do is start to "properly" personalize the messages (for some value of personalize)
          If we go with the first, how can you check on the sending end if the recipient wants it?
          if we go with the second, what about when I want to send e-mail to a friend I've lost touch with? he didn't ask for the e-mail, therefore my message is "spam"

          Even if we, as the GP suggested, impose a technical restriction on e-mail such that it has to be authenticated as to who it's from, all that does is make the filtering easier. What is going to prevent the dedicated spammer from "registering" a new identity? where would everybody's identities be registered? would you trust a centralized registry of "registered senders"? for some reason i think not.

          I've heard suggestions of using a "web-of-trust" method of "registering identities", but even with that idea, you're going to end up with many separate webs. and bog help you if you want to send e-mail between the webs, you'd be effectively unknown, and thus declared "SPAM".

          All to often the way it seems with technology is that we put band-aids on everything. Endless patch-Tuesdays, etc. and that when a new system is proposed and agreed upon it (a) takes forever to get off the ground ... IPv6 anyone?, or (b) is fored to be backwards compatible, which defeats the purpose.

          Maybe I'll have to think of an algorithm to dynamically and auto-magically create a positive, and negative web-of-trust, both for senders and for servers... but that's more for another time
          • by khasim ( 1285 ) <brandioch.conner@gmail.com> on Tuesday August 07, 2007 @09:21AM (#20140921)
            Check out TFA. They even mention Hotmail.

            Hotmail is one of the world's largest providers of e-mail service, with two hundred and eighty-five million registered accounts in more than two hundred countries. "We filter them all, and that takes huge amounts of computer processing power and Internet bandwidth, and it requires us to work constantly to keep the numbers from getting worse," Scarrow said. "We do this to minimize the impact on our customers, but it's a hell of a job."

            Yet about half the spam that gets through my system comes from HotMail and GMail.

            And let's not forget the cute ads that Microsoft appends to outgoing Hotmail messages. So, someone sends spam through Hotmail, which ends up with the ad attached ... and it gets reported as spam ... so when a legitimate message comes through from Hotmail it also has the ad and so it gets flagged as spam by SpamAssassin.

            That's great. The spam gets through and the legitimate messages are blocked. Maybe Microsoft could have put a bit more thought into their process? No? Getting the ads out is too important?

            Here's a thought. How about Microsoft and Google throttle the outbound connections on their servers? One message every 5 seconds? And take an account off-line AND ALL ITS PENDING MESSAGES if they get a complaint? Google has smart people. I'm sure they could work out an automatic arrangement with the larger anti-spam sites.

            The only "web of trust" you can really trust is your own white list.

            I'd rather focus on the opposite. Identifying ranges that are 99.9%+ likely to be spammers. Like most of the home accounts on Comcast and Verizon and such.
            • by achbed ( 97139 )

              Yet about half the spam that gets through my system comes from HotMail and GMail.

              You mean appears to come from HotMail and GMail. There are lots of gateways out there that are still open, and will willingly bounce messages from anyone purporting to be Buddha, God, and Allah. Trust me, I know. I get a ton of "message rejected" notices on my domain from email that does not originate from me, but is somehow scheduled for delivery anyway. And that's just the ones that don't get through. Domain hijacking for spam purposes doesn't require hacking DNS, just forge your "from" address.

              Of

              • by khasim ( 1285 ) <brandioch.conner@gmail.com> on Tuesday August 07, 2007 @10:10AM (#20141481)

                You mean appears to come from HotMail and GMail.

                Nope. They can't fake the IP address if you don't have pipelining turned on. It's coming from their IP's.

                Of course, very little stops spammers from also opening a ton of "legitimate" free accounts and spamming using those, but they can (sometimes) get tracked and shut down...

                That's the problem. You cannot "trust" Hotmail or GMail because they ARE used by spammers.

                And there is no technological reason why they could not address that issue. They know that spammers will open accounts with them. Yet they take no steps to mitigate that. Even limiting the outbound emails from each account would help. And having an automated process for reporting and blocking spam from them would pretty much solve the rest of the problem with them.
                • by thogard ( 43403 )
                  They can't fake an IP address if you have pipelining turned on either but you have to flush the input buffer before you send back the response to the EHLO. I did a simple hack that looked at the queue size at the time the greeting was issued and purged lots of spam that way.
                • by nuzak ( 959558 )
                  > Yet they take no steps to mitigate that. Even limiting the outbound emails from each account would help

                  They do that, in fact.

