Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Spam Your Rights Online

MSNBC: Offices Remain Spam Free Zones 310

Makarand writes "Thanks to a good job done by the tech staff and filtering software, office workers in the US are not bothered by spam mail and the value of email communications has not eroded. A survey conducted by Pew Internet & American Life Project, whose findings are reported in this article by MSNBC.com, found that spam is certainly a problem for personal email accounts but not for company provided email accounts. This is contrary to the perception that American workers are wasting too much time battling spam." YMMV.
This discussion has been archived. No new comments can be posted.

MSNBC: Offices Remain Spam Free Zones

Comments Filter:
  • I Disagree. (Score:3, Redundant)

    by Renraku ( 518261 ) on Sunday December 08, 2002 @08:00PM (#4840593) Homepage
    I see the crap our managers have to filter out at work. Its not so much external spam as it is internal spam. Example, 10 people discussing what they'll have for lunch in 10 minutes, over 20 emails. CCed to everyone.
    • I just started to get spam on my work email after 4 years, The only external emails I signed up for are vendors and a couple mailing lists. I suspect "Netop" sold thier email list, that was the last newsletter I opted in. But how do you prove it?

      Too bad I cant use mailwasher on exchange.

      • Re:I Disagree. (Score:5, Informative)

        by Jucius Maximus ( 229128 ) on Sunday December 08, 2002 @08:29PM (#4840757) Journal
        "The only external emails I signed up for are vendors and a couple mailing lists. I suspect "Netop" sold thier email list, that was the last newsletter I opted in. But how do you prove it?"

        Prove it using sneakemail [sneakemail.com]. It's too late for you to do anything about netop now, but using sneakemail can save you a lot of aggravation since you set up an e-mail address PER mailing list. If you get spam at one of them, you know who sold your address.

        Also, don't use your real e-mail address for anything related to comdex!!!!! You will drown under the spam.

      • Re:I Disagree. (Score:5, Informative)

        by AntiNorm ( 155641 ) on Sunday December 08, 2002 @08:43PM (#4840834)
        I suspect "Netop" sold thier email list, that was the last newsletter I opted in. But how do you prove it?

        Use the method I use: Get your own domain name -- they're cheap and worth it for the control you get -- and set the email so that mail sent to undefined addresses forwards to you. Use an external account to read this email, and do *not* give this address to *anybody*. Then, when you sign up for a list at a place like Netop, give them netop@yourdomain.com as your address. Then, any spam you get as a result of them selling your address will be addressed to netop@ your domain, which is quite easy to detect.

        This method has other advantages; it makes managing the email lists you are subscribed to easier, for instance. As far as places I have detected mining/address selling, Slashdot is mined quite often (as if it shouldn't be obvious). But the main advantages of this method are that it's easy to set up, requires no effort at all after you get it set up, and if an address at your domain starts getting spam, you can shut it down.
        • Re:I Disagree. (Score:4, Informative)

          by goon america ( 536413 ) on Sunday December 08, 2002 @11:54PM (#4841683) Homepage Journal
          This is like something I do with regular junk mail. Whenever I order or sign up for anything that involves snail mail, I always enter a different middle initial or a slightly different first name in the form. That way, I can track who sells my home address.

          As an added bonus, you get to receive 3-4 additional publisher's clearinghouse sweepstakes entries based on the different names.

    • Re:I Disagree. (Score:2, Interesting)

      by Pfhreakaz0id ( 82141 )
      the best reason to use Outlook/exchange is to send an email to vote where to go to lunch (and view the voting results).
    • 10 people discussing what they'll have for lunch in 10 minutes

      Wow. That got modded as funny. Funny, yea, I guess, but this happens almost everyday. Not just about lunch. Even true work stuff. What person needs permissions to what project, for instance. It has to go through a couple bosses (Office Space style...) in my company for me to be 'allowed' to re-permission a project (for good reason, sort of, but...), but all I need to know is 3 things:
      1) Who
      2) What project
      3) When
      That's it. But 10 or so people feel I need to see every damn mail talking about one tiny aspect of the companies day-to-day operations. Then there's all the "P.S." and "oh by the way" conversations in the mails. I've got to read every damn one incase there's a "something I was thinking about is..." applies to me or not...

      :-\
    • or the idiots that are in the IT department that instead of emailing a group of people that might need the information they do a company wide or region wide broadcast...

      If I could count the number of times I get a useless email from the northern-midwest office about some damned share on a server that causes every one of my users in my office to call me and ask if it affect them (it doesn't.. it doesnt affect anyone but a tiny handful of people...)

      the biggest abusers of the cc: or the broadcast groups are the IT people! too lazy to build their own maillists and they dont care if they cause 3 hours of work for every other IT person in the company nation wide.

  • I agree (Score:4, Insightful)

    by Drakonian ( 518722 ) on Sunday December 08, 2002 @08:02PM (#4840607) Homepage
    I don't have a problem with spam at work.

    I think that home users don't have the resources, know-how, or time to work out an effective anti-spam system.

    I can't even find a good IMAP spam filter!

