ewx | (no subject)

Some email users say they are using electronic mail less now because of spam.

The mail I save (which excludes cronmail and spam, but includes LJ comment notifications and a few low-volume announcement mailing lists; basically anything with an interested human at both ends) has increased a bit by raw volume lately, although not by much; however since July more than half of it (by message count) has been LJ comment notifications. The conclusion would seem to be that the conversations I used to have by email are now happening on livejournal instead, and up to a point this is true, though the subjects and actors seem to have changed somewhat. It's hard to determine the root cause of this; the spam volume doesn't dissuade me from sending people email, but perhaps it's encouraging other people I know to use LJ instead, carrying me along as an indirect effect.

My usenet posting volume has collapsed, too; 2002 saw about a 20% increase over 2001 (line count) but at the current rate 2003 is going to be around half of what 2003 was. It's harder to make an argument that spam has anything to do with this as (for whatever reason) I don't see anywhere near as much usenet spam as email spam; you could much more easily argue that LJ is responsible (both directly and in the indirect way described above) but I also feel less inclined to respond to things on usenet than I used to. That said I stopped reading some high-volume groups earlier this year for reasons unrelated to LJ, so it could just be a coincidence of timing.

Flat | Top-Level Comments Only

http://www.paulgraham.com/ffb.html has the interesting suggestion of automating something similiar, and making (eg) spamassassin automatically retrieve all urls in email identified as spam, this driving bandwidth bills for spammers through the roof and making it uneconomic.

And this won't be used to DDoS innocent third parties because...?

He proposes combining this with a blacklist, so you only spider blacklisted sites, but this is the weak point of the whole scheme, and a bit handwaved.

And this won't trigger the "yes, this is an actual verified e-mail address that Mr. Spammerman can and will sell at triple price" unique ID in the URL how?

It would trigger it, but it would also dilute the meaning of it. In particular, every link you ever sent to a spamtrap address would automatically get "verified".

I was thinking a while back that spamtrap addresses should use shifting domain names; once (for instance) *@one.mydomain.com starts getting spam, you rename all the records for one.mydomain.com to two.mydomain.com, and so on. Then any spammer accumulating lists of addresses gets a gradually increasing number of bogus addresses that cost you no more than a DNS lookup. (Variant that costs you a little more DNS bandwidth: add a wildcard MX *.mydomain.com that ends up back at 127.0.0.1.) This doesn't do anything about the kind of spammer who pulls addresses of usenet (or wherever), spams once and then forgets them, though.