I've been thinking about ways to stop spammers. Here's a system that
might automatically cancel spam messages before they hit mailing lists.
This is brainstorming, which means I purposely *haven't* thought out
every detail. Brainstorms work best when other people find problems
with the ideas and come up with new ideas that are more workable.
I've been thinking about the "cancelbot" setup on Usenet. It isn't
keeping spammers off of Usenet, but it's helping. (For those of you
who don't know, Usenet netnews articles can be removed -- cancelled --
after they've been sent out. This is done with a "cancel" message
that's sent after the original article has been sent. People, and
automated systems, send out cancel messages for spams.) The problem on
mailing lists is that messages can't be cancelled: Once the message is
sent, the spam has hit the fan and it's too late.
How could we do something like that on mailing lists? On moderated
lists, it's easy: the moderator rejects most spam. The problem is
unmoderated lists, eh? Here are some sorta random thoughts. Maybe
these will move us toward a manageable cancel setup.
1. For lists where messages don't have to go out immediately, build in
a one-day (or so) delay. The outgoing messages would sit in a mail
file for a day, waiting to be (possibly) cancelled before they're
distributed to the list.
This should be easy to add to Unix MLMs as a front-end, with no MLM
code change: Archive incoming mail from the alias file. For example,
for a list named "gumbo", sendmail aliases for Majordomo could be:
gumbo: /archive/dir/gumbo
gumbo-real: "|/usr/local/majordomo/wrapper resend -l gumbo ..."
Approved messages from /archive/dir/gumbo would be emailed to
gumbo-real or could be directed straight to "wrapper resend".
2. Have an "Anti-Spam Central" (ASC) -- a (virtual) organization with one
or more volunteers who agree to coordinate spam cancels. Moderators
and other list owners (and maybe even regular subscribers?) who got a
spam could forward the entire message to ASC.
3. ASC would evaluate messages submitted to see which were really spams.
For verified spams, they would distribute spam-searching "stop lists."
The stop lists they distribute could contain:
- MD5 body checksums, and/or
- message-IDs, and/or
- lists of 20 uncommon words (from an automated dictionary match) or
other "fuzzy" patterns that would match a slightly-modified spam.
4. These "stop lists" could be put on well-known Internet sites: ftp sites
and dedicated telnettable ports. The stop lists could also be sent by
PGP-signed email (etc.) to sites that don't have direct connections to
the Internet.
The MLM front-ends could retrieve these lists several times a day, then
search their queued messages for spams. At each site, queued messages
that match the stop lists would be forwarded to the list's owner (or
someone) for approval... the rest would go automatically to their list.
5. This system could also stop "slow spams", where a spammer sends out
the same spam once a day to a different list over a period of months.
(ASC's stop list could hold info on old and "slow" spams as well as
the latest ones.)
Though this might be overdoing things, ASC could even be hooked into
Usenet cancelbots. It could read Usenet cancel messages and grab
the cancelled spam from Usenet. This would stop spam forwarded by
Usenet gateways -- or spammers who spam both Usenet and mailing lists.
Well, this isn't complete, but I think you get the idea. Comments?
--Jerry Peek, jpeek@netcom.com
Follow-Ups:
References:
|
|
