Stopping Spam Before It Hits the Mail Server 157
Al writes "A team of researchers at the Georgia Institute for Technology say they have developed a way to catch spam before it even arrives on the mail server. Instead of bothering to analyze the contents of a spam message, their software, called SNARE (Spatio-temporal Network-level Automatic Reputation Engine), examines key aspects of individual packets of data to determine whether it might be spam. The team, led by assistant professor Nick Feamster, analyzed 2.5 million emails collected by McAfee in order to determine the key packet characteristics of spam. These include the geodesic proximity of end mail servers and the number of ports open on the sending machine. The approach catches spam 70 percent of the time, with a 0.3 false positive rate. Of course, revealing these characteristics could also allow spammers to fake their packets to avoid filtering."
It'll work..except when it doesn't. (Score:4, Interesting)
I'll go first.
All spammers have to do is change the characteristics of the message. It's always going to be a cat and mouse game, just like antivirus and antispyware, so saying that they've found THE solution to blocking spam from hitting the server is slightly irresponsible.
Re: (Score:3, Interesting)
Unless they use a truly novel approach of stopping spam before it hits the server.
I suggest an AK-47.
Re: (Score:2)
C4 on the outside of the firewall. That might remove more than expected...but it works!
Re:It'll work..except when it doesn't. (Score:4, Insightful)
I realize that you're kidding, but removing more than expected is something that I consider unacceptable. If it hits the mail server and gets shuffled off into a spam folder with 100 pieces of trash, that's fine. But if it's not even going to make it to the mail server, 0.3% is too high a false positive rate.
Obligatory!! (Score:4, Funny)
( X ) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( X ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( X ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( X ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( X ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( X ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email ( X ) Killing them that way is not slow and painful enough Furthermore, this is what I think about you: ( X ) Sorry dude, but I don't think it would work. ( ) This is a stupid idea, and you're a stupid person for suggesting it. ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Re: (Score:1, Offtopic)
This form is amazing, always manages to be relevant.
Re: (Score:2)
This is partially true. Spamassassin uses a few of the things described on the article already.
Re: (Score:2)
How about requiring that every email be printed out then physically delivered to the recipient? Wait a minute...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This one seems to be filled out more correctly.
Re: (Score:2)
You are right, it is a cat and mouse game. The problem is that the solution being employed is looking at the wrong mouse and the wrong cat.
In this case the mice are the spammers themselves - the people - not the messages. And the cat shouldn't be anti-spam software, at least not in the sense of detect and eliminate software. The cat should be a bounty on the spammers themselves. There are always people who know who the spammers are. Those people are likely just as unscrupulous as the spammers so they can
Re: (Score:2)
You are, of course, correct. The main flaw of such techniques is that you just need to hold the packets. What matters is that you deliver the packets, not the rate at which you deliver them. Instead of sending all the packets of a spam at the same time, the spammer will send the first packet of the first spam, then the first packet of the second, and so on. When they reached the first packet of the 100th spam, they'll send the second packet of the first spam, and so on.
This technique is used by Layer-7 atta
Regulate SMTP's and Open Relays (Score:2)
I'm talking fines and the ability to cut off any rogue SMTP servers. They also need a better method to validate connecting servers and it needs to be an industry wide adopted standard, whether that is done via certificate authority or
Re: (Score:2)
I have a 100% guaranteed way to stop spam from rea (Score:2)
I have a 100% guaranteed way to stop spam from reaching the mail sever.
Unplug the dam thing!
RFC 3514 (Score:4, Funny)
Problem already solved back in 2003, I don't get any spam now.
Re:RFC 3514 (Score:5, Informative)
"The evil bit is a fictional IPv4 packet header field proposed in RFC 3514, a humorous April Fools' Day RFC from 2003 authored by Steve Bellovin. The RFC recommended that the last remaining unused bit in the IPv4 packet header be used to indicate whether a packet had been sent with malicious intent, thus making computer security engineering an easy problem."
Re: (Score:2)
Fictional?!?!?!?
Well then I guess its time to go polish up the old resume.
I don't get it... (Score:1, Interesting)
Why do we need a crazily complex scheme like this when a simple entry in your router's 'Deny' list (for the source IP of the spam) has the same end effect?
