s quickly as new rules and methods of filtering
are devised, the spammers tend to be able to work around them and/or come
up with new tricks. The problem is that, no matter how good the filters
are, there will always be some level of the following:
- "False positives" - legitimate e-mails that are flagged
- "False negatives" - spam that makes it through the
filters and is considered "OK"
The possibility of false positives, in particular, requires that instead
of sending messages flagged as spam directly into the trash, they must
be directed into some sort of "quarantine" mailbox until the
user can inspect them to make sure that one or more important, legitimate
messages haven't been wrongly flagged. Although this probably doesn't
require as much user time as current user methods of handling spam, it
does significantly cut into the presumed time savings of filtering. Also,
many system administrators are reluctant to implement spam filtering due
to the added processing time and load it places on the system.
That said, though, a number of large mail hosts at Penn have begun offering spam filtering services - check with the support staff for your mail host to find out more.
Can't there be a list of addresses I don't want to
receive e-mail from that can be blocked at the server?
For a variety of legal and policy reasons, for Penn-owned e-mail servers,
the principle at work is the University cannot determine who is or is not
allowed to send you e-mail, in the same way that no one can dictate who can and cannot send you postal mail through the U.S. Postal System. Nearly all programs
for reading e-mail have filtering capability,
and you are entitled to use it to set up your own local filters. Remember,
though, it could end up being a long list of filters - spammers change
addresses frequently, and use all sorts of tricks to get around filters.
Your machine may end up using as much or more processing time and power in running
the filters as it would have taken to simply delete the messages.
What is an open e-mail relay, and what does it have
to do with "spam"?
In the early days of the Internet, it was literally possible to know
not only the name and address of every single mail server on the Net,
but also every person using those servers. The Net was a relatively closed
community whose members had a level of trust in each other that extended
down to the computers attached to the network. To facilitate the flow
of e-mail traffic around bottlenecks, the original e-mail specifications
- which are essentially still in use, unchanged - provided for mail servers
to "trust" each other enough that Server A would "relay"
mail from Server B that was addressed to Server C in the event that the
most direct path from B to C (say, through D or E) was slow or unavailable.
As more and more people began using the Internet, this sort of trust
relationship became unworkable and, more to the point, dangerous, as it
allowed e-mail tricksters to more easily "hide their tracks".
Security-conscious system administrators began turning off the "relay"
function, and it is now standard practice not to allow a mail host to
act as a relay, or to severely restrict the instances where relaying is allowed.
In recent years, particularly with the popularity of operating systems
like linux that usually include capability to be set up as a mail server,
more and more mail servers are coming online. The problem is that in some
cases, the "relay" function is enabled by default, and the people
setting up the server aren't experienced enough to know and understand
the ramifications. Or, in some cases, the setup routine asks "Do
you want to allow this to act as a mail relay?" and the installer
will answer "yes", again without understanding what it really
Today, however, what happens much more frequently is that virus writers include a "feature" that turns a newly-infected computer into an open e-mail relay (in addition to all the other bad things it does - yet another reason to install and use anti-virus software) which spammers will actually pay to use to "funnel" spam m