×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Some Anti-Spam Vendors Blocking and Slowing Gmail

ScuttleMonkey posted about 6 years ago | from the need-something-more-dire-than-can-spam dept.

Google 163

fiorenza writes "Google's Gmail (and corporate mail) are being throttled and sometimes blocked by some anti-spam services, including MessageLabs and Antigen. Ars Technica reports that the blocking is a result of the Google CAPTCHA crack, which has allowed a deluge of spam from Gmail's clusters. Most users won't get blocked mail, but Ars confirmed with MessageLabs that Gmail delivery delays are to be expected."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

163 comments

It's ok though... (-1, Troll)

teknopurge (199509) | about 6 years ago | (#22993496)

This is to be expected from free mail providers. If you want quality service, including people that police spammers and watch their systems, then you obviously pay for the higher-quality email service.

Regards,

Re:It's ok though... (4, Insightful)

New_Age_Reform_Act (1256010) | about 6 years ago | (#22993516)

With the current state of the world economy, no one will be willing to pay for something that they get used for free.

CAPTCHA Replacement Idea (2, Interesting)

KnowledgeEngine (1225122) | about 6 years ago | (#22996246)

My 2 Cents... Show the user 5 images. Your job is to 1) Select the one image that is out of place with a radio button 2)Solve the captcha that is one of the 5 images 3) Choose which word best describes the remaining 3 images from a drop down/combo.
How this would work
..1....2......3.......4......5 (Captcha image)
Cat Cat Money Cat "Peaches"
Drop down choices (Housewive, Gutter, Salsa, Fruit, Cat)
Answer: 1-(Image3-Money) 2-(Peaches) 3-(Cat)
Of course this would only be reasonable for something one time only like signing up for gmail.

Re:It's ok though... (5, Insightful)

TheMeuge (645043) | about 6 years ago | (#22993526)

Umm... I have used a number of commercial email systems (in-house for major companies and institutions) and none of them could provide a service that was even remotely close to what Gmail does for free.

Re:It's ok though... (4, Funny)

teknopurge (199509) | about 6 years ago | (#22993588)

Then you haven't used Exchange, etc.

Exchange trumps Gmail easily. No Contest.

Regards,

Re:It's ok though... (2, Interesting)

flyingfsck (986395) | about 6 years ago | (#22993734)

and you certainly haven't used Citadel, which trumps Exchange by a wide margin.

Re:It's ok though... (2, Funny)

Ucklak (755284) | about 6 years ago | (#22993890)

and you certainly haven't used Lotus Notes, which trumps Citadel and Exchange by a wider margin.

Re:It's ok though... (2, Interesting)

teknopurge (199509) | about 6 years ago | (#22993904)

I'm forced to use Notes every day.

Exchange is -years- ahead of notes.

Re:It's ok though... (2, Informative)

ubrgeek (679399) | about 6 years ago | (#22994230)

Notes is a bitch to admin and has a serious learning-curve but it's absolutely bulletproof. It's also used in some places as a tie-in/point of connection to DMS [wikipedia.org]. Like I said, I'd hate to admin it, but I love know it's going to be reliable (and I mean C&C reliable) when it's administered right.

That's so very very sad. (1)

CFD339 (795926) | about 6 years ago | (#22994610)

You must be in some crappy shop running a years out of date version administered by buffoons then.

Re:It's ok though... (5, Funny)

kitsunewarlock (971818) | about 6 years ago | (#22994416)

And you certainly haven't used a telegraph. I only get spam about once every month or so, and I can usually ignore it by about the 15th beep or so.

Re:It's ok though... (1)

xmas2003 (739875) | about 6 years ago | (#22995614)

Then you certainly haven't used /usr/ucb/mail, which trumps Lotus Notes, Citadel, Exchange, and Gmail combined!

Re:It's ok though... (5, Funny)

CowboyNealOption (1262194) | about 6 years ago | (#22993794)

I have yet to see Exchange work well in any environment over a few dozen people; certainly not without investing large amounts of money on duplicate servers and hardware. Included is my favourite Exchange analogy: If the same method that exchange/outlook uses to store email were used in the real world as a paper filing system: Every document is translated into Greek, and the original is burned. Then they are all glued together into one solid block and stuffed into a magic box with a tiny slot, through which you can talk to a little gnome who somehow gets each message for you as needed. Sometimes the gnome gets confused and it takes hours (sometimes days) for him to sort things out; meanwhile he can't find your documents until he is totally finished becoming unconfused again. As an added bonus the gnome costs several thousand dollars and when he dies every few years you need to buy a new gnome. Oh and if the first box gets (arbitrarily) full you have to buy another special gnomebox, which of course costs $$$

Re:It's ok though... (4, Insightful)

imemyself (757318) | about 6 years ago | (#22994058)

Wow, if you're having that many problems with Exchange, your sysadmins need to do a better job. Exchange is generally a pretty good mail/groupware server for corporate environments. If you throw an Exchange server together in five minutes, then yeah, you might have some problems, but as long as you think it through beforehand (and like with anything computer related, have a good backup strategy) it should work pretty well unless you have some really unusual requirements.

Re:It's ok though... (2, Interesting)

kesuki (321456) | about 6 years ago | (#22994152)

I remember reading a post about one poor hapless admin, who had come across an exchange server that was eating 10 GB of HD space a day, couldn't figure out what was causing the massive use of disk space, his company was in the middle of their most critical time of year, and he had 3 days left before the server crashed again and he'd be out of a job if he lost 12 of so days (since the last backup of that servers files) of e-mail.. it was an old post, and the people who had ideas were ideas the admin had already tried.