                  > And having an automated process for reporting and blocking spam from them would pretty much solve the rest of the problem with them.

                  They have that. Of course it's ignorebots on the abuse@ inbox, but hey, it's automated. As for automated blocking, that's kind of your problem. You can always block their IP addresses.

                  I don't give a damn about the free email accounts -- they'
            • The only "web of trust" you can really trust is your own white list.

              This falls under the problem of the "If I didn't ask for it, it's spam"

              Just recently, I got back in touch with a friend from college, I contacted her at work, and she asked me to e-mail her private e-mail address... of course, her private e-mail address didn't know who I was, so filed me under spam.

              White-listing is a great concept, but it isn't complete enough to work all-of-the-time. What we need is an "all-of-the-time" non-broken system.

            • Yet about half the spam that gets through my system comes from HotMail and GMail

              Sigh ... if you're going to be another one of these tedious /. Microsoft basher, you should learn to get it right.

              Both Hotmail and Gmail do an excellent job of spam filtering.
              Try looking at your 'Hotmail' email wrapper sometimes.
              You DO know what that is, don't you?


      • Re: (Score:2, Interesting)

        by Anonymous Coward
        The person that ran the linux systems at school showed me the daily log for spam blocked once. It normally reaches 10,000+ a day. He said he contemplated turning it off one time if another user bitched about the 10 spam emails that got through on some days to most user accounts. So if the number of messages that get past the filter is less than 20, even if it fluctuates, is still high quality filtering.
      • Yeah, I've liked Gmail's filtering too, but was until recently blissfully unaware that it occasionally put legitimate mails in my spam box. :-( Now that I know it, I've seen about 3-4 mails gone that way.
        • by gatzke ( 2977 ) on Tuesday August 07, 2007 @09:20AM (#20140907) Homepage Journal

          Ask your friends to stop using subjects like:

          "You will be able to penetrate deeper"

          "15% discount automatically on BOTH watches!"

          At least in gmail they are still around, and gmail will let you search for them easily. I am more worried about my university bouncing legit email as spam and I never see it... No way to find those.
          • Ask your friends to stop using subjects like:

            "You will be able to penetrate deeper"

            "15% discount automatically on BOTH watches!"

            I once had to email a copy of Arnold's poem "Dover Beach" (http://www.victorianweb.org/authors/arnold/writin gs/doverbeach.html [victorianweb.org]) to somebody, and a Bayesian spam filter bounced it. Go figure.

            The ones I have most trouble with are mailing list digests that do contain spam, but mixed in with legitimate content. Until the filters learn how to take apart the digest this looks set to remain an issue.

            • "I once had to email a copy of Arnold's poem "Dover Beach" (http://www.victorianweb.org/authors/arnold/writin gs/doverbeach.html) to somebody, and a Bayesian spam filter bounced it. Go figure."

              I followed your link. As a human Bayesian, let me say that if I got an email with those lines, I'd presume it to be spam, too!

      • I get maybe one spam a week in my inbox in gmail.

        That's my experience too. Unfortunately, I get three or four legitimate emails a day in my spam box. And even though those legitimate emails are from mailing lists I have subscribed to, and I have set up filters to label them, and I keep clicking the "not spam" button, gmail spam filtering overides my filter, doesn't learn to recognise the origin as legitimate, and doesn't seem to have the facility to whitelist them :-(

        • Have you put both the "From" and the "Reply-To" addresses on the mailing list into your Gmail address book? I've found that seems to keep mail in my Inbox instead of in Spam. (I think it's only the "From" that matters, but you can put both in there to be sure.)

          I'm not sure it's an automatic 100% non-spam rating, but it does seem to be worth some points at some point in Google's filtering process.
      • by stevey ( 64018 )

        Every time I receive a message asking me to verify my mail address for the privilege of communicating with somebody I just delete it an move on.

