|
Author: M.Prince (27 Oct 04 4:17pm)
First, thanks for the feedback! It's valuable to have people kicking the tires and thinking of issues we may have missed.
I agree with your assessment, and it's one of the issues for which we continue to work to find an elegant solution. While hardly elegant, here's what we've come up with so far. Initially, we think that we have a window of time where we're flying under the radar and spammers will either not know about us or ignore us. After that period, I think spammers will begin to adjust and we'll have to adjust with them. Our crude solution is to just periodically change the IP address of our mail servers and host machines on different providers and different subnets. There is some rate at which spammers are able to adjust themselves and share information with each other. As long as we can stay slightly ahead of that rate, I think we'll be relatively successful. Unfortunately, over time that rate is likely to get faster and faster.
In the longer term, and slightly more elegant, we've looked into basing our mail servers' DNS records on a dynamic and automatically rotating DNS. Getting a big chunk of IP Address space will be challenging, but we've begun talking with different providers on how we can do that. This isn't a complete solution to the problem, but does buy us a bit more time and makes a harvester's job harder. To some extent all technology and law can do in this fight is raise the barriers to entry for spammers and harvesters. While I'm sure professional harvesters will keep playing the arms race (as spam senders have with filter authors), if we can make it too expensive or too difficult for new entrants to get into the market then we will have accomplished something. Not a completely satisfying answer, but hopefully a realistic one.
The one advantage that we have in this particular arms race is that, unlike filtering, we're in the better position. It only takes a few messages arriving at a honey pot address in order to trigger the identification of a harvester. Even if spammers are able to determine a huge percentage of the addresses we use, and stop our messages from going through to our IPs, if one slips through the cracks we've got them. This should have the effect of, at least, changing the harvesting business model. Our anecdotal evidence is that there's a class of individuals participating in the spam trade who do nothing more than harvest and sell their lists. It's going to be difficult for them to provide instructions to every spammer they sell their list to on how to not send to our ever-changing mail servers' IPs.
Finally, if spammers do completely exclude the block of IPs we use then we may start offering our members a new service -- allowing them to route their legitimate mail through our MXs. It may serve as an efficient and effective way to filter out at least a certain spammers -- sort of like the problem of false positives in reverse. In fact, one solution may be to partner with large existing filter companies like MessageLabs, Brightmail, Postini, or various ISPs which already serve as central clearing houses for legitimate mail. If our mail server IPs look, to the outside world, the same as our mail server IPs I think the benefits may be mutual.
We're open to any other ideas -- the problem you point out seems like one of the biggest vulnerabilities to the system, so I welcome your thoughts.
Again, thanks for your feedback!
Matthew.
|
