Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Giving Your Greytrapping a Helping Hand

timothy posted more than 4 years ago | from the longing-for-more-actual-violence dept.

Spam 109

Peter N. M. Hansteen writes "Some spam houses have invested in real mail servers now, meaning that they are able to get past greylisting and even content filtering. Recently Peter Hansteen found himself resorting to active greytrapping to put some spammers in their place. The article also contains a list of spam houses' snail mail addresses in case you want to tour their sites."

cancel ×

109 comments

Sorry! There are no comments related to the filter you selected.

Give your COCK-AND-BALLS a "hand" (-1, Troll)

Anonymous Coward | more than 4 years ago | (#27290823)

Give your penis a helping hand. Jizz with joy as you cum on your already stickey keyboards while those porn spams finally start getting past your filters. Oh yeah baby!

Re:Give your COCK-AND-BALLS a "hand" (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#27291217)

good idea! thanks for the suggestion!

Re:Give your COCK-AND-BALLS a "hand" (3, Interesting)

PopeRatzo (965947) | more than 5 years ago | (#27293315)

I did my best to resist the impulse to stop browsing these comments at -1 because I had too often found interesting comments that had been modded down for the wrong reasons.

I guess I won't be able to do that any more, because I get too sad when I see how much energy some people expend in hatred of gays and blacks. Say, maybe we could filter comments by more than just the number? I wouldn't mind being able to see "-1 Flamebait" because often you find insightful comments that have been modded down by committed astroturfers, but "-1 Offtopic" (which my own comment here is, by the way) could get filtered out. Or how about a "-1 Racist/Sexist Asshole" moderation choice?

Where's the suggestion box here at Slashdot, anyway?

Re:Give your COCK-AND-BALLS a "hand" (3, Informative)

Miseph (979059) | more than 5 years ago | (#27294037)

You are able to do all sorts of wacky things with moderation effects. Just make all moderation other than off-topic have no effect on rating, and browse at 0. Presto chango, "-1, off-topic" goes away and everything else gets to stay.

Couldn't you just blacklist those servers? (3, Insightful)

interstellar_donkey (200782) | more than 4 years ago | (#27290915)

It just seems like it'd be easier now to find out the spam mail servers and block everything that comes from them.

Re:Couldn't you just blacklist those servers? (0, Insightful)

Anonymous Coward | more than 4 years ago | (#27291023)

Or everyone could just abandon email and move to using facebook to communicate.

Oh, that already happened.

Re:Couldn't you just blacklist those servers? (-1, Troll)

Anonymous Coward | more than 4 years ago | (#27291133)

**faggots

Fix'd that for ya

Re:Couldn't you just blacklist those servers? (1, Insightful)

Jurily (900488) | more than 4 years ago | (#27291045)

Your post advocates a

You know what, fill it out yourself.

Re:Couldn't you just blacklist those servers? (2, Informative)

noidentity (188756) | more than 4 years ago | (#27291181)

Your post involves a knee-jerk response. The original poster wasn't proposing a spam solution, merely asking whether dedicated spam servers would make it easier to simply blacklist them.

Re:Couldn't you just blacklist those servers? (1)

Antique Geekmeister (740220) | more than 4 years ago | (#27291991)

The knee-jerk is justified. The issues of botnetes used to send spam have been addressed here, repeatedly. And the issues of "legitimate" spam companies using forged SMTP information and co-located serves, worldwide, date back to the first commercial spam enterprises such as Canter&Siegel.

Re:Couldn't you just blacklist those servers? (1)

Nursie (632944) | more than 4 years ago | (#27291113)

Yeah, you would have thought that it would get into spamhaus pretty quickly and then RBL blocked like anything else.

Re:Couldn't you just blacklist those servers? (0)

Anonymous Coward | more than 5 years ago | (#27297491)

You would think so, but it seems like Spamhaus isn't always keeping pace with the spammers. Take, for example, this SBL entry: SBL74156 [spamhaus.org]

It was added on March 23rd. However, looking through my mail logs, they started spamming us all the way back on March 11th. So unless I set the greylisting period to 12 days, greylisting+Spamhaus is insufficient.

I do appreciate what Spamhaus does, and the XBL especially cuts out a lot of the spam I receive, but there's a lot that falls through the cracks.

Re:Couldn't you just blacklist those servers? (1)

JoshuaZ (1134087) | more than 4 years ago | (#27291171)

They are likely not keeping these servers indefinitely but renting them temporarily which makes this not a viable long-term solution.

Re:Couldn't you just blacklist those servers? (2, Insightful)

gmuslera (3436) | more than 4 years ago | (#27291221)

They are likely not keeping these servers indefinitely but renting them temporarily which makes this not a viable long-term solution.

For the ones renting them servers.

Re:Couldn't you just blacklist those servers? (2, Insightful)

JoshuaZ (1134087) | more than 4 years ago | (#27292557)

And are we not to expect that anyone renting servers has to check in advance that the people aren't spammers and if they mess up at all then they lose their entire business? How is that either just or practical?

