Subject: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Sun, 05 Dec 2004 10:31:21 -0500

I have developed a system to eliminate spam.  You are the first group 
to whom I have publicly presented it to so I would appreciate any 
criticism you might have, and after that any support.  To my 
knowledge this system is unique.  A colloquial description of my 
method is detail at the following link:

http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

Sincerely,

Michael G. Kaplan
New York, New York

-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Reinhold Jordan <[email-masked]>
Date: Sun, 05 Dec 2004 17:02:08 +0100

Hi,

> http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

interesting solution.

But what is with this:
 - a friend often send news with my and others mail-addresses in
   the To:-header.
 - she also have viruses in the past, that sends mails to all
   addresses in her addressbook.

How can your system hide my address from spamers?

Regards, Reinhold

-- 
                         Reinhold Jordan
WWW: http://reinhold.bachrain.de         Mail: [email-masked]
qmail-spam-protection with intelligent-greylisting, reverse-smtp...
qmail.spamfilter.041129.017.tar.bz2 actual rejects 99.78% of spam!!

---

From: Seth Breidbart <[email-masked]>
Date: Sun, 5 Dec 2004 11:05:53 -0500 (EST)

"Michael Kaplan" <[email-masked]> wrote:

> I have developed a system to eliminate spam.

Google for FUSSP.

> To my knowledge this system is unique.

It combines C/R (which causes it to spam innocent victims of forgery)
with captcha (which isn't perfect, either), with unique addresses (and
no explanation of how to keep them that way; consider being included
in a CC: list that gets involved in a discussion).

Seth

---

From: Devdas Bhagat <[email-masked]>
Date: Sun, 5 Dec 2004 22:06:51 +0530

> http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

I couldn't see any images :). Secondly, you advocate sending bounces
rather than rejects and those with inline images. That itself is a huge
volume of excess email. 
Thirdly, I would be sending bounces in non English languages. Perhaps you 
would care to deal with that problem as well? Most of my correspondents
do not have English as their primary language, for most of them it is
the third language.
Fourthly, how do you propose that ISPs deal with scenarios like this
where multiple addresses are created by the MUA which does not exist on
the same system as the MTA?
Fifth, you expect automatic address book updates. What happens if the
MUA does not automatically update addressbooks?

Devdas Bhagat

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 5 Dec 2004 18:49:14 +0100

On Sun, Dec 05, 2004 at 10:31:21AM -0500,
 Michael Kaplan <[email-masked]> wrote 

> To my knowledge this system is unique.

It is almost identical to SpamKiss:

http://www.spamkiss.com/

and it shares the same problems.

---

From: Reinhold Jordan <[email-masked]>
Date: Sun, 05 Dec 2004 21:04:37 +0100

Hi,

> http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

ok. Do I have to treat every person, who send me mail, to answer
this CAPTCHA? E. g. my boss?! What is about mailing-lists, newsletters,
business cards?

Regards, Reinhold

---

From: der Mouse <[email-masked]>
Date: Sun, 5 Dec 2004 15:24:47 -0500 (EST)

> I have developed a system to eliminate spam.  [...] I would
> appreciate any criticism you might have, [...]

> http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

It has most of the problems of C/R; in particular, early adopters will
end up spamming everyone whose address is forged into spam to them,
just like approximately all C/R systems in use today.  (This is
unavoidable by any system which sends challenges to new
correspondents.)

You claim it doesn't suffer from the problems endemic to C/R because
you "distribute a fully functional email address".  In that case,
spammers harvest a fully functional email address and spam it.
(Whether they harvest it from a webpage or from a correspondent's
address book or whatever is more or less irrelevant.)  It may go away
the next morning when you wake up to a mailbox full of spam, but your
next address is then promptly harvested from your webpage and spammed.
And $DEITIES help you if you put an address on your business card and
it gets scraped from someone's address book; all of a sudden all your
business cards are worthless (or almost), because they no longer
contain a "fully functional email address".

As described, it is completely unusable for the blind, and will not be
as effective at defeating bots as you think - there is some very good
work being done on extracting shape from images, and with synthetic
images such as you describe it becomes duck soup.  (It will defeat
current bots; if it becomes widespread enough to bother, bots will
arise that can defeat it.)  You dismiss the problem of the blind by
suggesting the hire someone to do the work, but you give no reasons why
spammers cannot invest in the same "trifling expense".

The system is completely broken at dealing with correspondents that do
not understand the language the challenge is in (either the text itself
or the picture-part labels).

You are apparently unaware of the work being done to get people to
decode such images by offering them free porn.

Your technique demands fairly drastic changes to outgoing mail
handling.

You take no account of the psychological pressures against C/R.  I
almost always reflexively ditch C/R challenges, and I know I am far
from the only one.

You do not describe any experience with implementations of your system;
your "case studies" appear to be entirely fictional.  Indeed, you give
no reason to think there _are_ any implementations.  No matter how good
it sounds, I am not impressed by vapourware, especially when it has all
the above problems.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: "Tripp Cox" <[email-masked]>
Date: Sun, 5 Dec 2004 16:14:30 -0500

----- Original Message ----- 
From: "der Mouse" <[email-masked]>
To: <[email-masked]>
Sent: Sunday, December 05, 2004 3:24 PM
Subject: Re: [Asrg] Please critique my anti-spam system

> contain a "fully functional email address".

These types of social issues will not go away.  Giving someone your email 
address is like giving them a key to communicate with you.  What they do 
with that key is beyond your control.  That's why I think one great way for 
the privacy-minded person to handle this is to not give everyone the same 
"key."  If someone is using one of your keys in a way you don't like, just 
revoke it.  Other folks with different keys who are behaving are not 
affected.  The person who enabled your key to be used in a way you find 
displeasing can be roundly chastised and given a new key... or not.

Tripp

---

From: Barry Shein <[email-masked]>
Date: Mon, 6 Dec 2004 19:33:21 -0500

Far be it for me to particularly defend these schemes but the usual
response about business cards and disposable addresses is you put a
semi-disposable address on your biz card and then when someone uses it
to contact you (legitimately) you tell them in the future use this
other address which is possibly also disposable but probably unique to
that respondant, whatever.

Then at least you'd know what was derived from your biz card as a
source.

The weakness is if someone feeds that biz card address into a
problematic spam list and you can't stand the spam but don't want to
re-print your biz cards. In that case quit and find another job and
they'll give you new biz cards for free (hell I dunno, as I said my
intention isn't to particularly defend the scheme just to provide the
usual repartee' so it doesn't have to be reinvented before our eyes.)

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 7 Dec 2004 09:46:24 +0100

> I have developed a system to eliminate spam. 

Besides all the very good reasons why your system is broken, there is
something I would like to emphasize.

Your system, exactly like C/R systems, exactly like SpamKiss, and
despite the few technical details that are different between them, is
simply a way to shift away the costs of spam.

Spam costs: money, time, hardware and human resources. At the present
time, costs are entirely upon the shoulders of the recipient. You plan
to put some of the costs on the back of the sender. Wether or not it
is a good idea, I let you see. But it is hardly a way to stop spam,
just a way to displace the costs.