    • Re:I agree (Score:3, Informative)

      The real problem with home users is that 0.04% of them (read morons) actually buy the stuff being solicited. Talk about a minority rule. The best anti-spam algorithm is thus: "Don't buy their shit".
    • Re:I agree (Score:5, Informative)

      by Greedo ( 304385 ) on Sunday December 08, 2002 @08:24PM (#4840728) Homepage Journal
      I can't even find a good IMAP spam filter!

      If you have access to the IMAP server, like I do, I recommend using Spamprobe [sourceforge.net]. It's a Bayesian filter and, along with a few procmail filters to weed out Asian spam, my inbox remains pretty clean.

      Now, if someone would make a half-decent IMAP *client* ... :)
    • Re:I agree (Score:4, Informative)

      by delcielo ( 217760 ) on Monday December 09, 2002 @10:11AM (#4843378) Journal
      Exactly.

      I am the reason people here at the office don't have to deal with spam, and I certainly DO spend quite a bit of time fighting it.

      On an average day, we accept about 15k e-mails and reject about 20k.

      It certainly isn't a matter of the spammers leaving the workplace alone.
  • YMMV ? (Score:3, Funny)

    by Space cowboy ( 13680 ) on Sunday December 08, 2002 @08:03PM (#4840610) Journal
    MM(F)V

    Simon.
  • Oh great (Score:5, Funny)

    by dagg ( 153577 ) on Sunday December 08, 2002 @08:04PM (#4840616) Journal
    The spammers are going to treat this as a challenge. "What? My spam isn't getting to the MSNBC employees? I gotta do better!"

    --Signature Spam [tilegarden.com]

  • by Otter ( 3800 ) on Sunday December 08, 2002 @08:05PM (#4840619) Journal
    Thanks to a good job done by the tech staff and filtering software...

    In part, certainly, but I wonder how much of the difference is due to the fact that spammers have a harder time getting work addresses. They're a lot less likely to be on public web pages, they're not used in chat rooms and they're much harder to generate by brute force.

    • by McDutchie ( 151611 ) on Sunday December 08, 2002 @08:11PM (#4840663) Homepage
      [...]
      spammers have a harder time getting work addresses. They're a lot less likely to be on public web pages, they're not used in chat rooms and they're much harder to generate by brute force.
      Huh? Most company e-mail addresses I have seen are trivially guessable. They username is almost always some combination of first name or initial and last name, with or without dots thrown in for good measure. If the spammers have not figured that out yet, that just proves Rule #3 [spamcop.net], but then again, it's probably just a matter of time.
      • Huh? Most company e-mail addresses I have seen are trivially guessable. They username is almost always some combination of first name or initial and last name, with or without dots thrown in for good measure.

        Not being a spammer, my reasoning may be wildly off on this, but -- they're trivially guessable in the sense that given an employee name and an employer you can generate the likely email address. If you're a spammer, though, trying to generate a million addresses with a high likelihood of validity, it's a lot easier to iterate from a@aol.com to 9999999@aol.com than it is to permute lists of first names, last names and corporate domains. What's the probability that there's really a franklin.deveraux@tgifridays.com?

        That's my reasoning, anyhow...

      • by AugstWest ( 79042 ) on Sunday December 08, 2002 @09:26PM (#4841043)
        Yeah, the ultimate test of this was when I couldn't get Dellhost support to respond to some major problems we were having for about a week.

        Finally I just cc'ed mdell@dell.com, and had a phone call within the hour.
    • and they're much harder to generate by brute force

      I agree with everything else but this.
      Most companies I know of use a very simply firstname.lastname@company.com pattern for email addresses. Combine this with relatively easy to get listing of employees, and you have a spammers delight.

      • Just bford@ford.com (or something like that).

        It's real easy to tell to because you get
        b.ford@ford.com (undeliverable)
        bill.ford@ford.com (undeliverable)
        william.ford@ford.com (undeliverable)
        bford@ford.com (no auto reply so it hit something).

        He was real nice though, forwarded my questions to the head of marketing. I was inquiring as to why they don't make a Cobra 2 seater instead of the faster standard mustang body style.

        Ford kicks Chevy's ass. GM sucks.

        Ford/Jaguar/Volvo/Lincoln/Mazda ...
    • I think this is a GREAT IDEA.

      Lets all post work address books on the *.test newsgroups. Make sure you get those CEO's and VP's too, I bet some nice SPAM laws are passed. :)

      Too bad we cant bounce all those SPAM emails to the *.gov email addresses too.
      • I have a similar idea: lets create as many free (Yahoo, Hotmail, Netscape.net) account as we can. And lets publish their addresses on forums, chat roms and other public places. In two weeks all of them will be full of spam. If we do it intensively - in 1 month Yahoo, Hotmail and Netscape.net will be overloaded and stop their work. Their sysadmins will have to do something better about filtering otherwise free email account business (is it a business anyway) will be gone.
    • by Ace905 ( 163071 ) on Sunday December 08, 2002 @08:18PM (#4840699) Homepage
      I'm a bit of a self-proclaimed expert in this area ; my software company developed 'Spam Interceptor' and in the initial stages of development almost all of our time was spent doing research on how email addresses are collected. We looked at MonsterHut's collection practices (Having known the former CEO) and moved on from their.