Re:Couldn't you just blacklist those servers? (1)

dgatwood (11270) | more than 5 years ago | (#27293017)

If the companies are not complicit, they will yank the server offline the moment they get a couple of spam complaints from the recipient. That usually translates to about 3-5 minutes after their client sends me spam. It takes about that long for me to do the whois lookup of their ISP and compose an appropriately worded email message.... Thus, it is unlikely that spammers will pay for real servers unless the hosting providers are well aware of what is going on and merely do not care.

Re:Couldn't you just blacklist those servers? (1)

Lord of Hyphens (975895) | more than 5 years ago | (#27299783)

And you haven't pre-assembled 4-5 form letters and a couple scripts that parse the whois and send a complaint letter?

Re:Couldn't you just blacklist those servers? (1)

dgatwood (11270) | more than 5 years ago | (#27300179)

Obviously the company should confirm that the complaints are legitimate, but that usually doesn't take long.

Re:Couldn't you just blacklist those servers? (3, Informative)

Nursie (632944) | more than 5 years ago | (#27293641)

If you rent servers to people that spam me, then you lose the ability to email me until I here you've sorted your act out.

It's that simple. And it has to be.

Thats fine with me (0, Troll)

coryking (104614) | more than 5 years ago | (#27295057)

Cause I'll just email your manager and the sales guy who didn't get my customers email and hopefully you'll be fired.

Playing email games like that with your own personal mail server is fine. Doing it on a corporate network isn't. And nothing makes me more happy then sicking pissed off sales guys and managers in your company after you. It is far easier to get your manager or sales staff to force you to remove that blacklist then it is to deal with with the assholes like you or the guys running the RBL. The only legit RBL's are places like Spamhaus who have automated ways to remove yourself from their automated list. I have no problems with those lists because botnets will not remove themselves from the list, but legit people just follow the link in the bounce and are removed immediately. Anything else, I try to get assholes who use the list fired from their company.

Re:Thats fine with me (3, Informative)

Nursie (632944) | more than 5 years ago | (#27296429)

"Cause I'll just email your manager and the sales guy who didn't get my customers email and hopefully you'll be fired."

I'll be fired because I blocked email from an IP address in your range that's set up to fire spam at people?

No, I don't think so, in fact I can advise the sales guys and management that anything coming from that IP address is likely to be fraudulent anyway. Check who you rent servers to, and check their activity, or lose the ability for that IP address to mail my servers until I'm happy you've got your act together. The end.

Re:Thats fine with me (0, Troll)

coryking (104614) | more than 5 years ago | (#27298357)

Except you'd be wrong because we aren't spammers and dont have any on our network. "You" are just an overzealous sysadmin who blocked legit email that was meant for your sales staff.

Re:Thats fine with me (2)

Nursie (632944) | more than 5 years ago | (#27299301)

"Except you'd be wrong because we aren't spammers and dont have any on our network. "You" are just an overzealous sysadmin who blocked legit email that was meant for your sales staff."

Why have I blocked you in response to spam then?

What the hell are you even fucking well talking about at this point?

I propose to block a host I receive spam from until I receive some sort of assurance that it's not spamming any more. Why are you so angry about this?

Re:Thats fine with me (0)

Anonymous Coward | more than 5 years ago | (#27304861)

Well, I don't know what he's talking about, but here's what I've seen happen, a lot.

User "Ftard" in China starts spamming with a spoofed return IP, and a bogus return address which matches the mail server at the spoofed IP.

Spammed server "Monkey" begins to backscatter to the spoofed IP "bystander", which simply drops the backscatter.

Admin "Rtard" who runs "Monkey" proceeds to blacklist "bystander". "bystander" server admin calls you and you tell him to stop spamming. Since he's not spamming, he can't stop.

I propose to block a host I receive spam from until I receive some sort of assurance that it's not spamming any more.

That is understandable, and reasonable. However, I would add that upon request, you also be willing to prove both the origin AND content of the messages to be spam. I can't count how many times I've had to tell people "Look, just because you don't want email from your credit card or bank doesn't make it spam. You signed an agreement that they could email you."

In addition, think about someone running a hosting company. They might have 20 different customers all sourcing from the same IP but different domains. By blacklisting just the IP, you're actually shutting down multiple other email providers who haven't been spamming you.

The problem with that is (0, Troll)

coryking (104614) | more than 5 years ago | (#27295033)

You'll turn into SPEWs, or SORBS, or whoever those assholes are.

Start blacklisting ISP's who rent them servers, and soon enough You'll have blacklisted pretty much half the internet. Most of them are innocent too.

Vengeance blacklisting is for assholes. I once had a netblock land in SPEW's snare and rather than try to get de-listed, I just emailed the managers and sales people of the company who refused our email. I figured if I went over the power-tripping asshole running the mail server and went to somebody who understood how much legit email they probably losing, maybe the asshole mail dude would get fired.

Hope he did get fired too. You can blacklist whoever you want in your basement computer, but it is a whole different story when the company you work for starts rejecting corporate mail based on spite-lists like SPEWs or whatever you are suggesting.

Re:The problem with that is (1)

N1AK (864906) | more than 5 years ago | (#27295873)

Your points not that informative, and simply referring to mail admins who are trying to minimise spam mail to there users as assholes a dozen times won't change that.

