You are viewing [info]shunn's journal

Catch-none
 
 
08 October 2004 @ 03:58 pm
Catch-none  
When I first secured my own domain, shunn.net, one of the pleasures of that vanity acquisition was catch-all email forwarding. What this meant was that any email sent to shunn.net—whether hunkylitfox@shunn.net, scumsuckingasswipe@shunn.net or mr.mxyzptlk@shunn.net—would end up in my inbox. In essence, I had an infinite set of email addresses to call my own.*

This was back in those heady days when spam was still a relatively scarce and benign offense, though even then the prudent were being warned not to put "mailto" URLs on their web sites, owing to the many robots out harvesting just such creatures to feed into their nefarious spam machines.

Over the years, as the tide of spam has risen, I've applied an increasing rigorous series of filters to hold back the onslaught. I've watched my daily spam intake increase logarithmically—maybe one a day back in the day, then ten, then a hundred, then a thousand. Yes, a thousand.

Part of this was due, I admit, to having placed many of those pesky bill@shunn.net links on my site. By the time I realized I seriously needed to scour them, the damage was done. My email address was out there, prominently listed amongst the ingredients for spam. But that was not all of it. Spammers grew more clever by leaps and bounds. They took to running whole dictionaries of common and not-so-common first names through their software, pairing each with domain names that anyone could glean from a handy DNS server. I received spam targeted at everyone from aaron@shunn.net to zusu@shunn.net.

I began filtering for spam at the client level, but then the spammers started targeting long lists of last names. smith@shunn.net, jones@shunn.net, and hickenlooper@shunn.net all were wooed with offers of low remortgaging, ch34p v14gr4, and penile enhancement. I erected my fortress walls higher, applying filters at the server level as well as at the client level.

Still the floodwaters continued to rise as spammers came up with ever-cleverer techniques for foiling the ever-cleverer filters. But even as good as the filters became, if I didn't leave my email client running all night, it could take upward of half an hour for my software to download and process all the messages that arrived in the course of eight short hours. I finally shut down bill@shunn.net entirely, shifting the burden of my personal correspondence to a different address that I'm not stupid enough to print here.

Still the levels rose.

I'm not sure quite why I waited so long—perhaps because I was loath to lose any of the increasingly rare real email messages suspended in that rising tide. But today something snapped, as I awoke to the prospect of downloading more than three thousand email messages to find the wheat amidst the chaff. Projected out over a full day, that's ten thousand emails in 24 hours. That's just unsupportable.

My catch-all forwarding is no more. I have set up a bare handful of email addresses where messages can actually get through to me, but everything else at shunn.net, and indeed at any of the other domains I now own, but everything else will bounce. And the bounces contain a message that wishes the ingestion of shards of fused silicon dioxide and subsequent painful expiration upon the senders of unsolicited commercial email.

So far today, since slamming the fortress gates shut this morning, exactly two spam messages have gotten through. I feel as if, having lain awake at night for months upon months while the neighbors run heavy excavation and construction equipment, they've finally been evicted and I can hear the crickets chirping again. Ah, blissful quiet!

If only I wasn't certain those two messages represent the leading edge of another slow logarithmic assault.


* This, of course, is not literally true. There is an upper limit on the allowable length of an email address, which means the set isn't really infinite. It's just really fucking big.
 
 
Current Mood: contemplativecontemplative
Current Music: The Dukes of Stratosphear, "Brainiac's Daughter"
 
 
( Post a new comment )
William Shunn[info]shunn on October 8th, 2004 01:33 pm (UTC)
I should point out that, if you can see the "feedback" email address listed below, the @ symbol in the address is a graphic, unreadable to robots. The address is also not clickable.
the sentimental curmudgeon[info]curmudgeon on October 8th, 2004 01:33 pm (UTC)
I have found that the spam filters in Eudora are a lovely thing.

Still. Tell me how to make things bounce?
William Shunn: Bilmo: Space Alien[info]shunn on October 8th, 2004 01:50 pm (UTC)
This is not something one can control at the client level. In fact, it's not something you can easily do at the server level for a single email address. Without significant jiggering, an email address is atomic—it either bounces all the time or it doesn't.

