Talk:Anti-spam techniques

message: Some parts of this article cite sources quite dutifully.  Could whomever is unhappy about the source-citing please add the "in-line" citation-needed tag to the statements they feel require clarification?  Megacz 01:00, 14 August 2006 (UTC)
thread_title:  Citing Sources 

message: [Original title was: "This is so sad" Minasbeede 21:51, 29 April 2006 (UTC)
thread_title: The following comment is so opinionated it is sad 

message: I'd like to move the Challenge/Response discussion to its own page.  I understand that this is a contentious topic, but there is a wealth of NPOV reasoning from both sides that could be added.   -- Megacz 04:23, 10 April 2006 (UTC)
thread_title: Request to move C/R to own page

message: A point of clarification:
Indeed, some argue that using a C/R system means sending unsolicited, bulk email (that is, spam) to all those people whose addresses are forged in spam.
The parenthesized "(that is, spam)" had been "(challenges to forged spam)". However, the point of the criticism described is that the challenges can themselves be unsolicited bulk email, and hence spam. This position is particularly elucidated by Vernon Schryver in news.admin.net-abuse.email -- Google Groups for his name and "challenge-response" should be enlightening.
::Excuse me, but Vernon's discussion in 2006 is not the original discussion of this aspect of C/R.  The original discussion was in Usenet group comp.mail.misc in 2003-4 (e.g. [Message-ID: <Pine.LNX.4.58.0403010720220.1116@kd6lvw.ampr.org>] et. al.). 71.106.211.51 (talk) 23:34, 11 August 2011 (UTC)
thread_title: C/R sucks discussion

message: My justification for moving "Spam tips for users" to the top of the article is simply this: a casual browser of Wikipedia (and this article in particular) would be a person interested in finding advice on how to protect his or her own personal PC from spam; therefore, he would be most interested in tips on personal spam protection.  Detailed explanations of anti-spam protocols for sysadmins would take less priority, therefore they are now delegated to the latter portion of the article. --Modemac 11:43, 30 Sep 2004 (UTC)
thread_title: moving "Spam tips for users"

message: I've noticed some comments on China. I live in China, but I use a non-Chinese e-mail address. If I use an e-mail service from inside China, I can't e-mail a lot of people outside of China. (I've started to notice sites that seem to be blocking me too, not just the Great Firewall.) In any case, the spam problems are starting to get bad here. Part of the problem is very, very, simple. Many Chinese are not well-educated about computers, the 'net, and antivirus software. There are a lot of zombie computers in China. On the up side, even though the problem is getting worse, the Chinese are starting to notice and complain, and even if they don't make as much money per user here, there's a lot of users. A lot of complaints are starting to pile up. I think more Chinese ISPs will start sharpening up and throwing out the spammers. One can but hope. Kaerondaes
:It's my understanding that some sites (chiefly hobbyists and local companies -- not large ISPs) who believe that they will never have a correspondent or customer in China simply block Chinese IP space entirely using a nation-based blocklist such as blackholes.us. Likewise for other nations that have had anomalously high levels of zombie and spam-haven activity, like South Korea.
:One difficulty is that most anti-spam activists (the people most likely to file accurate reports of spam, and to operate public DNSBLs and other spam-blocking resources) are in the United States and Western Europe. Most do not do business with China directly, and they are (or feel) unable to get in touch with Chinese ISPs responsible for the spam-emitting netspace. The language barrier is one problem; another is the perception of China as a "black box" or monolithic bureaucracy -- whereas what few detailed reports I have seen indicate that some Chinese networks are substantially cleaner than others.
:It's worth noting that Spamhaus (the most reputable Western anti-spam operation these days) has done some collaboration with Chinese ISPs in an effort to stem the tide of spam from China. See http://www.spamhaus.cn/ for more.
:Another perception I've seen on news.admin.net-abuse.email, SPAM-L, and other anti-spam forums is that Chinese hosting services are believed not to care when their sites are used to host spamvertised Web sites. This leads to what I've seen described as one stereotypical pattern of international spam crime:
:# An American (stereotypically, a Floridian for some reason!) decides to become a spammer.
:# He hosts a Web site in China.
:# He buys spamming software and a list of virus-infected systems from a Russian (or other Eastern European) black-hat programmer.
:# He sends spam through these virus-infected systems, which may be located in South Korea, China, Mexico, Brazil, Western Europe, Israel, and, yes, back in America.
:# The spam is chiefly targeted at American ISP users (and is written in English), but is also sent to people all over the world.
:# The spam victims go to the Web site, and (if they are fools) buy herbal Viagra; their credit card orders are processed through Western Europe.
:# The spammer packs sugar pills in bottles and mails them out from a warehouse in Florida.
:Thus, the spam that Americans receive and blame on other countries is in fact perpetrated upon them by American spammers, who are simply doing business and crime through other countries. Likewise, I would expect that most spam Koreans get is from Korean spammers, and most spam Chinese people get is from Chinese spammers! --FOo 03:51, 28 Mar 2005 (UTC)
replies: text: I've noticed that most spam i get doesn't seem to be very well targeted though, i get shitloads of spam in english that is obviously targeted at americans and a fair bit that is in languages/scripts i can't even read (chineese being the most common) but very little that is actually relavent to me as a brit. Plugwash 09:11, 26 November 2006 (UTC)
thread_title:  China and spam blocking 

