Technorama

Opinion piece on the current state of spam and solutions to the actual causes.
In recent years we have seen the rise of Sendio, SpamArrest and Vanquish as "solutions" to the problem of spam. However, these auto-responder mechanisms only address the symptom of spam, and don't tackle the root causes permanently. They do not prevent/detect the insertion of messages into the world email system; all their "solutions" do is treat the "recipient of spam" symptom by adding an extra level of burden onto the senders. For every email received they send out another email to the apparent sender asking them to opt-into some agreement where by their personal details are listed on a "green list" of non-spammer individuals.

In practice the user lists their email address in public without a warning. Each contactee who responds to their emails on a mailing-list or website is then expected to pass a turning test of increasingly complex proportions and submit their personal details for transfer outside of the Data Protection administration areas of the EU etc. Often every user on the mailing-list will get an auto-responder spam from the user, just like the annoying "Out of office" emails we don't appreciate as well.

There are four workable ways to treat the cause of spam, rather than treat each instance of every symptom of the mess that results:

• Prevent insertion by unauthorised hosts: A world wide Interweb body needs to maintain a green-list of ISPs mail servers which have signed up to an anti-spam code of conduct, putting up bond money to cover compensation if they do not follow the code.
  
• Detect insertion by legitimate hosts: Automatic detection and notification to ISPs if hosts are detected transmitting spam.
  
• Suspend hosts immediately as they are detected and remove from authorised list if the ISP does not resolve problems within a reasonable time-frame.
• Provide a mechanism for users to feedback emails which are spam back into the filtering system.
  

By implementing these measures:

1. Spam would be limited from entering the system.
2. ISPs which did not honour the code of conduct would go out of business if they did not tackle the problems and provide reasonable service to their users.
3. Users would have a way they could feedback spam reports into the system.

Users should also have functionality on their ISPs mail server to set conditions where incoming email should reject with code 550, and a message like: "Rejected by spam filtering" -- no bounce emails should be generated!

This is all obvious to me, why have ISPs not taken these steps already? Maybe its just the cost savings of sticking with filtering?

Labels: Spam