Subject: [Asrg] Ideas for anti-spam

From: Swaying Trees <[email-masked]>
Date: Mon, 27 Sep 2010 08:07:48 -0700 (PDT)

I have some experience in fighting off intentional internet crime of a few 
different types so I have that mentality and I'm interested in stop spam. I love 
creating systems to catch the bad guys and I've been successful at it in a few 
different arenas.
Types of spam being targeted:
1. Forum/comment/website/blog spam
2. Video spam (youtube)
3. Basically most spam but not email spam.

Basic idea: USE the eyes of the public. The public is the target of  spam. 
They're the ones that see it. Let THEM take care of the spam problem. They will 
be happy to do  so.

All we need to do is this: Let 3 established users of that website flag the spam 
and hide it. If reporters abuse this feature, their accounts will be canceled or 
suspended so they have to be sure its really spam. Only let users with a certain 
account age flag spam (3 or 6 months, for example). People with new accounts can 
also flag it but it doesn't hide it right away. Instead it goes into an Spam 
approval que where more experienced users can take action. The problem is 
complex because these are human spammers so the solution has to be significant 
as well.

Scenario: Spammer posts comments on message board. 3 people flag it and its 
deleted automatically and the spammer's account is disabled. It can be renabled 
in case of a false alarm and if the user confirms they're not a spammer. No 
system is perfect but if it stops 95% of the spam  coming in, its good enough. 
Spammers will realize that its simply not worth it if only 3 people can see 
their message and have the account disabled.

This would work for Yahoo messenger also. 3 people flag an account as spam and 
that's it. Different checks and balances can be created to take care of 
different "what if" situations.

Create a central website for example "flag the spam.com" (FTS). This is how it 
would work: On every piece of user created content (comments, videos), there is 
a "report" button, that makes a link to the FTS site. For example there's a 
spammer on Facebook or Youtube. When the FTS site receives reports from 3 
people, it sends back an email to the website reporting the spammer's username). 
Facebook/Youtube automatically takes immediate action, deletes the comments and 
spam and disables the user account. The flag icon (looking like a trash can 
icon) would become a universal "report spam" symbol. Website owners could  
either let FTS do the work, or buy the software from FTS to install it on their 
websites. I've thought of creating a system like this and testing it out on 
smaller websites to the bigger ones can see it really works.

As mentioned, checks and balances could be created to take care of  security and 
false alarms as much as possible. Secure keys and codes can be exchanged to make 
sure messages being exchanges are genuine and not fake. When there is so much  
spam going around, even if 3% of all reports are false, its still ok.

For spammers who create fake blogs or websites for traffic generation, the  same 
approach can be used to send reports to Google so their site can be excluded 
from searches. The goal once again: Make spam  reporting quick and easy for the 
public.
This is not true right now. Its difficult to report a certain website to Google 
for spam. Similarly, Facebook spam gets reported to admins who take action. 
Thats slow and there arent enough admins. Its very hard to report spam comments 
on Yahoo news. Also, action taken is slow.

For email spam, let each email server obtain an anti-spam certification which 
means, they take action against people who spam. Anyone who doesnt have that 
certification, will get a "spam" point meaning, their email will be more easily 
caught in spam filters. This creates a motive for email server admins to get 
certified. Black listed email servers which dont take any action against should 
not be entertained by other servers. They'll be left out of the internet cloud 
with no choice but to fix themselves. A system can be created to take care of 
cheats and other things.
Email spam is 95% of all emails sent. We cant fix this serious problem without 
having a serious solution.

Does anyone have any thoughts?