I'm fairly sure that the shit hit the fan and he took the blame, and i can't imagine a single reason why anything other than poorly designed malware, or a really rare hard to reproduce bug could be eating 10 GB of disc space a day...

If it had been recent i would have suggested he find a tool to let him add an external raid array for the OS to keep eating the 10GB a day until he had the problem locked down... but, it was too late for my advice...

Re:It's ok though... (2, Informative)

CowboyNealOption (1262194) | about 6 years ago | (#22994640)

The really nice thing is if you don't buy the superdupermondo version, you can add disk space until you turn blue and it won't matter: the mail stores in the standard exchange 2003 version are limited to 2GB, you can only have one, so be prepared to fork over more money for a version that is identical, except it doesn't have the limit. As an added bonus, feel happy that you could have bought a really nice linux server for the cost of the exchange software alone.

Re:It's ok though... (5, Insightful)

imemyself (757318) | about 6 years ago | (#22995226)

That is *completely* incorrect. In Exchange 2003 prior to SP2, the limit for the mailbox store was 16 GB. In SP2 they upped that limit to 75 GB, which really is probably enough for most of the small organizations that probably just have a single server running Exchange Standard.

Here is a document about it, scroll down to the part where it says Licensed Database Size Limit. http://technet.microsoft.com/en-us/library/aa998066.aspx [microsoft.com]

In Exchange 2007, Standard Edition can have up to five mailbox stores in each of five storage groups. And there is no limit on size. http://www.msexchange.org/tutorials/Exchange-2007-Store-Related-Changes-Improvements.html [msexchange.org]

Its also mentioned on the Microsoft Exchange page on wikipedia.

I'm not saying that Exchange is a perfect mailserver for (or worth the cost in) every situation, or denying that Microsoft does some really annoying things, but please try to get your facts straight before you complain about a piece of software.

Re:It's ok though... (3, Insightful)

Anonymous Coward | about 6 years ago | (#22996344)

While the 2GB size was erroneous, it is true that 2003 Standard is limited to a single mail store (see the article you linked to; it says as much). So prior to SP2 you were stuck with 16GB total size.

I find it typical that you start mentioning Exchange 2007; pretty much every Microsoft person recommended we upgrade to the newest software when we started having trouble with our Exchange server. Luckily we decided to get off the Microsoft upgrade treadmill; it was a pretty easy sell when we saw how much just the software alone cost.

Re:It's ok though... (1, Informative)

kesuki (321456) | about 6 years ago | (#22995620)

um the problem i mentioned the disc usage wasn't directly tied to exchange, it was tied to a 'feature' of windows, where it was endlessly consuming more and more gigs of space, at a rate of 10 GB a day. just wanted to be clear here, this was due to a 'feature' of windows not exchange server.

It just happened to be happening on a mission critical exchange server..

Re:It's ok though... (1)

Com2Kid (142006) | about 6 years ago | (#22995696)

A good admin would have fired up Sysinternal's Process Monitor and found out who in the hell was writing to disk. Looking at IO by process would have pointed to the culprit pretty quickly. Of course you won't find step by step instructions on doing that by Googling, one would have to show some initiative, but a good sysadmin has a virtual swiss army knife of tools that they use to keep things taped together.

Hell, if the emergencies didn't pop up at the worst possible moment, what fun would be left to have?

I've worked both in the server room keeping things patched up and out front with the people who write the stuff that breaks. The server room is almost always more fun, every day is a new emergency, but that is what you sign up for!

(Besides, sysadmins with systems which never break may find themselves out of a job! )

Re:It's ok though... (3, Insightful)

Bryansix (761547) | about 6 years ago | (#22994692)

It's funny how a good backup strategy involves NOT using anything from Microsoft to backup exchange. I mean seriously, how long has been exchange been out and Microsoft can't make a backup program that can backup and restore individual mailboxes? WTF! Oh, and I don't want to take the store offline to do it.

Re:It's ok though... (1, Interesting)

rabbit994 (686936) | about 6 years ago | (#22994832)

Wait? Exchange 2003/2007 Recovery Storage Group? Maybe it's time your Exchange got an upgrade.

Since Exchange 2003 SP2 I haven't seen Exchange Database corrupt itself and I deal with servers running 100-200 users on single servers. These servers have had RAID drives fail, Power pulled from them and users do some really idiotic stuff. Databases always came back ok.

You could have really nice LInux server for Exchange money, but you would also have something with a bunch of half baked software that didn't have nice Desktop Client, didn't support your blackberry like it should and is asking to break when you update one piece of software.

Re:It's ok though... (1)

Techman83 (949264) | about 6 years ago | (#22995388)

I would have to disagree, it's only ok if you don't know any better. I describe our exchange box as a 2 year old screaming child. It requires regular maintenance that cannot be done live.I cannot believe that large orgs use this as it is really only manageble in a small org, in which case there are plenty of easily setup foss software with far better support!

Re:It's ok though... (1)

urbanriot (924981) | about 6 years ago | (#22996106)

I couldn't agree more. Our company builds Exchange servers (single and clusters) for clients ranging from small business to large corporations, and after initial install we rarely have any post installation administration requests. We build our servers, install them, and they happily run for years.

I have no idea what that analogy you're jabbering on about has to do with anything, but you should try to find someone with experience to build your servers rather than whatever paper MCSE you have running the show.

While I'd love to see a good open source alternative that can do everything Exchange can do, as well as it does it, but I've found Exchange a treat to work with since 5.5.