      For the most part, I believe Business addresses are easier and more 'enticing' to collect. Every individual has different browsing habits, but for the most part - businesses in particular sectors tend to list themselves in very specific databases, are more likely to have the receptionist or researcher that signs up for mailing lists, and business domains are easier to identify. Some spiders look specifically for "INC." in the whois database - just as google does.

      With the companies I am personally involved with, we do not receive Nigerian Scam Emails until we are listed in a business directory - but how can you avoid the publicity business directories offer? It's not easy. Online businesses start receiving resumes around the same time. We received resumes before our home page was complete - people didn't even know what we did as a company, and that's the only way we knew they hadn't, "Been following the progress of our company for some time and [felt] very enthusiastic about working for us". I mean, these are just job-seekers with an automated resume distribution. Imagine if they made money simply by finding us.

      I don't want to get into too many details on business address collection techniques - let the spammers brainstorm them all over again. But I am certain the very fact that a business is a business - makes them more enticing to a wider range of higher-priced products and services. The collection of addresses, no matter the problems will be overcome, and in my experience have been overcome.

  • by Toasty16 ( 586358 ) on Sunday December 08, 2002 @08:05PM (#4840622) Homepage
    ...because tech workers are embracing it! I mean, why fight spam when it offers to enlarge your penis by 237% in 48 hours? This is truly a golden age of technology! Hallelujah!
  • by jridley ( 9305 ) on Sunday December 08, 2002 @08:05PM (#4840624)
    I wonder how much the lack of spam hitting business email accounts is because companies install spam filters? Our company throws all inbound email through spamassassin, and it works great.
  • by Whatsthiswhatsthis ( 466781 ) on Sunday December 08, 2002 @08:06PM (#4840631)
    Maybe company employees are wary of entering their email addresses into such forms as, "Money waiting for you! Enter email address:" and, "Find out who has a crush on you! Enter email address:".

    Of course, we all know what this report means: spammers still have left some rocks unturned, and thus there is room to grow even if internet usage stagnates.

    Rejoice!
  • by Magus311X ( 5823 ) on Sunday December 08, 2002 @08:07PM (#4840636)
    Good filtering software, along with good filters, really makes the difference.

    At work I use a product which allows me to filter on multiple levels:

    1. Allow. If it's on the domain list, IP list, or if the message contains any of the keywords in the list, it's allowed through.

    2. IP blacklisting. IP address matches? Delete it.

    3. Domain name blacklisting. Domain name matches? Delete it.

    4. Content filtering. Meets any of the content filters? Quarantine it.

    5. Attachment blocking. .cmd? .bat? .vbs? The other 18 I specified? Matched something in the antivirus pattern file? Delete the attachment, regardless of the source.

    Virus infections in the past year? 0 workstations, 0 servers. Number of spams/day before companywide? Averaged about 800 for 25 users. Now? About 20 for 25 users.

    Cost of the product? $1500 for the server license for both products. I'm happy.

    -----
    • by Jucius Maximus ( 229128 ) on Sunday December 08, 2002 @08:25PM (#4840733) Journal
      "Virus infections in the past year? 0 workstations, 0 servers. Number of spams/day before companywide? Averaged about 800 for 25 users. Now? About 20 for 25 users."

      One more element that is necessary for big companies (not necessarily your 25 user network) is to block off hotmail, yahoo mail, etc. The company I used to work at had more than one thousand people on the corporate network and most of them weren't very smart about how to be safe when using computers. (And because of corporate policy we were forced to use Outlook + MSIE, which is not exactly safe either.)

      When your network gets sufficiently big, you WILL have lamers that will infect the whole place from infections they got through hotmail. It doesn't matter how good your filtering is in that case.

      When the corporate IT people finally closed off the popular webmail providers, we went from one unleashed virus every 2 weeks to one every 4 months.

    • Just out of curiousity, what package cost $1500 and does all of that?

      I'm wondering because that's all stuff that I'm doing currently, but it cost me $0 - all free software, obviously.
    • Doesnt much more then a few exim rules, but I dont know much about mail.

      Doesnt matter how many spams you get, what about the legitimate emails that you dont get? Whats the signal to noise ratio of deleted emails?
  • by bwalling ( 195998 ) on Sunday December 08, 2002 @08:07PM (#4840638) Homepage
    I don't do anything to filter out spam. There isn't much spam, though. The only people that actually get spam are those in the IT department who post to newsgroups. I am quite certain that newsgroups are the source of the spam that I get at work. It started within 48 hours of the first time I made the mistake and used my real email address. The problem is that Google archives all of the newsgroup postings, so my email address is forever sitting in an easily harvested place.
    • by Anonymous Coward
      You can remove the posts from googles archives, I dont have the link handy but peak around google.com and you'll find it in "privacy & security" or something like that...
      • by ShaunC ( 203807 ) on Sunday December 08, 2002 @11:34PM (#4841604)
        The link to remove posts from Google's usenet archive is here [google.com]. There are a couple of stipulations in order for automatic removal to be possible. One, the "From" address on the usenet post must point to the real, unmunged email address under your control. Two, you must register and confirm a groups.google utility account from that same address (you can do so at the above link). The parent's parent's poster should be able to meet both of these qualifications.

