Re: PLUG: PMAS

david20@xxxxxxxxxxxxxxxx wrote:
In article <5dq0prF35i1raU3@xxxxxxxxxxxxxxxxxx>, bill@xxxxxxxxxxx (Bill Gunshannon) writes:
In article <f56v23$hfk$1@xxxxxxxxxxxxxxxxx>,
david20@xxxxxxxxxxxxxxxx writes:
In article <5dnrfgF32rpkjU2@xxxxxxxxxxxxxxxxxx>, bill@xxxxxxxxxxx (Bill Gunshannon) writes:
In article <op.tt4d52rn8vlggw@xxxxxxxxxxxxxx>,
"Tom Linden" <tom-remove@xxxxxxxxxx> writes:
On Sun, 17 Jun 2007 01:05:55 -0700, P. Sture
<paul.sture.nospam@xxxxxxxxxx> wrote:

In article <1378kfui13fk00@xxxxxxxxxxxxxxxxxx>,
Mark Daniel <mark.daniel@xxxxxxxxxx> wrote:

Bill Gunshannon wrote:
In article <f51cb9$478$1@xxxxxxxxx>,
helbig@xxxxxxxxxxxxxxxxxxxxxxxx (Phillip Helbig---remove CLOTHES to
reply)
writes:

In article <1378bo75v2pl6a1@xxxxxxxxxxxxxxxxxx>, Mark Daniel
<mark.daniel@xxxxxxxxxx> writes:


And I thought the SPAM load was moderating (silly me).

Looking for a specific e-mail I thought I should have received, I
just
opened my PreciseMail Anti-SPAM quarrantined messages page to search
for
it (without success). I don't do this often and haven't for a while
(obviously not since the last upgrade). Towards the top of the
2,967,263 byte report page is a (new to me) item "(Messages: 4605)".
That's four and one half thousand quarrantined SPAM in the past 14
days!
This is something like 328 per day!!
That seems about average. I've resorted to using ZEN.SPAMHAUS.ORG as
an
RBL. That gets rid of the lion's share.
I've just started using that zen.spamhaus.org as well, and the spam on
my VMS system has dropped significantly as a result.

So, how bad does it have to get before I can expect people to start
looking at my suggestion for a social solution rather than technical
solutions that may hide the problem but certainly don't reduce it or
the load it puts on the system?

bill
Isn't this a little like suggesting a social solution to the problem of
crime :-) I'd guess that as long as there is profit to be made there
will be such activities.

I have a telephone answering machine primarily to screen tele-marketers.
Best AU$50 I ever spent. But the marketers will continue to call as
long as people respond to those calls (with interest, dollars, etc.)
Those who wish to speak to me leave a message (or I pick-up). Not had a
single message from a marketer or charity asking me to call them back.
FWIW, I've discontinued my land line and survive with a cell phone at
the moment. That's obviously not an option for everyone, but it's been
effective for me. My snail-mail box is now under attack, but that's
still nowhere near as bad as it was in the UK a decade ago.

The solution surely will be technological, perhaps digital signatures
and associated PKI, to reduce the effectiveness of general SPAMing thus
reserving the activity for specialised crime rather than the general
mugging we all endure now.
My ISP has recently tightened things up, as a couple of months ago the
spam volume dropped. Unfortunately, I believe I lost some valid emails
as well :-(

About 18 months ago they implemented SMTP authentication, but I don't
think they were enforcing it for quite a while.

The latest development is that the appear to be enforcing the use of my
registered address in the From: field. Until recently, I could happily
cc a news group posting via email using the munged .nospam sending
address you see above, but now that fails unless I use my real address
(a bit more research needed here to confirm this theory).

Not what I want to keep my real address munged for news groups, but a
pretty minor inconvenience if it really does stop zombies connected to
my ISP from spewing spam.