Firstly, who says these people were talking about a corporate environment anyway? Secondly, when they blacklist emails there are other options than simply destroying all mail that reaches your domain. I have seen a number of setups which simply respond to 'spam' email with an email explaining the reason for the rejection and a phone number to contact to get your domain cleared.

Re:The problem with that is (1)

sgt scrub (869860) | more than 5 years ago | (#27298419)

Most of us "assholes" use metrics to make those kinds of decisions. From there it is easy to show the dumber ups how much spam is originating from specific sources and get them to agree on the +2 to spam score. Road Runner comes to mind (99.3% Jan08-Mar09). So does fdcservers (100% Jan08-Dec08). If you find anything other than open relays, proxy sites, or malware on fdcservers your doing good.

Re:The problem with that is (1, Troll)

coryking (104614) | more than 5 years ago | (#27298579)

Okay. Fair enough. There are exceptions.

I'm bitter because the now defunct SWEWs were overzealous assholes who cast a giant net. Our tiny /26 got caught when our upstreams /16 got blocked for whatever reason. We only had a couple clients get their shit rejected--and in those cases our client knew the recipients personally, I just had them call the recipient to inform them they had an idiot running their mail server.

The people using things like SPEWs to block mail traffic were not thinking like you are. They are either hoping for a quick fix or are on some kind of vigilante mission. The former can be educated by letting them know how much legit shit they've blocked. The latter are hopeless and as I said a few times, it is easier to let the higher-ups know what the deal is.

If you've got the stats to back it up, that is a whole different ball of wax. If I was in your list, I probably has doing some serious shit. I do the same thing only with comment spammers that have IPs of open proxies. As long as you have the metrics to back things up in the off-chance you do block a little legit traffic, life is cool. But you gotta have the metrics, which means you gotta thing. People who use spite-lists aren't thinking, and that is the problem.

Re:Couldn't you just blacklist those servers? (1)

Asic Eng (193332) | more than 5 years ago | (#27298703)

Well the only long-term solution I've heard about is this: http://www.deekoo.net/peeves/spam/spammers/premiere/index2.htm [deekoo.net] Mind you, that's not a legal solution. However if you ever get too much spam, I recommend looking at that site - it sure helps you to relax.

Re:Couldn't you just blacklist those servers? (2, Informative)

Lord of Hyphens (975895) | more than 5 years ago | (#27299861)

A quick note, turn off page styles if you're going to read that -- the background+text color combination is atrocious.

Grey-trapping (4, Informative)

goombah99 (560566) | more than 4 years ago | (#27291291)

I was not clear on the definition of grey-trapping. It is the process of providing decoy e-mail addresses that are discoverable by harvesters but not by ordinary humans. When mail arrives at the destination of a decoy, the sender IP address is then added to the spam filter of the receiver.

Basically sort of a honey pot approach.

So you might ask why can't ISPS do this at the ISP level rather than the user level? Make it opt-in, white-listable, etc..

The problem is what happens when some reputable sender get's on the list.

FOr example, Joe Spammer takes his address list and does a sing-up operation to Yahoo for all the addresses. Now the Yahoo registration server then does not automatically enroll them but still it sends an e-mail to every one of the e-mail addresses. some of which are the decoys.

so Yahoo gets grey-listed by the ISP.

I would think this attack would also foul up every grey-list in existance as well. So I don't actually understand how grey-listing works.

Re:Grey-trapping (3, Interesting)

Anonymous Coward | more than 4 years ago | (#27291455)

The problem is what happens when some reputable sender get's on the list.

I mentioned this to Mr. Hansteen a while back on usenet, warning him about putting his greytraps (and spamtraps) in public view on his webpages. All it takes for a legitimate sender to be listed with him, is one single newsletter signup with one of his traps.

Even though the trap will never respond, the sender will nevertheless have to send a message to the trap to attempt to verify the signup. Apparently, his list protects quite a lot of accounts, and he cannot whitelist everything ...

I never got a decent reply. I'm not sure what Mr. Hansteen's goal is, other than researching for its own sake and performing some good old sub-optimization of questionable value in the process.

Sounds familiar. (2, Interesting)

khasim (1285) | more than 4 years ago | (#27291883)

I was using something similar. The trick is to identify the ISP mail servers. Usually by some naming convention of the ISP ... but in some cases you have to just wait for a complaint to come when they get blacklisted. I solved part of that by sending the rejection list to the recipients at times so they could check it.

Meanwhile, greylisting is completely different.
Greylisting means that any new "triplet" (recipient name + sender's name + sending IP address) is TEMPORARILY rejected for X minutes. This is because many spammers were using zombie machines that would not try to resend the message OR would keep trying with different sender's names. Legitimate senders and email servers would (MOST OF THE TIME) be able to handle the delay and the message would get through. All future messages with that "triplet" would be received without delay.

Re:Sounds familiar. (1)

wvmarle (1070040) | more than 5 years ago | (#27294255)

I have the feeling that this grey-trapping is in combination with grey-listing. The honey pot e-mail server presumably uses greylisting by itself: it is as I understand meant to be the same server as that handles your regular mail.