        If you find that you have a large number of posts that you need removed, I wrote a PHP script called NukePost [shat.net] which will remove huge batches from the Google archive at once. The script simulates a browser session and makes all the required, repetative form posts at Google's controller site for you. All you need are the Message-IDs of the offending posts. I may write a groups.google spider to retrieve those in the future.

        In situations where it's obvious that you made the post but you can't qualify for automatic removal, an email to groups-support {at} google should get you taken care of. You need to include a few things in your message, details are here [google.com].

        I've heard rumors that Google maintains a separate usenet archive for paying customers (i.e. governments, corporations) to browse, which does not honor the removal requests or the X-No-Archive header - though I have absolutely nothing to back that up with - so it's possible that nuking posts is a futile effort. It should keep the cheap spammers away, at least.

        Shaun
        PHPLabs Supersite [phplabs.com]
  • by kzinti ( 9651 ) on Sunday December 08, 2002 @08:08PM (#4840641) Homepage Journal
    I get very little spam through my office e-mail. I don't know whether our admins use spam filters, but I have always attributed the low spam rate to the way I use the e-mail address. I use it mostly for internal e-mail, and I seldom give it to anybody outside the company. It doesn't show up in postings to Usenet (in a Reply-to field, for example), I don't use it to register at sites like nytimes.com, and I don't give it to people I don't know. That's not because I intentionally keep it a big secret, it's just a side effect of the way I work - I don't have much reason to give out my e-mail address. I believe that my lack of spam at the office can be credited to limited exposure.

    Contrariwise, I wouldn't be surprised if there are people who get tons of e-mail at the office.

    --Jim
  • Although I have heard of other people having problems at work with spam, I've been lucky so far. All of our email addresses are easily guessable (prone to dictionary attack) along with alternate addresses being 6 character usernames (prone to brute force attack.

    Hotmail accounts on the other hand, my username is not easily guessable, but I received 47 spams and 1 legitmate message in the past 24 hours in my inbox while 9 spams were redirected to the junk mail folder along with 2 legitimate messages.

    I wonder if the filters that are used by corporate America could be used by Hotmail, actually I wonder why they are not.
    • Hotmail is notoriously bad about spam. Their filters are easily the worst, and the "Junk Mail" folder only seems to catch a small fraction of the incoming spam, while filing away a good portion of vaild incoming messages. They also seem to have no protection against email bombing. I had a lame spammer mail bomb me overnight with a few hundred duplicates advertising NEW LOW MORGTAGE RATES, and Hotmail kindly managed to place the messages in the Junk Mail folder... and then disabled my account for going over the mailbox limit. And this happened three seperate times, over the course of a couple weeks, once when I was on vacation, and I missed who knows how many valid emails when I returned.

      I ditched Hotmail shortly after that.

      I wonder if the filters that are used by corporate America could be used by Hotmail, actually I wonder why they are not.

      Because Microsoft caters to internet advertising companies. Internet Explorer alone can tell you that. I wouldn't be surprised if MS left Hotmail open to spam on purpose, while pocketing a few extra bucks from spam kings.
  • Ok... (Score:5, Insightful)

    by craenor ( 623901 ) on Sunday December 08, 2002 @08:08PM (#4840643) Homepage
    Now let's see a study to show how much effort IT departments are putting in around the country (or world) to eliminate SPAM in the office place.

    I work for a major computer manufacturer (I'll give you a hint, we are again number one in personal PC sales), and I never see spam at work.

    But how much money does my company pay a year for me to not see spam?
    • Re:Ok... (Score:3, Informative)

      by swv3752 ( 187722 )
      Very good point. Several of my associates at my local LUG [swflug.org] are admins. They go through a lot of effort to filter spam. I'd say it is still taking up the same amount of bandwith, just the end user is not seeing it.
    • I'll give you a hint, we are again number one in personal PC sales

      Casio? [casio.com]

      How much does your company pay? Why didn't this survey ask? You could poll 99 office workers and one IT peon to produce the impression that only 1% of workers have any signicant problem with spam. :)
      • Maybe I was too cryptic...I work for Dell. I never see Spam mail at work.
        • Maybe I was too cryptic, I knew what you meant. ;-)

          I keep thinking if I say certain ridiculous things, no one could possibly think I'm that stupid. However, given some people here, perhaps they could.

          Do ask the guardians of your gate to the internet whether they are filtering. Companies vary a lot on this.
  • The amount of spam you receive is directly proportional to the frequency with which your e-mail address is publicly posted. Most offices don't publicly post the e-mail address of their employees, therefore, they don't get much spam. On the other hand, private individuals throw their e-mail address all over the place. Be it registering for some on-line service, or posting on a blog.
  • by Whatsthiswhatsthis ( 466781 ) on Sunday December 08, 2002 @08:09PM (#4840654)
    just not for work email addresses. C'mon, who hasn't checked their private email account from work?