Wow, if you're having that many problems with Exchange, your sysadmins need to do a better job.

Re:It's ok though... (1)

toadlife (301863) | about 6 years ago | (#22994108)

I have yet to see Exchange work well in any environment over a few dozen people; certainly not without investing large amounts of money on duplicate servers and hardware.
I have.

Re:It's ok though... (1)

LoadWB (592248) | about 6 years ago | (#22994172)

That *is* funny. Though I have never had this experience with Exchange 2003 at any site I've managed over the past five plus years. In fact, our Exchange 2003 installations have remained rock-solid and stable. These installations range from five people to over 50. Very happy with the performance and stability.

That is not to say that I have not seen Exchange 2003 tank. It happened recently to a colleague running on Windows 2000 Server. Lost his mail store.

But there are arguments on both ways of doing things: separate databases or files for mailboxes, or one monolithic mail store. I have seen uw-imap and QPopper eat mailboxes -- stuff happens sometimes. ::shrugs::

But that is why we are administrators, because the technology is not flawless.

Re:It's ok though... (1)

CowboyNealOption (1262194) | about 6 years ago | (#22994276)

I will admit that Exchange 2003 seems better than 2000 (which I have had eat an entire mail directory; adios email until a restore is done, and you lose everything that came in since the last backup). The latest issue with Exchange 2003 required it to rebuild the mail store, which took over 24 hours to complete (granted the hardware wasn't super fast, but still we were only talking about less than 2 gigabytes of email here). The same setup, using a linux mail server storing email in maildir format would have taken minutes to recover from, rather than hours. And as an added bonus, everyone except the impacted mailbox (and most likely, the single email message that was corrupted) would have continued functioning just fine.

Re:It's ok though... (3, Insightful)

Sleepy (4551) | about 6 years ago | (#22995292)

>Exchange trumps Gmail easily. No Contest.

As a source for spam, and a plague of server-generated 'automated' notices, Exchange beats EVERYTHING.

Exchange is fine if you keep it where it belongs: inside a workgroup or protected by a SMTP-protocol filter (which is not running on the same box).

Recently I had to defend a customer who was the target of a DDOS... 80% of which were "bounces" from Exchange (forged From: undeliverables, permanent Out Of Office, DSNs, Mailbox full emails, etc). Exchange is pathetic in terms of controlling what gets "onto" the server.

By comparison, Google mail is a VERY good Internet citizen. They may have had Captcha compromised, but they'll plug it up. I'll them over their competition anyday.

Re:It's ok though... (0)

Anonymous Coward | about 6 years ago | (#22995352)

Those are easy to shut off in Exchange, but it still requires somebody to actually be aware that it needs shutting off. Exchange may have stupid defaults, but every product is susceptible to that at some point or another. I'm sure whoever set up that machine and paid *such* close attention to it would create an equally bad sendmail box.

Re:It's ok though... (0)

Anonymous Coward | about 6 years ago | (#22994462)

You mean they don't have adverts automatically inserted?

Re:It's ok though... (3, Funny)

anotherone (132088) | about 6 years ago | (#22993546)

Did you seriously just post an unsolicited commercial message in a thread about how unsolicited commercial messages are watering down legitimate communication mediums?

Re:It's ok though... (0)

Anonymous Coward | about 6 years ago | (#22993554)

Oh, I see, if by "higher-quality email service" you mean a service that won't let most legitimate mail get through, while blocking a minuscule amount of spam, I guess you're right.

Re:It's ok though... (3, Insightful)

Stochastism (1040102) | about 6 years ago | (#22993572)

This is to be expected from free mail providers. If you want quality service, including people that police spammers and watch their systems, then you obviously pay for the higher-quality email service.
I suspect Yahoo, Hotmail and Gmail between them have more "police" than most other commercial providers put together.

I don't necessarily believe these free services are inherently low quality. What is true is that they are a massive target for spammers. Spammers get something from these services they don't get by sending mail directly by SMTP: DKIM and SPF authentication from (relatively) high reputation IPs.

Yes, they all go around blocking each other sometimes, but this is not new. I vaguely remember complaints about Gmail being blocked by Yahoo (or was it the other way around) a couple of years ago.

Re:It's ok though... (2, Insightful)

teknopurge (199509) | about 6 years ago | (#22993672)

Q: How do you keep the majority of the spammers away?

A: Attach a price-tag.

Regards,

Re:It's ok though... (0)

Anonymous Coward | about 6 years ago | (#22993854)

Aaargh. I know this is petty and small but stop signing everything with regards. It shouldn't but it is really annoying me.

Re:It's ok though... (1)

Kalriath (849904) | about 6 years ago | (#22996238)

It's to draw attention to his signature, which is an advertisement. Stop being so surprised.

Re:It's ok though... (0)

Anonymous Coward | about 6 years ago | (#22994500)

I have to agree with the other poster. If you absolutely must put "Regards," at the end of every post, at least put it in your signature. That's what it's for.

Also, "price tag" is not hyphenated.

Re:It's ok though... (1)

rubah (1197475) | about 6 years ago | (#22994970)

Our on-line signatures are not so much signatures as rubberstamps. Sometimes people like to go for the more personal effect.