Given the spew pouring out of the IP space of China, LACNIC, and Russia, blocking in such a manner appears to be near-lossless compression.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Interesting)
Many have found, if your outside the US, blocking US is much more effective then blocking China and Russia.
Re: (Score:2)
I found that the bulk of UCE that hit my mail server came from either China or Korea. After I began blocking all IP addresses from either of those two countries, I found the amount of spam hitting my inbox was almost nil.
Of course, it was my personal mail server, and I don't have any contacts in either of those countries, so the SNR from China and Korea was essentially zero (no signal, all noise). YMMV, however.
Re: (Score:2)
A machine determined to be a member of a botnet could be isolated, blocked from sending email any place other than the support address of its ISP. Access could be restored when the machine is disinfected.
That's what we did at the ISP I used to work at.We ticked off a few customers but not as many as were ticked off at us before we implemented that policy. I was amazed at how vocal our customers could be when AOL started rejecting our e-mails...
Re: (Score:2)
Global companies (Score:2)
I hear this suggestion a lot. However, many of us work for global companies that deal with legitimate email from these countries. We can't just reject IP blocks for countries when we have dealings in them. China and Russia are huge for international companies.
Re: (Score:2)
Re: (Score:2)
> Good plan, block the countries sending the most spam.
No, just block countries that send a lot of spam and in which you have no correspondents. Obviously this will work well for some and poorly for others. If it won't work well for you don't do it.
Re:Not practical. (Score:5, Funny)
what happens when someone tries to contact me out of the blue before I have a chance to white list them?
Absolutely nothing happens ... at least from your perspective.
Re: (Score:2)
Slightly off-topic, sorry, but I think it's abysmal enough to post and interest a few (or just make you thankful you're not here.)
"Absolutely nothing" is my company's solution to filtering out large or suspect attachments. If somebody sends me an attachment and my company's filters don't like it, the e-mail is dropped. I don't get a notice saying, "This e-mail contains suspicious attachments and has been removed." My customer doesn't get a reply saying, "This e-mail could not be delivered to the recipien
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
And follow up with a phone call to make sure they got the letter.
Re: (Score:2)
That's what happens when companies hire incompetent IT staff.
Re: (Score:2)
In an ideal world, you do your filtering during the SMTP session and give either a 4xx or 5xx code to the originating server if you are blocking the message due to filters. This puts the burden of notifying the original sender on the originating server and does not put your SMTP server at the mercy of relying on a (usually) forged return sender address to notify the original sender.
However, a lot of shops do their filtering after accepting
Re: (Score:2)
Actually, here's a good idea: put it in a greylist and let it hit once and see what the user chooses: whitelist or blacklist. And we're back at square one. GP should be modded Insightful because a lost email may be the perfect business opportunity, therefore not all spam must be blocked.
Spammers evolve from experience (Score:3, Insightful)
Just like other criminals, spammers must quickly respond to what actually works. In essence this is the flaw in any "security by obscurity" scheme, the bad guys simply respond to whatever works. If you get to try several billion times a day then you can try a whole lot of combinations.
.3% false positive is pretty high (Score:5, Insightful)
That means that in my office of 50 people, with an average of 50 emails per day (a very very low estimate), we'd get 7-8 false positives daily. I'd hear bloody murder if that was the case.
We get a lot more mail than that per day, and our spamassassin without autolearning (simply flag anything higher than 5.0) does a hell of a lot better job than that... down in the range of 1-2 false positives a month. Assuming a low daily average of emails (like my example), that's .002% false positives.
Re: (Score:2)
And of course, if you want to actually spot the false positives, you have to let all the spam hit the mail server anyway. Unless you're willing to just ignore all the spam packets and put up with all those false positives being lost to the ether, this won't reduce your mail processing load at all.
Re: (Score:2)
Re: (Score:2)
50 a day * 50 people = 2500 messages, 2500 messages * 0.3% = 7.5 emails.
Re: (Score:2)
Way too high I think. (Score:2)
Otherwise my understanding of the 0.3% false positive is where 100% = the total number of emails.
Which is rather unacceptable given the handling of false positives, and the total number of emails could be very high when you include spam.
