Wednesday, January 03, 2007

I do not know many people who enjoy getting junk mail. I know even fewer people who enjoy getting junk email. It is frustrating when I go to work on someone's computer, and I hear, "Would you fix my mail? I get a lot of SPAM." The poor recipients
expect me to be able to apply a special charm to their inbox to magically prevent unwanted mail from appearing. The saddest part is that I know how to stop or manage the flow of the garbage passing over the internet, yet I am not in a position to actually effect the changes needed to make this happen.

We all know why SPAM exists: to make money. Not everyone knows why or how it comes to them. Here is the general reason this junk makes it to you: there is no accountability for sending email.

Imagine for a moment that you receive packages at your wholesale food business. You registered online with "FoodCo" to receive food to resell. You pay them, the food comes. They seem reputable, and they offer all sorts of promises about speed of shipment and your health protection. What "FoodCo" doesn't tell you is that your food comes from ANYONE, and they never verify that the food is actually fit for human consumption or that it comes from a business that ships food at all. You find that 30% of the food you receive is made of plastic.

Why is this food a problem? Isn't "FoodCo" living up to its promise? They ARE delivering food, and they offer you medicine to cure you when you get bad food. They even provide a bin to dump the plastic food in. They tell you that they cannot guarantee that all shipments contain real food. They say this is just part of ordering food in the world today.

Bunk.

Would it be the responsibility of the person ordering food to make sure it is actually food? No. If I got sick from "FoodCo" prodcts, I'd hold them accountable for it. So, escape from "FoodCo" for a moment and look at them as an Internet Service Provider (ISP) that supplies you email instead of food. They make no guarantees that every email is something you want to digest. The fact is that no ISP takes steps to 100% assure that they know where their mail is coming from! Some guy in Russia has a computer set up right now, pumping out tender vittles about hot penny stocks, and spoofs the email to look like it comes from a friend, a reputable business, or a random internet domain he picked up for $5. He hopes a quarter of one percent of the 12 million people on the email address list he bought or spidered respond to his lure. He masks his identity and codes the email to dodge "FoodCo" SPAM countermeasures (which he is years ahead of).

THE SOLUTION:
The way the internet is set up requires multiple factors to reduce unwanted mail down to a trickle of legitimate businesses.

+ The origin of an email must be verified. Our ISPs need to verify the origin of those sending email. This means using the internet's DNS system to run a background check of sorts. DNS is just a series of address-to-name associations. You type in www.yahoo.com and DNS servers on the internet point you to 209.131.36.158. Think of it as looking in the phone book to find a street address. So an email comes to the ISP tagged with the number 209whatever, and asks DNS "Is this address REALLY yahoo.com's email server?" DNS says "Yes", and the mail gets moved along. DNS says "No", and the mail never gets delivered. This stops most spoofing. THE RUB: Every ISP/mail server has to participate worldwide. Not every ISP wants to. Some ISPs are spammers themselves.

+ Residential internet customers should not be allowed to host email servers. This means email has to run through a registered ISP, not from my house off Adelphia high speed internet. No more Russian guy sending from home. THE RUB: Every ISP/mail server has to particiapate worldwide. This does not mean you can't email anyone; your email still travels to your ISP then on to its final destination. Some spammers send mail directly from home or from a junk domain. THE RUB: People want their MTV. Not everyone abuses the privilege of sending email directly.

+ Band together. We have solutions like SPF (uses the "ask DNS" process) to take advantage of some of these aspects, but not everyone adheres to it. If only some people use it, then suddenly Hotmail can't send mail to AOL, or something odd like that. Home users can send mail like crazy or come up with the cheap domains to send mail from. It is far too easy to be an email server. I could set one up at home in 10 minutes and be pumping out molded content like a playdoh factory.

There are other factors to help reduce SPAM, but describing them alienates non-technical observers. This at least overviews that a larger ugly body is at work, unmanaged, blasting all our inboxes with junk. From the link,

"Massive volumes of unsolicited email are still being sent: Security firms Symantec and MessageLabs estimate that spam is between 54% and 85% of all email. In 2005 Ferris Research estimated spam to cost €39 billion worldwide while Computer Economics calculated malicious software to cost €11 billion globally. While the very latest figures from Sophos say 32% of relayed spam came from Europe with Asia leading at 34%."

'Nuf said.

1 Comments:

At January 04, 2007 10:04 AM, Blogger Katrina said...

Wow, you must be a teacher at heart, because I actually understood this!

Why can't you run the internet? I bet you could take it off some sweet jumps.

 

Post a Comment

<< Home