So only mails that pass the greylisting will be trapped, so that are mails, presumably spam, that pass the greylisting and are sent from a real mailserver.

Those servers you want to trap and blacklist.

Now the problem arises indeed when junk is being sent through legitimate servers, in my case that is a very real problem as many Chinese webmail services are used by spammers, and by customers of mine as well. So I don't want to blacklist them.

The handful of mails that makes it through greylisting and spamassassin I can deal with manually. I used to get about 300 spam a day, greylisting takes care of the first 280, then spamassassin takes care of another 16 or so, and the last four well I can handle. I do have the strong feeling though that spamassassin is less accurate at detecting spam coming through real mail servers, probably because there are no/less obviously faked headers as well.

Re:Grey-trapping (1)

Erwin-42 (117944) | more than 5 years ago | (#27295371)

The ISPs are using this approach, it's called a "spamtrap". If you look at the spamcop reports for an IP or SNDS data from Microsoft you can see the number of spamtrap hits. This does not blacklist the sender right away, but it does increase their spamscore.

I think your Yahoo situation is unlikely -- I'm sure Yahoo has some rate limiting/captcha/etc. in place to prevent someone to sign up thousands of accounts programmatically.

A proposal: Solicited Bulk Realtime List (SBRL) (2, Interesting)

Khopesh (112447) | more than 5 years ago | (#27300899)

I've actually proposed something very similar to this before, called a Solicited Bulk Realtime List [khopesh.com] , which would be an elaborate DNSBL-style spamtrap whose purpose is determining which lists play fair (no-unsubscribe vs opt-out vs opt-in vs confirmed-opt-in) regardless of solicitations. Such an index would enable users to safely unsubscribe, and perhaps more importantly, its widespread adoption would force all "list" emailers, be they spammers or not, to better implement subscription management.

SBRL would also enable the ability for a filter to set a threshold for new list mail. Let's say I completely block any "list" mail that the SBRL can't confirm unsusbscribe works, and then I count a day's incoming confirmed-opt-in emails plus twice the number of the remaining emails (opt-in/opt-out). Anything over my threshold gets digested just like a mailman list with the digest feature (a collection of all of them that came in over the day) rather than direct delivery.

An IT-grade implementation could have new addresses start at a high threshold (e.g. 10) and then lessen by one per business day until it hits the default threshold, e.g. 3.

Re:Couldn't you just blacklist those servers? (3, Funny)

KiloByte (825081) | more than 4 years ago | (#27291373)

Sure, if you run a spam server, please mail me at aaron@angband.pl (or, if you sort it the other way, zeke@angband.pl). Don't use these addresses otherwise. Thanks.

Re:Couldn't you just blacklist those servers? (4, Insightful)

FooAtWFU (699187) | more than 4 years ago | (#27291505)

This is the point where we send you Gmail invites and suddenly you've blocked Gmail.

Re:Couldn't you just blacklist those servers? (3, Interesting)

KiloByte (825081) | more than 4 years ago | (#27291723)

Unlike the guy in TFA (who blocks the sender for 24 hours), I only assign some points in SpamAssassin.

Re:Couldn't you just blacklist those servers? (1)

russotto (537200) | more than 5 years ago | (#27292971)

It just seems like it'd be easier now to find out the spam mail servers and block everything that comes from them.

That's what he did. He just did it in an automated way by feeding the spammers addresses which, when used, would cause the automatic blacklisting of the host which used them.

Re:Couldn't you just blacklist those servers? (1)

sgt scrub (869860) | more than 5 years ago | (#27298209)

I think multiple MX domains on a single relay is the issue. If your site is hosted, run (unix/linux) host -t MX yourdomain.com. This will show you what your mail servers are. Now do that for someone else using the same hosting site. Every hosted site using that company will, typically, have the same response. Some ISPs create an alias so the MX request returns your domain but not many. Even the ones that do cheap out and use one ip address.

Um, (2, Interesting)

Darkness404 (1287218) | more than 4 years ago | (#27291029)

Um, how much spam does the average /.er even get per day? I have gotten exactly one spam message that has made it past Gmail's spam filtering this year (2009) and it was quick and easy to delete. I don't give my e-mail address out to everyone, but I do sign up to many things with it yet still it is very rare for spam to make it to even my spam filter. So is spam really that large of problem in 2009?

Re:Um, (4, Insightful)

tepples (727027) | more than 4 years ago | (#27291063)

So is spam really that large of problem in 2009?

It's Gmail's problem. The cost of filtering spam means Google has to put more ads on your messages and, if Gmail becomes unprofitable, possibly even terminate free Gmail.

Re:Um, (2, Interesting)

Idiomatick (976696) | more than 4 years ago | (#27291201)

Talking about costs. Spamming isn't free if you are running your own servers. And it is high risk. But as GP said spam never gets through gmail. One would think that the scrupulous spammer would not bother spamming gmail anyways. There is no benefit to doing so unless you just hate google and are using a lame form of ddos.

Re:Um, (2, Funny)

geminidomino (614729) | more than 5 years ago | (#27296423)

One would think that the scrupulous spammer would not bother spamming gmail anyways.

