Large ISPs ponder spam

The recommendations, unsurprisingly, are aimed primarily at ISPs. For the most part, they are reasonably obvious stuff; they include:

• Close open relays. Most people who run mail systems will have done this some time ago; anybody who doesn't finds it hard to send mail after a short while. The guidelines also recommend tightening access to open proxies.

• Shut down formmail.pl. It is hard to imagine that systems running formmail are still out there, but they must be. The LWN web server gets a handful of attempts to use formmail.pl (which has never been installed there) every day.

• Detect and disconnect zombie systems. This clearly has to be done; compromised systems are increasingly in demand as spam sources. Detection of such systems should be relatively easy, most of the time; one hopes, however, that ISPs will be careful when deciding just how active they want to be when looking for compromised systems.

• Use authenticated email submission. The report also recommends pushing customers over to the mail submission port (port 587) for feeding email into the system. Separating out the submission step, again, allows for prior authentication. Of course, implicit in all of this is the idea that ISP customers are not to be allowed to directly send mail to remote systems.

• Put rate limits on outbound email traffic. Recommended limits are 150 recipients per hour, up to 500 recipients per day. This idea has all kinds of problems, starting with the effect it will have on anybody running a mailing list.

• Close down web redirector services. Evidently some redirection services are open to anybody who wants to use them; putting redirected URLs into spam helps make the message look more legitimate and hide the ultimate destination.

• Set up and use spam reporting services.

There is also a set of recommendations for bulk mail senders, with ideas like "do not harvest email addresses," avoid forged headers, and provide clear opt-out instructions. The best recommendation, however (which would be "cease and desist") is absent. The "recommendations for consumers" section limits itself to suggesting the installation of firewalls and anti-virus software.

In one sense, these guidelines are a step in the right direction. They are an admission from a number of large ISPs that they must take responsibility for spam originating on their networks. In the best possible scenario, ISPs will take a higher level of interest in their contribution to the problem and shut their spammers down. In the worst case, however, we could see a significant reduction in what "normal users" are allowed to do on the net, major hassles for anybody wanting to run mailing lists or handle their own mail, and increasingly intrusive probes from ISPs which are ostensibly intended to root out compromised systems - all with a wink to "legitimate" bulk commercial emailers and no real reduction in spam volumes.

For now, at least, vast parts of the net are beyond the control of these large ISPs. That puts a limit on their ability to make a significant dent in the spam problem, but also in their ability to impose their own vision of how the net should work. Limits of that sort can only be a good thing.