FTC study says spam filters are improving

Spammers are aggressive as ever, but ISPs are getting better at blocking junk messages before they reach in-boxes.

The story "FTC study says spam filters are improving" published November 28, 2005 at 4:28 AM is no longer available on CNET News.

Content from Reuters expires after 30 days.

[W2Kuser]

too many legit e-mails being blocked

This story is just simpleton cheerleading hype for the anti-spam vendors. It completely skips the bigger issue of more & more legit e-mail being blocked by increasingly extreme blacklisting practices.

What to shut down a competitor's business? Simply hire a spammer to use your competitor's domain name in a forged return address. MSN, AOL, Yahoo, Hotmail and tens of thousands of business will reject e-mail from your competitor without them even being notified.

And good luck getting your domain removed from the blacklist - there are very few, and non-standard proceedures to restore your domain name. You can't even find out which "service" has blacklisted your domain! It's the ultimate in "identify theft", but there there are no laws to protect the hijacked parties.

It's like having hundreds of secret credit reporting companies that let anyone add negative information about you, and you having no recourse to find & correct the harmful data.

[clsgis]

Joe-jobs survivable

When a spammer pretends to be you or your business in his spam, trying to take your Web site down, it's called a "Joe job."
I've got an old, widely published email address. Thousands of spams are sent to it daily. Recently, much of the junk is bounces from places that try to bounce spam back to the sender. It seems my old email address is popular with spammers.
My Internet service providers know. They think it's interesting and they're glad I host my own email now so they don't have to deal with it.
If your ISP doesn't know the difference between a Joe job and you spamming, you're at the wrong ISP. They're not all the same you know, and you get roughly what you pay for.

[hadaso]

Spam should be stopped at the source!

Most spam now comes from compromised PCs (infected with trojan horse software that allows spammers to route email through them). ISPs seem to neglect blocking these machines from blocking email, since they can assume that the recipient's ISP would use filtering to discard the messages.

Spam should be stopped at the source, not at the destination. The current practice of blocking it at the destination (filtering) gives a negative incentive to ISPs to act to prevent spam! The result is degrading of the email system that becomes less reliable: one is never sure that an email message would get through the filters set by the recipient's retarted postmaster! And most users do not get to really control the filters. They just pay their ISP to censor and discard part of their email.

[Stating]

Not Blocking Enough Emails

I am not yodeling for joy at my daily barrage of spam. Gee thanks Yahoo for giving me a gigabyte of free email storage -- I need it to receive all the spam I get.

Why is it that I cannot elect to block emails sent from country domains like China, Korea, Russia, Brazil? How many more fake Rolex and mortgage refi emails must I endure. How hard would it be for Yahoo Mail to add these blocks on the Filters page?

[billstewart]

Blocking by Country, Blocking at Source

Blocking countries that you don't want email from by domain name isn't very effective - most spam sent from China is .com or .biz or whatever. But some ISPs offer per-country blocking based on the sender's IP address, which is fairly reliable. Pobox.com, for instance, lets you use the country to either block mail entirely or use extra filtering, so I block mail from China and use extra filtering on mail from Japan.

Somebody else posted that spam should be blocked at the source, not the destination - but you can control the destination, and there are lots of sources out there, many of which are happy to accept spammers. Most responsible ISPs try to stop spam, though not all ISPs are responsible, and stopping mail from hijacked PCs is hard. Some ISPs block users from directly sending email, requiring them to use the ISP's mail servers instead, which is annoying to Linux users, who can usually run mail servers on their home machines better than most ISPs. It turns out that maintaining an IP address blocking list works just as well, and lets the recipient choose who to accept mail from.

[clsgis]

block as much spam as you choose

One reason I host my own email is so I can block and filter as I choose. I've published my block list
at http://tinyurl.com/brkrx
so you can use it if you like. Or you can subscribe your email server to any combination of public block lists (DNSBLs). Once you find a set of DNSBLs that work for you, it stops 90-95% of the junk. Then you can clean up 90% of what's left with something like Spambouncer or Spamassassin. If your address gets a five hundred spams per day, as mine does, maybe half a dozen will make it to your inbox. I believe this is the minimum level of spam protection typical corporations expect.

Of course, even though it's pretty easy now, few people are going to bother to set up a personal email server. But you *can* find an Internet service provider who lets you tune your own filters and whose blocking is more or less what you like. If you're using consumer DSL or TV cable, forget trying to make your ISP's email service work right. Lots of ISPs block most of .CN and .KR and .BRi and comcast.net. Shouldn't be hard to find a mailbox provider who does what you want. But you have to write them and ask, and it's going to cost a few bucks per month.

[hadaso]

Why spam works

Spam works because people use email as if it were text based telephone, or an electronic version of postal mail. It is not!

Spam works because people use a single email address (or a few) as if email addresses weres a scarce resource. They are not! The number of possible email addresses in a single domain is much much larger than the number of possible telephone numbers on the whole planet!

Spam works because people hold on to an email address as if it were a street address. It is not! Email addresses are not tied to specific hardware, like a phone number or a street address. They are just routing instructions. You only receive spam at an email address if you receive email on that address. If you switch an address spammers start from square one: they have to find out what that address is and then they can instruct a server to put messages in your mailbox (and by then you should already be using another address).

Spam works because spammers can safely assume that out of ten millions messages received, a million would end up in a mailbox and a hundred thousand would be read by recipients (that's 1%!). If only a thousand out of ten million would arrive at a mailbox, spammers would be looking for another job, but as long as people continue using an email address as if it were something precious to hold on to spammers would be working and getting rich!

Harvesting email addresses published on the web is a major source of email addresses that spammers use to construct their mailing lists. Obfuscating addresses like user (at) example (dot) com (instead of [e-mail]) works only because most addresses are not obfuscated in this way, and spammers do not need to waste their time overcoming this obstacle. If most published addresses would be obfuscated this way, spammers would easily overcome this obstacle. The real way to overcome the harvesting problem is to publish alternate means of communications: the usual way is an online form that can be filled by users, but a better way would be using temporary email addresses when publishing email adress on the web. For instance: [e-mail] would only accept two messages and then would stop routing email to me. A better approach that could be used by businesses would be a simple system that creates temporary email addresses for posting on websites and replaces them every day (blocking the old ones so they cannot be used again).

There are endless ways to avoid spam almost completely. But to defeat spam completely people need to realize that email addresses are as cheap as dirt, and there are better ways to use email than paying a lot of money to an ISP for the use of a single address that cost absolutely nothing to the ISP (the address costs nothing. The routing and storage of email costs money, but this cost is independent of the number of addresses used to receive the email).

[aabcdefghij987654321]

Your explanation is wrong (but interesting)

Spam works because people actually buy things from the spammers. If *everyone* simply refused to buy anything from a spammer then this entire global barrage of garbage would quickly dry up and blow away. The reason spam works is there's money to be made with it.

[clsgis]

spammers-for-hire scam the spamvertisers

Con artists are the most vulnerable to a con.

Certain spam-related crimes make money. The Nigerians and the phishers wouldn't keep doing it for no return. Mortgage "leads" sell for $15-30 each.

But I suspect a lot of spamvertisers, the people who hire the actual spamming gangs, are just would be con artists trying to sell worthless herbal remedies. They already fell for the worthless herbal remedy pyramid scheme. They'll keep falling for the con, thirty million spams with your sales pitch for $500 or whatever the current rate is.

I suspect it's a compulsive disorder for some of them, like gambling or shoplifting.
If that's the case, the junk will flow until it destroys the public email system, because there's an endless supply of would be con artists.