Subject: Spam solution?

From: <[email-masked]>
Date: Fri, 21 Sep 2007 12:44:48 +0200

Welcome,

I'm a system administrator of a secondary school, and ive

installed a spam filter a couple days ago, to prevent

spam. The problem is the various spam images

there is used graphical attachments, a lot of different words

to advertise their products. Now I have strong filter, so I afraid

to drop the mail was written in english.

I think to need an new e-mail rules, to stop this madness.

I call it application card. When somebody want to make a contact

with somebody, should send a "request card". This would be an
empty mail

without subject, with a special flag. So the spammer cannot
advertise.

The user's mailer would have a new folder, e.g. "request cards
folder"

(with a lot of sub-folder for every day) so the user can decide with

a copule of clicks to accept somebody connectionship request.

Naturally, the user can ban this connectionship licence

later, if it is wanted. Users would give license,

an entire domain if they want. If somebody send a mail without

license, would receive an auto-reply: need to get a licence.

With the chechking this new "license flag" can be seen the

suspicious sources, where arrives too much ask for request.

Sincerely Cserny Zsolt

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: <[email-masked]>
Date: Fri, 21 Sep 2007 13:10:02 +0200

More opportunities of the request card:
If it would br given an quota for each e-mail domains to send 
application request card, that is more possibility to stop spanning, 
because, the spammers want to get connection thosands of users.
But if there is already a relationship between 2 address, after can 
send unlimited e-mails.
The request card system can be managed by an administrator also,
for each users. There would be an e-mail address, the "entry point"
managed the sysadmin, to this address came the requests 
for licence to sending emils the managed domains. So this entry 
point would works as a "e-mail  firewall".

---

From: Dave Aronson <[email-masked]>
Date: Fri, 21 Sep 2007 07:27:45 -0400

[email-masked] wrote:

> I call it application card.

Nice try, and I can say for sure that the basis of your idea is good 
enough to make products that people were willing to pay for... a few 
years ago.  Unfortunately it makes one or two classic mistakes, which 
have been figured out in the meantime.

If I understand rightly, it depends on spammers to go along with it, 
sending an application instead of a plain email.  If they were that 
civil, the entire spam problem would have dried right up shortly after 
people started objecting to it.  If you mean that the user would set it 
up in such a way that this would be automagically enforced for all new 
contacts, that relieves the dependence on the civility of the obviously 
uncivil.

Even then, though, the mechanism itself has been thought of before. 
It's generally called challenge-response.  It may be acceptable for 
people who receive a tiny volume of unsolicited but desired email, or 
solicited email from new contacts.  However, for the rest of us, it 
doesn't work very well.  It imposes a burden, small but tiresome, on our 
new correspondents, that many are not willing to bear.  In fact, much of 
the email we want to get, is sent by automated mechanisms that simply 
*cannot* respond to it.

(Some might think that the answer is to establish standards for the 
format of the challenges and responses, so that these automated systems 
can respond.  I think it's a pretty safe bet that the spammers would 
then start using such systems.  Back to Square One, just with a lot more 
money down yet another rathole, and more pain for the innocent.  A while 
back I gave some thought to designing standards for signing up for 
automated emails, in such a way that the source would be automagically 
added to your "whitelist".  That never really got anywhere either, but I 
suspect that it also would have been abusable by spammers.)

Lastly, unless the request cards folder, with its many subfolders, is 
going to be managed automagically by the email program, this sounds 
rather unwieldy.

The spam problem is deceptively simple-looking from the point of view of 
the typical user, or even administrator.  I suggest you check out the 
Internet *Research* Task Force's working group on spam, called the 
Anti-Spam Research Group or ASRG.  Their home page is at 
http://asrg.sp.am/.  A lot of it consists (or at least when I hung out 
there, consisted) of going round and round in circles, actually 
accomplishing very little, but you can learn a lot from the discussions, 
about how complex the problem really is, what has been tried, and why 
certain approaches are absolutely doomed.

-Dave (no, not that one, no, not that other one, the other other one)

-- 
Dave Aronson
"Specialization is for insects." -Heinlein
Work: http://www.davearonson.com/
Play: http://www.davearonson.net/

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 21 Sep 2007 14:11:29 +0200

On Fri, Sep 21, 2007 at 12:44:48PM +0200,
 [email-masked] <[email-masked]> wrote 
 a message of 59 lines which said:

>    I think to need an new e-mail rules, to stop this madness.  I
>    call it application card.

Please, please, please, a *lot* of time and effort have been devoted
to the spam issue. Do not start from the beginning, spend some time
first to learn what others did.

Check your "solution" againt FUSSP
(http://www.rhyolite.com/anti-spam/you-might-be.html) first.

---

From: Dave Crocker <[email-masked]>
Date: Sat, 22 Sep 2007 16:49:51 -0700

> (http://www.rhyolite.com/anti-spam/you-might-be.html) first.

Indeed.  Let's also not forget:

      <http://craphound.com/spamsolutions.txt>

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net