NYTimes: Tangled Up in Spam 413
ezekieldas writes "Congratulations to the SpamAssassin developers and community! There's a mention of SA in the NYTMag as "one of the best tools for network administrators..." in an extensive article entitled
Tangled Up in Spam.
The article is quite substantial and the author, James Gleick, is more technically educated than what we've come to expect from the big press. Central to the story is the complexity in dealing with spam effectively in both technical and legal terms and the confusion it brings upon the neophyte. The conclusion drawn may be oversimplified but nonetheless pragmatic: 1) forged headers should be illegal 2) a specific header entry should identify the email as unsolicited."
At last (Score:5, Interesting)
NO NO NO (Score:2, Interesting)
SpamAssasin in large corporate use? (Score:3, Interesting)
Illegal? (Score:5, Interesting)
Why does everyone in the USA assume that everyone else in the world will somehow obey US law when it is made "illegal"?
Experiment (Score:1, Interesting)
MIT's Post Servers... (Score:5, Interesting)
Always with the legislation... (Score:5, Interesting)
Garunteed Way to Block Most Spam (Score:2, Interesting)
Interesting free speech point (Score:5, Interesting)
Looks like we have the supremes on our side; if we could just congress to issue some letters of marque and reprisal on the spamhausen, we'd be getting somewhere...
Techical Solutions Are Required (Score:5, Interesting)
I think that breaking that economic model -- ending the reciever-pays system for email -- is the only way to fix spam. If you had to pay some amount of money -- event 1 cent -- for each message that is delivered, spam would stop being economical. And that's the only thing that's going to make it stop.
-Esme
The real way to get rid of spam (Score:3, Interesting)
Sure all these programs help, but think about what creates spam in the first place.
There are clearly people out there willing to buy the things offered in spam. Obviously not that many, but enough to make a profit. I think that there should be more of an effort to target these people and tell them not to buy stuff from spam!
There is only so much a program can do to stop spam. As we've seen numerous programs have been made, Spam Assasin being one of the best (I use it), but the spam just keeps coming
Until there is no incentive to send spam in the first place people will do it despite any laws against it.
Re:SpamAssasin in large corporate use? (Score:4, Interesting)
Personally, I'd like to see more companies using SpamAssassin just to prove that it can stack up against other products, because I think it can work well if it's configured properly and you use spamd. I use it on my mail server at home and at last check it catches 98.2% of all spam message sent to my machine, and I haven't had any false positives since I set up my whitelists.
No hope (Score:4, Interesting)
I just wish that I would not get emails in the same day to enlarge my breast and penis. It is just too sad and stupid.
Re:Illegal? (Score:3, Interesting)
First of all, it's a start. If the USA adopts this law, it may well be that many other nations follow suit, making life harder for spammers.
Second, it will help against spam originating from the USA. That guy Ralsky seems to be responsible for a sizable portion of all Internet spam. He is based in the USA, and taking orders from sites and companies in the USA. Even if his actual spam originates from an ISP in China, you'd still be able to take him to court for this.
Re:Illegal? (Score:4, Interesting)
Stop the flow of money from US residents, and you will be effectively making everyone in the world obey US law, with respect to spamming within and into the USA.
Re:Illegal? (Score:2, Interesting)
Um, that wasn't a troll. It's a valid point. If sending spam becomes illegal in the U.S., big fucking deal. Plenty of spammers are not in this country, and those that are will move offshore (c.f. KaZaA). Good luck prosecuting a bunch of spammers in some pacific island country...
Another cool anti-spam tool (Score:5, Interesting)
I've been using Cloudmark's SpamNet [cloudmark.com] for the past few months and it's been working quite well.
The smart thing that SpamNet does, is that it relies on its users to determine if something is spam or not. If some email lands in your inbox and a few hundred SpamNet members have proclaimed it spam, it most likely is, and it gets immediatly filtered out. This has the net effect of a few user's needing to filter out a few message ocassionally, while the vast majority of messages are filtered out for all users. Although SpamAssassin seems quite good, it's still based upon filtering rules and spammers are constantly tweaking their emails to try to get around them. Since people are still better at determining what's spam and what's not, I find that its accuracy is generally better.