        Nothing bugs me more than receiving a bug report via email, then being unable to reply back to the submitter without jumping through hoops.

        Don't even get me started on why this kind of system is bad - or what happens when two people who use systems like this try to mail each other.

        • by nuzak ( 959558 )
          > Don't even get me started on why this kind of system is bad - or what happens when two people who use systems like this try to mail each other.

          Most C-R systems are pretty good at avoiding jabbering like that. Doesn't stop them from being fundamentally broken though.

          But if you get a challenge for a spam that was forged from your address, do the net a favor: jump through the hoop and let the spam through. The user of the C-R system deserves it.
      • by chromatic ( 9471 )

        I have friends that automatically bounce emails back for whitelist verification.

        I wouldn't brag about having psycopathic friends [oreillynet.com].

    • Re: (Score:3, Interesting)

      It's not just that this idea is unpopular, in my mind it is untenable. The nature of a decentralized system such as the internet is such that it, by its nature, resists control. So you want to require every internet user to have an ID for verification purposes? How would that be enforced internationally? It only takes one China or Nigeria to fail to comply, and the solution becomes worthless. Even if 100% compliance was possible, how long would it take for the system to be hacked? Imagine waking up on
      • This comes up every single time there is a discussion about spam.

        It is simply impossible to have a system that will identify EVERYONE in the world ... that will not also allow the spammers to grab fake addresses whenever they want to.
        • It is simply impossible to have a system that will identify EVERYONE in the world ... that will not also allow the spammers to grab fake addresses whenever they want to.

          You don't know what "impossible" means, do you? Impossible means "if you had unlimited funding, you still couldn't do it."

          A total identification system is fairly easy. The hard part would be picking the right one, and handling bad authorizers. It may be "impractical", but it sure as heck isn't "impossible."

          (Absolutely easy method: one e-mail address per real person, always based on their nation of residence. Anonymnity goes out the window, but you get real authorization.)

          • Conceiving the system is far from impossible. Forcing people to comply by the rules of the system will always be impossible, that is the point.
        • by icknay ( 96963 )
          Rather than track everyone in the world, you could just have a reputation system based on email addresses. Anyone can make up a brand-new email address at any time, but then it won't have an impressive reputation. The main barrier to this is that currently, the From: on an email is easily forged, so the notion of reputation does not work. Domain Keys and SPF attack exactly this problem -- enabling a durable notion of reputation for a domain. If we could get a few more people to implement those, it's going t
      • When you send a message with XMPP, your server is responsible for validating and re-writing the from field. It then connects to the recipient's server. The recipient's server, before the message is received, performs a DNS lookup of the sender's server, and checks that it matches the sending server's IP. If it does, then it relays the message.

        When you receive a message from foo@bar.com, then your server guarantees that it comes from bar.com, and the bar.com server guarantees that it comes from the 'foo'

    • There's a reason why it's extremely unpopular. We need anonymity on the Internet.

      Do you really want everything you do on the Internet to be trackable back to you? If they set up some sort of central ID authority, I can't help but think it will be expanded beyond spam service, and frankly, I don't want everything I do to be tracked.

      I think that part of the problem is that people do stupid things without any thought of consequence. For example, several years ago, my sister called and asked my e-mail ad

      • What made it worse, of course, is that she didn't just send the message to me, she CC'ed it to everyone she could get an e-mail address for. So that means that several dozen people now have my e-mail address. Knowing her friends, at least several of them CC'ed it to everyone they could get e-mail addresses for, which means that hundreds of people now have my e-mail address. After just a very few iterations of this, I might as well get on national television and broadcast my e-mail during the Superbowl. No d

    • Re: (Score:3, Insightful)

      by Opportunist ( 166417 )
      That will never happen. Never.

      Reason? Simple. Who would immediately lose their "internet rights"? Clueless people with spam sending trojans. The same people that pretty much everyone who earns money through the internet loves. ISPs love them, because they use little bandwidth and don't care if their connection speed and reliability is far below anything advertised. Internet shops love them, because they rather buy crap online than trying to find it for free. Governments love them for as long as they're occu
      • Reason? Simple. Who would immediately lose their "internet rights"?

        Let them!!!

