From: C Matthew Curtin <cmcurtin@research.megasoft.com>
Date: Sun, 15 Jun 1997 21:00:32 +0800
To: Bill Frantz <frantz@communities.com>
Subject: Re: Spam Libs (Frauenfelder on HotWired)
In-Reply-To: <3.0.32.19970613120139.0074c9b4@homer.communities.com>
Message-ID: <199706151242.IAA08090@goffette.research.megasoft.com>
MIME-Version: 1.0
Content-Type: text/plain




I'm not sure about c'punk relevance, but that doesn't seem to make
much difference these days.  Anyone interested in the previous message
is likely interested in this.

Here's (most) of a note I sent to Mark Frauenfelder.

-------------------------------- snip --------------------------------
From: C Matthew Curtin <cmcurtin@research.megasoft.com>
To: mark@wired.com 
Subject: MadSpams...SpamLibs... uh... yeah
Date: Thu, 12 Jun 97 08:43:58 EDT

*chuckle* ... that's pretty good.

Some of my favorite activities with regard to spammers:
 * giving them a nice call on the telephone.  Call collect, and then
   say that you've got something to sell them.  Read them back their
   own spam if you can get that far.
 * calling their 800 number and reading them their own spam
 * calling them to ask  if they have any idea what they're doing to the
   Internet.  The answer is invariably "no."  (Of course not, these
   are clueless parasites.)
 * signing up one spammer's autoresponder to another spammer's
   autoresponder. 
 * collecting a list of technical and administrative contacts for
   zones that are notorious about originating spam, the people who
   sell and give out their spam software, etc.  Then, every time spam
   comes in, simply bounce it to that alias, and the spammers all spam
   each other.
 * sending mail back that's politely insulting.  My favorite
   one-liner:
     "You're not a very smart man, are you?"
 * My favorite for sex-related spam:  hinting that I became aware of
   their spam after my 9 year old daughter with an email address asked
   me what "hardcore anal sex" is.  Doing this over the phone is
   great, because I can yell hysterically.  Through email is even better,
   since I can copy their ISP's contact, and that one... all the way
   to the backbone.
 * Sometimes my mail relay seems to choke on spam, and sends back a
   packet with a MSG_OOB bit sent to the host that originated the
   spam.  Gee, dunno how that happened.  Sometimes if the host stays
   up after that, it's followed by an oversized ping.  Shucks, that's
   too bad when that happens.  Maybe one day I'll track down that, uh,
   bug and ... fix it.

Of course, I always complain about every spam that hits me.  The
administrative contact of the site that is as far back as I can trace
the message, the administrative contact of the site's ISP, and that
site's ISP, all the way up to a backbone provider, or a well-known,
responsible organization.  I have a form letter for doing this, and
I've got another completely-ready-to-go letter that just needs me to
slap in the To: addresses:
   wallace@cyberpromo.com, postmaster@cyberpromo.com, postmaster@agis.net

You can guess what that one's for.

In all seriousness, I'm working on a paper for filtering spam.  I
think I've found a way to almost completely eliminate it through a
combination of router access control lists, spam-aware mail transfer
agents (MTAs), and filtering local delivery agents.  Individuals who
wish to filter beyond that can also put on filters of their own with
programs like Z-mail, Eudora, and procmail.  I'm hoping that I'll be
able to get enough people filtering the stuff out that it simply won't
work.  If it won't work, economics will dictate that the spammers go
out of business and go back to assembling chilitos at Taco Bell.

Maybe a good thing to do would be to provide a program to users for
the spam that does slip through, sort of an automated spamlib, that
parses the headers and knows where to send it... :-)

------------------------------- unsnip -------------------------------

-- 
Matt Curtin  Chief Scientist Megasoft Online  cmcurtin@research.megasoft.com
http://www.research.megasoft.com/people/cmcurtin/    I speak only for myself
Pull AGIS.NET's plug!   Crack DES NOW! http://www.frii.com/~rcv/deschall.htm