Steven

---

From: Douglas Otis <[email-masked]>
Date: Mon, 27 Sep 2010 10:17:31 -0700

On 9/27/10 8:07 AM, Swaying Trees wrote:
> I have some experience in fighting off intentional internet crime of a 
> few different types so I have that mentality and I'm interested in 
> stop spam. I love creating systems to catch the bad guys and I've been 
> successful at it in a few different arenas.
> Basic idea: USE the eyes of the public. The public is the target of 
> spam. They're the ones that see it. Let THEM take care of the spam 
> problem. They will be happy to do so.
>
> All we need to do is this: Let 3 established users of that website 
> flag the spam and hide it. If reporters abuse this feature, their 
> accounts will be canceled or suspended so they have to be sure its 
> really spam. Only let users with a certain account age flag spam (3 or 
> 6 months, for example). People with new accounts can also flag it but 
> it doesn't hide it right away. Instead it goes into an Spam approval 
> que where more experienced users can take action. The problem is 
> complex because these are human spammers so the solution has to be 
> significant as well.
>
> Scenario: Spammer posts comments on message board. 3 people flag it 
> and its deleted automatically and the spammer's account is disabled. 
> It can be renabled in case of a false alarm and if the user confirms 
> they're not a spammer. No system is perfect but if it stops 95% of the 
> spam coming in, its good enough. Spammers will realize that its simply 
> not worth it if only 3 people can see their message and have the 
> account disabled.
>
> This would work for Yahoo messenger also. 3 people flag an account as 
> spam and that's it. Different checks and balances can be created to 
> take care of different "what if" situations.
>
> Create a central website for example "flag the spam.com 
> <http://spam.com>" (FTS). This is how it would work: On every piece of 
> user created content (comments, videos), there is a "report" button, 
> that makes a link to the FTS site. For example there's a spammer on 
> Facebook or Youtube. When the FTS site receives reports from 3 people, 
> it sends back an email to the website reporting the spammer's 
> username). Facebook/Youtube automatically takes immediate action, 
> deletes the comments and spam and disables the user account. The flag 
> icon (looking like a trash can icon) would become a universal "report 
> spam" symbol. Website owners could either let FTS do the work, or buy 
> the software from FTS to install it on their websites. I've thought of 
> creating a system like this and testing it out on smaller websites to 
> the bigger ones can see it really works.
>
> As mentioned, checks and balances could be created to take care of 
> security and false alarms as much as possible. Secure keys and codes 
> can be exchanged to make sure messages being exchanges are genuine and 
> not fake. When there is so much spam going around, even if 3% of all 
> reports are false, its still ok.
>
> For spammers who create fake blogs or websites for traffic generation, 
> the same approach can be used to send reports to Google so their site 
> can be excluded from searches. The goal once again: Make spam 
> reporting quick and easy for the public.
> This is not true right now. Its difficult to report a certain website 
> to Google for spam. Similarly, Facebook spam gets reported to admins 
> who take action. Thats slow and there arent enough admins. Its very 
> hard to report spam comments on Yahoo news. Also, action taken is slow.
>
> For email spam, let each email server obtain an anti-spam 
> certification which means, they take action against people who spam. 
> Anyone who doesnt have that certification, will get a "spam" point 
> meaning, their email will be more easily caught in spam filters. This 
> creates a motive for email server admins to get certified. Black 
> listed email servers which dont take any action against should not be 
> entertained by other servers. They'll be left out of the internet 
> cloud with no choice but to fix themselves. A system can be created to 
> take care of cheats and other things.
> Email spam is 95% of all emails sent. We cant fix this serious problem 
> without having a serious solution.
>
Your scheme is easily poisoned.  Covert accounts are free and can 
exchange messages with other accounts over some period and be 
indistinguishable from normal users.  Unfortunately, the art of saying 
something without saying anything has become a forte for many, like 
adding +1 to a thread. ;^)

-Doug

---

From: Swaying Trees <[email-masked]>
Date: Mon, 27 Sep 2010 12:49:34 -0700 (PDT)

hi Doug

>> Your scheme is easily poisoned.  Covert accounts are free and can  exchange 
>>messages with other accounts over some period and be  indistinguishable from 
>>normal users.  Unfortunately, the art of saying  something without saying 
>>anything has become a forte for many, like  adding +1 to a thread. ;^)

I dont see how. You mean those 1) covert accounts will be used to generate false 
reports? Or 2) will they not be detectable as spammers because they look like 
normal users?
For 1: users who file false reports can have their accounts suspended/cancelled.
For 2: its not possible to not be detected as a spammer. Anyone can be reported 
as a spammer. The evidence (offending messages) will be gathered. People who 
have been wrongly reported can appeal. 

