6 ms·

IMHO The best way to reduce spam is to identify the problems in the current incarnation of email and design a new system that takes such problems into account.

jbert 15y ago
Well, the same problems apply to postal mail, IM and phone calls, etc. I think the two properties which a comms method needs to have a spam problem are: 1) it is inexpensive to communicate with someone 2) it is has a fixed, human-memorable "address" which can be communicated out of band (business card, verbally etc) Once you have these two things, such lists of fixed address can accumulate and be circulated - and they can be spammed. (2) implies that your comms method accept comms from unknown people. (1) is necessary for spammers to bother to do to use that channel to communicate with you. I think you have to give up one or the other of these things to avoid spam. Note that (1) is a sliding scale. Physical post is significantly more expensive than email to send, and suffers less spam - but it is not non-zero. Basically if cost of "customer acquisition" < "cost to send spam" on that comms channel, then you'll get some (if (2) is met). [*] I suppose some heuristics to decide if it is OK for "random unknown user X" to contact me can help. But false positives are the very devil here...
- deleted 15y ago
  [deleted]
- alexchamberlain 15y ago
  Why can't I be asked the first time someone communicates with me? (This is ofc client-side spam prevention, but it should be passed upstream ideally) However, this isn't necessary for all communications. For instance, if a communication is signed by a reputable company (bank, for instance), then don't bother asking. ISPs should keep the list of reputable companies as short as possible and, regardless, it gets rid of phishing emails.
  - mike-cardwell 15y ago
    If people see a message saying "x has tried to contact you, do you wish to allow them", some of them will say yes. So spammers will continue to spam just as hard as they always have. Also, considering how easy it would be to spoof "x", they could probably make people click "yes" a significant amount of the time.
    - alexchamberlain 15y ago
      You have defined problem number (3): the ability to spoof. Introduce certificates and signing - problem "sorted".
      - mike-cardwell 15y ago
        You mean like S/MIME, PGP, DKIM? How does this prevent me from getting a certificate for "Viagra Salesman" or even "Roger Smith" and sending spam selling viagra?
        alexchamberlain 15y ago
        Directly, it doesn't. However, I can block your certificate., or better, I can block the CA signing certificates that represent either businesses I don't want to talk to or people who don't really exist. Whilst I don't generally believe governments should intervene in the internet, this is one area they could intervene in. They could act as a certificate authority. Of course, CAs will make mistakes, but they can revoke certificates when things go wrong.
        mike-cardwell 15y ago
        You can also currently block IPs, domains, URLs and specific message content. There are even globally distributed lists of such things. This is already how we manage to block most spam on the edge. What you're proposing is just a small iteration on the existing defences. An expensive one, which wouldn't work unless you managed to get everyone doing it at the same time.
- tonyedgecombe 15y ago
  Actually I don't think it would have to cost much before the volume of spam plumetted. Just 1 cent per message would probably put off most spammers.
  - mike-cardwell 15y ago
    We'd still be left with a spam problem. Just a smaller one. And it would be nigh on impossible to implement and co-ordinate such a change.
  - tomjen3 15y ago
    There is a proposal for a proof of work system that does not require the sender to pay direct monetary fees and does not, significantly, slow down sending emails since it can be computed while the sender is writing the email. I can't remember what it is called, but I hope somebody else can chime in with the name. The smart thing about it is that you can use it as a filter in your baysian spam filtering systems. That way it can be implemented gradually, with no need to cut out everybody who doesn't yet use it.
    - throwaway64 15y ago
      https://secure.wikimedia.org/wikipedia/en/wiki/Hashcash https://secure.wikimedia.org/wikipedia/en/wiki/Hashcash
  - eru 15y ago
    Nice, but it would impact legitimate mailing lists. (In the 90s Bill Gates touted the idea that the recipient of the email would receive the fee, and routinely refund it to the sender for legitimate messages.)
    - pixelcort 15y ago
      Wouldn't using the mailing list's email address in the hashcash algorithm work? Then the mailing list's server or recipients' clients' spam filters could utilize the hashcash header, comparing it to the mailing list address in the To field. Mailing lists could even demand a lower hash target, requiring more energy to send messages to lists. This could rate-limit flame wars, for example.
mike-cardwell 15y ago
Easier said than done
mseebach 15y ago
It seems to me that the easiest way to reduce spam is to use proper spam filtering. My private Gmail and my work email (proprietary commercial solution) are almost entirely spam free.
- mike-cardwell 15y ago
  We're talking about the global spam problem, not your localised end user spam problem. Even if gmails spam filter was perfect and stopped all spam (impossible), they'd still have a problem because they'd be using vast amounts of human and computing resources to do it.
  - simonbrown 15y ago
    If it was perfect, spammers would no longer have an incentive.
    - mike-cardwell 15y ago
      I already specified that perfection is impossible. Even if every email is routed via a human filter instead of a computer filter, there would still be mistakes. If a spammer can't get a message through, they will keep tweaking it until they succeed. If even 999 out of 1000 spams are blocked, they'll still keep firing.
  - Jach 15y ago
    Maybe at first, but I think the GP's idea is more generally to make sending spam not a viable way of making money. If end users never see spam and spam profits drop from 0.2% of email addresses or whatever they're at now to 0.000000000002% then other methods to make money will be used.
    - mike-cardwell 15y ago
      You simply can not get that sort of accuracy without vastly increasing the number of false positives.
  - 15y ago
praptak 15y ago
Then please come up with one. Try not to score too many checkboxes on the form: http://craphound.com/spamsolutions.txt http://craphound.com/spamsolutions.txt
- alexchamberlain 15y ago
  Love the form - wish I had the time and the skills to come up with a solution.

