New Anti-Spam Measures and Policy

[sangiro 4]

Heya all,

I want to tell you about some changes that I'm making to fight SPAM to Dropzone.com Mail accounts and also to your email addresses that may be listed somewhere on the site.

1) Much more aggressive and pro-active anti-spam policy and approach for Dropzone Mail

Up to now my approach has been somewhat hands-off and allow spam to get into the Dropzone.com Mail system, flag it for you as possible spam and let you deal with it as you see fit. Going forward the approach will be much more aggressive and pro-active. I will not allow most spam though to you anymore. It will be deleted at the server level before it gets delivered. There's always a slight risk of "false positives", meaning messages that are not spam being marked as such, and deleted. We've taken a lot of steps to try and prevent this from happening, and if it does, keeping the likelihood of it happening really low. Normal email communication should almost never get caught. You may subscribe to some mailing lists that format their mail as complex HTML pages - those are at risk. If you stop getting them, go back and check. I've tested this and I still get some pretty complex pages coming though.

In the past we used SpamAssasin only to look though email for typical characteristics of SPAM. Based on a point system it assigns a "SPAM-Level" to each message. Messages scoring 5 (*****) were marked as SAPM and sent on to you. In the future we will enhance the SpamAssasin algorithms by also checking each email sent against a list of Open Relay databases. These are open servers often used by spammers to hide where there emails are coming from. Emails originating from one of these servers will automatically have their SPAM-Level bumped up in SpamAssassin.

We will also use the Open Relay checks built into SpamCop (another anti-spam application) to further check messages. SpamCop is known to be quite strict.

In the future, all messages scoring 4 (****) or higher in SpamAssassin will not be delivered to you at all. You can still use the anti-spam filters of Dropzone Mail to sort even lower scoring messages to a special folder or delete them completely.

2) White-listing

We've added all email addresses that resides on Dropzone.com to a "white-list". This means the server will reject any email to dropzone.com for an address that's not on that list. Although this will not necessarily reduce spam it will reduce the load on the server. "Brute force" spam attacks often try to force their way into the system by simply adding any possible word to in front of @dropzone.com and firing it at our server to process. For each one it gets wrong (which is 99.9% of them) we have to scan for virusses, see if we can find the user and sent a "bounced mail" message back. This bogs down the mail server for legitimate mail. If the address is not on the white-list we wont look at it in the future. It will simply be deleted.

3) Encrypting Email Addresses (using character entities)

In the future all email addresses on Dropzone.com will be encrypted using the actual character entities to create the HTML that you see on a page. This means robots running though the site parsing the pages to harvest email addresses will only see the entities and will find nothing. You have to look at the code through a browser for it to make sense. My email address for example would look like this to a robot:

Quote

sangiro@dro
pzone.com

(Those of you who know how to do it, open a user's profile with an email address. View the page source code and find the email address...)

The following email addresses are currently encoded:

• Address in your Forum Profile


• Address posted with a Classified ad in the allocated space (not if you put it in the body of the ad)


• Addresses in the Stolen Gear Database


• Addresses in the Dropzone Database (if you listed a contact email for your DZ)

A few final thoughts:

Will this stop all spam to your Dropzone.com Mail account? No it may not. But depending on how you use your email address we should get most of it. If you make your address available online and publish it all over the web you should expect it to be harvested, sold and re-sold.

Use some common-sense techniques to protect yourself. Even with the encoding use something like : sangiro_at_dropzone_dot_com. The encoding scripts will have no issues with that and most users will understand what to do to email you.

Check out this page for some good information on why you're getting a lot of spam. Again, not that by FAR the majority of spam goes to addresses that has been published on the web and that by removing them or fixing them it does make a difference, even after the fact!

Ok, that's it for now! Dropzone.com Mail users, give me some feedback and let me know if this helps. Those of you who stopped using your Dropzone.com mail accounts - try cleaning it all out and give it a go again!

Safe swoops
Sangiro