Between Hotmail, Yahoo! Mail, and Gmail, and several domains, I think I’ve had as many as 11 or 12 accounts active at one time, not counting various employer supplied accounts. The oldest of these dates back to 1996 and it was heavily used for USENET postings, and appeared proudly in my email signature for years, before doing that was a guaranteed way to increase your incoming spam numbers.

It saddens me in a way that the three oldest active email accounts I have, all belonging to this domain, get nothing but spam these days. Thousands and thousands of spams each day. When Google Mail started allowing you to read other accounts I set up a proxy account with GMail that reads these three old accounts, and I consume the proxy account via IMAP. It’s been a couple of years since I set the proxy up, with the intention of monitoring the old accounts for someone who hadn’t gotten the message about my GMail address.

In the past week the number of spam has suddenly increased dramatically, and I am ready to throw in the towel. I am ready to delete the oldest of my email accounts. Which is surprisingly hard to do. I own the domain and can always recreate them, but, like having a domain that will be 14 years old in a few months, having an email address that is that old pleases me. I feel bad enough for having abandoned it to the vagaries of spam for so long, deleting it now feels like adding insult to injury.

Still, it must be done. The torrent of spam isn’t going to stop and I’m ready to have much less of it in my life. GMail hides spam away without my having to do anything, deleting these accounts frees me from having to keep the digital dikes shored up and functioning. Not only will I reduce the influx of negativity into my life, I’ll reduce the amount of time and effort spent wading around in that muck.

The plugin is working fantastically, from my perspective.  Nearly all the comment spam I got was to older postings, and now that they are closed for comments, I’ve only had one spam make its way into the Akismet net.  

I almost miss my daily ritual of deleting all the comment spam.  Almost.

Some Background

As an Information Technology professional I have maintained a current copy of my resumé online, both on sites of my own as well as on Dice.com, for more than a decade.  Technology placement firms and recruiters traverse the web and catalog all the resumés they can find.  Each resumé is indexed by keywords, allowing the recruiter to automatically send out emails soliciting interest in new positions they are trying to fill.  Post a resumé that is buzz-word compliant online and you too will start getting “Urgent Opening – Respond with Rate Immediately” emails.

Are these messages spam?  Not in the strictest sense; placing your resumé online for all to see is advertising and contains an implicit offer.  The recruiter is responding to that offer.  However, these messages are still in a bit of gray area.  They are unsolicited, and often are wildly off base with regard to the alignment of the opening they tout and your actual experience or interest. How the sender of these messages responds to requests to cease sending the emails, is the final criteria that determines if they are spam or not.

Most recruiters understand relationship management is their true business; can they develop a cordial, professional relationship with me that is mutually beneficial to all involved?  Unfortunately, some feel that high-pressure and a lack of common courtesy is warranted, even acceptable.  Who cares if we trample the sensibilities of one or two or even a hundred people we blindly email?  After all, there are lots of IT professionals out there, we’ll focus on the ones who aren’t squeamish about integrity or ethics.  This descent into used-car-sales techniques is not an endorsement.

S.1618 Title III and H.R. 4176 § 301

The disclaimer that Talentberg, and others, use to claim their message isn’t spam is Senate bill 1618 or House resolution 4167.[1]  Both of these bills contained language outlining what was or wasn’t spam.  The disclaimer looks like this:

In accordance with Bill S.1618 Title III passed by the 105th U. S. Congress, this letter can not be considered spam as long as we include: (1) Contact information and (2) a way to be removed from future mailings. To remove yourself email us at remove@somebogusdomain.com and type “Remove” in the “subject” line. Under the provisions of U. S. Bill S. 1618 Title III, this letter is not spam and no further action can be taken by the reader against this company/person. Any report of this letter as spam to any independent agency or site is a violation of this law and will be dealt with promptly.

Unfortunately it is completely false.

S.1618 does exist, and contains this language:

Title III: Spamming – Requires a person who transmits an unsolicited commercial electronic mail message to include at the beginning of the body of the message: (1) the name, physical address, electronic mail address, and telephone number of the person who initiates transmission of the message or who created the content of it; and (2) a statement that further transmissions of such mail to the recipient by the person may be stopped at no cost to the recipient by sending a reply to the originating electronic mail address with the word “remove” in the subject line.
(Sec. 302) Empowers the Federal Trade Commission (FTC) with regulatory authority over such unsolicited electronic mail, including authority to conduct investigations, commence civil actions against individuals, and impose fines, penalties, and injunctions. Requires the FTC to take appropriate action within two years after the transmission of such electronic mail.
(Sec. 303) Authorizes a State to bring a civil action on behalf of its residents against individuals or entities transmitting electronic mail in violation of this Act. Requires such State to notify the FTC of such action.
(Sec. 304) States that this Act shall not apply to an electronic mail transmission by an interactive computer service provider unless the provider initiates the transmission or the transmission is not made to its own customers.
Authorizes actions by such providers to enforce the sanctions under this Act. Requires such action within one year after receipt of the transmission.
(Sec. 305) Requires a person who receives from any other person an electronic mail message requesting the termination of further transmission of commercial electronic mail to cease such transmissions to the individual. States that a person who secures a good or service from, or otherwise responds electronically to, an offer of unsolicited commercial electronic mail shall be deemed to have authorized such transmission.

The House of Representatives also had a measure that spoke to spam, H.R. 3888 § 301, which was pro-spam.  However, public outcry caused the offending section to be removed from the bill, and replaced with section 201:

Section 201 sets forth a sense of the Congress resolution regarding the practice of sending consumers unsolicited commercial electronic mail (or “e-mail”), often in bulk. This practice, commonly referred to as “spamming,” has been a serious concern to the Committee because spam congests the Internet and other electronic networks. In addition, some Internet Service Providers (ISPs) charge users based on time spent on using their network. Time spent by consumers deleting and preventing spam costs consumers money.
Thus, the Committee, for now, seeks to reduce the practice of spamming without imposing government mandates on the Internet and other electronic networks. Accordingly, the sense of Congress outlined in section 201 calls on the private sector to adopt, implement, and enforce measures that prevent and deter spam. The Committee expects that the private sector will view Congress’ charge as a useful opportunity to reduce spam voluntarily.

Since it requires both chambers of the Congress to make law, and given that the Senate didn’t approve H.R. 3888, nor did the House approve S.1618, there is no law that protects some emails from being spam merely by including an unsubscribe link.

Some email may alternatively quote H.R. 4176 § 101:

This message is being sent to you in compliance with the Federal legislation for commercial e-mail (H.R.4176 – §101).

Again, a bill, not a law.  In short, there is no legal protection for mass emailing simply by quoting a bill, and providing an unsubscribe link.

Talentberg

The Talentberg emails I get are frustrating on many levels.  One, they rarely coincide with my professional goals, career direction, or geographic restrictions.  It it painfully obvious that the sender hasn’t taken the time to actually review my resume to see if the keyword match is in fact good fit for the open position.  My stated desire to not relocate or travel is ignored in every single communication they’ve sent me.

Two, the erroneously quoted S.1618 is usually incomplete.  It appears that their email template truncates the notice.  Either they don’t know how to configure their own outbound email, making them incompetent, or they are deliberately trying to make it hard for people to unsubscribe to their messages, making them unethical.  Either way, I am not interested in putting something as valuable as my professional life into their hands.

Three, their absolute refusal to remove my address from their mailing list despite numerous, repeated request from me to do just that.  I have finally caved in and added rules to my mail server and client to “mark as read” and “delete” all messages from their domain.

In researching this “company” several inconsistencies appeared.  Their web site was only registered in February of this year, yet they claim a longer history than that.  Their site lists only a vice-president as part of the management team.  Furthermore, while you can find at least two people associated with the company on LinkedIn, one seemingly has two names, on American sounding and the other Asian in nature.  All of which adds up to a fly-by-night organization.

[1] Source: Spam and the Law – S. 1618 and H.R. 4176

Zanshin.net is by no means prominent. After nearly eight years of having a blog I have only a handful of comments. For several years, prior to switching to WordPress, I had comments completely disabled on my site to avoid dealing with comment spam. I eventually renamed the functions that supported comments and trackback pings, as my referer logs were full of crap, and my commnets were all link bait for stuff you’d expect to get from a guy wearing a trench coat in the alleyway, who starts his patter with, “Psst! Hey, buddy….”

Since the widely available themes for WordPress all seem to include the comment form, and since WordPress provides the Askimet spam plugin, I decided to enable comments once again. Part of my daily routine now is to periodically visit the administration pages for my site and check to see if there are any comments waiting for moderation and if there are any commnets caught in the Askimet spam filter. Mostly I get spam comments in the filter.

The caught comments are usually obviously spam; links to prescription drugs or male member enhancement products, or online gambling. However, once in a while there is a borderline comment, like this:

I found your site on technorati and read a few of your other posts. Keep up the good work. I just added your RSS feed to my Google News Reader. Looking forward to reading more from you.