Re:It's ok though... (4, Informative)

kris.montpetit (1265946) | about 6 years ago | (#22993752)

This is to be expected from free mail providers. If you want quality service, including people that police spammers and watch their systems, then you obviously pay for the higher-quality email service. Regards,

What can i say, Google gives me 7 gigs of space for my account, the most popular local ISP gives 100 megs, and this crappy service. Actually gmail is the only email client i've dealt with recently that isn't hell and a half to support. the anti spam service has been near perfect until now as well on all 3 of my accounts. :D

And saying thats its a budget service is just plain uneducated. its funded (quite generously, I might add) by the discreet, context sensitive ads you will find on the side of the page, as opposed to part of your internet subscription.

Re:It's ok though... (0)

Dan541 (1032000) | about 6 years ago | (#22996048)

What on earth do you need 7Gigs for?!

Unless your going to email a movie!

I agree 10meg is living in the stone age but 7gigs just seems overkill.

~Dan

Gmail and others blocking legit domains, so hey (3, Insightful)

gnuman99 (746007) | about 6 years ago | (#22993542)

There were number of times where my emails are silently deleted from Hotmail or even gmail, so hey. Welcome to the world of screwed up SMTP protocol. And all thanks to spammers.

Today email is less reliable message delivery medium than regular mail which is quite sad considering all transactions in SMTP were considered to be, well, transactions. An acceptance of email by destination means it is delivered, not going to /dev/null. Want to filter spam? Reply with 5xx codes instead - not accept with 2xx and then bin it (unless mailing list headers found in mail, there you can drop spam)

Re:Gmail and others blocking legit domains, so hey (4, Interesting)

imemyself (757318) | about 6 years ago | (#22993684)

I definitely agree with you, if a mail server accepts my mail with a 200 code, then the mail *should* be delivered. Even if its put in someone's spam folder, the message should get there. That's one of my pet peeves. That being said, from my experiences when setting up my mail server, Gmail was probably one of the best about not blocking legit mail (I've had an SPF record since the beginning though). I had lots of problems with Hotmail, and I think my mail was usually marked as spam by Yahoo until I enabled DKIM signing. With SPF records and DKIM, I don't think I have any major problems (though my mail server handles a pitifully small amount of mail, so its not like we're going to get marked as a bulk sender).

Re:Gmail and others blocking legit domains, so hey (5, Insightful)

BagOBones (574735) | about 6 years ago | (#22993910)

Really? Do you have any idea the resources this would take for some organizations?

Based on stats from my frontend SPAM filters 80 - 90% of ALL mail receive in a day is SPAM.

On my reports some individual users are targeted with between 1500 and 2000 SPAM messages a day. There storage quotas would probably be exceeded over night from SPAM alone.

I would need to increase my storage capacity immensely if I allowed every spam message to get to the users Junk folder. Not to mention the extra bandwidth of allowing all those mail delivery connections to complete OR to send NDRs to forged senders that are going to bounce back at my system and cause even more load.

Re:Gmail and others blocking legit domains, so hey (4, Insightful)

freedumb2000 (966222) | about 6 years ago | (#22994116)

True, and it is really not necessary to pass all mail. In my experience weeding out mal-configured mail servers (i use postfix rules and greylisting) takes care of over 90% of spam. The rest gets caught by an RBL or tagged by spamassassin and sent to the users spam folder. Things may change any day though depending on future strtegies by spam senders, but at the moment it works quite nicely.

Re:Gmail and others blocking legit domains, so hey (0)

Anonymous Coward | about 6 years ago | (#22994154)

OT: Mass-mailings is spelled 'spam' in lowercase, not uppercase. It is not an abbreviation, nor is it a trademarked canned food product, but a regular noun.

Re:Gmail and others blocking legit domains, so hey (1)

Hyppy (74366) | about 6 years ago | (#22994482)

It's a noun, it's a verb, it's an adjective! It's a floor wax, it's a dessert topping it's... oh, wait...

Re:Gmail and others blocking legit domains, so hey (1)

imemyself (757318) | about 6 years ago | (#22994308)

OK, then use DNS/IP blacklists have your mail server's not accept the mail and report a 500-something error to the SMTP client that's trying to send it. That would block a substantial amount of the spam. Then the rest could be put in the user's spam folders based on content filtering, which can be very unreliable. I just noticed a legitimate message that spam assassin marked as an 8.1 (I've tuned it to put it in my spam folder at 3.3). If need be, the spam folder could be deleted every week. There's no need to send NDR's if you didn't accept the mail in the first place, and the blacklists would be applied before the actual message was sent, so it wouldn't be taking a massive amount of bandwidth. And if you're currently accepting the mail from the client and then just sending it to /dev/null, you're already using more bandwidth by accepting the mail.

I'm not saying that your mail server should accept and deliver every email it receives, but if your server claims to have accepted it w/ a 200 code, then I think its reasonable to expect that your server is going to attempt to deliver it. The different SMTP error codes are there for a reason.

My opinion on spam is this: ten pieces of spam getting through is a (relatively) minor annoyance; one legitimate email being sent to /dev/null (especially if the sender has no way of knowing that it was blocked) could be a disaster depending on the situation.

Re:Gmail and others blocking legit domains, so hey (1)

kesuki (321456) | about 6 years ago | (#22994358)

Most of the spam mail is identical, and goes to multiple accounts. if you have millions of users, then you can save space by making messages with identical md5 sums all take only one slot of disk storage space.

then you run into the problem that not all e-mails produce unique md5 sums (something only an e-mail provider with millions and billions of test cases would ever notice...) and well the occasional bit of mail gets lost because it produced an identical md5 some by chance as a spam message.

