Has the Spam War Been Won? | Hacker News Reader

Has the Spam War Been Won?

cacm.acm.org

19 pointsyarapavan24 comments

Unfortunately I think spam must still work, or spammers would have stopped sending it. They're pretty pragmatic. It wouldn't take more than a couple months of making no money before they switched to some other racket.

Sure, but I think the salient point here is this: we've gotten good enough at filtering spam that looking through your email inbox is no longer a major headache. That's how I frame the war on spam, anyway, and in that sense I'd say we're definitely winning. Maybe not won, but winning.

I worry that while this is true for us GMail users, it may not be true for everyone.

Plus GMail is a bit strict. I still get lots of false positives.

I think the problem is "solved" for non-GMail users, too.

Nowadays, setting up a good spam-protected mail server isn't very sophisticated anymore.

In our company, I'm running a plain Exim mail server with a SpamAssassin in almost default configuration and some standard RBLs. Although I have a quite burned email address, I'm getting just around 5 spam emails per day and false positives are rare (less than 1 per month, I guess).

It works perfectly for all of my personal email addresses that I have taken care to keep off of the web in spiderable form, but I get lots of false positives for my business email addresses that are out there as as a mailto:.

we've gotten good enough at filtering spam

If we had (all of us) the parent's point would apply: spammers would not be making enough money since no-one would respond. So for some people, spam is still a problem when are fooled by scams.

I still receive too much spam. Still relying on Thunderbird.

I wonder if Thunderbird's filter has been improved at all lately. Some possible improvements come to mind. For example it could take into consideration who is already in my address book. If somebody sends me an email with only an image and no text, and that someone is not in my address book, it seems safe to consider it spam.

It should also remember whom I actually sent mails to, and filter all "Unknown Recipient" mails that I never triggered.

Also, how can emails with "VIAGRA" in the subject pass by the spam filter? It must have had thousands of opportunities to learn that VIAGRA in emails equals spam.

Guess I should go find Thunderbird's bug tracker.

Server-side spam filtering is the only thing that really works. Thunderbird can't do greylisting, for example.

What I wish for is that Thunderbird can teach my server about spam. That is, if I flag a mail, Thunderbird should inform the server, and the server should learn. There might already be a standard for that kind of thing, but I am not sure.

I think the server will also need adaptive filtering techniques (like bayesian networks), in addition to the technical filters like greylisting.

Viagra != Spam. Ask a pharmacist. And I'm not making that up. Yesterday a pharmacist's son told me of his father's spam filtering woes.

I took care to write "VIAGRA in emails equals spam", to exclude the case of real Viagra as being sold in pharmacies. Of course I didn't add "in emails to me".

I take it you have privacy issues with GMail. Otherwise you could use GMail as your mail server and sync Thunderbird with imap.

Yes, so far I did not want to use GMail.

If it's been won and I still receive tons of spam does that mean it has been won by the spammers?

I hear you. Running different filters on each of three accounts and still received 200 spam that got through in one day.

My spam counts for the last couple days (that spamassassin caught), working backward from today:

554, 481, 489, 901, 1192, 932

So the last couple days have been good, but it's been running about 1K per day for as long as I can remember.

We have about 55 accounts on this machine. Let's assume most legit mail doesn't bounce (i.e. human mistakes and misspellings are rare). Grepping for "user unknown" in the mail log gives about 100,000 matches per day.

In short, the bastards are still hard at work.

I think it's far from won. While we work on better ways to detect spam and faster reactive methods. Spammers are doing the same. Writing better virus, testing better social engineering techniques. It's still very profitable.

"Analysis reveals a surge in spam levels in February to 89.4 percent, an increase of 5.5 percent since January mostly due to an increase in spam emanating from the Grum and Rustock botnets. Over the past year, Grum has experienced relatively little change in spam volumes, but from February 5, Grum’s output increased by 51 percent making it responsible for 26 percent of all spam, up from its usual 17 percent. http://www.messagelabs.com/resources/press/45666

A pretty poor article, considering it's from an acm.org blog. It's 2010, and his blog post is based only on two studies, one from 2005 and the other from 2008. To explain the two years for which he has no information, he quotes "his personal experience".

Just a few days ago we read here on HN how one nigerian spammer was netting 40M… (http://news.ycombinator.com/item?id=1174235). And as it was said in other comments, if spammers are still sending spam, there has to be a reason.

The "I don't see spam in my inbox" argument misses the real great cost of spam: false positives. Beating spam actually makes the problem worse because the better filters are the more spammers spam, and the more spam there is in my spam folder the harder it is to find false positives.

Aside from your squeaky clean inboxes there is another front in the spam war - the botnets in which your, your relatives, friends, and colleagues' infected computers may be participating unknowingly - and in this aspect the situation is worse than ever.

There is a very easy solution for that: make the ISP block the outbound SMTP port. This will force spammers to use web-mail, where the mail provider is better armed to detect spammy accounts. Unfortunately, this would (and does) tend to centralize the internet further, which is not acceptable.

I know most people can't use it due to needing email to be instant, but at least for my personal mail I've found greylisting to work wonders.

What it does is tell the sender that it is busy/something is wrong and to call back later. It then makes a note of this. When the person calls back it will then accept the mail and add the address to a whitelist.

This works because most spammers don't use a rfc complaint mail server and don't care to call back. It is cheaper to just move onto the next target.

I use it and it helped somewhat, but spam still gets through. Also, it can at best be a temporary solution. It wouldn't be that hard for spammers to upgrade their mail servers. Meanwhile, I have to live with a delay in receiving emails caused by greylisting.

If not won, the advancing spam offensive has at least been held in check and reduced to a trench warfare activity.

Reply on news.ycombinator.com