Jeff Key

It works on my machine

Sponsors

My Job

My stuff

Old stuff

Useful Stuff

CAN-SPAM? No, CAN-SPAM can't can spam.

I simply can't imagine this bill doing having any effect.  I read an article today that says MessageLabs estimates that 66% of spam is sent through hijacked computers.  This should not be surprising to anyone:  Spammers don't follow the rules.  Why in the world would they establish and respect opt-out services?  The vast majority of spam I get has Paris Hilton, teens girls, my neighbor or dogs in the subject.  You're telling me these people will want to run a fair business?  It just takes a couple dopes to click through to the sites in the spam to make their campaigns worth it. 

Who's going to stop these idiots?  How many spammers are there?  What is the process of tracking down and prosecuting these people?  Mugging is illegal everywhere, but people still do it and the return is apparently worth the risk.  The big difference is that the victim, and witnesses in some instances, see the mugger.  Not only do we not know who the spammer is, but it's pretty easy for them to cover their tracks.  If we can't determine who the bad guys are, how are we going to know which ones are worth the government's time and money to track down?

This can only be stopped with technology.  The single biggest problem right now is worrying about the existing email infrastructure, protocols, etc.  I say leave it alone -- it's old, there are existing anti-spam tools in place already, and needs it replacing anyway.  Microsoft, once the leader in proprietary everything, has been working on the spam problem since the 90's, Gates has recently been quoted as saying.  They should put out a solution that works with every OS/application they still support and let other interested parties have the specs.  Screw the critics.  We've waited long enough for an “open“ solution and what do we have?  Nothing but mailboxes full of porn, get-rich-quick schemes, PayPal frauds and trojans.

Posted: Dec 09 2003, 08:52 PM by jeffreykey | with 7 comment(s)
Filed under:

Comments

SBC said:

# December 9, 2003 10:33 PM

Darrell said:

I forget who this happened to, but some programmers on slashdot or whatever got the *physical mailing address* for one of the worst spammers, and signed him up for every direct mail catalog in the US. The post office was backing up trucks to deliver junk mail to him every day. And when interviewed, he said that what the programmers did was "illegal." Poetic justice reigns supreme.
# December 9, 2003 11:47 PM

Jon Galloway said:

Scoble is insane (http://weblogs.asp.net/jkey/posts/42381.aspx) and Michael Robertson is a crackhead (http://weblogs.asp.net/jkey/posts/33053.aspx). I'm gonna try to stay off Jeff's "axis of evil" list.

I like this approach to fighting Spam: http://tbray.org/ongoing/When/200x/2003/10/12/SpamPlan27. I'm cheap as hell, and I'd still pay a penny an e-mail to stop getting 200 spams a day.
# December 10, 2003 1:27 AM

Jeff Key said:

SBC: Definitely an interesting angle.

Darrell: Are you sure that's not an urban legend? If not, that's darn funny. Too bad they didn't sign him up for tons of manure.

Jon: You can't argue with the facts! :) Scoble's a good guy, he's just an easy target.

Thanks for the link. The thing that worries me about money-based spam deterrents is that I hear it's relatively easy for these guys to get stolen credit card info. Then, not only are the victims (the spammed) getting additional charges, but you wind up with new victims -- those whose cards are illegally being used to pay for the spam.

As for using the existing infrastructure, I actually favor the digital signature method, as it's been in a good number of mail clients for a while (at least MSFT ones), as he mentioned. Add to that a SpamNet-like "vote away spam" button and you're set. SpamNet was pretty effective for me, but it used some unknown technology to fingerprint the emails, which is getting harder and harder to do. With digital signatures, you pay for the _identity_, which is constant. Once you vote a _sender's certificate_ as a spammer, it works like a primary key and there's no question as to whether or not the sender is a spammer. Of course you run the risk of blacklisting legitimate folks like catalogs and whatnot, and that problem exists today with SpamNet. If the process of obtaining a digital ID is hard enough, it may make it ineffective to try to get a new one every time their certificate is banned.

The best solution I've used in the real world so far is SpamArrest. I've been using it for a couple months now and it's stopped over 6,500 spam and not let a single one through. Yes, I need to check what it didn't let through once a day to make sure something legitimate hasn't been stopped. BUT, having to do that is a heck of a lot better than dealing with false positives and false negatives.
# December 10, 2003 8:03 AM

Rana said:

Hi,
I agree spamming has to be stopped!Period.
# December 14, 2003 2:13 AM

Jon Galloway said:

Jeff-
On this subject, seen this: http://news.bbc.co.uk/1/hi/technology/3324883.stm ?
Mail sender pays, but pays computationally so the worry of stealing to pay for spam (something I'd never considered) goes away... or does it? I guess this might just unleash zombie farms of spam computers (even more so than they are now). Interesting, anyhow.
- Jon
# January 8, 2004 3:16 AM

Jeff Key said:

I saw a quick blurb about that a while ago, Jon, but didn't know the details. Good stuff! It would be a monumental task to get every email-sending application to use these new standards, which is the #1 problem in general: With such an established application base and protocols, where can you "inject" new goop that will have the least amount of impact? I say leave SMTP as it is and create a new protocol altogether, designed with what we've learned over the years. Yes, it's drastic, but anything that will have a significant impact will require massive changes on every client and server anyway, so why not start from scratch with an improved foundation?
# January 19, 2004 11:45 PM