This message brought to you by Microsoft Works(TM).

Gmail is a goldmine (1)

coryking (104614) | more than 5 years ago | (#27298619)

I'm sure it is well worth a spammers time to at least try their luck spamming google. After all, the hard part isn't getting a list of addresses--you just spam a-zzzzzzzzzzz@gmail.com. The hard part is getting past their filter and if you can be the only spammer to gets it right, you win at being a spammer.

But yeah, something tells me spamming google from a real server would result in getting blocked pretty quickly.

Stupid spammers.

Re:Um, (0)

Anonymous Coward | more than 5 years ago | (#27298659)

I'm convinced that spammers are just not that bright. Fortunately for them there are plenty of dumber people with small penises out there to support them.

Re:Um, (1)

neiltrodden (981196) | more than 4 years ago | (#27291081)

They aren't targeting these emails at your average /.er though.

Re:Um, (2, Informative)

corsec67 (627446) | more than 4 years ago | (#27291089)

Just because you don't see doesn't mean that Google doesn't have to invest a large amount of resources to process spam, in terms of storage, network transfer, and CPU overhead.

Re:Um, (2, Informative)

Anonymous Coward | more than 4 years ago | (#27291131)

I wouldn't say that spam is a problem for the savy and those behind a properly configured server. But as a system admin for several area businesses, they would find themselves swimming in spam without proper filtering. Thankfully Spamassassin coupled with Vipul's Razor gives results comparable to Gmail's spam filter.

Re:Um, (1)

dirvine (1008915) | more than 4 years ago | (#27291149)

Is this spam sending not illegal in the USA? I see many of these addresses as located there, surely a quick federal related visit is warranted.

Surely these illegal activities can escalate or be backed by some pretty unscrupulous folks, seems like a good start to go get them now.

Re:Um, (5, Funny)

TheOtherChimeraTwin (697085) | more than 4 years ago | (#27291165)

how much spam does the average /.er even get per day? I have gotten exactly one spam message that has made it past Gmail's spam filtering

Wow. I remember when the average /.er was running their own mail server. Let me tell you kids, those where the days! The world economy was strong, and I didn't have to have cat food for dinner.

Re:Um, (3, Funny)

Anonymous Coward | more than 4 years ago | (#27291695)

"The world economy was strong, and I didn't have to have cat food for dinner."

I miss mom's cooking too.

Re:Um, (1)

wvmarle (1070040) | more than 5 years ago | (#27294261)

You mean you left the basement already and for good?

Re:Um, (0)

Anonymous Coward | more than 5 years ago | (#27296375)

You mean you left the basement already and for good?

No, my mother's dead, you insensitive clod!

I'm renting out the upstairs to cover costs.

Re:Um, (0)

Anonymous Coward | more than 4 years ago | (#27292317)

yeah, I'd suggest moving more towards deer food. Cat food can get you in trouble when your neighbors start noticing the disapearnce of their pets.

Re:Um, (1)

Nursie (632944) | more than 5 years ago | (#27293673)

"Wow. I remember when the average /.er was running their own mail server."

Hi there. I'm still here!

I also have a friend who runs a couple. Gmail is for suckers that don't mind giving away their data and don't have the balls to do it themselves.

I get minimal spam (about 1 a day maybe?) after setting up postfix to check headers, check spf and ask spamhaus.

Re:Um, (1)

zero1101 (444838) | more than 5 years ago | (#27302273)

I can't speak for anyone else, but I stopped running my own mail server when free webmail services got as fast, convenient, and effective at blocking spam. There's no real benefit to running my own server that outweighs the administration effort at this point.

Re:Um, (3, Interesting)

chimpo13 (471212) | more than 4 years ago | (#27291187)

I've seen an increase in spam that has made it past my gmail spambox in the last week, but I get several thousand spams a day so it's not a big deal.

I used to allow any email that shows up to the domains that I have, and I'd get way more spam. It's weird that 3,000 spams a day is slow since it's not like I go out signing up for stuff but I also don't hide my email.

I still get actual email that gets filtered as spam which sucks, but I put up with it since gmail works about 99.5% of the time. I wonder how many legit emails I've had that people think I ignored since I didn't respond.

Re:Um, (4, Insightful)

noidentity (188756) | more than 4 years ago | (#27291245)

I have gotten exactly one spam message that has made it past Gmail's spam filtering this year (2009) and it was quick and easy to delete. I don't give my e-mail address out to everyone, but I do sign up to many things with it yet still it is very rare for spam to make it to even my spam filter. So is spam really that large of problem in 2009?

I have seen exactly one malware on my machine that my virus scanner picked up and it was quick and easy to delete. I don't leave all my machine's ports open, but I do leave several vulnerable ones open yet it is still very rare for any of the malware's operation to be noticeable to me. So is malware really that large of a problem in 2009?

Re:Um, (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27295007)

You are the cancer that's killing the internet. I fucking hate you!