SpamNet isn't perfect though, as far as I know, it only works with Outlook on Windows and doesn't have a Unix, Linux or Mac version. It also sometimes filters out valid bulk mailings, but overall, I would definitely recommend it.
Re:Always with the legislation... (Score:5, Interesting)
Consider the following. We all access the internet from a fixed and typicaly small number of physical and virtual locations. Were we to map the internet as a whole, starting from any given location the map would look like an expanding cone.
In short, almost all of the traffic from a given point flows through a very small number of servers and routers at some point close to the source.
Since spam messages are sent by the millions and it is fairly easy to determine what messages are likely to BE spam why not set up a filtering system on the routers that determines the rough content of a message based on both its Spam Precentage and the number of identical messages sent.
I.E. If the router sees 500,000 messages of nearly identical content with a 89% spam rating it blocks all of them. If it sees 44 messages with a 23% spam content it lets them through.
Thoughts anyone? I'm sure this idea has gaping flaws in it... what would have to be chnaged for it to work? What are the critical flaws? Is this a viable model or am I missing something major?
Re:SpamAssasin in large corporate use? (Score:3, Interesting)
Reasons for not using SpamAssassin are the CPU and bandwidth costs. Refusing e-mail from known spam sources is cheaper and (more importantly) does not give away information about which addresses are valid.
After checking the source IP address against lists such as Wirehub [wirehub.nl], Osirusoft [osirusoft.com] (despite its name not only a list of open relays) and/or some other lists, almost no spam will be accepted.
IP space is finite and, even better, allocated in ranges. Continued spam from (or spamvertizing a website on) an IP address is a very good indicator for more spam from the IP range.
Re:NO NO NO (Score:2, Interesting)
On the other hand, I doubt that any of this is enforcable in any event.
Comment removed (Score:3, Interesting)
Outlaw "forged" headers? (Score:3, Interesting)
The only headers that should be preserved are perhaps the Received: lines which show that route that the message has taken. Still, I can think of a legitimate reason to muck with these - if a company network has a sufficiently complicated internal structure, these headers might reveal some information that they don't want widely available.
Re:Talking of spam... (Score:2, Interesting)
Re:Illegal? (Score:3, Interesting)
Playing devil's advocate here, you still have to prove they sent the spam out, which would be that system's Achilles heel. Else what would stop people from hiring an offshore spammer to send out fake spam from a competitor?
Re:Kudos to SA. (Score:4, Interesting)
If you email address is simple (e.g. first initial+last name+some number) and your domain name is that of a public ISP, then there's an excellent chance that the spammers will find you regardless of whether or not you ever use the address. Email addresses at work tend to be safer because spammers usually don't bother guessing at addresses in domains with so few valid mailboxes.
I rarely ever get spam. (Score:5, Interesting)
1. Spend 10 bucks, buy a domain name (eg xyz.com).
2. Set up a few email aliases to point to your real email. eg:
joe@xyz.com ---> you@hotmail.com
temp123@xyz.com ---> you@hotmail.com
spam123@xyz.com ---> you@hotmail.com 3. Never give out 'joe@xyz.com' to anyone except friends/family.
4. Use the other emails for signing up for things on the web or in usenet.
5. When you get your first spam addressed to 'temporary21@xyz.com', delete the email address (no more spam from that source!).
I find this method works extremely well. By using aliases in this way you effectively hide your real mailbox. Even if your hotmail account starts receiving spam you can just get a new one and point your aliases at it. Also, if you change ISP you don't need to change your email address.
If you use it to forward to a hotmail account it might be better if the hotmail account name isn't a dictionary word or name (ie. use a random string for an account name that the 'bots won't guess.
You're screwed if your 'trusted' address gets out there but if you're careful you'll at least get much more use out of it before needing to kill it.