message: Wikipedia isn't a link farm, but the end of this article is looking rather cramped, and is attracting link spam. Does there need to be this big list of products? -82.33.52.78 02:53, 4 September 2005 (UTC)
replies: text: No, there doesn't. --FOo 04:52, 4 September 2005 (UTC)
thread_title:  Too many links 

message: I've heard several people mention a "do not email list".
Is there some reason it isn't mentioned in this article? (Is there some other article that discusses do-not-email lists?)
"Such a thing does not exist" is *not* a good reason for leaving it out -- if it's a hoax/myth, then it's even more important to mention it and then tell people that it is a hoax/myth.
The article Enabling the Complaint Department briefly mentions how Blue Security uses a one-way hash to distribute their "do not email list". That technique makes it impossible for spammers to extract email addresses from that list.
--DavidCary 00:50, 4 January 2006 (UTC)
thread_title:  "Do not email lists" 

message: The recent AfD proposal complained that this article is too much of a "how-to manual".  I tend to agree and I have tried to rewrite some of it to make it better, but I don't think I made much progress.  I think the article title, "stopping e-mail abuse" is part of the problem, and I think changing it to something else would help.  I think some of the problem is that many of the anti-spam techniques are things that individuals must do, and  since most people don't want spam, these techniques end up sounding like how-to tips rather than neutral point-of-view descriptions of the ideas.  
I encourage people to take another stab at this article.  Be bold.
I think that creating a wikibook is certainly a valid thing to do.  It can concentrate on  the how-to stuff.  However, I think there should still be an encyclopedic article covering of the various techniques. Wrs1864 21:32, 7 December 2006 (UTC)
replies: text: I've beem making some changes here, and I see that Barrylb has also.  I would be interested in knowing if we are actually making progress or not.  As I mention above, I find it hard to keep my very strong anti-spam point of view from coming across and making it a how-to manual.  Wrs1864 23:32, 12 December 2006 (UTC)
thread_title:  Addressing Article for Deletion issue:  how-to manual 

message: :I would like to rename this article to 'Anti-spam techniques'. The article sounds like a how-to manual or essay. -- Barrylb 01:54, 8 December 2006 (UTC)
replies: text: Since there are no objections I will go ahead and rename the article to Anti-spam techniques. I've checked a lot of the links to this article and they seem to use the article in this context. -- Barrylb 02:50, 9 December 2006 (UTC)

text: Good point, Minasbeede...  I think 'E-mail anti-spam techniques' would be more consistent with other articles though. Wrs1864 20:44, 10 December 2006 (UTC)
replies: text: How about 'Anti-spam techniques (e-mail)' ?  I think this is the more common style of disambiguating an article topic. Barrylb 01:47, 12 December 2006 (UTC)

text: I guess the question is whether we want to have information about IM spam, blog spam, forum spam in the article. I'd rather just keep the article about email and specify that in the title to make it clear. If we include all the other types of spam then the article could become unwieldy. -- Barrylb 04:57, 12 December 2006 (UTC)

text: Well, I think the point is that since it is easy to rename articles and since there aren't currently articles on anti=spam techniques for IM/blog/VoIP, we don't need to worry about it right now.  The important thing is to get the name changed to something that doesn't scream "This is a howto manual!".  When I was on the #wikipedia IRC channel, I mentioned that I was trying to change the name from "stopping e-mail abuse" and two people (I think both admins) immediately said to delete it because howto manuals are not appropriate.  23:30, 12 December 2006 (UTC)
replies: text: If we just call it "Anti-spam techniques" how will we word the opening paragraph? It would need to define anti-spam techniques in general terms and lead us to including all types of anti-spam techniques in the article (not just email). Barrylb 04:43, 13 December 2006 (UTC)
thread_title:  Renaming this article from "Stopping e-mail abuse" 