Re:Um, (1)

Runaway1956 (1322357) | more than 4 years ago | (#27291495)

I never count my spam. I've gotten a huge increase in spam, recently. At least 6 pieces since January 1st, maybe 10 pieces. I dunno if I carelessly filled in the wrong form somewhere, or what, but man, it's killing me. ;) Like yourself, I just marked them as spam on my gmail account, and I haven't seen any of them again. :-)

Re:Um, (2, Informative)

dberstein (648161) | more than 4 years ago | (#27291751)

I run my own mail server(s) and actually the number of spams I get is quite low with a daily average of 0.75 spams per day. That's down from ~20 spams a day before I enabled gray listing, RBL on my MTA and HELO restrictions.
There 0.75 spam/day emails are detected by my MUA's spam filter, meaning I tend to never have a spam email in my inbox!
You can find good/reliable VPS'es from $10/mo. that'll allow you to:
  • Run your own DNS servers.
  • Run your own SMTP/IMAP/POP servers (Postfix/Dovecote make a great combo).
  • Run your own web server.
  • Practice/learn sysadmin skills.
  • No lock-in to any vendor.

I rather pay for my own VPS than pay Google for a freaking email account and/or their App Engine.

Re:Um, (3, Informative)

cibyr (898667) | more than 4 years ago | (#27292109)

I rather pay for my own VPS than pay Google for a freaking email account and/or their App Engine.

Except google apps "Standard edition" is free [google.com] . And it's pretty much all you'd need unless you're a largish business. Pretty much the only difference is you get a mere 5GB (of which I'm using something like 200MB) instead of 25GB per mailbox, a limit of something like 50 users, and you don't get their mobile access and migration tools. You get SMTP/IMAP/POP and the best webmail interface there is :)

Re:Um, (2, Interesting)

dberstein (648161) | more than 4 years ago | (#27292821)

Webmail as your primary MUA?! Are you kidding me?
I guess that's like saying skateboarding should be your primary transportation vehicle. Some people do it I suppose, but is it the best idea?
Get your own infrastructure and access your emails as you wish, like for example mutt on a remote terminal, or webmail (squirrelmail), or in any mobile IMAP client (my iPhone works great).
What about backups? What if tomorrow they change the policy of old/archived message?
I do have a couple of gmail accounts, but those are mostly for redundancy and seldom used by me.

Re:Um, (1)

maxume (22995) | more than 5 years ago | (#27294017)

Gmail does imap. It supports iphone. You can backup using imap.

There are still plenty of reasons for someone to run their own server, but "I need imap" isn't a strong one.

Re:Um, (1)

GMFTatsujin (239569) | more than 5 years ago | (#27301093)

Gmail's not so bad. It's even useful for professional purposes. For me, a Gmail account is good just to give to the outside world during job interviews.

It seemed more respectable, if not just easier, to say "me at gmail dot com." My other email address, which I actually use a lot, has a weird domain name that raised too many eyebrows, despite how personal and clever I think it is.

My infrastructure was set up when I had other professional goals in mind. I didn't want to have to rejigger it all for marketing purposes. Not when there was a simple, reputable, free alternative.

My job interview hits went up when I had an easy email account to give out. Gmail was a handy service to have when I wanted to remove obstacles to communication.

Re:Um, (1)

johnjones (14274) | more than 5 years ago | (#27292943)

they (google) are not so wonderful for bussiness stuff for personal stuff I like them but they seem to put a lot of bussiness email in the bucket...

oh well try explaining that to the CEO "well google trains the software not us"

exit stage left

Pretty much my experiance as well (3, Interesting)

coryking (104614) | more than 5 years ago | (#27295109)

Just switched a client to google mail for business (really, what is it called? Google Apps? Google Mail? huh) and have heard nothing but complaints. The "gmail" thing gets email that never shows up in their imap folder, their imap folder gets stuff that disappears from their gmail thing.

Attachments work funny.

If you delete message from a "thread" in gmail, it will delete every "send" and "reply" message in the whole damn thread and thus nukes all of it in Outlook. If you nuke a single message in IMAP, it fucks up how gmail handles the thread.

All kinds of things. Their thole thing is great, but the minute you want to use a "real" mail program on top of it (like most businesses I know), trouble brews and shit just doesn't work the way you'd expect. There was a reason Google took so long to add IMAP support--their whole damn system works like no other email program. I bet they had to basically hack the whole damn thing to work like a "real" mail system IMAP was designed for. Basically, using them is a horrible form of lock-in.

Now I have to move them back to a "real" mail system this coming week so their life can work as it always did.

Re:Pretty much my experiance as well (1)

KGBear (71109) | more than 5 years ago | (#27301497)

Sorry, but Gmail is not the problem here. Outlook is. I find it hilarious that you think Outlook is a "real" mail program. Outlook is a MS Exchange client and very good at that. But it is a lousy client for anything else. We have all sorts of users here (state university) and the Outlook users are constantly whining about IMAP, so much so that now they just don't even try it anymore. They just have decided "IMAP sucks" and they all just POP. Meanwhile the people using Thunderbird, Apple Mail, Eudora, Netscape Mail (yes, there are some of those. No, really.), heck, even Pine use IMAP with no problem at all. If you want to know about "real" mail programs, try something other than Outlook and take the time to learn -- say, Thunderbird -- properly. You'll be amazed.

