Re: Paul Graham's "Filters that Fight Back" -- anyone implementing

I'm forwarding the message below to gmane.org.infiniteink because
I want to link to it on my "Reverse Spam Filtering: Winning
Without Fighting" page. You can view the original message and the
thread it's in here:

 <news://news.grc.com/grc.spam>

Note that I've obscured the email addresses in the message.

Nancy
Infinite Ink
<http://www.ii.com>


---------- Begin forwarded message ----------
Path: news.grc.com!.
From: "John Graham-Cumming" <[email protected]>
Newsgroups: grc.spam
Subject: Re: Paul Graham's "Filters that Fight Back" -- anyone implementing this? (Robin?)
Date: Mon, 18 Aug 2003 06:49:13 -0700
Message-ID: <bhqln2$rir$1-n6yLf4/zqydWk0Htik3J/[email protected]>
Xref: news.grc.com grc.spam:11966

"Sam Schinke" <[email protected]> wrote in message news:[email protected]...
> POPFile has this checked in as a feature request. I have posted my thoughts
> on the idea there. The final decision is of course, up to John as far as
> seeing it implemented in POPFile's "core". I don't personally think he'll go
> for it as POPFile isn't primarily intended as a spam fighting tool. It is
> primarily about sorting out email, and if it fights spam that is a nice
> side-effect.

And it will *not* be going in to POPFile.  For a couple of reasons:

1. I don't think it's a well thought out proposal, and I'm surprised that PG
decided to publish it.

I believe that spammers could easily use this system against people.
Specifically if I were a spammer I would include links in my mail that
validate your email address is the user of an FFB and then queue you up for
my own attack: a joe job.  Secondly, unless this were quickly rolled out to
many people the initial users are going to be automatically confirming their
email address to any spam who comes along.  I can't think of a better
service to the spam community, if I am a spammer and I want to verify my
email list I can just send out spams containing one URL without even a real
message.   This even enhances dictionary attacks since I can now determine
which addresses are in use without having to rely on bounces or SMTP errors.

2. The system uses a web site black list.

I do not like black lists because they are a form of death penalty and
therefore need to be carefully tended.

John.
---------- End forwarded message ----------