In some ways, yes, I do agree that e-mail is free. However when used to innundate mail servers with millions of messages (especially in the case where said servers normally handle multiples of thousands) it becomes an issue of SPAMmers foisting their advertising costs on the consumers. I don't have to pay for radio, television, or print advertising. They're just "there" in a forum in which I would normally be participating anyways.

These advertising mediums are also regulated. There must be a vaild company represented, and/or a legitimate means of contacting the source of the advertising in order to report inaccuracies or outright falsehoods, as well as offence taken to the ad. (Imagine "Enlarge your penis - GUARANTEED!" appearing in the likes of the New York Times or the Toronto Star, for example). Accountability for one's own advertising is very important, and when you have no means of "following the money" in these ads (ie; you submit credit/financial details, a product is mailed to you anonymously (if at all), and the shell company subsequently vaporizes - they have zero accountability for the products/services they sell and can therefore get away with fraud, which they do on a daily basis.)

Microsoft's idea, of course, comes a dollar short and a day late. SPAM database? I can throw a rock (virtually) and hit a dozen of them. All Microsoft has to do is link to them in their mail clients (Outlook (Express), Hotmail) and server (Exchange) and allow the user to selectively activate the feature.

Of course, they could realize that such databases are often grossly inaccurate and generate entirely too many false positives to be considered reliable. Instead, they could focus on Bayesian filtering technology, taking a page from AOL/Netscape Communications/Mozilla.Org and integrate such filtering into the server itself. Client creates list of SPAM characteristics based on the users' identifications, and eventually server just stops sending those messages to the user. A requisite feature, however, is the ability to atleast see these messages before their deltion to ensure no false positives have been identified.

If done properly, a centralized mail server (IMAP / Exchange) could update the SPAM characteristic database on the client and allow the user to connect using any Microsoft mail client from anywhere in the world and have their own personalized database of SPAM characterisitics right at their fingertips. This is a feature that is presently lacking from the likes of Mozilla Mail, becase they don't presently offer their own mail server software.

Microsoft has a genuine chance to innovate here and finally do something right where e-mail security is concerned, but will they do it properly, or will it be another blunder like their all-or-nothing attachment filtering?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/170/20768#20768