30 MB of spam

[miriam_e]

I logged on today to be deluged with 30 MB of spam from some halfwit doubtless hoping for some worthless footnote in history as being the moron who clogged email around the world for a day.

It is moments like this that you see with great clarity how ineffective are the common approaches to spam abatement. What people don't realise is that they are not only useless, but they can be easily misused to prevent legitimate but inconvenient emails from circulating. One of the servers I get email through has an automated spam filter. I don't have any say over what gets blocked, and I've always been a little suspicious about that. Recently I received email from a friend active in Amnesty International wondering why emails he'd sent me about the corrupt Kenyan government have been bouncing. I narrowed the problem to a link mentioned in the emails. I was unable to receive, or send(!) any email containing the link to the news website
http://allafrica.com

It reminds me of the stupid anti-porn filters that block sites about protecting yourself against breast cancer.

Solving spam is easy. All we need do is verify the source of the email the same way web pages are routinely verified for packet damage. If the sender is verified then forged email (the overwhelming mass of spam) instantly disappears. The remaining miniscule fraction can be blocked by your own filters or laws against spammers.

Why on Earth do we continue to search for solutions in easily corrupted rule-based systems?

Comments

[annie-lyne.livejournal.com]

Rule base systems, like SpamAssassin, do actually work. I've administered a spam filtering server at work. The success rate in tagging is about 99%. I could make the server even more aggressive than it is, but it's working fine at the moment, so it doesn't need change.

Rule based systems on its own, I'd say, are insufficient. DNS blacklisting works insanely well, looking at the logs on our server. This means that the potential exists for a server to block a spammer before it even tries to send any mail, so there's no bounce messages, no extra resources wasted, nothing.

What are you using to filter mail?

[annie-lyne.livejournal.com]

I also might add, even if one administrator implements clueless rules, this doesn't mean it's a technical problem, but perhaps also a human problem too....

[miriam-e.livejournal.com]

Yes, rule-based systems do work, but they are fragile, always play catch-up, and are open to misuse.

It would be much more satisfactory to use an email system that doesn't leave everybody open to the problems of the current system. Email has hardly changed since the early days of 7-bit communications. It forces encoding in wasteful base-64 (which is basically old 7-bit uuencoding) lets people be easily spammed, barely supports html, and other problems I can't think of just now (I'm a bit faint headed -- I've been up since daybreak but haven't had breakfast yet and it's about quarter to 4 in the afternoon -- eeek!).

DNS blacklisting is also open to misuse.

If you think these kinds of technology don't get misused then consider the problems in China with centralised authorities screwing with people's communications... and that is a relatively benign government. Imagine what happens with a truly horrid, fascist government. It came close to happening here with John Howard, and it may still happen in USA.

[annie-lyne.livejournal.com]

The game of catch-up is omnipresent in certain fields of CS, consider computer security. Bugs are being found all the time that compromise security and they are always being worked on.

There's more on this that could be elucidated, but I'm not in the right frame of mind either ;)