Re:Gmail and others blocking legit domains, so hey (1)

Asm-Coder (929671) | about 6 years ago | (#22994372)

Ok, so if your filters are picking up mail as spam, drop it, and reply with a 500 error. The original sender will receive a message saying "The message could not be delivered." A legitimate contact will ask whoever they were emailing by some other means, and will ask them to create a rule to allow their mail through. A spammer can't because all they have is an email, and won't be bothered to find out 10 million phone numbers and call them all.

You could even give the recipient a short message saying, "xyz@abc.com sent you a message that was marked as spam. Do you know this person and want to accept messages from them in the future?"

This isn't rocket science people. It's not hard to fix. The rules were set up with the potential for spammers in mind, and it has a built-in system for handling it. However, people who break the rules make it difficult for the system to work.

Re:Gmail and others blocking legit domains, so hey (1)

chromatic (9471) | about 6 years ago | (#22994900)

You could even give the recipient a short message saying, "xyz@abc.com sent you a message that was marked as spam. Do you know this person and want to accept messages from them in the future?"

This isn't rocket science people.

Your idea is better than backscatter, but how do you know xyz@abc.com really sent that message?

Re:Gmail and others blocking legit domains, so hey (1)

Dan541 (1032000) | about 6 years ago | (#22996192)

You could even give the recipient a short message saying, "xyz@abc.com sent you a message that was marked as spam. Do you know this person and want to accept messages from them in the future?"
 
So instead of 10thousand spams I get 10thousand short messages?

I can't say I'm optomistic

Re:Gmail and others blocking legit domains, so hey (0)

Anonymous Coward | about 6 years ago | (#22994588)

I would need to increase my storage capacity immensely if I allowed every spam message to get to the users Junk folder.

He didn't say that. Read it again:

if a mail server accepts my mail with a 200 code, then the mail *should* be delivered.

A 200 response is the mail server's way of saying "yes I accept this mail". To silently discard it after that is simply broken behaviour. If you aren't going to accept the mail, don't tell clients that you have.

Yes, spam far outnumbers legitimate mail. But a lot of that spam can be rejected while the client is still connected, meaning you don't have to store it all.

Re:Gmail and others blocking legit domains, so hey (1)

rabbit994 (686936) | about 6 years ago | (#22995978)

Use a decent SMTP Proxy like ASSP or other commercial systems where if it's marked as spam, the sending SMTP Server is given 5xx notice so if it's legit, user gets a bounceback and if it's spambot, it just disappears.

Re:Gmail and others blocking legit domains, so hey (2, Informative)

Spazmania (174582) | about 6 years ago | (#22994486)

if a mail server accepts my mail with a 200 code, then the mail *should* be delivered.

That's not actually the rule. The rule is: if a mail server accepts my mail with a 200 code, then the mail should be delivered *OR* a non-deliverable message should be constructed and returned to the envelope from address.

When you actually follow that rule, it's quite amazing how many folks get bent out of shape by the undeliverables returned when someone forges their address, even though they haven't bothered to use SPF to protect themselves.

Re:Gmail and others blocking legit domains, so hey (1)

Sorthum (123064) | about 6 years ago | (#22995268)

SPF has severe implementations flaws. Generating an NDR for a message you've accepted, back to a purported sender is contributing to the backscatter problem, and is NOT a viable solution.

Re:Gmail and others blocking legit domains, so hey (1)

value_added (719364) | about 6 years ago | (#22994700)

I had lots of problems with Hotmail, and I think my mail was usually marked as spam by Yahoo until I enabled DKIM signing. With SPF records and DKIM, I don't think I have any major problems ...

Yahoo allows you to request your server be whitelisted [yahoo.com], so you could have saved yourself the trouble with DKIM and friends. I did exactly that, and my DSL-based servers send and receive email all day long without issue.

As a side note, I use Spamhaus RBLs, so my spam (predominantly from the cable dynamic IP crowd) is essentially zero. By contrast, my Yahoo accounts' bulk folders were always filled with that kind of spam, when it wasn't filled with the legitimate emails from the many mailings lists I subscribe to. Yahoo has since (a month or two ago) made changes, and from what I can see, they no longer accept email from cable users.

If there's an irony in all this it's that doing things yourself is a bit more work, but infinitely more satisfying. To say nothing of the fact that it probably works better in almost all cases.

With SPF records and DKIM, I don't think I have any major problems (though my mail server handles a pitifully small amount of mail, so its not like we're going to get marked as a bulk sender).

You don't have to be a bulk sender to end up tagged with Yahoo's X-YahooFilteredBulk, for example. It can be your very first and only mail.

Re:Gmail and others blocking legit domains, so hey (3, Interesting)

gnuman99 (746007) | about 6 years ago | (#22993708)

Just to add something, the problem with 5xx replies is filter is *before* queue so some mail may be delayed and servers need to be contacted a few times before they get a delivery slot. For example, say gmail can filter 1 million messages at a time. That means 1 million open connections. So, if you are connection 1,000,040 you get 4xx response - temporary failure due to no available resources. So try again later.

This is not a problem, really. You can wait a few days until you can deliver the message as long as it is *delivered* eventually. /dev/nulling spam while accepting it with 2xx code is like burning unopened envelope at post office because it was typed instead of handwritten indicating possible spam.

Pre-queue filter with only 1 unique IP connection at a time to mail server. Problem solved.

Huge email servers get reasonably constant and predictable amount of mail per day and per hour and even per minute. They can plan pre-queue filtering with some margin for any spikes. And if there is a huge bomb and your mail doesn't get there for 7 days and your server gives up, hey, at least you get a "Could not deliver the message because destination was not available". Much better than "err, never got any mail from you" from the destination party.