I didnt understand your message.

________________________________
From: Douglas Otis <[email-masked]>
To: [email-masked]
Sent: Mon, September 27, 2010 12:17:31 PM
Subject: Re: [Asrg] Ideas for anti-spam

On 9/27/10 8:07 AM, Swaying Trees wrote:
> All we need to do is this: Let 3 established users of that website flag the 
>spam and hide it. If reporters abuse this feature, their accounts will be 
>canceled or suspended so they have to be sure its really spam. Only let users 
>with a certain account age flag spam (3 or 6 months, for example). People with 
>new accounts can also flag it but it doesn't hide it right away. Instead it goes 
>into an Spam approval que where more experienced users can take action. The 
>problem is complex because these are human spammers so the solution has to be 
>significant as well.
> 
> Create a central website for example "flag the spam.com<http://spam.com>" 
>(FTS). This is how it would work: On every piece of user created content 
>(comments, videos), there is a "report" button, that makes a link to the FTS 
>site. For example there's a spammer on Facebook or Youtube. When the FTS site 
>receives reports from 3 people, it sends back an email to the website reporting 
>the spammer's username). Facebook/Youtube automatically takes immediate action, 
>deletes the comments and spam and disables the user account. The flag icon 
>(looking like a trash can icon) would become a universal "report spam" symbol. 
>Website owners could either let FTS do the work, or buy the software from FTS to 
>install it on their websites. I've thought of creating a system like this and 
>testing it out on smaller websites to the bigger ones can see it really works.
> 
Your scheme is easily poisoned.  Covert accounts are free and can exchange 
messages with other accounts over some period and be indistinguishable from 
normal users.  Unfortunately, the art of saying something without saying 
anything has become a forte for many, like adding +1 to a thread. ;^)

-Doug
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Jose-Marcio Martins da Cruz <[email-masked]>
Date: Mon, 27 Sep 2010 22:03:20 +0200

Swaying Trees wrote:

> For email spam, let each email server obtain an anti-spam certification 
> which means, they take action against people who spam. Anyone who doesnt 
> have that certification, will get a "spam" point meaning, their email 
> will be more easily caught in spam filters. This creates a motive for 
> email server admins to get certified. Black listed email servers which 
> dont take any action against should not be entertained by other servers. 
> They'll be left out of the internet cloud with no choice but to fix 
> themselves. A system can be created to take care of cheats and other things.

Hope each email server will look to some kind of certification is unrealistic. 
Either way, who will deliver certifications ??? And based on what criteria ??? 
Much simpler things (SPF, DKIM, ...) are already hard to deploy.

--

---

From: Aaron Wolfe <[email-masked]>
Date: Mon, 27 Sep 2010 16:38:49 -0400

On Mon, Sep 27, 2010 at 11:07 AM, Swaying Trees <[email-masked]> wrote:
> different types so I have that mentality and I'm interested in stop spam. I
> love creating systems to catch the bad guys and I've been successful at it
> in a few different arenas.
> They're the ones that see it. Let THEM take care of the spam problem. They
> will be happy to do so.
>

What is this assumption based on?  We all know how poorly users
respond to "training" scenarios with email spam.  Most of  them just
don't want to see spam and have no interest in policing the internet.

> canceled or suspended so they have to be sure its really spam. Only let
> users with a certain account age flag spam (3 or 6 months, for example).
> People with new accounts can also flag it but it doesn't hide it right away.
> Instead it goes into an Spam approval que where more experienced users can
> take action. The problem is complex because these are human spammers so the
> solution has to be significant as well.