message: I'd like to reorganize this article and remove some content (for example, address harvesting isn't an anti-spam technique) to point out that some of these techniques are imbedded in anti-spam products (appliances, services and software) while others are used for researchers and law enforcement.  Pjbrockmann 17:12, 17 July 2007 (UTC)
replies: text: I've renamed that section to "Avoiding E-mail Address Harvesting". It is an important technique. You are welcome to do some reorganizing. -- Barrylb 18:10, 17 July 2007 (UTC)

text: "Honeypots" might need disambiguation.  Some use that term for email trap addresses (used to detect spam since they aren't "real" email addresses.)  "Honeypot" for network security denotes a computer system that presents the appearance of having some vulnerability but in reality captures information about some form of network abuse.  When the term "honeypot" became very current in the anti-spam community (primarily in the group news.admin.net-abuse.email) it was used at first to denote a computer system that looked like it provided an open relay email service but didn't.  At that time spammers frequently and routinely would test large blocks of IP addresses to see which of the addresses, if any, in that block were assigned to a system that functioned as an open email relay.  Email administrators may create and use email trap addresses in a routine fashion.  Almost anyone could set up an open relay honeypot and there were software products created to allow ordinary users to operate an open relay honeypot, as mentioned in the article.  Open relay honeypots are a tool against spam but they are used against a particular type of network abuse.  There were also software products created that could be used to combat open proxy abuse used to send spam after that form of abuse to send spam became more prevalent.  Open relay abuse and open proxy have declined substantially since those honeypot tools came into use.  The same idea could be used to combat spam zombie networks: create fake zombies.  There has been a distinction made between "research" honeypots and "production" honeypots.  The honeypots used to combat spam were production honeypots.Minasbeede 14:00, 20 July 2007 (UTC)
thread_title:  Reorganize and pruning 

message: I suspect that fake MX may have some utility.  In my experience (which is now old) there were spammers who sent spam to systems for which there was no active MX record pointing to that system.  The spammers apparently had address lists that included the equivalent of a@x.y.z and attempted delivery directly to x.y.z even though the only MX record for x.y.z pointed to w.y.z.  So these particular spammers, apparently, ignored MX records altogether. 
Those interested in experimenting could research this.  Create a fake email address (victim@mysystem.ISP.com) and run Jackpot on mysystem.ISP.com (assumed to be a Windows system not running any MTA.)  In addition to trapping any relay tests aimed at mysystem.ISP.com Jackpot would also intercept any spam sent to the fake address.  (Linux/Unix users could do something equivalent.) --Minasbeede 17:33, 29 August 2007 (UTC)
thread_title:  Fake MX 

message: Is Boxbe ( https://www.boxbe.com/ ) notable enough to add to the "Cost-based systems" section?
--70.130.47.149 20:33, 9 September 2007 (UTC)
replies: text: Is Vanquish?  Neither is, IMO.--Elvey (talk) 20:03, 12 February 2009 (UTC)
thread_title:  Cost-based systems 

message: The key information is absent in the article.
Assume, there are some messages (perhaps, with attachments) in the mailbox file called mbox. The antispam program needs to read this file, filter it and write back some part of the content. Before to analyse each message (spam or information), the program should separate messages. 
How does the antispam program identify the end of one message and beginning of the next message?
This section should appear BEFORE sections describing criteria for authomatic removal of messages.
dima (talk) 10:56, 12 July 2008 (UTC)
thread_title:  process mbox: separation of messages. 

message: The "citation needed" marks are absolutely right. I do not know who brought in the 50 percent of denied spam mails but the RFC2821 does not rely on a FQDN. There should be read carefully SHOULD, and not MUST -sic! Thus, I suggest to change the article, -wofa07, 85.178.19.208 (talk) 00:06, 13 March 2009 (UTC)
replies: text: HI!  several comments.   First, I'm the one who put the "citation needed" by the 50% on the HELO checking.  (Actually, I put one by the 25% later in the article too.)  I agree that there needs to be some citations dug up on this, but I actually strongly suspect that something in the 20+% range is accurate.  There are lots of things that are good spam indicators and that work in practice, even if the RFCs say otherwise.  So, yeah, RFC 5321 (which replaces RFC 2821) says that you aren't supposed to validate the HELO, that doesn't mean it doesn't work in practice. Wrs1864 (talk) 01:32, 13 March 2009 (UTC)
replies: text: HELO wrs1864! Exactly this is my point. I do not even believe in the 10% range. From my experience, one has to check out the sender's ip, the sender's MAIL FROM:, the RC2822 From:, the relays, and finally the RCPT TO tags. This bundled stuff comes to a good estimation of spam or non-spam. How can I distuingish between the goods and the bads? If I deny acceptance too early, I have some risk of false positives, or? This was at least my reason to prefer the assessment method (simply mark it as spam and leave it to my customers with a little help). Meanwhile, I deleted this stuff in the article, and replaced it with some remarks concerning the rules of RFC2821 & RFC2822. I was not aware that there is a new replacement (RFC5321), thanks for it. I hope that I didn't changed things obsoleted by RFC5321... -wofa7,Wofa07 (talk) 02:18, 13 March 2009 (UTC)
replies: text: The purpose of wikipedia articles is to describe the subject, we aren't supposed to pass judgment (see WP:NPOV), or to tell people how to do stuff (see WP:NOTHOWTO).  This article was almost deleted once because it had way too much "how to" stuff in it, which I admit is very tempting to add.  So, if you admit that the HELO checks can catch any spam, and that people are using it, then we should describe it.  Your objection is the percentage, which I agree needs a citation to back up.  This article is also supposed to be an overview/summary, and is way too long as is.  I think it may be time to go through it and move stuff out to separate articles and bring the writing back up into compliance with wikipedia policies.  *sigh*.  Wrs1864 (talk) 10:15, 13 March 2009 (UTC)
thread_title:  HELO fqdn requirement 

