Service Provider Journal

Did tag spam kill Edgeio?

Interesting to note that Michael Arrington's post about the demise of Edgeio did not mention what role, if any, that tag spam played in its downfall. For that matter, tag spam didn't come up in the 100+ comments left by readers. But Om Malik, commenting back at the time of Edgeio's launch in February 2006, predicted trouble for Edgeio due to tag spam, and as far as I can tell, the idea of this type of service is still at risk due to tag spam. Does anyone have a handle on it?

Berlind: Use IMAP and x-notify to improve spam management

David Berlind moves the anti-spam discussion ball down the field for a first down! Seriously, this is important stuff for every ISP, Web site operator and mass emailer. And IMAP is definitely cool, underutilized existing tech.

Spam goes on and on, despite Gates' promise

As Todd Bishop succinctly put it: "Time's up." Two years after Bill Gates promised a way to solve the spam problem in two years, it's a big problem still. Today, in addition to spam delivered by e-mail, we have spam delivered via RSS feeds -- particularly in blog comments, but more and more plaguing such feeds trolling for new search engine results. Lately, I've particularly noticed such spam in Technorati search results.

Microsoft officials who claim that spam's been "solved" to any significant degree should get back to work or get out of the software platform business.

It's also distressing to compare the flood of press hype over Gates' promise two years ago, versus the trickle of coverage last week of yet another broken promise.

Email marketers "mad as hell" - so what are we?

According to Bill McCloskey, the email marketing industry is "mad as hell" at the anti-spam measures being taken lately by service providers, enterprises and anti-spam technology providers. Somehow, I don't think getting angry is going to save email marketers from being blacklisted. How about a more constructive approach? Surely this isn't the way.

The impact of fake/spam blogs

In a free speech society, who makes the decision that a blog, or any Web page, is "fake," or spam? Dave Sifry exudes confidence in his assessment. But I can easily see some gray areas to be exploited between a blog like this and journals such as mine. Who decides? The Blogger terms of service don't prohibit such content. The big challenge will be to search engines, to filter out what the general public perceives to be fake content, or spam. Could this turn into a slippery slope though? How long will it be before someone's authentic content is inadvertently tossed aside in such search engine filters?

Spam and email reliability: Route around bad ISPs

So the inevitable warning cries have arrived: anti-spam filters are increasingly making email unreliable as a delivery mechanism. This hand-wringing article, which even urges customers to "simply get used to losing email," ignores the obvious answer: demand authenticated email, switch to ISPs which implement it, and drop like a stone any ISP whose anti-spam filter has too many false positives. I was beating like a drum on tech vendors at RSA last week about the need for authenticated email. The problems around implementing it are all political and financial, not technological. Meanwhile, don't let the Associated Press or any other news organization tell you the Internet email sky is falling. And no, I don't have a recommendation for an ISP that offers authenticated email, but it's becoming a major theme of my work, and that of many others.

Sendmail position on Sender ID

Meng pointed me to a page where Sendmail explains why they're going ahead and licensing Sender ID under an open-source license: in short, Sendmail's going to wait until Microsoft gets its Sender ID-related patent before it signs a license.

It's worth pointing out that Sendmail controls its own open-source license. Signing a license with Microsoft is incompatible with many other sorts of open-source licenses, such as Apache. This Sendmail page explains it in more detail.

This move is likely to kick Sendmail out of a few open-source distributions, particularly as adoption of Sender ID kicks into gear.

Interesting anti-spam tech demos

Meng Meng Wong's doing some darn interesting demos at an ISPCON session this morning. Cloudmark for Sender ID, announced in August, provides service providers a way to pull up a Sender ID-based whitelist quickly.

Meng also showed a mockup of an experimental version of Microsoft Hotmail uses this data to attach reputation to individual emails. "I expect to see it in Hotmail by the end of the year," he says. The demo he showed, which may or may not be the user experience in the next Hotmail, tagged whitelisted mail with a smiley face, questionable mail with a blank face, and probably spam with a frowny-face. Most intriguingly, he showed a demo project he code-names Karma which aggregates the Cloudmark whitelist with lots of other whitelists. "The specs are now internally consistent across Sender ID and SPF," says George Webb, director of business management for Microsoft's safety technology & strategy team, who's in the room. "It's time to stop talking and start doing." Now that the IETF MARID group is no more, Wong's encouraging peopel to join MAAWG, the Messaging Anti-Abuse Working Group. "You've got to have some bucks to join," he cautions, "but the intention is right and they've got their heart in the right place." ISPs including AOL have Earthlink have joined.

It's a mixed blessing. If MAAWG succeeds, we'll have a new weapon against spam, but it won't have happened in an open way.

Meng also made news in a press release yesterday:

a prototype for a next-generation, spam-proof, cooperative email architecture. The system is based on the concepts of authentication, reputation, and accreditation developed at the Aspen Institute in December 2003 and embodied by standards like SPF, Sender ID, and DomainKeys

More details here. By cryptographically signing messages with Yahoo's DomainKeys, it might even help with whitelisting forwarded email, Meng says.

18% of email now includes an SPF record

Meng Meng Wong, inventor of SPF, is speaking at ISPCON this morning. He says his research shows that 18 percent of all email now includes a published SPF record. "Pretty good progress for one year," he says. As SPF gains traction, people will start sharing whitelists more widely. "When I give you my business card in the future, it won't mean 'mail me' -- it means 'put me in your white list so I can mail you.'"

So how will it become easier for someone to do that? What about iNames? Interestingly, Meng had not yet heard about iNames, introduced last week by Identity Commons. He was intrigued and says he will check it out. My mention of it will probably help connect a few dots between the identity and anti-spam worlds.

Felony spam conviction is a first

AP: Two Guilty in 1st Felony Spam Conviction. Spam remains a huge topic at ISPCON. With various ID schemes rolling out soon, I've got to figure out how to pursuade my ISP to register its Sender ID addresses. Meanwhile, it's good to see some spammers going to jail.