Internetworkers: http://www.ibiblio.org/internetworkers/

[Sil Greene <Sil_greene AT unc.edu>]

Well, all spam (in theory) has a valid link.  Whether it's the From: 
or Reply-To: address being a valid account (even a mail drop), or whether 
an embedded link in the body of the message is used, the only way it's 
profitable is to be able to accept replies.  So it may be unreasonable to 
assume valid header addresses in every case, but somewhere in the message 
is a valid connection.  The problem is to algorithmically isolate and 
utilize the valid.

The approach I've described only depends on finding the valid.  It's nice 
to avoid creaming your network with attempts at invalid connections, but 
that's not a necessary part of the system I've described.  So an 
individual using this system could afford to try all paths -- the From, 
the Reply-To, and any embedded links -- and since the user isn't sending 
thousands/millions of bogus replies to each spam, they won't incur the 
same costs to their local network.

Think of it as an anti-spammer DDOS -- two pings each, from a metric 
buttload of machines, will bring down the mightiest of servers.


Reported 03.11.18 00:35 from Alan MacHett:

.:That would work, but only against direct email marketing -- those we might
.:call "legitimate" spam.  The problem is that the "illegitimate" spammers
.:are not using valid reply-to or direct return-path addresses.  We already
.:see this problem with all the poor folks whose legitimate email addresses
.:were used as illegitimate reply-to addresses in countless spam and who
.:subsequently get inundated by all the angry spamees.  Not to mention that
.:those same spammers aren't particularly worried about reply messages
.:anyway.  They bounce from host to host in order to continue their assault,
.:leaving some mail admin to clean up the mess.
.:
.:Now, if your macro could extract or build addresses for the companies on
.:whose behalf the spam are being sent, then, yeah, those companies will
.:give up on bulk email, eventually putting spammers out of business.
.:
.:--Alan
.:
.:Sil Greene said:
.:>
.:> .:The best way to eliminate spam is to make it not profitable.
.:>
.:> Agreed.
.:>
.:> .:The two
.:> .:routes to that end are (1)consumer education and (2)technology.  I could
.:> .:write a whole book on why consumer education won't work, so the best
.:> route
.:> .:to recovery is via technological defeat.
.:>
.:> I'm not sure about your comment to (1).  Your comment seems(!) to assume
.:> that consumer education equals-equals teaching people to ignore it.
.:> And that was my default assumption as well.  But a post on Slashdot today
.:> enlightened me to another option, which is just as easily a form of
.:> consumer education, as it is more a shift in attitude of the spam
.:> recipient.  And it'll be a whole lot more successful, as you don't have to
.:> convince everyone to ignore spam; you just have to convince a small
.:> percentage to act this way.
.:>
.:> Instead of ignoring spam, reply to it -- in droves.  Spam is prevalent
.:> because it works, and spam works because you can send several
.:> thousand/million/whatever emails for nothing, and the small
.:> percentage of recipients who reply provide you with an insanely high
.:> profit margin.  But if all of us reply to every spam message we get (say,
.:> via a button-activated macro/script, see below), then we immediately cut
.:> into the profit margin: the spammers, or their clients, have to start
.:> weeding through bogus replies to get to the ones that will make them
.:> money.
.:>
.:> So, a use case:  I'm sitting on my little ibiblio account, reading
.:> Internetworkers, when a spam message comes in  (Subj: Hi,
.:> Tola--ffoooo--!).  I recognize it for spam, as I don't recognize the
.:> sender name or address, and the subject line is similar to other spam
.:> messages I receive.  I select the message and click my special
.:> "Spam-the-Spammer" button, activating a macro within my email reader.  I'm
.:> given an option or three, and select the defaults, and the spam is deleted
.:> while a bogus response is sent.
.:>
.:> This macro or script:
.:>   -- generates a random email address (I like all my faked emails to come
.:>       from "whitehose.gove", for example, but I don't much care what the
.:>       account is called)
.:>   -- allows me to select from generic replies or write a new one ("Yes,
.:>       Larry, I'd love to help you smuggle your funds to the US economy,
.:>       send me more info!"  .. versus "Hey, Toli, I'd
.:>       love a copy of that Banned C D")
.:>   -- sends the response
.:>   -- (optionally) finds a way of identifying the spam so the process is
.:>       more automated next time
.:>   -- finally, deletes the email from my inbox
.:>
.:>
.:> I think that the number of people who reply to spam, making it profitable,
.:> is very small.  It won't take many people sending bogus requests to
.:> surpass this number, and the amount of time the spammers must spend on
.:> each response to actually make money will quickly rise.  (Even if they get
.:> paid by the response by another company buying their services: after a
.:> month or two of increasing bogus responses, that other company will start
.:> renegotiating fees or will seek other providers, and the spam agency will
.:> find its profits shrinking.)
.:>
.:> What do y'all think?
.:
.:---
.:Come and play at the InterNetWorkers Web site!  
http://www.ibiblio.org/internetworkers/
.:You are currently subscribed to InterNetWorkers mailing list
.:To unsubscribe visit 
http://lists.ibiblio.org/mailman/listinfo/internetworkers
.:

-- 
"If you put your supper dish to your ears you can hear the sounds
 of a restaurant."  --Snoopy    (Charles Schultz 02-12-2000 RIP)
Sil_Greene AT unc.edu