Re: OT: Hammering Spammers

[Justin Fielding <justin@xxxxxxxxxxxxxxx>]

Roger Merchberger wrote:

> Rumor has it that Justin Fielding may have mentioned these words:
>
> > Lars Hansson wrote:
> >
> > > Just what the world needs; YET another mail access protocol.
> >
> >
> > Actually maybe we do.
>
>
> No, we don't. Read carefully: "mail *access* protocol" -- not "mail 
> *tranfer* protocol." The OP was talking about replacing POP3/IMAP/etc. 
> with something else that has built-in database capabilities, not 
> replacing SMTP.
>
> >   Spam prevention could then be built in to the protocol, for example 
> > just out of the top of my head, maybe the originating servers CPU 
> > serial number could be used as a fingerprint.
>
>
> So now every ISP would have to have a serial-number-capable CPU for 
> their mailserver(s)? And then publish that info to the world? That 
> would 1) suck, and 2) reek of big-brother-izm, which would not scale 
> well globally.

Not a great idea, but was off the top of my headas an example.  I 
actually think emails which are not digitally signed should be rejected 
by mail servers.  Each person has their personal digital certificate, 
this is much like your passport or social security id. 

> >   I think service providers should be prosecuted if they can't 
> > provide solid evidence against customers of theirs who are spamming.  
> > It would wake the industry up a bit after 1 or 2 major ISP's are 
> > wiped out by large law suits.  The buck has to stop somewhere.
>
>
> And what would this do to the "little guys" like me? what you're 
> proposing would put me out of business without a shot fired, as we 
> don't have the backing for big-time lawyers....
If you just made sure you had real details of your customers, and made 
sure your customers are not spamming, then there is no problem.  If you 
let people send spam via your systems, then I'm sorry but the world can 
do without your business.

> ... not to mention that ISPs shouldn't be responsible for the conduct 
> of their customers any more than a video store or any other service 
> business. (Think: "That guy wouldn't have been a serial rapist if he 
> wouldn't have had access to the porno section at the local video 
> store. The answer: Close the video store! -- Bzzt. Wrong answer.)
I think this is more than a little different, if you can't see that, 
then let's just stop now.  I agree, do you blame the companies making 
guns for the guy who shoots his wife?  No (although if you did, the 
world would be a better place).  The thing is, do you blame the guy in 
the gun store who sold him the gun without any licencing via the back 
door?   Yes.  SO these large ISP's who KNOW that people are spamming via 
their system, turn a blind eye.  They know what's happening, but they 
are paying customers, and hey, someone has to pay for the fat cat's 
dinner.  I can log all of the comcast connections to my mail server, 
where these guys hammer my server with dictionary spamming.  If I give 
these details to comcast, do you think they do anything?  Yeah right.  
Even if the claim is made that these people are just Mr & Mrs smith and 
they must be infected with this virus etc, that can be 1. Bull**** 2. 
True, but why are these people still infected with a known virus?  They 
should have virus protection.  Having a PC running windows and not 
having up to date virus protection is just plain stupid these days.

The point is, we have to make people take liability for their actions 
(or lack of).  If you don't make sure your car is in good order, and 
your brakes fail, and you have a pile up.  You WILL be held responsible 
if it is found that your actions or lack of, caused the accident.  
Unless people are held responsible, they won't make any effort to change.

> > I wish the IT community, specifically those who have to deal with the 
> > problem of spam, could get together and launch a massive DoS attack 
> > against comcast or similar.  An on-line revolution.
>
>
> I used to think that way as well[1], but it seems any more, the 
> spammers & clueless admins seem to have more bandwidth than those of 
> us wearing the white hats -- and we could quickly bite off more than 
> we could chew.
>
> It would be better to put more energy into:
>
> http://www.im2000.org/

Took a look at it and instantly don't like it.  I don't want my emails 
stored on the senders server.  There are first security concerns, 
secondly, it means I can't get my mail if the senders server is down, 
doesn't make sense to me.  I think there are better ways.

> and ditch SMTP altogether.
>
> Laterz,
> Roger "Merch" Merchberger
> [1] Search the list archives for the subject: "Let's Hammer a Spammer!"
>
> --
> Roger "Merch" Merchberger  --  SysAdmin, Iceberg Computers
>  _±±_                          zmerch@xxxxxxxxxxx
> (©||®)  If at first you don't succeed, nuclear warhead
>  _)(_   disarmament should *not* be your first career choice.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature