News for hackers. Stuff that matters.
Re:Own-Mailbox, the first 100% confidential mailbox by vidarh on Monday June 29, 2015 @08:38PM (#9802110)
How would my mail server know that the sender is a low volume source?

It's trivial to randomly cycle through the domains you're sending to in order to deliver at a low rate to any single domain.

> Further, allowing the occasional doesn't-look-like-spam-but-is-actually-spam message (if such a thing exists), isn't the end of the world.

It is when you allow the occasional such message from each of tens of millions of compromised machines worldwide.

Recently we had to block inbound mail from most of Ukraine because hundreds of thousands of IP addresses belonging to Ukrainian ISPs were used to spam us. I started manually blocking /24's, but couldn't keep up, so we moved to blocking /16's, and even that was going too slowly to avoid affecting our systems.

Another time recently we had to block a particularly notorious Asian ISP that basically don't care that the millions of addresses in their net bocks all gets hijacked for spamming purposes (or quite possibly they do care as a result of being paid to look the other way).

This is business as usual when you operate anything but the smallest mail servers where you might get lucky and not get detected by spammers.

We still receive spam sent from malware addressed at domains of clients we haven't hosted for half a decade, that's been picked up from peoples mail clients....

This is why a lot of people decide it's easier to just blanket block all dynamic IPs. It costs a lot of money to stay on top of spam, and a lot more if you decide to try to avoid collateral damage.

> The real spam problem that needed to be addressed was mailboxes being completely flooded with unsolicited messages. So flooded that it becomes impossible to read or even find the legitimate messages.

The practices you complain about are the reason why the spam problem is now contained sufficiently for e-mail to still be usable.

Re:Own-Mailbox, the first 100% confidential mailbox by jsprogrammer on Monday June 29, 2015 @10:33PM (#9802534)
Sounds like you can map out the compromised addresses and selectively block them.

Avoiding auto-spam-boxing new domains (as opposed to IP addresses), would be helpful. Any strategy that attempts to leverage multiple machines would still need to register and maintain many domain names, making such a spam strategy costly and more technically difficult. Further, an easy check for malicious users is to examine the websites at the domains suspected of spamming. Or even just WHOIS info.

Re:Own-Mailbox, the first 100% confidential mailbox by jcranmer on Tuesday June 30, 2015 @02:14AM (#9803272)
If spam detection requires human intervention, it is too slow. Domain reputation needs to converge within 3-5 minutes---even 30 minutes means you have lost the spam race.