Internet mail architecture sucks (Score:3, Interesting)
Re:Kudos to SA. (Score:5, Interesting)
Bad idea (Score:4, Interesting)
There are also philosophical problems with such a scheme which others can explain...
Re:I rarely ever get spam. (Score:4, Interesting)
Re:SpamAssasin in large corporate use? (Score:3, Interesting)
We run an Exchange server. I didn't go with the free version, because we don't have the skill set to maintain it at our company. I have some Linux experience, but after 3 days of trying to get it to work I finally had to give up.
I installed Deersoft's SpamAssassin on my Exchange server. Kind of expensive (about $5000) and right now Deersoft customers are left hanging due to Network Associates purchase of Deersoft. NAI pulled the Deersoft version and are releasing it in Q2 2003.
A new breed of email is on the horizon (Score:5, Interesting)
With Bind 9, we finally have a decent, working implementation of DNSSEC. This will allow for a new breed of secure, verified websites and email, and (Finally!) makes a RBL actually mean something.
How's that you ask?
Well, one of the biggest problems with SPAM is the forged header, open relay issue. It's a complicated issue, and one that doesn't have an obvious, "in your face" kind of answer.
DNS is designed to tell you where to go, and SSL/Certs make sure that you got there. Why aren't they joined together? The fact that you are the DNS server for a domain makes it clear and obvious that you are an authoritative designator for where you are supposed to go - why have this wholy separate and dis-jointed SSL/Cert that can't even be made to work [slashdot.org] consistently?
If an ISP can issue DNS-SEC certs with impunity, we might actually see a reason to have encrypted and ISP certified email.
And suddenly, the ISP is back in charge again, able to validate every email going out as coming from one of it's customers. Revoke the cert and their email becomes unreadable.
Now, we have an email system with a powerful mechanism built in that is:
1) Standards compliant
2) Easy to implement
3) Clearly laid out
4) Cheap
5) secure
6) private - using the ISP's cert to identify yourself doesn't mean that the ISP can read your email! (like they can now - the command is "mail -u _username_")
What's not to argue with? The issue of locking down an open relay becomes a non-issue - an ISP could simply identify an "s-mail" server (secure mail) that will only relay for those holding a valid cert at that ISP.
Roaming wouldn't be an issue, nor would open relays or forged headers.
A brave new world? Yep. One I'd like to live in? Yep. One that's coming? We can only hope...
Where spam really comes from (Score:3, Interesting)
But most importantly of all, we cannot forget that American consumers are responsible for spam. That's right, spam is OUR fault. It is our fault because no matter how many messages are filtered, and no matter how many websites are closed for spam complaints (or get DDoS'd by rampaging slashdotters), they still make money. They make money because of that infinitesimally small group of consumers who buy stuff from spammers. That small percent is what makes it all worth it to them.
The day that spammers' profit margins drop to nil because consumers refuse to buy from spammers is the day that spam vanishes from our inboxes forever. No laws, no filters, no problems.
Unfortunately, as P.T. Barnum would put it, "There's a sucker born every minute..."
Re:Kudos to SA. (Score:3, Interesting)
I am wary of these thnigs too. I have various 'levels' of e-mail addresses. The actual real pop3 address practically nobody gets, except my parents, and a few technie friends. All of these people know better than to abuse an e-mail address.
The 'next' address is what most people I know get.
The webmail addresses are what I use if I do something related to 'the unwashed masses' . Those can get filled with spam, I don't care. I only check them once every few days.
For anything that is shown publicly, I always anti-spam-armour it, and make it some sneakemail address or unique address for my domain name.
Due to this strategy, I only get 3-4 spams or so per year.
Re:Kudos to SA. (Score:3, Interesting)
If you took the same precautions I did, how do you think you got into the spam-generals addressbook?
Co-worker unknowingly installed spyware on their computer which harvested my email address out of their email software address book. Sucks.