  • Most spammers go after domains that ISP's use. This way they get fewer pissed off people that have their own domains and no how to complain about the spam they get and won't buy anyhting anyways. Since most business email accounts are at the companies domain, they don't get as much spam. Plus people don't use there company email addresses ont he web as much.
  • by pheph ( 234655 ) on Sunday December 08, 2002 @08:10PM (#4840660) Homepage
    Its called 'being on a distribution list'. I get so much e-mail I don't care about, I had to create a rule so that any mail sent only to me is placed directly in my inbox, otherwise it gets moved to another directory...

    DILBERT:
    Panel 1:
    To: All Users
    From: Network Admin
    Please refrain from frivolous E-mail. It bogs down
    the network.

    Panel 2:
    To: Network Admin
    From: Dilbert
    cc: All Users
    I agree.

    Panel 3:
    Dilbert says, "Have you noticed there's too much
    communication in the world, Dogbert?"
    Dogbert says, "Yeah, every day at about this time."

  • I'd cynically figure that employees hustle to delete or underreport spam that might show they're not using their machine solely for business, like they're supposed to most places. Then, of the charitable view, employees DO recognize they shouldn't be using the their work email for private pursuits and so don't share it. The average business doesn't need its employees roaming the internet, anyway, and there aren't many good reasons to be giving out your work email except to people who you do business with -- hopefully not spammers.

    At home, hey, we live closer to the edge. But I object to the stereotype of home users just not knowing how to deal with spam, like it's their fault. Perhasps they should be more careful, but nothing about being carelss makes one "deserve" spam (or fill in crime of your choice). It takes nontrivial sophistication to filter, and anyway stuff gets through. The filters are getting smarter, which is like building stronger locks to keep burglars out, rather than stopping the burglars from trying. Not that spam is anything but wonderful (someone here will say it is); how dare I imply it should be illegal. :)

    Besides, spam can only grow -- it's not going away on its own.
  • i disagree (Score:5, Funny)

    by frenetic3 ( 166950 ) <houston@alum.mHO ... minus herbivore> on Sunday December 08, 2002 @08:16PM (#4840684) Homepage Journal
    well, the company i work at uses a small web hosting co for mail/www and i swear they sell my address... i almost shat in my seat when one of my [female] coworkers walked by and i was sifting through my mail by pressing the down arrow (50:1 spam ratio) and suddenly an ENORMOUS pair of breasts fills the preview pane of outlook. bit of an awkward silence after that. needless to say, i've been a bit more vigilant about spam filtering since then :)
  • My experience (Score:4, Interesting)

    by minesweeper ( 580162 ) on Sunday December 08, 2002 @08:17PM (#4840693) Homepage
    Well, when I had a corporate email account about a year ago, I don't recall ever receiving one piece of spam. Granted, maybe this was due to some good filtering at the server level, but I think it's more due to the fact that I never used that email address for business outside of the company. I never used it to buy anything online or sign up for any service, or published it on any website. Also, the address was firstname.lastname@[companyname].com. I'm sure that makes it considerably harder for a spammer just to cycle though alphanumeric string hoping to hit a real address.

    Similarly, I currently have an email account with my university, but I use it almost exclusively for academic-related communications, and I've not received one spam email at that address in over a year now. And, I doubt the university has invested much money in spam filters for student email accounts.

  • Do you ever get the feeling that the news at msnbc is more for making microsoft look good and less for providing unbiased information to the public?
  • Last year I rarely got a spam complaint at the office. This year I get them all the time. It's not "innocent" spam either, now it's animated XXX GIF files. I'll be implementing an anti-spam system very soon.
  • My company's spam filtering software seems to not be able to recognize the fact the email with the following words in the subject Enlarger You Penis are spam. It does seem to tag internal mass postings from the HR dept. as spam though.
    My home machine running spam assasin on the other hand never fails to recognize spam.

    • "My company's spam filtering software seems to not be able to recognize the fact the email with the following words in the subject Enlarger You Penis are spam. It does seem to tag internal mass postings from the HR dept. as spam though."

      Damn, a 50% kill rate is not good enough to qualify your spam filtering as competent! Blame your IT people!

  • by timlewis_atlanta ( 195776 ) on Sunday December 08, 2002 @08:27PM (#4840741) Homepage
    Everyone needs to check out popfile.sourceforge.net. It's GPL, dead easy to set up and use, and quite frankly, it's brilliant. It uses naive Bayesian filtering, catches about 99% of my spam, and rarely if ever catches a non spam message by mistake. Spammers are going to HATE this tool. Try it. You won't be sorry.
    • It's good, I've been running it for a month or so, it's currently running at more like 93-97% detection of spam.

      Also, I caught it marking two messages from my ISP as spam, but they were both advertisements; so I'm not concerned, in a sense it got it right.

      Incidentally, my ISP has spam filtering as well, since I've switched it on a few weeks ago, it has only caught 2 spam message out of several hundred that were caught by popfile(!)