Why not be your own ISP? I am. My 'ISP' only provides me with a T1 pipe.
So I run my own DNS and Mail, in fact, it runs on each node under
loadbroker.
You could do the same even with DSL.
How does your running your own ISP fix the email for the guy who wants
to do business with you but his ISP is BLed? he will end out taking
his business to someone who runs as shoddy an email system as his own.
Talk about the mediocre winning the battle.

But, let me throw this out for consideration. You don't have to
answer publicly, just give it some thought. How many customers
do you have? Wouldn't it be better for all concerned if you could
establish a trust relationship such that you could know with 100%
certainty that all of their emails to you and all of yours to them
would get thru? If you knew that all of your existing customers
had a guaranteed pipe into your system wouldn't filtering for new
potential customers be easier than trying to filter for SPAM?
Keywords: PLI PL/I PL1 PL/1 PL-I PL-1 PLM SPL "Subset G"
How much SPAM is likely to match that?

What's that a keyword for every customer ? That's really going to scale.
How do you draw that conclusion? Tom deals in PLI Compilers. Every
customer is going to be looking for the stuff in the same class of
keywords. Now, if you're Sears or Kmart this method may not work well,
but then, email isn't likely to be their primary method of communicating
with customers, either.

I'm sure that Tom's company receives tons of legitimate mail which doesn't
mention PL1 (or any variant) by name.

I have this problem at the University where we have certain well known accounts
which are contacted by new and prospective students from all over the world
to ask about the University, Degree courses etc
Since they are one off inquiries we can't , as users can with normal email
accounts, whitelist addresses communicated with on a regular basis to reduce
false positives. On the otherhand these are well known addresses so they get
lots of spam. Also the standard spam rules for obfuscation etc are often
falsely triggered by course codes (often mistyped) or abbreviated course names
or qualifications.
But we definitely don't want to put off prospective students by not responding
to their queries.

The answer is to try to identify keywords and phrases expected for these types
of enquiries in messages directed to these accounts and to use those to offset
the anti-spam products spam scoring. It takes a lot of effort to get anything
reasonable. People misuse english - especially if it isn't their first
language. You can't use certain words because they mean other things in other
circumstances which appear in well known spam. These accounts now let through
much more spam than normal accounts but still tag the majority correctly ie
the balance is shifted to false negatives rather than false positives eg
Fake degree spam may well get through.

I definitely don't think detecting non SPAM by looking for positive phrases
would work for normal email accounts which get all sorts of mail. It is much
much simpler to look for the tricks used by spammers.


David Webb
Security team leader
CCSS
Middlesex University

Rather than relying on standard email, wouldn't it be better, in your
case to have a web based form to deliver email directly into your system.
You can allow for attachments and for anti spam mesaures such as a captcha.

Heck. at least they won't get the email address wrong when they send
in the application.
.

Relevant Pages

  • Re: use this patch immediately message
    ... They get tired after awhile of having their Web Hosts killing their Accounts ... them and use them to catch Domains that Spam) ... And if you find the ISP and Websites are protected by the ISP and Web Host, ...
    (microsoft.public.security)
  • Re: Stop Spamming Technique? Thoughts?
    ... Alan will be happy to enlighten you, ... >> finds it's loosing customers for not cooperating. ... >> 5.Contact other customers of the ISP, explain what the problem is, ask ... Beating spam by spamming is generally not the way to go... ...
    (comp.os.linux.misc)
  • Re: PLUG: PMAS
    ... I've just started using that zen.spamhaus.org as well, ... looking at my suggestion for a social solution rather than technical ... My ISP has recently tightened things up, as a couple of months ago the ... If you knew that all of your existing customers ...
    (comp.os.vms)
  • Re: Motzarella beats Tiscali FUP
    ... light of the fact that he used to run an ISP. ... the control of user accounts. ... installed on luser PC's spewing spam out like a cracked sewer. ...
    (uk.rec.motorcycles)
  • Re: Current status?
    ... spam will not stop because you start blocking port 25. ... I still won't use the idiots running the ISP for my mail. ...
    (comp.os.vms)