Large ISPs ponder spam
The recommendations, unsurprisingly, are aimed primarily at ISPs. For the most part, they are reasonably obvious stuff; they include:
- Close open relays. Most people who run mail systems will have done
this some time ago; anybody who doesn't finds it hard to send mail
after a short while. The guidelines also recommend tightening access
to open proxies.
- Shut down formmail.pl. It is hard to imagine that systems running
formmail are still out there, but they must be. The LWN web server
gets a handful of attempts to use formmail.pl (which has never been
installed there) every day.
- Detect and disconnect zombie systems. This clearly has to be done;
compromised systems are increasingly in demand as spam sources.
Detection of such systems should be relatively easy, most of the time;
one hopes, however, that ISPs will be careful when deciding just how
active they want to be when looking for compromised systems.
- Use authenticated email submission. The report also recommends
pushing customers over to the mail submission port
(port 587) for
feeding email into the system. Separating out the submission step,
again, allows for prior authentication. Of course, implicit in all of
this is the idea that ISP customers are not to be allowed to directly
send mail to remote systems.
- Put rate limits on outbound email traffic. Recommended limits are 150
recipients per hour, up to 500 recipients per day. This idea has all
kinds of problems, starting with the effect it will have on anybody
running a mailing list.
- Close down web redirector services. Evidently some redirection
services are open to anybody who wants to use them; putting redirected
URLs into spam helps make the message look more legitimate and hide
the ultimate destination.
- Set up and use spam reporting services.
There is also a set of recommendations for bulk mail senders, with ideas like "do not harvest email addresses," avoid forged headers, and provide clear opt-out instructions. The best recommendation, however (which would be "cease and desist") is absent. The "recommendations for consumers" section limits itself to suggesting the installation of firewalls and anti-virus software.
In one sense, these guidelines are a step in the right direction. They are an admission from a number of large ISPs that they must take responsibility for spam originating on their networks. In the best possible scenario, ISPs will take a higher level of interest in their contribution to the problem and shut their spammers down. In the worst case, however, we could see a significant reduction in what "normal users" are allowed to do on the net, major hassles for anybody wanting to run mailing lists or handle their own mail, and increasingly intrusive probes from ISPs which are ostensibly intended to root out compromised systems - all with a wink to "legitimate" bulk commercial emailers and no real reduction in spam volumes.
For now, at least, vast parts of the net are beyond the control of these
large ISPs. That puts a limit on their ability to make a significant dent
in the spam problem, but also in their ability to impose their own vision
of how the net should work. Limits of that sort can only be a good thing.