message: This article is supposed to be about anti-spam measures, but in fact is almost entirely about filtering of inbound mailstreams to remove spam. 
This is a bit like saying that the only anti-smoking technique is chemotherapy.
The first, and most effective, antispam measure should be to educate webmasters about the insecurity of 'mailto' URLs and the harvesting risk that these pose. Add to this section the need to protect against other (albeit less significant) methods by which addresses may be robotically collected, such as domain-spraying. 
Anything placed after that point in the delivery-chain is symptom-treatment, designed to control a problem which would have been better avoided in the first place.
Perhaps the article should mention this first, before filtering? 
-After all you could chase the thief using a forged copy of your creditcard around town all day with a sawn-off shotgun trying to blow his head off, failing miserably, and maiming a few passersby in the process... and then EVEN if you finally manage to nail him, there's another to deal with. And another. Or, you could rethink you policy of flashing the card around so anyone can read the number. Which is easier? --Anteaus (talk) 13:36, 20 March 2011 (UTC)
thread_title:  Article is entirely about mailstream-filtering, which is only one aspect of the issue. 

message: Sender Policy Framework should be discussed.
The sending domain uses its DNS record to advertise which domains can legitimately send email "From:" that domain.
A site receiving an email purportedly "From:" a domain then checks against the published DNS record.
If all sites sending and receiving email were to implement this standard then email with forged "From:" addresses
would be eliminated.  — Preceding unsigned comment added by 94.30.52.142 (talk) 11:59, 1 July 2011 (UTC)
thread_title:  SPF 

message: But spam ISN'T "unsolicited bulk email."
It is "unsolicited commercial email."
When I, the recipient, receive an "enlarge your mortgage" email, I have no way of knowing whether I am the sole recipient, or whether I was blind-carbon-copied along with ten million other unfortunates.
But I can still see that some twerp is stealing my bandwidth, my email in-box quota, and my time, trying to sell me something.  The idea that this isn't spam because I can't demonstrate that it was sent "in bulk," whatever that term even means this week, is preposterous on the face of it.  — Preceding unsigned comment added by 2601:400:8001:BA60:18C5:85F4:AE47:5A82 (talk) 01:31, 27 June 2016 (UTC)
thread_title:  definitions 

message: Hello fellow Wikipedians,
I have just modified  on Anti-spam techniques. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20060424083903/http://www.ftc.gov:80/bcp/conline/pubs/alerts/spamalrt.htm to http://www.ftc.gov/bcp/conline/pubs/alerts/spamalrt.htm
*Added archive https://web.archive.org/web/20090317163709/http://www.crn.com:80/security/199800149 to http://www.crn.com/security/199800149
*Corrected formatting/usage for http://apnews.myway.com/article/20101226/D9KBQRMG0.html
*Added archive https://web.archive.org/web/20070104065059/http://www.ciac.org:80/ciac/bulletins/i-005c.shtml to http://www.ciac.org/ciac/bulletins/i-005c.shtml
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—InternetArchiveBot (Report bug) 15:19, 15 October 2016 (UTC)
thread_title:  External links modified 

message: The article needs to include mention of misuse. Genuine emails have been obstructed by some spamfilters, and that can have devastating effects. The fact merits mention in the article.207.228.146.76 (talk) 06:46, 15 November 2017 (UTC)
thread_title:  malicious use of 'antispam techniques' 

message: Have just removed the "Detecting spam" section. Nothing terribly wrong with it, but all the points are better handled in one of the four main sections. - Snori (talk) 18:15, 20 December 2018 (UTC)
thread_title: Trim