jbert 15y ago

Well, the same problems apply to postal mail, IM and phone calls, etc. I think the two properties which a comms method needs to have a spam problem are: 1) it is inexpensive to communicate with someone 2) it is has a fixed, human-memorable "address" which can be communicated out of band (business card, verbally etc) Once you have these two things, such lists of fixed address can accumulate and be circulated - and they can be spammed. (2) implies that your comms method accept comms from unknown people. (1) is necessary for spammers to bother to do to use that channel to communicate with you. I think you have to give up one or the other of these things to avoid spam. Note that (1) is a sliding scale. Physical post is significantly more expensive than email to send, and suffers less spam - but it is not non-zero. Basically if cost of "customer acquisition" < "cost to send spam" on that comms channel, then you'll get some (if (2) is met). [*] I suppose some heuristics to decide if it is OK for "random unknown user X" to contact me can help. But false positives are the very devil here...

deleted 15y ago
[deleted]
alexchamberlain 15y ago
Why can't I be asked the first time someone communicates with me? (This is ofc client-side spam prevention, but it should be passed upstream ideally) However, this isn't necessary for all communications. For instance, if a communication is signed by a reputable company (bank, for instance), then don't bother asking. ISPs should keep the list of reputable companies as short as possible and, regardless, it gets rid of phishing emails.
- mike-cardwell 15y ago
  If people see a message saying "x has tried to contact you, do you wish to allow them", some of them will say yes. So spammers will continue to spam just as hard as they always have. Also, considering how easy it would be to spoof "x", they could probably make people click "yes" a significant amount of the time.
  - alexchamberlain 15y ago
    You have defined problem number (3): the ability to spoof. Introduce certificates and signing - problem "sorted".
    - mike-cardwell 15y ago
      You mean like S/MIME, PGP, DKIM? How does this prevent me from getting a certificate for "Viagra Salesman" or even "Roger Smith" and sending spam selling viagra?
      - alexchamberlain 15y ago
        Directly, it doesn't. However, I can block your certificate., or better, I can block the CA signing certificates that represent either businesses I don't want to talk to or people who don't really exist. Whilst I don't generally believe governments should intervene in the internet, this is one area they could intervene in. They could act as a certificate authority. Of course, CAs will make mistakes, but they can revoke certificates when things go wrong.
        mike-cardwell 15y ago
        You can also currently block IPs, domains, URLs and specific message content. There are even globally distributed lists of such things. This is already how we manage to block most spam on the edge. What you're proposing is just a small iteration on the existing defences. An expensive one, which wouldn't work unless you managed to get everyone doing it at the same time.
tonyedgecombe 15y ago
Actually I don't think it would have to cost much before the volume of spam plumetted. Just 1 cent per message would probably put off most spammers.
- mike-cardwell 15y ago
  We'd still be left with a spam problem. Just a smaller one. And it would be nigh on impossible to implement and co-ordinate such a change.
- tomjen3 15y ago
  There is a proposal for a proof of work system that does not require the sender to pay direct monetary fees and does not, significantly, slow down sending emails since it can be computed while the sender is writing the email. I can't remember what it is called, but I hope somebody else can chime in with the name. The smart thing about it is that you can use it as a filter in your baysian spam filtering systems. That way it can be implemented gradually, with no need to cut out everybody who doesn't yet use it.
  - throwaway64 15y ago
    https://secure.wikimedia.org/wikipedia/en/wiki/Hashcash https://secure.wikimedia.org/wikipedia/en/wiki/Hashcash
- eru 15y ago
  Nice, but it would impact legitimate mailing lists. (In the 90s Bill Gates touted the idea that the recipient of the email would receive the fee, and routinely refund it to the sender for legitimate messages.)
  - pixelcort 15y ago
    Wouldn't using the mailing list's email address in the hashcash algorithm work? Then the mailing list's server or recipients' clients' spam filters could utilize the hashcash header, comparing it to the mailing list address in the To field. Mailing lists could even demand a lower hash target, requiring more energy to send messages to lists. This could rate-limit flame wars, for example.

mike-cardwell 15y ago

Easier said than done

mseebach 15y ago

It seems to me that the easiest way to reduce spam is to use proper spam filtering. My private Gmail and my work email (proprietary commercial solution) are almost entirely spam free.

mike-cardwell 15y ago
We're talking about the global spam problem, not your localised end user spam problem. Even if gmails spam filter was perfect and stopped all spam (impossible), they'd still have a problem because they'd be using vast amounts of human and computing resources to do it.
- simonbrown 15y ago
  If it was perfect, spammers would no longer have an incentive.
  - mike-cardwell 15y ago
    I already specified that perfection is impossible. Even if every email is routed via a human filter instead of a computer filter, there would still be mistakes. If a spammer can't get a message through, they will keep tweaking it until they succeed. If even 999 out of 1000 spams are blocked, they'll still keep firing.
- Jach 15y ago
  Maybe at first, but I think the GP's idea is more generally to make sending spam not a viable way of making money. If end users never see spam and spam profits drop from 0.2% of email addresses or whatever they're at now to 0.000000000002% then other methods to make money will be used.
  - mike-cardwell 15y ago
    You simply can not get that sort of accuracy without vastly increasing the number of false positives.
- 15y ago

praptak 15y ago

Then please come up with one. Try not to score too many checkboxes on the form: http://craphound.com/spamsolutions.txt http://craphound.com/spamsolutions.txt

alexchamberlain 15y ago
Love the form - wish I had the time and the skills to come up with a solution.