This is not a well thought out system.  You're assuming people want to
help you, that they will be accurate, and that they will be honest.
These are bad assumptions to make.  I won't bother to point all all
the holes in this leaky boat, but consider what happens when one group
of users simply disagrees with another group or individual.

> deleted automatically and the spammer's account is disabled. It can be
> renabled in case of a false alarm and if the user confirms they're not a
> spammer. No system is perfect but if it stops 95% of the spam coming in, its
> good enough. Spammers will realize that its simply not worth it if only 3
> people can see their message and have the account disabled.
>
> This would work for Yahoo messenger also. 3 people flag an account as spam
> and that's it. Different checks and balances can be created to take care of
> Create a central website for example "flag the spam.com" (FTS). This is how
> it would work: On every piece of user created content (comments, videos),
> there is a "report" button, that makes a link to the FTS site. For example
> there's a spammer on Facebook or Youtube. When the FTS site receives reports
> from 3 people, it sends back an email to the website reporting the spammer's
> username). Facebook/Youtube automatically takes immediate action, deletes
> the comments and spam and disables the user account. The flag icon (looking
> like a trash can icon) would become a universal "report spam" symbol.
> Website owners could either let FTS do the work, or buy the software from
> FTS to install it on their websites. I've thought of creating a system like
> this and testing it out on smaller websites to the bigger ones can see it
> really works.
>
> As mentioned, checks and balances could be created to take care of security
> and false alarms as much as possible. Secure keys and codes can be exchanged
> to make sure messages being exchanges are genuine and not fake. When there
> is so much spam going around, even if 3% of all reports are false, its still
> ok.
>
> For spammers who create fake blogs or websites for traffic generation, the
> same approach can be used to send reports to Google so their site can be
> excluded from searches. The goal once again: Make spam reporting quick and
> easy for the public.
> This is not true right now. Its difficult to report a certain website to
> Google for spam. Similarly, Facebook spam gets reported to admins who take
> action. Thats slow and there arent enough admins. Its very hard to report
> spam comments on Yahoo news. Also, action taken is slow.
>
> have that certification, will get a "spam" point meaning, their email will
> be more easily caught in spam filters. This creates a motive for email
> server admins to get certified. Black listed email servers which dont take
> any action against should not be entertained by other servers. They'll be
> left out of the internet cloud with no choice but to fix themselves. A
> system can be created to take care of cheats and other things.

A lot of very smart people have put a lot of thought into these issues
before.  I think you might want to become more familiar with the
existing solutions and the theories behind them.

---

From: Douglas Otis <[email-masked]>
Date: Mon, 27 Sep 2010 14:43:11 -0700

On 9/27/10 12:49 PM, Swaying Trees wrote:
>  hi Doug
>
> >> Your scheme is easily poisoned. Covert accounts are free and
> >> can exchange messages with other accounts over some period and
> >> be indistinguishable from normal users. Unfortunately, the art
> >> of saying something without saying anything has become a forte
> >> for many, like adding +1 to a thread. ;^)
>
>  I dont see how. You mean those 1) covert accounts will be used to
>  generate false reports?

A reputation scheme reacting to submissions from responders vetted by 
account duration is open to legitimate messages being blocked.  The goal 
might be retaliation of some sort or to cause the reputation scheme to 
be dropped.

>  Or 2) will they not be detectable as spammers because they look like
>  normal users?

Yes, until they go rogue and submit reports based upon dubious content.

>  For 1: users who file false reports can have their accounts

Accounts are essentially free and unlimited.  Any reaction to spoofed 
submissions quickly degrades into a popularity contest where only those 
white-listed are safe.

>  For 2: its not possible to not be detected as a spammer. Anyone can
>  be reported as a spammer. The evidence (offending messages) will be
>  gathered.

