Subject: [Asrg] New To The List

From: "Ian Wilson" <[email-masked]>
Date: Tue, 18 Mar 2003 13:07:11 -0400

Hi,

I'm new to this list, and certainly not as well versed in the technical aspects of the SPAM problem as those whose posts I've read seem to be, which brings me to my question,   It seems rather easy for me to use filters in Outlook Express to filter a great deal of this trash, which makes me wonder if it isn't just as easy to do at the Mail Server.  Could my ISP filter as much of this junk as I now do, and if so isn't putting pressure on our ISP's a good place to start.  

A couple of other questions that I am sure could be answered by someone.  It seems to me that a lot of SPAMMERS forge return addresses.  For instance a message might say that it comes from [email-masked]* and when I contact [email-masked]* I usually get a return message that indicates the SPAMMERS didn't actually send the message using Yahoo.  This makes me wonder is it possible, at the mail server level to check and see if a return address is forged?

Also I have been using a program called Mail Washer, which I like a lot.  Recently they sent me a message that alerted me to a new subscription service they are offering.  It seemed to indicate that it would use the resources of everyone who subscribes to gather a database of SPAMMERS.  When one arrives at my mail box I bounce it in the normal way, and that bounced message is examined, and if it is determined to be SPAM it will be added to a database, and I won't see mail from them again.  Clearly this list is populated by persons who know a lot more about this than I do, and I wonder if anyone has any thoughts on Mail Washer in general.

ian

---

From: "Ronald F. Guilmette" <[email-masked]>
Date: Tue, 18 Mar 2003 11:52:17 -0800

In message <001101c2ed70$e6852240$60cefea9@f4n8i1>, 
"Ian Wilson" <[email-masked]> wrote:

> It seems to me that a lot of SPAMMERS forge return addresses.  For =
>instance a message might say that it comes from [email-masked]* and =
>when I contact [email-masked]* I usually get a return message that =
>indicates the SPAMMERS didn't actually send the message using Yahoo.  =
>This makes me wonder is it possible, at the mail server level to check =
>and see if a return address is forged?

Yes, that's very possible, and I wrote some hacks some time ago which
implemented that exact functionality in the Postfix[tm] mail server.

(The bad news is that I implemented this stuff for an old version of
Postfix, and I declined to update it when the primary Postfix developer
declined to roll the relevant enhancement code into future Postfix
releases.)

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 18 Mar 2003 23:32:31 -0500

At 1:07 PM -0400 3/18/03, Ian Wilson wrote:
>brings me to my question,   It seems rather easy for me to use 
>filters in Outlook Express to filter a great deal of this trash, 
>which makes me wonder if it isn't just as easy to do at the Mail 
>Server.  Could my ISP filter as much of this junk as I now do, and 
>if so isn't putting pressure on our ISP's a good place to start.

When you make a mistake with your filter, you find the good message 
in the spam folder and move it out.  When your ISP makes a mistake, 
you never get the message.  When you get a message with Viagra in the 
subject, you filter it to the spam folder.  When someone at Pfizer 
does, it's an important message.

So, ISPs can filter.  But it's not that easy.  In fact, most major 
ISPs *are* filtering.  But they can't block everything without 
blocking too much real email.

>indicates the SPAMMERS didn't actually send the message using Yahoo. 
>This makes me wonder is it possible, at the mail server level to 
>check and see if a return address is forged?

Currently, no.  That is one the primary discussion areas on this 
list.  It's complicated by the fact that "forging" the return address 
is something that people do all the time.  You send personal mail 
from work and set the return to your hotmail address.  You send work 
mail from home and set the return to your work address.  Both 
reasonable things to want to do.

>they are offering.  It seemed to indicate that it would use the 
>resources of everyone who subscribes to gather a database of 
>SPAMMERS.  When one arrives at my mail box I bounce it in the normal 
>way, and that bounced message is

No comments on specific solutions.  The general problems with systems 
like that are
1. False positives.  One group of people thinks that the mail they 
get from Classmates.com is spam, another thinks it's not.  If too 
many people report it as spam, the second group loses.
2. Coming up with algorithms that detect bulk spam.  The spammers 
send out thousands or even tens of thousands of different variations 
of the same message.  Many of those variations aren't visible to your 
eye (hidden codes in the message)--but software that tries to detect 
similarities needs to detect the "eye space"--what you see, not what 
is actually there.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg