If you just kinda LANDED here, consider starting at the beginning and clicking on Consumer Notes

SPAM

SPAM is particularly offensive to me, partly because of the ways SPAMmers try to conceal their identities and e-mail origination point. They harvest names from any place on the web they can think of including chat rooms and NewsGroups. They even send out "spiders" which go through every web site they can find-- sites like yours and mine--and extract email addresses from the HTML. This is why all my web pages now have something like email:noam.sane at theeidealist dotnyet instead of email:noam.sane@theeidealist.net. Since there's no "@" sign in the email text, and dotnyet, is not a valid domain, their parsing routines won't know where my email addresses are. You, though, won't be able to click on the link and send me mail. You'll have to type it in or cut/paste and edit. I'm gradually moving to the use of a graphic instead because its hard to parse a bunch of dots: Try to "select" that text; you can't because it's not text.

Update 4/2005: What "they're" doing now is to look for .GIF files, like my example, then use OCR (Optical Character Recognition) routines to analyze them and find the text like you might do with your scanner. I now see web sets whose email address graphics are obscured with "noise" (like a snowy TV picture") so that the OCR program cant extract the text. I've made a change in how I do mine: I now use TWO .GIF files with the left and the right half of the address. We'll see if the spam harvesters' 'bots are smart enough to assemble 2 GIFs into 1 address...

Update 2/2009: Just to stay ahead of the bastards, I now use THREE .GIF files, the middle one having no useful content. See bottom of page.

What really pisses me off about spammers is that they're using flaws in the system to circumvent your personal wishes. They are constantly looking for ways to get past the anti-spam services you sign up for which plainly indicate your desire to not get any spam. And since it costs essentially nothing to send thousands and thousands of spam (as opposed to junk mail or faxes) they don't care how many they send, even if most addresses are bad. They just hope for 1 response per hundreds of thousands.

If you find anyone who actually patronizes a spammer please SHOOT THEM because if nobody responded to spam they wouldn't send any. And you'd be benefitting the gene pool. And please don't reply to opt-out email; you should not have to lift a finger to get off of a list you never signed up for. If you opt-in, then you're exercising your right to choose.

I use an awesome anti-spam service called SpamCurb (http://www.spamcurb.com) for my email. They filter the mail for spam (AND viruses) using a number of different methods. In my case they are my mail service so I have POP3 boxes with them. In the case of businesses with their own mail server, SpamCurb will filter the mail, then forward to the subscriber the mail that passes the tests. I get very few spams now (DISCLAIMER: I have a business relationship with them).

Whether you have box(es) with them or you have them scan and forward your mail, to reduce false positives (and thus missing "ham" or good mail) you can elect to have SOME of their tests REJECT the mail and other tests TAG the mail. The tagged mail does get sent to you but you can use the RULES or FILTERS in your mail program to move this mail to a special folder for later perusal. You also get an email report everynight which you can scan for false positives if you like.

Another nice feature of a service like this is that THEIR SERVER handles the spam onslaught; you get very little bandwidth in your Internet connection used up by spam and virus-laden mail.

Spam Backscatter
It's gotten so bad that anti-spam systems are causing their OWN spam. Jack at SpamCurb recently told me about why his mail server had gotten bogged down a couple times. I asked him if it was spam coming from one of his subscribers or if it was spam coming in hoping for an open-relay. It was neither:

It's a spammer forging "spamcurb.com" in his emails. Broken anti-spam boxes and services accept the spam with the forged address (i.e someperson@spamcurb.com though it really came from sleazeball.com), determine that there is no such local user, and send the bounces (non-delivery reports) back to the apparent sender, someperson@spamcurb.com, which of course doesn't exist.

Barracuda and Messagelabs are especially bad. It's called "backscatter", and their products, "backscatter servers". Postini is both bad and a lousy spam filter. If you know anyone who is using or thinking about using these, be sure to let them know that backscatter is becoming such a big problem that people are forming blacklists of backscatter servers. In other words, if their anti-spam solution is anti-social, it could get them blacklisted.

Turning In Spammers
If you HATE spam like I do, you might also want to join SPAMCOP. This is a website to which you can email or paste spam you've received. Their computer then analyzes it and sends copies to the appropriate SysOps, postmasters, etc. in an attempt to get them to shut down the spammers. You can also reroute your inbound mail thru their server so it filters out probable junk mail. They also maintain a blocklist that email servers can consult before accepting email.

SPAMCOP identifies spam by its source, not its content which means you are less likely to have email filtered because someone said "I had some left over chicken breasts…" or "Jill and I found a great mortgage and now she is working from home". They use thousands of reporters (like me) who send them spam to analyze. The more spam that comes from a server, the longer it gets on the BLOCKED list for. If the owner of the server finds out that it is an open relay that spammers can use, and if they fix the problem, they'll eventually be taken of the list as the amount of spam attributed to them falls off.

Here's an email exchange between me and Ellen at SpamCop that's worth reading:

Hi Spam Cop:
I'm running out of bytes and will need to renew. My question is whether anything is REALLY happening for my money. I cut & paste at home and at work, and I use SpamDeputy for Outlook on my laptop.

Are people really getting the message that SPAM isn't tolerated? Are SysOps getting useful info from you to terminate offenders? Is there a better way to get SPAMMERS "in trouble"? I keep getting mail from some company in Canada trying to sell me fake diplomas; each time they use a different mail server. It seems like they just keep doing it; I'm often tempted to set my computer to continuously dial the phone number they give but then I'm lowering myself to their level.Just let me know that this is worth my time and $12 and then I'll renew both accounts.

---

Hi --
yes reporting spam and yet seeing the flood not decrease can be discouraging; however I should tell you that spammers do get removed by their ISPs on a regular basis and if we didn't report them then how would the ISPs know? Mostly reporting has an effect on:

 1) "new" spammers who aren't yet hardcore, as it were
 2) budding mainsleaze spammers and
 3) some career spammers who make the mistake of moving to whitehat ISPs who do terminate them rapidly. I also believe that it has an effect on the      bigger ISPs/backbones although it takes longer to see the results for various reasons.

Will your personal spam load decrease? Probably not unless you dump all your email addresses and start over with random number/alpha addresses that no one can dictionary and that your friends can't remember anyway and never use them anywhere in public.

I *do* believe that because of the multitude of complaints about spam that most big companies that would be spamming by now aren't because they are realizing that they will do themselves more harm than good. Have the complaints gotten rid of Ralsky and some other big career spammers? No, not yet but we are making his life more difficult. Will spam ever go away? Probably not but if we can have a positive effect on the rate of increase then we are doing the right thing.

Ellen (SpamCop Deputy)-

A nice add-on for SpamCop is SpamDeputy (http://spamdeputy.com/) which is software that automates the sending of spam to SpamCop and another agency. It's $20 US, $22.31 Euro (1/13/02). It works perfectly and saves you time.

Here's a good article about SPAM called Spam Makes Me Sick by Kirk Kirksey from San Diego's Computor Edge magazine.

Virus Hoaxes and Myths

Don't pass on that virus warning or urban legend  (see below) without confirming it. When I get stuff like "Don't Even Breathe! This Virus Will Wipe Out Your Hard Drive AND Civilization As We Know It!!!" I assume it's a virus hoax and I check it out first at places like:

http://www.Vmyths.com/
http://vil.mcafee.com/hoax.asp
http://www.symantec.com/business/security_response/threatexplorer/risks/hoaxes.jsp
http://www.sophos.com/security/hoaxes/index_hoax.html