        Look, if you're stupid enough to get your machine infected like that, you're too stupid to be on the Internet.

        That's why I keep saying we need to eliminate warning labels. If you're not bright enough to figure out that you shouldn't use a hair-dryer in the bathtub, you deserve to die! Remove them from the gene pool, and all of our problems caused by idiots disappear.

        • I'm all with you, I'd be the first to rip their network cord from the socket and seal it with a "break it and we go medieval on you" police seal. But as I said, this will not happen. What industry and government wants is dumb, simple morons to bullshit. Nobody actually wants educated, interested and informed people. At least not past the point where they are good enough to generate money for industry and government.
        • Reason? Simple. Who would immediately lose their "internet rights"?
          Let them!!!

          Look, if you're stupid enough to get your machine infected like that, you're too stupid to be on the Internet.
          I'm not disagreeing with you, but did you read the rest of the GP's post? There are reasons why governments and societies protect the stupid.

          • Yes, yes. I know all about Opportunist's argument about why governments and societies protect the stupid, because they make them money. It's not the first time he's made the argument, and I'm sure it won't be the last.

            But if we rid the world of stupid people through the elimination of warning labels, the whole point will be moot, no?
        • "That's why I keep saying we need to eliminate warning labels."

          You assume the increased number of subsequent Darwinian deaths will outnumber the number of stupid birth-control failures. Also, that dumbness is primarily genetic. Neither is that likely.
    • Spam wouldn't be such a problem if we had proper verification of senders. Whether that's through some central identity or whatever. I realize this idea is extremely unpopular and is not in the spirit of the original Internet, but heck, if you had to essentially have an ID that verified who you were and if you sent out spam, you'd lose it, how much less spam would there be?

      Sure, and while we're at it, if everyone was required under penalty of death to have their name tattooed in large block letters on their

    • "I realize this idea is extremely unpopular and is not in the spirit of the original Internet"

      The idea that you should be able to mask your true identity, deluge others with unwanted data, and consume excessive bandwidth in the process is NOT in the spirit of the original Internet. It's not even in the spirit of a commercially operated Internet.

      Spam is now the single greatest scourge of the Internet. It wastes resources, causes significant effort to merely manage, not eliminate, and has been the tool of t
    • You don't have to verify who someone is, as long as you verify that the From and Reply-To address(es) associated with an email are valid for the sending MTA. If not, drop the email.

      Yes, I know this would impact mailing lists, but I think that's a small price to pay to help stop spam.
  • Not MSM? (Score:5, Interesting)

    by spikedvodka ( 188722 ) on Tuesday August 07, 2007 @08:41AM (#20140571)
    How is the New Yorker *NOT* MSM? it's practically on every newsstand from here to Moscow (and yes, I have traveled that far, and seen it there) It's lasted for over 80 years so far and has won more than just a handful of nationally and internationally recognized awards for journalism.

    If anything the New Yorker is a good way to reach people that might not be quite as technically proficient or knowledgeable.
    • MSM ?

      The three letter acronym MSM can refer to:

      Maastricht School of Management, in Maastricht, the Netherlands

      Metal-semiconductor-metal junction.

      Miami Sound Machine

      Men who have sex with men

      Million Skirted Men, a movement advocating men's right to wear skirts.

  • I don't know why, but when I saw

    The amount of spam that "spam king" Robert Alan Soloway, indicted under the CAN-SPAM Act, is accused of sending over a period of four years is now pumped out about every 30 seconds, around the clock, around the world.
    I heard Michael Gross [imdb.com] in my mind...

    "the possibilities for disaster boggles the mind"
    .
  • Suck (Score:3, Informative)

    by Anonymous Coward on Tuesday August 07, 2007 @08:46AM (#20140609)
    I run a mail server for our 5 person business. I left at 8pm last night and got in at 6:45am this morning. During that time, 191 messages where blocked due to the content of the headers. 1,799 connection attempts where rejected due to being on rbls or part of my block list(182,910 entries). 351 pieces of spam still got through that and got caught by the filter which I went through by hand to verify that none of it was valid for users. I just finished going through everyones inboxes to make sure nothing got through. Wanna know how many valid pieces of mail for all 5 users? 17. 17 out of the potential 2,341 attempted mail deliveries within a 11 hour time span.