Your scheme would not use the community to identify spammers when 
content must confirm assertions.  In your scheme, how will the service 
confirm the source of the message?  And what prevents an endless 
acquisition of new accounts?

>  People who have been wrongly reported can appeal.

What level of support staff is needed to review content and to deal with 
appeals?  Spammers have an incentive to lie, and they often do.

The underlying problem is a lack of a clearing house able to recognize 
synonymous identities and a lack of federated credentials when dealing 
with "free" identities.   Forums are expected to endure some level of 
abuse from individuals, weighed against the suppression of speech by 
oppressive authorities.   Often an abuse problem can be solved by 
requiring fees to join, which overcome the economics of spamming.

-Doug

---

From: Richi Jennings <[email-masked]>
Date: Mon, 27 Sep 2010 23:09:20 +0100

> existing solutions and the theories behind them.

Seconded. An interesting place to start might be:
 http://en.wikipedia.org/wiki/Vipul's_Razor
I vividly remember Wired Magazine's 2001 gushing writeup, which
basically told us that Razor was going to finish spam for good.

There's also Vernon Schryver's "Final Ultimate Solution to the Spam
Problem" page. Some years ago I wrote a short layperson's guide:
 http://blog.richi.co.uk/2006/04/tips-for-your-new-anti-spam-idea.html

// [email-masked] +44.7789.200701 / 1.408.256.0084 (vm)
// Skype, Twitter, Facebook, etc.: http://richij.com/contact

---

From: Swaying Trees <[email-masked]>
Date: Wed, 29 Sep 2010 07:52:12 -0700 (PDT)

Hi guys thanks for the replies!

Aaron wolfe wrote:
>> What is this assumption based on?  We all know how poorly users respond to 
>>"training" scenarios with email spam.

It doesn't involve any training. All they have to do is click on the "report 
button".

>>   Most of  them just don't want to see spam and have no interest in policing 
>>the internet.

This is not true. On Youtube for example, comments are flagged as spam. If 
people see spam and they know they can have an effect, they'll do it. Its just 
one click.

>> You're assuming people want to help you, that they will be accurate, and that 
>>they will be honest. These are bad assumptions to make.  I won't bother to point 
>>all all the holes in this leaky boat, but consider what happens when one group 

Once again there are pluses and minuses. Youtube already has the "flag as spam" 
system and it does more good than harm. If we're stopping a lot of spam for a 
few misses or abuses, thats ok.

I dont know anything about email spam, so my comments on that were just some 
basic ideas that you guys are right, have probably already been thought of and 
so on.

For my comments on general internet spam, I'll work on this and see if I can do 
anything. Oh yea I'm going to be the global spam hero! Yea right. I have a 
domain. Hopefully I will create a test project to service one website and see if 
it works.
Once again, I've done some programming work on other intentional internet crime 
and it has worked good, so I believe in myself and its worth trying.
In my attempts to stop that internet crime, I've had some misses but overall, 
the system evolved and has done a lot of good. Some side effects are possible 
and thats ok. That will happen. There are side effects of putting a lock on our 
doors also - what if we forget the keys inside? But we have to take the good and 
the bad and see what we're gaining, what the risks of our losses are, etc.

Doug, thanks for your comments as well. I just have to test it out to see if it 
works and how it evolves. Oh yea, now I gotta actually bell the cat. Talk is 
cheap! Hopefully soon I will.

Steven

________________________________
From: Richi Jennings <[email-masked]>
To: Anti-Spam Research Group - IRTF <[email-masked]>
Sent: Mon, September 27, 2010 5:09:20 PM
Subject: Re: [Asrg] Ideas for anti-spam

---

From: der Mouse <[email-masked]>
Date: Wed, 29 Sep 2010 12:03:41 -0400 (EDT)

>> respond to "training" scenarios with email spam.
> It doesn't involve any training.  All they have to do is click on the
> "report button".