Re: (Score:2)
If you assume that 90% of all email is spam, and 2500 is the legit number, that's 250000 emails hitting the mailserver and being rejected.. a .3% false positive means 750 emails a day being dropped.
IMO that's pretty useless.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
what point in time it'd be better to reject everything and just deal with escalated messages
This is in fact, the real solution. Email was not designed for the world we live in and cannot be truly fixed. The convenience and ubiquity of email, however, makes it very difficult to give up. IM, social networking and SMS are taking over the role that email used to reign alone. There will be a natural progression toward obsolescence as email is replaced.* When the consumer does not need email, that will be the tipping point. At that point some of the solutions that cannot hope to be implemented now can b
Re: (Score:2)
Re: (Score:2)
If you going to cut & paste, then do it correc (Score:2)
The original is "The end result was a system capable of detecting spam 70 percent of the time, with a 0.3 percent false positive rate."
Re: (Score:2)
Re: (Score:2)
0.3% FP on the total mail input, but 90% is spam anyway.. so that means 3% of legit mail is dropped.
3$ is way too high.
Re: (Score:2)
Not even remotely. At best this system could only be used as input to a secondary system that then uses this information along with other sources. See, e.g., SpamAssassin's scoring approach.
False positive rate? (Score:5, Insightful)
0.3 would be terrible - three out of ten false positives. 0.3 percent - what the article actually says - is not too bad. But current techniques allow me to check the spam bin for such messages. This technique would pretty much preclude that capability, since the mail would never arrive at the server. I'm not sure that a rate of 0.003 would be acceptable under those circumstances.
Re: (Score:1)
Re: (Score:2)
Personally I would think that if 10 is 100%
10 isn't 100%. 1 is 100%. That's how % is defined.
Re: (Score:2)
Personally I would think that if 10 is 100%
10 isn't 100%. 1 is 100%. That's how % is defined.
Trying to follow all of the numbers without any context is making my head hurt.
Neither TFS, GPP nor you were very clear on the key aspect of percentages: they are a ratio. You said, " 10 isn't 100%" but that's not necessarily true. Ten out of how many? 10 out of 10 is 100%. However, expressed as a ratio, 10/10 = 1, which is what you said is how 100% is defined (100 per cent, i.e., 100 per 100, or 100/100 = 1 = 100%). Since no one specified ten out of how many total, 10 could be 1%, 100%,
Re: (Score:3, Interesting)
.3 is 300 out of 1000.
.3% is 3 out of 1000.
It's similar to the confusion created when idiots write "It only costs me .25 cents to make a phone call" when they really mean ".25" or "25 cents".
Re:False positive rate? (Score:5, Insightful)
And when my mail filters blocks spam, it sends out a message with redirections to an alternative gsm-number telling them to call me so I can whitelist the adres.
That's called back scatter and its as bad as spam.
Think about it, my mail servers block about 35,000 spam per day. If they sent a message to each failed recipient with alternative instructions, that would be 35,000 messages I sent out. Some 34,990 of those messages would either be undeliverable or would get delivered to people who had nothing to do with the original message. You are effectively clogging up a bunch of innocent peoples mail systems with your messages.
Put it another way, suppose some spammer sends 1,000,000 messages with your email address spoofed as the sender. If everyone else did what you do, you would then receive 1,000,000 messages back to your inbox giving you alternate instructions to contact these people.
You wouldn't want that. Nobody else does either. So please stop.
Re: (Score:2)
Back scatter spam has been a known issue for a long time now. There's no more excuse for anyone still operating a mail server this way than there is for anyone still knowingly operating an open relay (since for all intents and purposes, that's what this is).
Re: (Score:2)
What's the problem with rejecting the SMTP session, with the error displaying the SMTP error code along with your phone number/error message in it?
Nothing, but that's not what was described. What was described was a situation where a 'bounce' message was sent by the recipient.
Additionally, for performance reasons a lot of spam processing usually happens after the message is accepted. In this case you can't reject the SMTP session, because by the time you decide its spam, the session is long over.
Re: (Score:2)
> What's the problem with rejecting the SMTP session, with the error displaying the SMTP error code along with your phone number/error message in it?