  • by black6host ( 469985 ) on Sunday December 08, 2002 @08:31PM (#4840768)
    the spam I receive at work from outside the company or the emails from within. First, if it's spam I can usually tell from the subject line. Easy to delete. The emails from within require me to at least read it. And once people learned that they can use nice, pretty and extremely huge, clip art I've found that bringing up that important email to "everyone" is a real time waster.

    In addition, far too many people where I work will email a subject to death. Coupled with a large CC: to population along with the "reply to all button" some subjects just won't die the undignified death they deserve. And, you have to read every one because of the odd one that may contain useful information.

    I swear, what once took a 1 minute phone call to resolve now results in 20-30 emails back and forth. The only good thing I see is the CYA factor. I've saved my butt a couple of times being able to forward a message that I sent long ago, that apparently was never read. Why wasn't it read? Must have been deleted with along with the spam!

    Seriously though, I spend far too much time wading through needless email at work than I do spam.
  • This is sort of off-topic, but I'd like to suggest why it is that home users get more spam than corporate users: they don't care. I'm using Yahoo. I simply delete spam. It's not hard. It takes up about five seconds of my day. There is no chance of not receiving something due to filtering. In a corporate enviornment, however, it is different. They pay for the servers, they pay for the [small amount of] productivity lost. At home, nobody cares. Sure, if you were getting 20 spams a day you would care, but most of us are not receive that volume of spam.
    • I simply delete spam. It's not hard. It takes up about five seconds of my day. There is no chance of not receiving something due to filtering.

      There may be no chance of not receiving the good stuff, but once you start getting a substantial spam load, there'll be an appreciable chance that you'll accidentally delete something you want. If you're getting 50 spams a day, you get in the habit of hitting the DEL key really quickly -- and some of those things you delete wouldn't really be spam.

      There aren't any perfect filters, not even your own eyeballs.

  • A related question to spam: How is it that after I create a hotmail account, within one day, I can be getting spam? Does hotmail sell lists? Or are there people and bots that just put together random strings of possible user names? Does hotmail try to filter these out?
    • "A related question to spam: How is it that after I create a hotmail account, within one day, I can be getting spam?

      Does hotmail sell lists?"

      I wouldn't put it past them.

      "Or are there people and bots that just put together random strings of possible user names?"

      For sure. There are enough usernames on hotmail to make it worthwhile.

      "Does hotmail try to filter these"

      Unlikely. This spam makes you more likely to either leave or pay for a bigger inbox so your messages are not auto-deleted to make room for more spam. Either way, MSFT makes money.

      • I perfer yahoo's "This is spam" thing for reporting it is spam. Although in my hotmail I have filters for cathing the emails with addresses ending in .phd, .now, .you, and the ones like that. (Heck, I even added those to the filters to my primary yahoo account).
        I agree though, I get spam on the hotmail, although I have only given to a few friends(7) and never used it any where else, total email from friends is like 1 msg/month or less, because most send it to my yahoo account. Now yahoo, I have an account that I haven't really used that my friends now and it gets no spam messages.

        Course right now biggest problem with hotmail is that I can't use my unaltered last name with it, "Glasscock", tells me to use a different one or something... ("Glassc0ck" works but it bugs me that their filter on words won't let me use it unaltered. Anybody else with real names that hotmail doesn't like?)
  • by e40 ( 448424 ) on Sunday December 08, 2002 @08:33PM (#4840788) Journal
    We use spamcop.net [spamcop.net] at work. It's gets 95% of the spam. The thing which made us move on it was female employees complaining of sexually explicit spam from porn sites--with an HTML enabled mail reader, sometimes the first thing they saw was some pornographic picture.

    Unless a company makes a best effort to protect people from exposure to offensive material (as defined by them, within reason), the company could be sued by the employee for creating a hostile workplace. While I haven't heard of cases of this yet, it's only a matter of time. (I hope I didn't give anyone any ideas here...)

    We've been experimenting with spamassassin [spamassassin.org], and it's roughly as good as spamcop (as to how much spam gets through to the end user), but it's free. Note: spamcop and spamassassin have to completely different approaches to determining what is spam.
  • Over the course of this weekend, my personal email account has received 7 spams.

    Over the course of this weekend, my work email will have received over 50.

    A quick googling shows my personal email address showing up twice as often as my work address.

    Why, then, do I get so much less spam at home than work? Because the ISP I use is very aggressive about filtering spam, while the IT department at work is deeply fearful that "We might accidently filter a million dollar order" (yah, like anybody ordering a million bucks of stuff will do it SOLELY through email).

    True, the above is nothing but a datum, not refutation, but still, the idea that "work gets less spam than home" is not ALWAYS true.
  • From the look of it, if you're a company paying a geek or herd of geeks to write filters for your mail or have purchased some sort of filtering software solution to screen out the spam, you're still wasting money on filtering spam! Office productivity might be up but the company is still having to spend $xxxx.xx on a filtering solution, which I'd bet doesn't offset the increased productivity.

