Spammer Death By List Size

One of the best ways to stop spam is to make it uneconomical. The economics of spam are based on a simple formula involving the ratio of sent messages to responded messages, adjusted by a number of factors such as filtering ratio, cost of bandwith, profit per response, lawsuit risks, etc.

My half-baked idea is primarily concerned with attacking the top number in the spam economics equation: forcing the cost of sent messages to grow larger while keeping the number of respondents constant (assume the same idiots will continue forever to turn off their spam filtering and will continue to buy spamvertised products, and although we can't do much about it, their growth hopefully will not outpace population trends!).

What I'm proposing is going to require three significant elements: 1) Low-Cost Spam Acceptance And Disposal, 2) Higher Cost Per Spam Sent, and 3) Massive Poisoning of Spammer's Email Address Lists

I explain them in detail below:

1) The community at large needs to establish what I'll call "Hollow Email Address" technology. This is different from disposable email addresses (DEAs) and spam-traps, which are not optimized to reduce the cost of receiving and ignoring a spam message. Large numbers of people need to be given the ability to create non-bouncing email addresses that destroy spam quickly and cheaply. Domain admins can do this today using procmail, ASSP, or custom MTA configuration - but those are all geeks-only tools not accessible to the general public. Some DEA systems can be tweaked to fit the bill also, but most out-of-the-box still store the spam, which is expensive to do on a large scale. These email addresses capable of disposing of spam very cheaply (no heavy computation, no storage, no human intervention) are what I'll refer to as "hollow" addresses from here on.

2) The cost of sending one spam message needs to be higher than the cost of receiving it. In the future, when DKIM is in widespread use, this will be true for hollow addresses as defined above. Signing (which is a form of encryption) and sending a spam message is going to cost more than accepting and discarding that message without validating (decrypting) the signature, provided that you have some means to identify the spam from its envelope (such as, the recipient's address).

With the above two pieces of infrastructure well in place, then comes the "killer app", which is the core of my idea:

3) Once we have widespread use of "high cost to send" AND "low cost to discard" technologies, we (the community at large) can start relentlessly, systematically "poisoning" spammers address lists with hollow email addresses in a MASSIVE scale.

That's it. Sounds simple huh? The three elements, even #3 above, already exist in some form today (who hasn't used a disposable address to signup for a spam-prone service, therefore causing an infinitesimal increase in the spammer's cost without a corresponding increase in return?). But what I'm proposing is to massively scale this up, to the point where spammers' lists are filled with BILLIONS or even TRILLIONS of hollow email addresses. This number of hollow addresses circulating on the Internet could be made so large, that no one spammer would even own the entire list.

Think about it:

- The cost of a spam run would go up dramatically. Today it may cost something like $100 to send enough spams to reach 1 million spam-reading humans (rough guess). Imagine increasing this cost to $100,000 or more!

- Certain types of spam runs would become computationally untractable. The DKIM signatures alone, when you have BILLIONS of email addresses, would require more computing capacity than even the largest spambot networks.

- Instead of getting 1 response for every 10 million emails sent (wild guess), spammers would have to send 1000 times more spam (10 billion messages for 1 response).

Best of all, poisoning the spammers' lists can be a distributed, community effort:

- Webmasters, especially those who care for parked domains, can post hollow addresses by the ton, for web harvesting spammers to pickup.

- Open Source enthusiasts could create generic website packages to help with the above.

- People who post to mailing lists can add hollow addresses to their signatures. Utility software could generate them on the fly. Mailing list admins could periodically post an ever-shifting list of hollow addresses as part of their FAQ or other announcements.

- Volunteers can obtain free lists of hollow addresses to submit into "opt-out" and "unsubscribe" requests in their spare time (for the uninitiated, opt-out and unsubscribe are sure-fire ways of getting ON to spammer's lists).

If every webmaster out there today would go out and post a list of 10,000 hollow email addresses somewhere on their site, email harvesting from websites would be dead in a few months! Imagine volunteer webmasters could do this on just one million of their sites. That would instantly generate TEN BILLION EMAIL ADDRESSES - larger than any spammer's list today and probably enough to break some poorly written spamware already!