Except it sucks (2, Interesting)

coryking (104614) | more than 5 years ago | (#27295087)

IMAP is flaky and slow. It is a hack to map googles lack of folders onto IMAP's idea of folders.

It is a bitch for an administrator. There is no good way for an admin to setup email forwarding accounts--yeah, the user can do it, but you have to create an account for them and they have to do it, you cannot!. Their concept of distribution lists suck. You cannot change somebodies email address without creating a new account. I could go on but I wont.

Basically, for a business, using Google apps sucks. The only thing it has for it is the webmail interface. But integrating "real" mail programs with it sucks.

Bottom line is Google apps is 100% lock-in. It does thing in its own unique way and does not integrate with anything else worth a damn.

Re:Um, (1)

Deagol (323173) | more than 5 years ago | (#27299981)

$10/month? Please, *please* name names.

The only one I know of is prgmr.com -- but they don't do FreeBSD, which is what I'd prefer.

Re:Um, (1)

dberstein (648161) | more than 5 years ago | (#27300803)

I've been happy with http://cheapvps.co.uk/ [cheapvps.co.uk] (Xen).
FreeBSD VPS I don't know, I've always used Linux ones (Debian in particular).

Stats (3, Informative)

coryking (104614) | more than 5 years ago | (#27295011)

For every single message you are getting, google is probably filtering out at least a hundred.

My own mail servers, tiny in comparison, get about a connection every second. 98% of those connections are rejected out of hand (bad HELO, fucked reverse DNS, residential IP address, bullshit brute-forced email address, etc) and of that remaining 2%, half is legitimate email. Which means for every hundred connections, one is legitimate. So 1% of all our mail traffic as legitimate. 1%.

In other words, you have no clue at all how fucking bad spam is. It is bad. Really bad.

Re:Stats (1)

leromarinvit (1462031) | more than 5 years ago | (#27303715)

I must be doing something wrong then. I run my own mail server too, and I get maybe 3-5 attempts at relaying a mail to somewhere else per day, and maybe one or two spam attempts per day. Some of which are filtered by SPF or reverse DNS checks, the rest is up to dspam to catch.

Re:Um, (1)

sgt scrub (869860) | more than 5 years ago | (#27298495)

So you don't give out your email address unless it is to sign up for stuff? I would say you are a good reason why google's spam filter is so well tuned :-p

Re:Um, (1)

cptdondo (59460) | more than 5 years ago | (#27298719)

I've had the same email address since 1994. I get about a thousand a day; some days it peaks at several hundred an hour.

Spam shows no signs of going away.

With Greylisting, SA, and dspam I get about 99% rejection rate. Still, about 10-20 get through a day.

Re:Um, (0)

Anonymous Coward | more than 5 years ago | (#27299955)

http://www.symantec.com/business/security_response/landing/spam/index.jsp

Dynamic Dolphin?? (2, Interesting)

azav (469988) | more than 4 years ago | (#27291095)

I seem to remember reading about a convicted spammer who created Dynamic Dolphin in Broomfield, Colorado. Does anyone else remember who this asshole was? I would not be surprised if he started the whole thing.

Re:Dynamic Dolphin?? (3, Informative)

wmbetts (1306001) | more than 4 years ago | (#27291195)

His name is Scott Richter.

Re:Dynamic Dolphin?? (1)

azav (469988) | more than 5 years ago | (#27293629)

Ahhh yes, Snotty Scotty. Why is this man still alive?

Re:Dynamic Dolphin?? (1)

geminidomino (614729) | more than 5 years ago | (#27296433)

Because it's illegal to kill him. Only reason.

More self-promotion on Slashdot... thanks! (1)

macraig (621737) | more than 4 years ago | (#27291277)

Not that there was ever really anything more than a facade of impartiality at Slashdot, but thanks a bunch for tossing even that facade in the dumpster.

This twit even writes about himself in the third person in an attempt to disguise his self-promotion; disgusting.

Wow! (1, Funny)

Anonymous Coward | more than 4 years ago | (#27291289)

From TFA:

Dynamic Dolphin Privacy Protect
5023 W 120th Ave #233
Broomfield
null,80020

Hey, I used to live in null! Had to leave though, there was nothing to do.

Yawn. Antispam is a commodity purchase now. (4, Informative)

CFD339 (795926) | more than 4 years ago | (#27292061)

At one time I invested a few weeks time into building a heuristic antispam filter. One of the principles I used was very similar to this (there were many others).

I came to the conclusion pretty quickly that in the game of anti-spam, the larger the email pool you have, the more efficient your heuristic tools can be. Once I proved that to myself, I went looking for who was doing the best job using the techniques I decided worked best, and routed my mail through them.

Its cheap, effective, and gets the spam off my network bandwidth. Even if you do a perfect job yourself, you're still paying for the traffic. That's a waste by itself.

If you're so worried about privacy, get yourself an appliance that uses the same principles as the services (like postini, etc.). Either way, antispam is no longer a business for the individual.

Re:Yawn. Antispam is a commodity purchase now. (3, Informative)

Gerald (9696) | more than 4 years ago | (#27292737)

Seconded. My email addresses tend to be old, public, and static. This means they get a ton of spam. It's not worth the time and effort of handling anti-spam in-house when Postini can do an equivalent or better job at a reasonable price.