The training involved is in figuring out when/whether to hit it, not
how to.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Swaying Trees <[email-masked]>
Date: Wed, 29 Sep 2010 11:53:15 -0700 (PDT)

>> The training involved is in figuring out when/whether to hit it, nothow to.

That would be easy, if it *looks* like spam and if its a new account and if the 
reporter is an established user, then in most cases, it is probably spam.
Once again, abuse of this feature or unintentional misuse is possible but these 
things cab be fixed in an evolving system.

________________________________
From: der Mouse <[email-masked]>
To: Anti-Spam Research Group - IRTF <[email-masked]>
Sent: Wed, September 29, 2010 11:03:41 AM
Subject: Re: [Asrg] Ideas for anti-spam

/~\ The ASCII                  Mouse
\ / Ribbon Campaign

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 29 Sep 2010 15:11:31 -0400

On 9/29/2010 2:53 PM, Swaying Trees wrote:
> That would be easy, if it *looks* like spam and if its a new account and
> if the reporter is an established user, then in most cases, it is
> probably spam.
> Once again, abuse of this feature or unintentional misuse is possible
> but these things cab be fixed in an evolving system.

If you rely on evolution to deal with accidental/purposeful and _easy_ 
abuse of the system, then the system is a failure from the beginning - 
email spammers evolve much more quickly than individual sites, let alone 
broad implementation, or worse, Internet standards.

How does your system deal with rogue providers who choose to ignore 
reports and actively collude with the spammers?

How does your system deal with botnets which generate 95%+ of all spam, 
and _every_ From line is forged, so it's generally impossible for 
outsiders to figure out which account was infected (especially if the IP 
is NATted), let alone who/where the bot is controlled from?

How does your system deal with organized efforts to subvert it?  Don't 
kid yourself, people will - Microsoft is currently suing someone for 
attempting to subvert spam controls that are somewhat similar w.r.t. 
end-user reports as yours.

Many large providers ALREADY implement systems similar to this via their 
"This is Spam" (TiS) buttons.  But TiS buttons only work in certain 
limited circumstances with a small subset of spam.  Even that success is 
only possible because their TiS buttons key against originating IP 
address not end-user-identification.  And expert human analysis from 
administrators factor into many TiS systems to help it make effective 
solutions.

---

From: "Geo." <[email-masked]>
Date: Wed, 29 Sep 2010 15:20:31 -0400

I don't understand why we don't all promote abusing the spammers system,
they are not immune either. Imagine if we told everyone the way to stop spam
is to try to buy whatever it is they are selling and stop just short of
paying.. Now you send out a million spams, get 100,000 responses that are
all bogus, go ahead and deal with that... talk about increasing the cost of
spamming.

> -----Original Message-----
> abuse of the system,

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 29 Sep 2010 15:43:03 -0400

> all bogus, go ahead and deal with that... talk about increasing the cost of

Leaving entirely aside the legality or morality of doing so...

- How do you limit damage to only the spam originator, when their 
facilities may (and usually are) shared with non-spammers?

It probably won't be a matter of where the provider is knowingly 
providing service and causing more general problems for them might be 
appropriate (to some).  The abuse could even injure entirely innocent 
upstreams up to and including transit providers.

- What if the spammer has moved.  How do you know?  What do you attack?

- What if the spammer is smart and makes it look like it came from you?

- What if the source is a spambot behind a NAT?  What do you attack?

Now, after you've read all the above, go read about BlueFrog and what 
happened to it.

It's never appropriate to fight abuse with abuse.

---

From: "Geo." <[email-masked]>
Date: Wed, 29 Sep 2010 16:05:50 -0400

it's not an attack, it's a response to the spam offer. It doesn't abuse the
network or the computers, it abuses the spammers sales system and manpower.

---

From: der Mouse <[email-masked]>
Date: Wed, 29 Sep 2010 16:25:40 -0400 (EDT)

> it's not an attack, it's a response to the spam offer.