    Just because your inbox doesn't have a lot of spam doesn't mean someone out there isn't making sure you see it that way.
    • by Anonymous Coward on Tuesday August 07, 2007 @10:13AM (#20141535)
      No kidding. I admin a medium sized ISP. We have 8 (soon to be 9) distributed servers dedicated to email.

      3 load balanced e-mail filtering appliances, at the Internet facing edge. (Basically, BSD boxes running postfix, spamassasin, clamav, policyd, DCC checks, RBL and a few other checkers and daemons I'm forgetting.) They get about 90% of our spam.

      2 load balanced postfix boxes, running policyd on our outgoing mail, they will greylist any naughty customers with a zombie that have sent to much. Also, they do inbound user verification with LDAP, if spam has BCCed an invalid recipient or two, reject. Add another layer of anti-virus on the way to the customers. This catches another 8-9%. I'm guessing around 1% gets through.

      1 DCC server, because we exceeded the threshold for being able to use free DCC long ago. (I'll admit it's a bit under used.)

      1 MTA running exim for the hosted domains. This has spamassain, and a few other services, supplementary to everything in front of it. I'd say it gets most of the rest for those with hosted domains.

      1 big bad 8x processor pop server that runs webmail and pop for the customers. It does no spam checking, because it could never handle the load, just stores what we think is not spam for the customers, around 25,000 accounts.

      By comparison, we need one (1) production, not counting backups, provisioning server. It handles minor things like DHCP for 15,000 customers.

      Now you have an idea on what your ISP spends its money and resources on. There is no small industry selling you solutions to fight the SPAM.
    • why are you reading your employees email? surely some of it may be private, and unless you had grounds for searching you should really keep your nose out.
      • HA!

        As a techie, I used to read several of my BOSSES email. I didn't want to, but I had to get rid of the P3n1S ads. (My immediate boss was a very straight woman)

        Later, this job was taken over by an anal-rententive network 'manager', replete with CNA, FUKSA, etc certificates plastered on his office walls.
        His solution?
        Reject all emails coming from Hotmail and Yahoo! He actually thought that's where the spam was originating.
        (You should have heard the screams come from upper management then!)

        Event
    • I just finished going through everyones inboxes to make sure nothing got through.
      Wait, you read everyone's mail? Do they all know about this policy? If not, I'd seriously kick your ass if I were your boss and would find out.
      • by LWATCDR ( 28044 )
        "If not, I'd seriously kick your ass if I were your boss and would find out."
        1. It is the company server and bandwidth. You should expect that it is not private.
        2. Bosses don't "seriously kick your ass". They may reprimand or terminate.

  • Who died and elected him Spam King? (Not objecting, just hopeful that the previous Spam King died.)
    • If I'm not mistaken, the previous Spam King would be Alan Ralsky, who was in effect shutdown in October of 2005 by the FBI. He's also done time for fraud among other crimes.
  • by badger.foo ( 447981 ) <peter@bsdly.net> on Tuesday August 07, 2007 @08:54AM (#20140671) Homepage
    The amount of spam that "spam king" Robert Alan Soloway, indicted under the CAN-SPAM Act, is accused of sending over a period of four years is now pumped out about every 30 seconds, around the clock, around the world.


    Well, they're trying to send a lot, but with a proper setup at and around your mail server, you will not be seeing much of it anyway.


    Simple greylisting helps a lot, supplemented with greytrapping-generated blacklists (with 24 hour expiry) it's even fun to watch. The last 2-3 percent that actually makes it through to be seen by content filtering gets converted back to free electrons.


    I've had a series of blog entries over at bsdly.blogspot.com [blogspot.com] about this and the conclusion is clear - with a competent system administrator, Spam is a solved problem [blogspot.com] (Links to other refs inside, follow links).

    • Amen. Regulation of the internet to curtail spam is a solution looking for a problem without an existing solution. In other words, it's government.
    • Re: (Score:3, Interesting)

      by seebs ( 15766 )
      I don't think an ever-increasing percentage of my bandwidth and CPU time going into spam filtering counts as a "solved" problem.