Re:Gmail and others blocking legit domains, so hey (1)

Spazmania (174582) | about 6 years ago | (#22994508)

Pre-queue filter with only 1 unique IP connection at a time to mail server. Problem solved.

Botnet.

Re:Gmail and others blocking legit domains, so hey (0)

Anonymous Coward | about 6 years ago | (#22996420)

How is prevented DDoS on current architecture?? Firewall problem hosts out. Problem solved. Spoofed packets? Forward to mail server *after* connection was established and confirmed.

Re:Gmail and others blocking legit domains, so hey (1)

moderatorrater (1095745) | about 6 years ago | (#22993714)

Today email is less reliable message delivery medium than regular mail
Depends on where you receive your regular mail and how you do email. I've has less than 10% of my emails not get where they were going, and if you take out the former company domain that was spamming people, it's 0%. Where I live now, there's a good 30% chance that my mail won't get to me.

Re:Gmail and others blocking legit domains, so hey (1)

Teflon_Jeff (1221290) | about 6 years ago | (#22994652)

I wonder if Comcast has anything to do with this...

What? They've been behind most of the other internet throttling schemes lately. It's at least plausible to ask.

"And they would have gotten away with it too, if it hadn't been for those meddling Nerds."

Crack down (2, Insightful)

Midnight Thunder (17205) | about 6 years ago | (#22993544)

I am not sure what Google can do to crack down on this abuse, but they really need to. Have there been any improvement to their Captcha system since it was compromised? Are they closing down suspect accounts?

They will, eventually, be cracked again. (2, Interesting)

khasim (1285) | about 6 years ago | (#22993898)

What they need to do is have a process for detecting when an account is spamming.

Now, you and I would just say "when an account is sending 10,000 messages a day" and that would be correct for about 99.9% of the cases.

I'd also recommend Google "seeding" the spammers databases with "spamtraps" (not tied to Gmail or Google in any way). If an account sends email to a spamtrap, that account is frozen.

And so forth.

Re:They will, eventually, be cracked again. (5, Insightful)

timeOday (582209) | about 6 years ago | (#22994402)

What they need to do is have a process for detecting when an account is spamming. Now, you and I would just say "when an account is sending 10,000 messages a day" and that would be correct for about 99.9% of the cases.
No, that's the whole point of defeating captcha. Instead of sending 10,000 messages from 1 account, send 10 messages each from 1000 accounts.

Re:They will, eventually, be cracked again. (1)

timeOday (582209) | about 6 years ago | (#22994442)

PS, that also defeats the spam trap addresses. If you're only sending a few (or 1) spam from each account, killing an account because it sent email to a fake user doesn't help much.

Re:They will, eventually, be cracked again. (1)

rtb61 (674572) | about 6 years ago | (#22995394)

The problem will eventually resolve itself. With the switch to IPv6, dirt cheap appliance servers and free open source software, everyone will be running their own email server. The net result of that is, the default will be to block all free web mail messages and only allow known ones in.

Until then ISP's are going to have real problems with free web mail services, for the end user of course the solution is simply block them, and wait for an alternate form of communication to let you know an address to allow in.

Re:They will, eventually, be cracked again. (3, Interesting)

kesuki (321456) | about 6 years ago | (#22994456)

welcome to spamtrap@donotreply.com (just kidding, but donotreply.com gets a lot of interesting e-mail, I just wondered what they'd do if they started getting 'spamtrap' addressed mail)

well, making special spamtrap e-mail addresses and putting them in the clear on usenet, message boards, or even on social networking sites owned by google, and making sure the content is boring drivel no one would e-mail that person about. well, i mean how could you decide how to make boring drivel that would still put their address out on sites? 'first post' messages?

wouldn't someone notice that google got 'first post' every time on 123 consecutive front page articles? wouldn't they? though and e-mail them a congratulation and get spam busted?

i mean i know i can post boring irrelevant information, but i can't guarantee that if an e-mail is tied to that identity that someone won't e-mail me....

so spam traps are harder to implement than one would think, unless they're in 'hidden' code. EG: you go to a website, the e-mail is in the html, but never shows on the page... and if you do that, then they might make a scanner that nullifies those addresses... once the realize what's happening.

Mod parent up!!! (0)

Anonymous Coward | about 6 years ago | (#22994474)

Wish I had mod points....

Re:They will, eventually, be cracked again. (1)

textstring (924171) | about 6 years ago | (#22995468)

they obviously know what spam looks like judging by my mail box and they could probably get away with running their spam filter on outgoing mail, but then it could become a privacy and usability issue. personally, i think keeping their domain name as far away from SPAM as possible is the best move google could make.
your spamtrap idea is great, if i could stand to read another letter of it i'd be more interested

Re:Crack down (5, Interesting)

Thelasko (1196535) | about 6 years ago | (#22993930)

I think the safest thing they can do right now is return to their invitation only registration in an effort to close the breach. Then they have to start deleting spam accounts quickly before the spammers adapt to inviting themselves. If they are lucky they will be able to delete spam accounts faster than they multiply.

Re:Crack down (1)

Normal Dan (1053064) | about 6 years ago | (#22994418)

Then they have to start deleting spam accounts quickly before the spammers adapt to inviting themselves.

One of the great things about the invitation only registration is google can delete an entire block of accounts and follow the chain up to the offender.

The down side is, people who live alone with no friends on or off line will be unable to get a gmail account. At first glance this may seem fine since they would have no one to email anyway, however, some porn sites require email registration.