    Also, don't forget the cost, albeit small, associated with missed mail that was flagged as a false postive.
  • I work for a major games developer, and the only spam I get at work is the spam that goes to the entire company, as somehow a spammer managed to find out our all@company address.
  • by howlinmonkey ( 548055 ) on Sunday December 08, 2002 @08:45PM (#4840850)
    Just because end users don't see the spam doesn't mean there isn't a cost. How much time is spent creating software to combat spam? How many hours do admins spend dealing with spam before it even reaches users? How much time do users have to spend circumventing anti-spam filters to send/receive legitimate email?

    These are just a few of the obvious costs related to keeping spam out of user mailboxes. It would probably boggle the mind to know the actual cost of keeping spam out of Suzy or Sammy Secretary's mailbox.
  • At a previous employer, we had no WWW access, so there was no way to enter our address (from work) into any forms. We sure as hell weren't putting our addresses onto any websites, posting to USENET, sending chain letters to friends. It was used for business and business alone. Personal emails? I SSH'd to my mail server.

    Personal emails at work were *STRONGLY* discouraged, and it was made clear that the company would read our emails if they ever felt like it.

    I never used my work email address for anything. I'd say that 90% of the email I *did* get was company related stuff anyway, which went right into the trash can.
  • SPAM does not distinguish between personal and corporate email accounts. What happens here is that most people use the corporate accounts strictly for business related matters and corporate mail, while their personal emails are used for everything else (where the exposure to harvesters is most likely to happen).

    I have lots of friends who post messages on the Usenet using their corporate email accounts. Guess the result? Lots and lots of SPAM.
  • You have got to be kidding! I get about twenty times the spam at work as I do at home. At home I just get one or two a week sent to webmaster, offering colocation, traffic enhancement, and other minor crap. But I work I get hardcore porn ads, Mrs. Mojimbo from Nigera, term life insurance, penile enlargements (add 4 inches!), diets (remove 4 inches!), and some stupid time traveller trying to get back home.

    It's all my work's fault, of course. They inadvertently left an open relay in place long enough for us to get blacklisted by the good guys and primelisted by all the bad guys. It's fixed now, but damn! I get about 50 to 100 a day.
  • by Ken Williams ( 28157 ) on Sunday December 08, 2002 @09:14PM (#4840981) Homepage
    hrm, we use complex filtering software and techniques, and i still get lots of spam. i receive about 200 work related emails each day to a certain account, and about 25% of that is spam.

    what i really wonder though is how many legitimate (non-spams) emails i never receive because of filtering software! i frequently get email or calls from people who claim they sent email that i never received. i also frequently get mailing list bounce warning emails (primarily from securityfocus lists though) claiming that emails sent to me are bouncing. hrm ...
    • what i really wonder though is how many legitimate (non-spams) emails i never receive because of filtering software!

      That is how the spam war will end: The spammers will become sophisticated enough that no matter what we do, any filter we try to use will result in too many false positives (falsely labelled "spam") to be of any use.

      (False positives, of the four possible outcomes, are by far the worst, if you think about it.)

      Spam is only going to get worse.
      • That is how the spam war will end: The spammers will become sophisticated enough that no matter what we do, any filter we try to use will result in too many false positives (falsely labelled "spam") to be of any use

        At this point people will most probably switch to whitelists or somesort, however I had a horrible thought once when thinking about this.

        <horrible_thought>

        Another approach other than a whitelist is to include a signature like PGP in the email. This could be placed in the headers of the mail and attached by the mail client. Mail servers could have an option to check these signatures automatically, or the signature can be checked by the recieving mail client at the expense of a bit more bandwidth. Once the clients can transparently sign and verify messages this means that a user can choose to only to accept signed messages (i.e. I don't add you to a whitelist but you need a valid key). These keys need to be managed by some central authority which revokes keys if they are found to be used by spam, therefy causing all the messages sent to be useless.

        My horrible thought is that MS is in the best position to offer this becasue of the Outlook/Hotmail dominance. They would call it their spam inititive and ship all updates to outlook with this feature, the next update when the feature is widespread would auto-enable the feature. This would block out most mail to and from non MS agents in the name of fighting SPAM.

        </horrible_thought>
  • We use spamassassin [spamassassin.org] at work, which we've just setup recently.. We've been using pegasus email [pmail.com] for years and years. Since the machines were ps/2s running dos 3.x. pegasus doesn't cut down on spam, but there is *no* excuse for email clients such as outlook that can infect your computer with such apparent ease. If you use a client like this, or force it on your users, you are an irresponsible net citizen.
  • at the place I work we have 3 full time people monitoring an expensive piece of spam filtering software. so if may save a couple of minutes of time off of the other 500 people, those 3 have been pulled from other duties to take care of the task...
    • Ahh. but the way that it is calculated is that if it takes only 3 mins per day deleting spam, it is costing the company 25 man hours per day to "just press delete". The real time spent on spam deleteion may be up to 6 times that number. Also... some of the spam may be from 3k to several megabytes. for a 100k spam message that reaches everyony, thats about 50mb of disk space. Multiply that by 20 spams/day, and the cost of disk storage for the mail server goes up..... (also the backup tape unit backing up the mail would have to increase in size)...