On the surface there is nothing wrong with this commnet. However, the http link provided with the commnet leads to a site all about franchising, which in and of itself isn’t objectionable. What is objectionable are the links to other, spammier sites, on the franchise site. My first thought was to just delete the commnet outright. Links to spam, even one generation removed from my site? Fail. But the utter lack of comments on my site made me pause.

What if I kept the comment but removed the objectionable link? The site is mine after all. I don’t have much of a comment or privacy policy here, and to me that is now the problem. If I had a page that outlined what was and wasn’t acceptible, and the consequence of violating those terms, then I would feel perfectly justified in editing the comment to remove the link. Without the terms already in place, however, I can’t justify altering the comment author’s thoughts. I wouldn’t like it if someone copied my thoughts and then took them out of context (i.e., changed the copy in some fashion), so I don’t think I should engage in that behavior.

As much as I’d like to accept the comment quoted above, I can’t without altering it through the removal of it’s associated link. (Yes, I recognize by using it as an example in this posting I have in effect, published the comment. Some hairs are easier to split than others.) In order to avoid this problem in the future I have crafted a privacy policy and some terms of use for zanshin.net, that includes a section on trackback pings and comments.

Not wanting to open every single entry to undo the ‘allow trackback pings’ option I did an end run around the bastards. Since I don’t display the pings, and since I don’t want them at all anymore (no one has ever legitimately linked to me via the mechanism) I simply renamed the CGI script. Now the script-kiddies mindless robot code no longer sees my site as vulnerable.

I’ll wait a few days before I relax my vigilance, but I think this ultimate measure will end the problem once and for all. I just wish I’d thought of it sooner.

Keeping ahead of the trackback spam is particularly annoying. My email spam filter grabs the notifications of new trackbacks and throws them in the spam folder when the trackback itself tastes like spam. Since there are some 700 new messages in that folder every day I rarely cull through it looking for false positives. So trackback spam can go unnoticed for several days. I’ve switched the notification email address to my Gmail account, hopefully I’ll see them sooner that way.

My web site content management software (MovableType) sends me a message for each new comment and each new trackback or ping. Since I rarely, if ever, get any comments I have only gotten “new comment” email from the site twenty-nine times. Usually the content of the comment is acceptable and, as a result, it passes the incoming mail filter and lands in my inbox. Cool.

Trackbacks, or pings as they are sometimes called, are links to a specific posting I’ve made from someone else’s site. I write about some topic x and they write about my posting on their site with a link back to my posting. If they so choose their content management software can “ping” mine resulting in a link on my posting to theirs. It’s a neat feature that is unfortunately ripe with potential for various pond scum eating knuckle draggers.

Purveyors of Viagra or porn or adult sex toys use automated software that generates trackbacks to a postings on thousands (millions) of sites, including mine. Now my site has links to their product. In effect they are using my site to advertise their shit. Imagine having your own billboard along side the highway, only it is constantly being covered up with ads for everthing under the sun: gambling, sex, and drugs. You are paying for their ad.

When the email from MovableType arrives the spam filter sees the content of the trackback posting title as spam since it usually contains words that have scored very high in previous spams. Words like sex, Viagra, online gambling, et cetera. So I don’t see the trackback notification – it’s off in the junk folder hidden in the noise of several hundred or even several thousand other messages. Training the spam filter to accept the trackback messages regardless of their spam-like content only increases the amount of real spam in my inbox. Not training the filter leaves me wide open to abuses by various uni-brow cretins who ought to have their noses stapled to their assholes just before being covered with fire ants and set ablaze with lighter fluid.

This morning I cleared out several HUNDRED trackback spams and turned off once and for all the trackback feature on my web site. What really upsets me in all of this is that the offenders are totally uncaring that the software they are using indiscriminately vandalizes my site (and hundreds of thousands of other sites). If a punk wants to vandalize your house, and every other house on your street with spray paint he has to at least physically go to each house. The script-kiddie (a euphemism for shit-for-brains-nose-picker) just downloads a script or two and runs it, never caring a whit about the damage that will follow. At the push of a button he can deface not only your house, but every house for hundreds of miles.

Prison time is too good for these vermin. They should be made to bath lepers with their tongues.

Henceforth I will not be enabling the comment feature on new postings. Eventually I’ll get around to turning comments off on all the existing postings, just to avoid getting any comment spam while I’m not looking.

If you want to respond to something I’ve written here, please feel free to email me. There’s a contact link towards the bottom of the colophon.