Switching to Postini also freed up a ton of RAM and CPU on our hosted servers.

Content filtering? (3, Interesting)

martin-boundary (547041) | more than 4 years ago | (#27292593)

How does "investing in real servers" let the mail through content filtering? Last time I checked, a content filter reads the *contents* of the mail (ie not the envelope or the header, hence the name). The spammers can buy servers until they're blue in the face, that won't make a blind bit of difference to the outcome in that case.

Re:Content filtering ? exactly and add DKIM... (1)

johnjones (14274) | more than 5 years ago | (#27292993)

exactly combine this with DKIM and a external reputation system....

(looking at ones navel is fascinating but knowing what other people this is spam is a good idea)

regards

John Jones
www.johnjones.me.uk [johnjones.me.uk]

Easy (3, Insightful)

coryking (104614) | more than 5 years ago | (#27295137)

Because it is cheaper in terms of bandwidth and CPU to first reject email based on things other than content. For example, you can quickly weed out about 85% of all spam traffic by just rejecting assholes who use mail-formed HELO's or don't have proper DNS. Filtering based on simple things like that dont eat your CPU and are very effective*. You can also weed out a bunch of trash by simply blocking residentail IP addresses using Spamhaus**. Greylisting will nuke about 10% of the rest, leaving you with 5% for content filtering.

If spammers buy "real servers" it means they aren't sending you bullshit headers with funky smelling DNS. It means they will eat into your CPU budget because you now have to fall back on content filtering. You dont want to do content filtering. You want to have spammers strike out because they aren't acting like real mail servers. 85% of spam comes from shit that acts nothing like a legit mail server.

* If you your EHLO doesn't match your reverse DNS record, say HELO to a disconnect. If AOL and Yahoo are doing it, I'll do it too. Cause if you don't have it configured the way the big-boys like it, you have worse problems then me rejecting your email...

** whose list of residential IP's are provided by the carriers themselves, not a bunch of spiteful assholes like SPEW's. And if you insist on running some SMTP server at home, you can de-block yourself automatically by visiting their website. Plus I'm pretty sure the bigboys use this list as well, so again, if I block your email, AOL and Yahoo are blocking it too.

Re:Easy (1)

chrysrobyn (106763) | more than 5 years ago | (#27298029)

list of residential IP's are provided by the carriers themselves

Where do I get this list?

Re:Easy (1)

coryking (104614) | more than 5 years ago | (#27298827)

PBL IP address ranges are added and maintained by each network participating in the PBL project, working in conjunction with the Spamhaus PBL team, to help apply their outbound email policies.

Spamhaus PBL [spamhaus.org]

That list will block a good hunk of botnet spam before it ever gets past HELO.

I want to trap a Grey (1)

Oktober Sunset (838224) | more than 4 years ago | (#27292691)

Damn, I thought this was going to be about ways to construct a better snare for catching the aliens.

So far my pit trap has only caught a few squirrels, but I'll get one of those little alien bastards one day. And then we'll see how he likes being anally probed. SQUEAL PIGGY!! YEEHAW!!

Re:I want to trap a Grey (1)

PopeRatzo (965947) | more than 5 years ago | (#27293347)

They're not "aliens" so much as home invaders.

ho8o (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#27293183)

Due to (the troubles Fuck The Baby fate. L3t's not be

Final Solution (4, Interesting)

PopeRatzo (965947) | more than 5 years ago | (#27293333)

The article also contains a list of spam houses' snail mail addresses in case you want to tour their sites.

Can we "tour" those sites with molotov cocktails and pipe bombs?

Re:Final Solution (1)

anonymous cowshed (1503301) | more than 5 years ago | (#27295669)

Someone should tour them with a lawyer and sue the parasites. How much time & money is spent on spam blocking, they should repay it. It's shameful that they are all in the US too.

Re:Final Solution (1)

Hillgiant (916436) | more than 5 years ago | (#27300767)

Dust off and nuke the site from orbit. It's the only way to be sure.

RBN (1)

mgcarley (735176) | more than 5 years ago | (#27295951)

Ethics aside, has anyone thought of hiring the RBN to SPAM/DDoS these people? (Just to annoy them)

Fight fire with... Vodka... In Soviet Russia, fire fights you! (Sorry, had to be said).

what's greytrapping? (1)

Uzik2 (679490) | more than 5 years ago | (#27296515)

and why is it different than greylisting? Why did these guys feel the need to make up a new name for the something they're copying from someone else?

this is an idiotic (2, Interesting)

nimbius (983462) | more than 5 years ago | (#27296573)

and unsustainable practice. just because jacksauce saw some AOL ips spam him with subscription notices doesnt mean the return addresses actually map to real people, or the intended effort was prankish in nature. it could simply have been designed to manually harvest emails, all part of a botnetted script.

this guys out of touch. real people, the ones you hope for revenge, dont exist anymore in the spam world. if the problem becomes pronounced enough your spam filters should be able to generate a report of the offending subnets and allow you to blacklist them. problem solved.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>