I can imagine a server-level filter that returns bounces for messages that don't pass, but I'm not sure how easy it would be to implement in practice. Depends on your ISP/host.
Robert[info]readwrite on October 9th, 2004 02:27 am (UTC)
I don't know what the maximum number of characters before the "@" is in an email address, but I would guess it's at least 20. If it's "n" characters, and assuming at least 40 possible characters for each of those 20 characters (26 letters, 10 figures, and a few punctuation marks [again, not sure which are allowable]), then the number of possible email addresses at a given domain would be

40 + 40^2 + 40^3 ...+ 40^n

if my math is correct. If n=20, that would be a very big number indeed. And for every character over 20, or every additional allowable symbol, the number would rise considerably... It's a wonder you only get 10,000 a day...
William Shunn: Bilmo: Space Alien[info]shunn on October 9th, 2004 07:32 am (UTC)
I was poking around the Internet looking for RFCs relating to email addresses, though, and I was not a little startled to discover that RFC 2822 (Internet Message Format) does not seem to specify a length limit on "local-part" (the token representing the part of the email address that comes before the @ sign). Apparently, allowable length depends entirely on the machine where the email account is hosted.

Still, it's safe to say that a limit does exist, even if it varies from domain to domain, so your formula is indeed correct.

However, I think there's a good reason I was only getting about 10,000 spams a day as opposed to millions or more. That's because the average cottage-industry spammer probably doesn't have access to the computing resources that would allow him to generate a list of all the possible email addresses that exist for a given domain, or even a significant fraction of them, let alone sending an email to each of those addresses. Easier to target a fairly likely list of possibilities, i.e. first names or last names.

I could see the next generation of spamming software adding all the possible one- or two-letter combinations to the front each last name (to hit jsmith@shunn.net or tsjones@shunn.net), or combining all the first names with all the last names a couple of different ways(brianhaskell@shunn.net or brian.haskell@shunn.net). That would be good for another exponential leap in the amount of spam.
Robert[info]readwrite on October 9th, 2004 04:12 pm (UTC)
Well, as I thought about this whole question some more, I started to look at it from the spammer's point of view. (In order to understand the criminal, one should try to put oneself in his shoes.) Let's take our number of possible email addresses at your domain. The last term alone, 40^20, is extremely large. It's equal to 2^40 x 10^20, which is a number greater than 10^36. (2^10 = 10,024, so 2^40 is 10,024^4, or approximately 10,000^4, which is 10^16, which multiplied by 10^20 gives you 10^36.) Let's say our spammer has some sophisticated hardware and software that can send 10,000 email messages an hour. It would still take him 10^9 hours, or around 40,000,000 days (assuming he has assistants who can keep up the process 24/7) to send a message to each of those possible addresses. And we can see that 40,000,000 days is well over 100,000 years!

And that's only a fraction of the number of possible addresses...one term (albeit the largest) out of our sum...so since our spammer is trying to get his message about V1c0d1n out to the largest number of individuals, he would indeed do well to target the most likely addresses at your domain.

I've seen this combination of two first names (Charlie Adam, Billy Joel, etc.) frequently as the name of a sender of spam, though not as a target. But since these bogus double-first-names represent, a good many of them at least, an actual email address, and since, according to a NY Times Magazine article I read, spammers get clients by...spamming, perhaps it makes sense to target other spammers when sending out one's message...
Comrade Leonid Ilyich Brezhnev[info]brezhnev on October 11th, 2004 01:39 am (UTC)
All spammers should be rounded up, straitjacketed, fed nothing but steamed Brussels sprouts, and forced to listen to Eminem 24X7.
William Shunn: Bilmo: Graffiti Mustache[info]shunn on October 25th, 2004 07:24 am (UTC)
Alternating with Helen Reddy on random Wednesdays.
[info]sansfoy on October 21st, 2004 07:23 pm (UTC)
why spam
I don't understand why there isn't a greater effort to track down and incarcerate spammers. The financial burden of their activities is staggering and they are hated far more even than telemarketers.