Two refinements: sampling and QOS filtering (Score:2, Interesting)
I think that the router should not use this information to shut anybody off. Rather, it should use this information to reorder its routing priority tables. Thus the router will serve its most spam-free peers first, handling the heavy spam forwarders only when it has time. Eventually consumers will leave ISPs with poor throughput, so ISPs will have a much stronger incentive to track down and terminate their members who spam.
Re:NO NO NO - for a different reason (Score:1, Interesting)
I have it configured to use AutoWhiteLists, and I had to tweak the scores assigned to the various bayesian filter rules a bit (they didn't have enough weight by default).
Since then, every single mail I've gotten has been correctly identified as either spam or not spam. It is *amazing* how accurate the bayesian filters are. When no other SA rules identify the mail as spam, you still see that the BAYES_90 rule was activated (90% chance the message is spam).
Just don't forget to use sa-learn-spam and sa-learn-nonspam so that the Bayesian filters are more accurate! Luckily, I haven't deleted a single mail (spam or not) since Nov 2001, so SA had a large base of spam to learn from
Re:I rarely ever get spam. (Score:1, Interesting)
Re:At last (Score:2, Interesting)
In a way it's just ignoring the problem.
If you want to forward your spam to Spamcop or similar you still have to actually look at it to be sure, and it's this approach which is more effective in making life difficult for spammers.
Also, Genius: The Life ... of Richard Feynman (Score:3, Interesting)
Check out where Gleick quotes Feynman on the inherent risk of Shuttle flights [around.com]. Prescient, that Feynman.
Re:Techical Solutions Are Required (Score:4, Interesting)
Re:Kudos to SA. (Score:2, Interesting)
Spam is not about content, it's about behaviour (Score:3, Interesting)
Spam is not about content. Not everyone even agrees what constitutes spam when they are evaluating it based on content, so how can a program or a recipient community do this? What makes mail spam is stuff like sending it unsolicited and in bulk. It won't matter what the content is.
I have signed up with some companies for announcements about their products. While that company may not be spamming, their content could have a lot of the same wording as another company selling similar products, but is sending it to harvested addresses. The latter is spam, but the former is not. How do you tell based on the content?
Tools that evaluate a message based on content are probably going to classify both messages the same way. If they are both classified as spam, then one of them will be "collateral damage". If they are both not classified as spam, then the other will be "leaky pinky". So I still prefer to block spam on the basis of the behaviour of the sender.
Re:At last (Score:4, Interesting)
Someone sent an email from us to spamcops saying we were spamming - I checked our logs and in one day one person sent us 4 unsubscribe requests - they never got another email but I wonder if it wasn't them. Anyway, we were totally shut down with no warning, two different sites (one hosted the website the other hosting the email program) yanked off the internet when spamcops complained to our ISP.
This is downright stupid. One, anonymous complaint (never did find out who did it so we couldn't very well remove them from our list!) and all our websites, over a dozen, art galleries, political sites, stores, and some 'adult dance club' sites (you do what you can to make clients now...) all went down. No warning. And no apologies from our ISP or spamcops when we pointed out they pulled our service with absolutely NO research, no attempt to contact us, no evidence whatsoever other than a sole complaint which could have been posted by anyone (um, competitors to the adult club jump to mind).
My ISP (Speakeasy) eventually got someone in touch with us who really did nothing more than empathize with how angry we were and promised to try and not do it again. That's it. There's a movement afoot to try and reign in this sort of insane overkill, one story here [website101.com] and an a nascent organization against overzealous antispammers is here [niba4u.com].
For the record, we did not have confirmation on our opt-in list so theoretically someone could have signed up another (say a priest or something) for our mailing lists. We never got more than a couple new registrations a day so there was no systematic abuse, still, we fixed this and added confirmation (using mailermailer.com, I'm very impressed with them so far) after the complaint (no need to knock us off the web to get our attention, a simple email would have done) and, as I said, we had valid contact info if they had only bothered to ask...
Anyone else been a 'victim' of crazy blacklist providers?