      Spam costs the company ALOT more than the software and the 3 fulltime people when all the other stuff is added up...

  • I still get spam addressed to my old company's two old obsolete domains (I can't persuade them to turn that off!), plus my old company's current, my current company's current address (I transferred from a subsiduary company, so get to see both email servers) and now both companies are in the processes of changing their domain names again, so it looks like another two servings of spam for me.

    Fortunately, I use filters which catch 90% of the 25 or so daily spams.

    As comparative data points, my home email (freely used in Usenet, etc) gets about 50+ spam per day, but as I use POBox.com [pobox.com], they kill 75% at the server, and another 20% gets forwarded with a spam tag, to get binned at my home PC.

    Oh, and my Hotmail address (an obvious [firstname]_[lastname]) gets almost zero spam, filtered or unfiltered - I think I get more messages from M$ than junk (well, non-M$ junk anyway!)
  • and I'll tell you why. The only reason businesses don't get as much spam compared to home users is because of one difference. The average home user doesn't have an IT department at their disposal to help fight spam. At the company I'm at we still get tons of spam for the same reason home users do. Too many people treating their work account like their home account and signing up for lists and things they shouldn't be. Spam has gotten so bad that we're considering implimenting the silver bullet of spam filtering, TMDA [tmda.net]. The only problem is that this is very difficult to impliment and it goes purely on a whitelist only basis. Spam is everywhere and anyone who says differently is either downplaying the problem, or living in a bubble.
  • At least in my office environment, where we've got new Pentium 4s running Windows 95 unpatched (it's an old-school custom-job database/workflow "solution" tying us down).

    We get our share of "You've been accepted!" but more common by far is "Japanese lass' sexy pictures" and "A very powful tool" - you know the drill. Our IT people's idea of security is forbidding accessing personal email accounts on the Web.

    I'd trade virus emails (which crash Outlook even when you're running VirusScan or similar) for spam any day.
  • Where I work, we get affected by each Outlook addressbook-reading virus as they come through, even though Outlook is banned on the internal network, with threats of firing employees who use it.

    Somehow, people don't seem to get the message.

    While these occurrences are not common, they generate a huge amount of email.

    They also generate a large number of clueless replies from people, asking to be taken off internal mailing lists that have been spammed, or back to the person whose addressbook has been compromised asking them to stop sending messages!

    It all comes back to education in my opinion ...
  • by nbvb ( 32836 ) on Monday December 09, 2002 @12:00AM (#4841712) Journal
    I work for a Rather Large Company (tm) and was tasked with architecting the mailgate for the entire company. Several requirements:

    1) Ingress spam & virus filtration;
    2) LDAP directory integration;
    3) Message address rewriting on ingress & egress.

    See, I was tasked with this when our company merged with 3 other ones, so we had a mess of Exchange and Notes servers out there. The idea was for me (your friendly local Unix sysadmin) to build a single ingress/egress point (my boxes) while the NT admins rebuilt all the exchange & notes servers into one coherent infrastructure. (That's a lot of work with ~40,000 employees!)

    Anywho, the way I did it was to install a pair of Sun boxes in our DMZ with Trend Micro VirusWall on it, as well as their eManager product. That handles our ingress spam & virus filtration. That product proxies an inbound connection on port 25 to another pair of Sun boxen that run Sendmail gateways, which, thanks to some custom rules, do the LDAP lookups & address translations.

    So we have multiple levels of SPAM & virus filtration -- the Trend stuff is very simplistic, crappy, relatively undocumented code, and works exactly as designed. As much as it looks amateurish to me, I can't help but to recommend it because it Just Freakin' Works. Also, if you're a big enough fish, the folks at Trend are incredibly friendly & helpful -- several of our suggestions made it into the product.

    Someone high-up in our organization decided after Nimda and Code Red that all inbound messages with attachments should be quarantined for an hour, because Trend promised virus pattern updates within an hour after a virus outbreak. We were able to graft that on using some shell scripts. Works just peachy.

    Between Trend Micro & Sendmail, we've got a GREAT solution that gives us plenty of filters. We have all the spam & anti-virus filters using Trend, and can block or redirect by domain using a mailertable with Sendmail. Also, the LDAP support in Sendmail wasn't very good when we started integrating that (8.10 was the first usable LDAP release), but by 8.12, it works great. We redirect the message internal to the company based on what's in LDAP, and it works flawlessly for ~1 million messages/day.

    Tastes great, less filling. And mostly free software (Sendmail was free, as was the Directory Server, since that license comes with Solaris.) All we paid for was the Trend Micro stuff, which we had a site license for anyway since we use it on the Exchange servers as well.

    So yeah, I'd have to agree that SPAM isn't NEARLY the problem at work that it is at home. Also, since we got the Exchange servers out of the SMTP business and "just" for mailboxes, we haven't had a virus outbreak since. Lovely!

    --NBVB

Beware of Programmers who carry screwdrivers. -- Leonard Brandwein

Working...