And that doesn't even cover the scams, the kiddie-porn, and other obvious criminal activity coming over the wires. I can't leave my email open anymore for fear of the odd porno slipping past the filters while my nine year old son is doing something on the computer.
William Shunn[info]shunn on October 25th, 2004 07:28 am (UTC)
Re: why spam
I wonder if there's not just enough law enforcement resources to devote to it to make strict enforcement seem worthwhile. That's one possibility, though I also suspect that much spam went offshore in the wake of the US anti-spam legislation, which makes enforcement just that much more difficult.

Also, I wonder what interest outfits like McAfee and Symantec would have in law enforcement not stemming the flood of spam....
When I first secured my own domain, shunn.net, one of the pleasures of that vanity acquisition was catch-all email forwarding. What this meant was that any email sent to shunn.net—whether hunkylitfox@shunn.net, scumsuckingasswipe@shunn.net or mr.mxyzptlk@shunn.net—would end up in my inbox. In essence, I had an infinite set of email addresses to call my own.*

This was back in those heady days when spam was still a relatively scarce and benign offense, though even then the prudent were being warned not to put "mailto" URLs on their web sites, owing to the many robots out harvesting just such creatures to feed into their nefarious spam machines.

Over the years, as the tide of spam has risen, I've applied an increasing rigorous series of filters to hold back the onslaught. I've watched my daily spam intake increase logarithmically—maybe one a day back in the day, then ten, then a hundred, then a thousand. Yes, a thousand.

Part of this was due, I admit, to having placed many of those pesky bill@shunn.net links on my site. By the time I realized I seriously needed to scour them, the damage was done. My email address was out there, prominently listed amongst the ingredients for spam. But that was not all of it. Spammers grew more clever by leaps and bounds. They took to running whole dictionaries of common and not-so-common first names through their software, pairing each with domain names that anyone could glean from a handy DNS server. I received spam targeted at everyone from aaron@shunn.net to zusu@shunn.net.

I began filtering for spam at the client level, but then the spammers started targeting long lists of last names. smith@shunn.net, jones@shunn.net, and hickenlooper@shunn.net all were wooed with offers of low remortgaging, ch34p v14gr4, and penile enhancement. I erected my fortress walls higher, applying filters at the server level as well as at the client level.

Still the floodwaters continued to rise as spammers came up with ever-cleverer techniques for foiling the ever-cleverer filters. But even as good as the filters became, if I didn't leave my email client running all night, it could take upward of half an hour for my software to download and process all the messages that arrived in the course of eight short hours. I finally shut down bill@shunn.net entirely, shifting the burden of my personal correspondence to a different address that I'm not stupid enough to print here.

Still the levels rose.

I'm not sure quite why I waited so long—perhaps because I was loath to lose any of the increasingly rare real email messages suspended in that rising tide. But today something snapped, as I awoke to the prospect of downloading more than three thousand email messages to find the wheat amidst the chaff. Projected out over a full day, that's ten thousand emails in 24 hours. That's just unsupportable.

My catch-all forwarding is no more. I have set up a bare handful of email addresses where messages can actually get through to me, but everything else at shunn.net, and indeed at any of the other domains I now own, but everything else will bounce. And the bounces contain a message that wishes the ingestion of shards of fused silicon dioxide and subsequent painful expiration upon the senders of unsolicited commercial email.

So far today, since slamming the fortress gates shut this morning, exactly two spam messages have gotten through. I feel as if, having lain awake at night for months upon months while the neighbors run heavy excavation and construction equipment, they've finally been evicted and I can hear the crickets chirping again. Ah, blissful quiet!

If only I wasn't certain those two messages represent the leading edge of another slow logarithmic assault.


* This, of course, is not literally true. There is an upper limit on the allowable length of an email address, which means the set isn't really infinite. It's just really fucking big.
 
Copyright © 1995-2012 by William Shunn.
All rights reserved, except where explicitly specified otherwise.
write to feedback AT shunn DOT net