Re:Crack down (0)

Anonymous Coward | about 6 years ago | (#22994466)

This is actually an excellent idea. I remember when Gmail had invitations, but everyone and their dog had them coming out of their ears. At the time, it seemed pointless, but it all makes sense if you think about it. Invitations add traceability. If some spammers can be identified, then the person who gave a given spammer their invite could be silently scored. If multiple spammers are invited by one account, their score increases. Eventually, people with high scores have their invites taken away and/or lose privileges, or are kicked off, etc.

Ultimately, if someone can crack a relatively complex image captcha, then someone will be able to defeat any similar system that is invented, eventually. It is interesting to note that some of those bots that are able to hit ~30% accuracy are at least as accurate as humans. :-)

Re:Crack down (0)

Anonymous Coward | about 6 years ago | (#22994960)

Evidence seems to suggest that the CAPTCHA wasn't cracked.

Instead, it looks like someone with plenty of financial resources set up a system where a robot grabs a Google CAPTCHA and sends it to the 3rd world, in real time. People there are paid a fee for successfully typing in the values of CAPTCHA images.

It's looking like a real paper trail is necessary.

Google wins (5, Insightful)

mfh (56) | about 6 years ago | (#22993562)

The missing part of this story really is that Google`s Gmail client has very effective anti-spam filtering. I can see why companies who earn their keep protecting typical client-side email systems, would want to make Gmail obsolete or ineffective. Spammers might use Gmail as a tool to spam, but with good filtering it really doesn`t cost that much compared to the loss of time spent weeding out ham from spam.

Whoa.. so what you're saying is... (2, Insightful)

Animaether (411575) | about 6 years ago | (#22994380)

...to be safe from spammers using Google Mail... people should just -get- Google Mail themselves?

I don't know whether to just blink or to think that you discovered a Google strategy here; getting even more people over to Google Mail because there's less spam there; nevermind the fact that a portion of that spam is sent from their own servers(!) I suppose there wouldn't be a heck of a lot of incentive to do something about the spam accounts, then.

=====

Or maybe you're saying that Google should apply their spam filters for incoming mail to all outbound mail as well. That sounds a lot more sane anyway.
If a legit message is flagged as possible spam, ask for user input (make sure this can't be automated too easily) on whether it's actually legit or not.
Regardless of that response, if N messages in t time are flagged, have an engineer (okay, school kid) check it out and disable the account if necessary

We use messagelabs (2, Interesting)

DaveOne (1130433) | about 6 years ago | (#22993946)

Our company uses Messagelabs. Just tried a quick message from my Gmail account. Almost immediately received the message. No delay for my account, at any rate.

Re:We use messagelabs (1)

call-me-kenneth (1249496) | about 6 years ago | (#22994014)

Same here - mail between my Gmail account and my work account, which gets Messagelabs spam/malware filtering, works fine in both directions. Sounds like a badly-sourced story to me...

Gmail should go back to cell phone authentication (3, Insightful)

Animats (122034) | about 6 years ago | (#22994180)

Gmail should go back to their old scheme, where you had to have a cell phone to receive your password, and you could only have one gmail account per phone. That would slow the spammers down.

If you don't have a phone, you're probably not a good candidate for an advertiser-supported service anyway.

Re:Gmail should go back to cell phone authenticati (1)

Vegeta99 (219501) | about 6 years ago | (#22994304)

What? I've never seen an ad in my gmail when i use my phone.

Of course, the phone runs Windows Mobile so I don't use the gmail program, I just have it check IMAP every 10 mins, but who's counting?

Re:Gmail should go back to cell phone authenticati (1)

Animats (122034) | about 6 years ago | (#22996046)

What? I've never seen an ad in my gmail when i use my phone.

In the early days of Gmail, you had to supply a cell phone number, and your initial password was sent to your cell phone via SMS. One Gmail account per cell phone number. This puts a dent in spamming; you have to keep buying new phone numbers as your old accounts are terminated.

Some free dating sites now do this. I've been bugging the Craigslist people to try it.

Re:Gmail should go back to cell phone authenticati (3, Interesting)

Oriumpor (446718) | about 6 years ago | (#22996000)

Expect to see a technological solution, this isn't a company full of middle managers or people who are used to losing technical battles.

If I were a betting man I'd say Google will either A) release a new authentication/authorization scheme for creating new accounts, or B) they'll evolve their current system to be resistant to delivering false negatives on bot provided responses.

Because honestly, isn't this just graphical/visual acuity based Turing test that needs to be treated as "passed" by the industry? The reasoning being: the equivalent of Alicebot now exists for the graphical world, so the test needs to be re-engineered to test another (currently) unpassed Turing style evaluation.

Based on that realization: the whole reason capcha's are stupid is that if you keep the existing design but try and make it "harder" to break, the designer of the Bot need only account for that change and not an entire redesign.

All this sounds like a great technical challenge: think up a new Turing test... When in reality those posting go back to invite only are absolutely right but it's likely we won't see that come out of Google.

Re:Gmail should go back to cell phone authenticati (1)

waded (1032834) | about 6 years ago | (#22996146)

Yes, and it also increases cost to acquire customer, decreases the number of potential customers at the same time(to those who have cell phones.) That would be an idiotic thing to do, when really all Google has to do is balance well-done features against poorly-done features well enough to acquire and keep you from switching away (switching costs on email can be kind of high with "unlimited storage" in play these days.) Ad impressions are ad impressions, even ones taken when composing an email that'll never make it to its destination. Bo hoo.

The old scheme was likely more relevant for early testing, although perhaps putting those spammers-without-cell-phones in the mix earlier on might have been a good idea.