It's an attempted attack, on the spammer's system (in the larger sense,
not restricted to computers).  If you didn't want and expect it to have
some deleterious impact on the spammer's systems, would you bother?

It's also a response to the spam, true, but that doesn't make it any
less an attack.

> It doesn't abuse the network or the computers, it abuses the spammers
> sales system and manpower.

If it is the spammer's.  If this became popular, I daresay it would
take only couple of spam runs naming your website and phone number to
demonstrate very clearly one of the major holes in the scheme.

>> Now, after you've read all the above, go read about BlueFrog and
>> what happened to it.

>> It's never appropriate to fight abuse with abuse.

What he said.  On both counts.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 29 Sep 2010 17:01:20 -0400

> it's not an attack, it's a response to the spam offer.

Of course it's an "attack" because by it's very definition it's designed
to disrupt.  It's an attempted DDOS.

> It doesn't abuse the

"Sales systems" are usually computers, and for them to be abuseable, 
they have to be on networks.

There are bots that send out 20-60 _billion_ spams per day.  Even if a 
few percent of recipients "responded" that could easily cause network 
meltdown "surrounding" the "sales system[s]".  The "sales system" may be 
hosted in such a fashion that the "surrounding network" is entirely 
innocent.

For example, those very same bots use compromised machines (running a 
trojaned instance of nginx or similar) or public (effectively) 
redirectors as the only visible face of their ordering systems.  So, you 
have a few bazillion people (and automated systems) trying to do fake 
orders thru some poor guys compromised windoze (or linux!) box blowing 
out an ISP network segment, or, indeed, thru Yahoo or Gmail servers (eg: 
googlegroups url spammers).

Then, what about joe jobs?

Not to mention that concerted efforts to disrupt telecommunications for 
knowingly fake orders will probably be illegal on a number of fronts, 
including fraud and computer intrusion laws.

And finally, guess what?  Just going to their ordering sites is 
dangerous.  There are several major spambots (eg: cutwail/Zeus) 
spamvertising "ordering sites" that _also_ try to forcibly download yet 
more malware.

So while you're feeling smug submitting a fake order, your computer has 
just been pwned, and then _you_ become the target for the next round of 
fake orders.

Do you get the impression that this is a very bad idea yet?

---

From: Swaying Trees <[email-masked]>
Date: Wed, 29 Sep 2010 14:15:27 -0700 (PDT)

Oops sorry, I should have clarified. My suggestions have been mostly for web 
spam (most kind of spam excluding email). I don't know anything about email 
spam.

________________________________
From: Chris Lewis <[email-masked]>
To: [email-masked]
Sent: Wed, September 29, 2010 2:11:31 PM
Subject: Re: [Asrg] Ideas for anti-spam

> but these things cab be fixed in an evolving system.

If you rely on evolution to deal with accidental/purposeful and _easy_ abuse of 
the system, then the system is a failure from the beginning - email spammers 
evolve much more quickly than individual sites, let alone broad implementation, 
or worse, Internet standards.

How does your system deal with rogue providers who choose to ignore reports and 
actively collude with the spammers?

How does your system deal with botnets which generate 95%+ of all spam, and 
_every_ From line is forged, so it's generally impossible for outsiders to 
figure out which account was infected (especially if the IP is NATted), let 
alone who/where the bot is controlled from?

How does your system deal with organized efforts to subvert it?  Don't kid 
yourself, people will - Microsoft is currently suing someone for attempting to 
subvert spam controls that are somewhat similar w.r.t. end-user reports as 
yours.

Many large providers ALREADY implement systems similar to this via their "This 
is Spam" (TiS) buttons.  But TiS buttons only work in certain limited 
circumstances with a small subset of spam.  Even that success is only possible 
because their TiS buttons key against originating IP address not 
end-user-identification.  And expert human analysis from administrators factor 
into many TiS systems to help it make effective solutions.
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: Seth <[email-masked]>
Date: Wed, 29 Sep 2010 21:45:56 -0400 (EDT)

Swaying Trees <[email-masked]> wrote:

> spam (most kind of spam excluding email).