Agreed! Back-scatter in the form of messages generated by the recipient server are worse than the original spam in my opinion because you can't effectively block them without blocking bounces for mail your clients _did_ send. Add to this that spammers usually fake the from and reply-to headers and it's somebody else getting the bounces.
Receiving SMTP servers
Re: (Score:3, Insightful)
I do get your point really. But my dad (read: the boss) would not be happy if he missed a deal cause a million people who got spoofed got 1 mail from us telling them to call us if their message wasn't spam.
Read that over a few times. You are saying its ok to send out a MILLION unsolicited and annoying email messages (aka SPAM) to people who have never heard of you, so that your father won't miss a single deal?
How is that any different from rationalizing sending out a million direct marketing spam in the hop
Re: (Score:2)
Re: (Score:2)
0.3 percent false positive
They predicted something around 97 billion e-mails per day sent in 2007. I wouldn't want to guess what it's at today, but it's probably higher. Regardless, 0.3% of the emails equates to about 291 million legitimate emails per day black holing. No errors. No "marked return to sender". It just vanishes, eaten by the shub internet. Oops. And we can be pretty sure those numbers are higher -- this is a back of the envelope analysis.
Re: (Score:2)
No errors. No "marked return to sender".
If the box just dumps the packets on the floor, the sender will eventually get an error message from their mail server. Of course the mail server will have tried uselessly quite a lot of times (for days, usually) before giving up.
Re: (Score:2)
0.3% does indeed correspond to a rate of 0.003. That's what the article said, but it's not what the summary said. The summary said "The approach catches spam 70 percent of the time, with a 0.3 false positive rate." Omitting the "percent" changes the actual value by a factor of 100 from what the article says.
"IP addresses, he notes, are easy to fake." (Score:3, Informative)
IP addresses, he notes, are easy to fake.
Sure, you can fake your IP address so you get past this filtering, because it just looks at the first packet. It won't help you though, because you can't complete a TCP 3-way handshake from a fake address, and without doing that you can't actually send spam.
Re: (Score:1)
You can't complete a TCP 3-way handshake from a fake address...
Oh ye of little faith....
Re: (Score:3, Insightful)
Re:"IP addresses, he notes, are easy to fake." (Score:4, Funny)
It's easy, really. All you need to do is use a fake address which happens to be exactly the same as your real address.
It's as simple as closing a user's browser window without using Javascript [thedailywtf.com].
Re: (Score:3, Interesting)
oh ye of little knowledge.
If I compromise any layer 2 device on any network between you and the destination, not only can I fake the address, I can have it doing 480 spins in a pink tutu. Have you read any of the reports from the major network access points around the world? Bogus packets pass through them all the time. They even have a name for them -- martian packets.
Re: (Score:2)
It is possible to spoof an IP address and fake a TCP three-way handshake from a fake address. The trick is that any modern OS randomizes TCP sequence numbers to make it difficult to "complete" the three-way handshake without actually receiving part 2 of the three-way handshake. However, if you have the analytical tools to guess the correct sequence number to send back in part 3 of the three-way handshake, you're golden.
It's not exactly trivial, but g
Re: (Score:2)
IP addresses, he notes, are easy to fake.
Sure, you can fake your IP address so you get past this filtering, because it just looks at the first packet. It won't help you though, because you can't complete a TCP 3-way handshake from a fake address, and without doing that you can't actually send spam.
Not true. When we say "fake", we don't always mean "not your valid IP address right now." For example, you might send your spam from a van that drives slowly through a large city, taking advantage of any open corporate wireless networks it finds on the way. That's one way. Another is to simply bribe your way in to a different ISP or corporate network every night (this has been done). You drive your van up to the back door at 3AM, pay the NOC guy on duty $1000 to hand you a live RJ45 jack and you pump out a
Re: (Score:2)
I really think "breaking into other people's networks" shouldn't be called "faking your IP address". They are very different concepts.
Still reaching its destination (Score:2)
Spatio-temporal (Score:5, Funny)
So this software functions in both space AND time? Fascinating.
It's good that they specified that in the name, to avoid questions such as "Will this software work in the universe which we inhabit?"