      How much time should I spend on becoming the hypothetical "competent" sysadmin? How much should I have to pay someone else to do it for me?

      Tell you what. You provide the salary for me to hire someone reasonably competent to keep filters up to date, and send me a couple of fairly powerful servers, and pay for a second dedicated T1 to do nothing but process email, and I'll back you
      • Re: (Score:2, Informative)

        by badger.foo ( 447981 )
        You seem to be lumping several very different techniques together, thinking it's all about content filtering.

        Content filtering costs a lot of cpu, greylisting and stuttering (replying 1 byte at the time) costs our end very little.

        The cited techniqes are likely to save you significant costs by discarding the obvious cases at the gateway and letting your computation heavy content filtering deal with five percent or less of the load it is handling at the moment.

        All I can say is read the articles. You really do
        • Re: (Score:3, Informative)

          by seebs ( 15766 )
          You know, I actually do use greylisting. And a lot of other techniques, too.

          They all add up, and they really do require a lot of extra hardware.

          Do you have any clue what percentage of the bandwidth I pay for is going to the initial TCP packets from hosts I drop immediately? I'll give you a hint: It's a lot.

          I guess... I've heard serious discussion from people at large sites of what goes into their spam filtering. I'd guess they're not morons; in many cases, I know that they are quite intelligent, and hav
          • Re: (Score:2, Interesting)

            by badger.foo ( 447981 )
            It's not solved. As long as it's taking a measurable number of people working full-time to "solve" it, it's not solved. It'll be solved when we no longer have to spend huge chunks of bandwidth on it, no longer lose mail to it, no longer have mail delayed by it -- you do know that greylisting often delays legitimate mail, right?

            Unfortunately, the age of innocence is past, and I have another shocking revelation or you:

            There is no silver bullet.

            Spam is a solved problem to a very large extent. We are successfu
            • by seebs ( 15766 )
              Billions and billions of dollars of year are not a "solved" problem.

              I'm not saying we need or want legislation. I'm just saying that it's not a solved problem.

              Greylisting is a workaround. It is an obnoxious workaround which reduces the functionality of legitimate mail. Any time I have to sacrifice some useful functionality to keep things working, that is exactly what a "workaround" is.

              I'm not claiming there is, or should be, a silver bullet; nothing I said implied any such thing. What I am saying is tha
  • Just the other day I ran across an old thread on the linux security audit mailing list where a few of us were bitching about the second spam in a month! In the end, they elected to leave it an open, unmoderated list so that non-subscribing developers could continue to post responses to things they may have been cc'd on.

    Seven short years later and our current spam catch rate (at a regional CLEC) is over 98% and far from perfect...

  • Canter and Siegel's seminal spam
    Do I have to hear about that this morning?
  • "The amount of harm done by any of the cited 'unfair' things the net has been used for is clearly very small,'' the Internet pioneer Richard Stallman wrote a few days after the DEC e-mail. Stallman opposed any action that would interfere with the aggressive openness that came to define the Web. And he still does. In his message about the DEC spam, Stallman pointed out--three decades before the appearance of Craigs-list and Monster.com--that the network provided a unique opportunity to advertise jobs and an
  • I get more spam than ever. And setting up spam filtering on Evolution is much harder than it should be. In fact, I couldn't even find a simple, clear, authoritave instruction for starting it. When it should just be on by default when I first install Evolution.
  • Does anyone for all these 20 years thought that there might be some deficiency in Email protocol itself?
  • What's so striking is that there are so few different spams that make it through the filters. And most of the top spammers are known; see the ROKSO list. They're all crooks; legitimate businesses haven't been able to spam through filters in years now. With slightly more law enforcement effort, most of those spammers could be put behind bars. Two or three go to jail every year now; if that could be increased to ten or twenty, the problem would drop substantially.

    The way to find them is by following th

  • Canter and Siegel's seminal spam was propagated through Usenet and not email.
    I was a usenet admin at that time. I remember quite clearly the rage throughout the news.admin.* groups. I still have the T-shirt that was made to remember those scum. "Green Card Lawyers, spamming the globe"

I've noticed several design suggestions in your code.

Working...