Re:Gmail should go back to cell phone authenticati (3, Insightful)

whereiswaldo (459052) | about 6 years ago | (#22996322)

Gmail should go back to their old scheme, where you had to have a cell phone to receive your password... If you don't have a phone, you're probably not a good candidate for an advertiser-supported service anyway.

Since when does cell phone == phone? Tons of people don't have cell phones, and most of them are consumers of various goods just like people who do have cell phones. It's amazing how the 'net culture makes it easy to write off huge swaths of the population just because they don't have or want the latest gadgets.

Re:Gmail should go back to cell phone authenticati (0)

Anonymous Coward | about 6 years ago | (#22996522)

Obviously gmail can't simply strip millions of us of the ability to use our accounts. If they didn't want those of us who are largely stationary, use a POP client and don't own cell phones, then they shouldn't have started offering POP access.

Serves gmail right (0)

Indy1 (99447) | about 6 years ago | (#22994376)

for the past 6 months or so, the amount of gmail spam hitting my server has been insane. I've thrown up a pile of filters and what not, but sometimes the only solution is to firewall gmail off for a few weeks until the spam wave dies off.

If they want to treat their network like a sewer, then I have no problem doing the same, and dumping their ip ranges into the firewall with the rest of the spam sewers.

1 AND !1 = 1 ??? (1)

billcopc (196330) | about 6 years ago | (#22994450)

Most users won't get blocked mail

Okay, so business as usual. If users did receive blocked mail, they would be whining now wouldn't they ?

So Google's captcha got smashed, ho-hum! Happens all the time to others, and it is certainly NOT a good reason to blacklist Gmail, unless you also block all Yahoo and Hotmail.

If this causes your spam solution to slow down due to overload, the fault is not Google's, it's your fault for running an underpowered mail queue. Spam is everyone's problem, and we have to work together to clean it up. Pointing fingers doesn't solve shit!

Re:1 AND !1 = 1 ??? (1)

Dan541 (1032000) | about 6 years ago | (#22996266)

If this causes your spam solution to slow down due to overload, the fault is not Google's,
How is it not google's fault?

They did fuck all about it!
I was still able to register with gmail after they knew the captcha had been cracked.

Don't blame the spammers (3, Insightful)

kitsunewarlock (971818) | about 6 years ago | (#22994492)

Blame the companies that allowed the idiots who buy from spammers to get internet in the first place. I know: everyone makes mistakes. At 2 AM, even I've clicked on a banner once or twice to find something (although I can never recall joining a site due to advertisement via mass mailing).

But, sadly, statistics still prove that if you try to hit 1,000,000 people without any true risk of getting caught, your bound to hit a sucker eventually. There's one born every minute, after all. Not to use colloquial phrases as my source, of course.

Personally I'm disheartened that American spam has lowered so. It makes it much harder to track down the parent company and call them and ask them why they sent you their e-mail in the first place...

might aswell block yahoo too (0)

Anonymous Coward | about 6 years ago | (#22995230)

usenet if flooded with chinese spam from gmail my mailbox filled with spam from yahoo. blocking both seems like a great idea. read somewhere that the captcha really hasn't been cracked, spammers have just hired cheap labour to solve them.

Re:might aswell block yahoo too (1)

Bronster (13157) | about 6 years ago | (#22995766)

Specifically yahoo.co.uk is sending thousands of spams per day via their SMTP service, because the UK service provides SMTP for free accounts.

Seriously, it's a trickle of a couple per second to every one of our mx servers, all day every day. Quite impressive.

(and no, I don't have any answers. Outbound spam scanning is good though)

Get rid of Captchas! (1)

zymano (581466) | about 6 years ago | (#22995280)

And go after the IP number and the individuals doing this shit.

Go after their ISP's and take the idiots to court.

Cat and mouse games are stupid.

Re:Get rid of Captchas! (2, Interesting)

Skapare (16644) | about 6 years ago | (#22995968)

The IPs doing this shit are the end user addresses for home and office computers that are no different than all the other end users that use Gmail. They could block an IP, but eventually that IP will be used by someone else who is a legitimate and secure Gmail user. They are better off closing accounts that send spam. But Google isn't doing that (based on having seen spam from the very same user I reported to them as a spammer 2 weeks prior). If they do decide to pursue the user of the IP, once they get past the legal roadblocks of getting the identity out of the ISP (while doing this for 100,000 such IPs at the same time), all they get is some stupid loser who has an infected Windows box being used as part of the botnet. They can get this machine cleaned up, but they aren't anywhere near the real culprits.

What Google needs to do is segregate all users that are new since the crack (they know when it was, because they can see a spike in new user signups from random end user IP addresses). In the mean time, close down direct signups and fallback to the invite system only allowing the old users to send invitations. Re-engineer the CAPTCHA system to at least temporarily thwart the signups before bringing that back online. For all new users, run all their outgoing mail through the same filters that are used for incoming mail. Mail that can't be sent, put it in a new folder type for "blocked outgoing". The user has to pass a new CAPTCHA per each message to do a re-deliver around the filtering (or just rephrase and send a new one). And limit the number of these to 3 per day (although this may not do much good since the botnet may only be doing this much or less over a million accounts).

Re:Get rid of Captchas! (1)

Dan541 (1032000) | about 6 years ago | (#22996276)

And go after the IP number and the individuals doing this shit.

Go after their ISP's and take the idiots to court.

Cat and mouse games are stupid.
You think we woulden't take spammers to court if we could?

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...