Re: (Score:1)
Perhaps they should add some disclaimers [physics.uwo.ca], just to be completely sure.
I'd use ... (Score:1)
But I'd first have to question why somebody is throwing spam at my mail server in the first place?
IronPort and the ilk (Score:1)
Is that really a practical trade-off? (Score:3, Interesting)
And of course as others have already pointed out, this just starts another round of whac-a-mole by pursuing this avenue.
Re: (Score:2)
These include...the number of ports open on the sending machine.
WTF? Does the filter nmap the sending mail server before accepting the message?!?!
A Spam Filter is like DRM (Score:1)
Wrong approach (Score:5, Insightful)
The fundamental property of spam is that it involves many similar messages going to a large number of destinations. That's what to look for. Google can do that, because they manage a very large number of mailboxes with a single system. SpamCop used to do that, but they had to be in the mail-forwarding business to do it and that was too expensive.
Trying to detect spam by looking only at the mail for a single account is inherently a form of guessing. The existing technologies are reasonably good, but not good enough that the spammers give up.
Re: (Score:2)
It won't be long until the zombies create individual spams for each recipient. Just scramble the catch words, add some random stuff to the gifs so they message-digest differently etc..., and there's not enough similarity in the messages anymore to be statistically detectable. If at all, traffic analysis would help, but here too, botnets are extremely flexible and could spread batch runs in I
Re: (Score:2)
It won't be long until the zombies create individual spams for each recipient. Just scramble the catch words, add some random stuff to the gifs so they message-digest differently etc.
Back when I was in the spam hunting business, we called that 2002. Since then, techniques have become radically more sophisticated.
Re: (Score:2)
Messagelabs are in the mail-forwarding business, and they seem to manage to make money out of it.
Oblig Checklist (Score:4, Funny)
Your post advocates a
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(x) Armies of worm riddled broadband-connected Windows boxes
(x) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
(x) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Re: (Score:2)
I think you missed a few:
(X) Bandwidth costs that are unaffected by client filtering
(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical.
Two things: (Score:2)
First: I do not want others to decide what's spam for me.
Second: I got graylisting, amavisd with spamd & co, and more. Why exactly would I put such a system on every other node of the net too? To throw away resources?
with a 0.3 false positive rate (Score:2)
Re: (Score:2)
Well, 0.3 usually translates to 30%, so that is how I read it. I see McAfee is involved somehow, so that is likely an improvement for them.
I hope they don't get rid of my spam folder. (Score:2)
YOU REMEMBER WHEN SEX WAS THE LAST TIME? REFRESH THE MEMORY OF VIA GRA!
No more hair Rogaining medicine.
GIRLS DO ANYTHING FOR A BIG HOSE
It boosts your rod!
Make two days nailing marathon
for your delicate advantage
And all that is just from the most recent page in my spa
MS -- Virus -- Bots -- Spam (Score:3, Insightful)
Why does it seem everyone ignores the real source of the majority of spam: Microsoft windows computers infected by viruses running botnets that send spam. Yes, is generated by other systems, but not nearly the amount that is being generated by MS based botnets.
How about everyone just send their frigen spam bill to MS. How about a class action for everyone to collect for the damage that MS does to networks around the World. Better yet lets just forward all the spam we get to MS. Let them sort it out.
Re: (Score:2)
Most of that dead dog you just posted has been beat and beat again. If "the new standard" OS where an issue, we would have real and WIDE SPREAD viruses in the wild long long ago for the millions of unix servers that have been under attack for years. This is a far more a fundamental issue of systems design and responsibility of MS for their product.
Re: (Score:2)
A better "THE" fix already exists (Score:2)
Although it is not 100% effective, having a spam filter in front of the email server is the best solution IMHO. Solutions like this let traffic hit the mail server before stopping it as spam. Other than it being annoying to users, the big issue with spam is lots of small connections slowing down the system. Letting a EHLO for each of the spam hits despite filtering it away before completion is not helpful. But then, it might depend on if your an end user that hates getting spam or an admin that hates wh
Re: (Score:1)
Re: (Score:2)
Wave. A MIMEXML, XMPP/SMTP hybrid type thing. http://wave.google.com/ [google.com]