So you have a site that takes comments.  You make a political post.
Half the people commenting agree, half disagree, and it's a
contentious issue, so they all start reporting all the posts they
disagree with as spam.

Seth

---

From: Swaying Trees <[email-masked]>
Date: Wed, 29 Sep 2010 19:15:22 -0700 (PDT)

They wont do that because they know people who filed false reports lost their 
accounts. The person who got wronged would file an appeal and get their posting 
priveleges back and the others would lose their accounts, or have them suspended 
and so on. Perhaps that person would get a "flag" where their comments can no 
longer be instantly reported as spam (and so, their comments would now only be 
reportable to the admins using the regular slow route).
You tube already has "mark as spam". Various other places have "report abuse" 
links. I'm only modifying this existing feature to give more power to the users. 
If you get 100 spam comments taken down with 2 false reports, its a good system.
Users see spam first. If they have more power to act on it, thats the right 
thing to do.

Again for the person who said "you're assuming the person will do the right 
thing" - people already use "report as spam" links on Youtube and yes, so they 
do police it. Ofcourse they want to, no one wants to see spam. The proof is all 
the comments you see marked as spam. Youtube's spam is not perfect. Only the 
comments thing is somewhat OK. There's tonnes of video spam that goes all around 
there. Tonnes of other websites that dont have any "mark as spam" feature thats 
policed by the users.

________________________________
From: Seth <[email-masked]>
To: [email-masked]
Sent: Wed, September 29, 2010 8:45:56 PM
Subject: Re: [Asrg] Ideas for anti-spam

Seth

---

From: John Levine <[email-masked]>
Date: 30 Sep 2010 05:08:48 -0000

>They wont do that because they know people who filed false reports lost their 

You might want to read up on the way people do political manipulation
of sites like Digg and Reddit.

R's,
John

---

From: Rich Kulawiec <[email-masked]>
Date: Thu, 30 Sep 2010 07:13:20 -0400

On Wed, Sep 29, 2010 at 07:15:22PM -0700, Swaying Trees wrote:
> links. 

Yes, they do, and many of them have histories of being exploited.
All such mechanisms were completely worthless *before* the rise of the
zombies (thanks to the boundless stupidity of users); now they're
laughably completely worthless, since of course there is no way to
distinguish between "actions taken by user X" and "actions taken
on behalf of user X by the new owner of X's system".

Spammers (and other abusers) have already demonstrated mastery of this,
so it would a very bad move to deploy a mechanism they've already proven
they can exploit at will.

---Rsk

---

From: Rich Kulawiec <[email-masked]>
Date: Thu, 30 Sep 2010 07:19:36 -0400

On Wed, Sep 29, 2010 at 03:20:31PM -0400, Geo. wrote:
> they are not immune either.

Because it's wrong.

---Rsk

---

From: mathew <[email-masked]>
Date: Thu, 30 Sep 2010 10:00:50 -0500

>> they are not immune either.

And because spammers are criminals, and not above hiring a botnet to
DDoS your web sites as revenge.

Again, see BlueFrog.

http://en.wikipedia.org/wiki/Blue_Frog

mathew
-- 
<URL:http://www.pobox.com/~meta/>

---

From: mathew <[email-masked]>
Date: Thu, 30 Sep 2010 10:02:35 -0500

> of sites like Digg and Reddit.

Here's a handy link for the lazy.
http://blogs.alternet.org/oleoleolson/2010/08/05/massive-censorship-of-digg-uncovered/

And bear in mind that Digg has been gamed for ages, and has attempted
to prevent this kind of thing.

No, having end-users vote democratically on what constitutes spam and
then imposing that decision on everyone is a complete non-starter.

mathew