Filters that Fight Back

August 2003 (Originally this essay began with a discussion of filtering.

2003 年 8 月（这篇文章最初是从讨论过滤开始的。

An expanded version of that discussion now exists on its own as So Far, So Good .) --> We may be able to improve the accuracy of Bayesian spam filters by having them follow links to see what's waiting at the other end.

现在，该讨论的扩展版本已单独存在，名称为到目前为止，如此良好。） --> 我们也许能够通过让贝叶斯垃圾邮件过滤器跟踪链接来查看另一端正在等待的内容，从而提高贝叶斯垃圾邮件过滤器的准确性。

Richard Jowsey of death2spam now does this in borderline cases, and reports that it works well.

Death2spam 的 Richard Jowsey 现在在边缘情况下这样做，并报告说效果很好。

Why only do it in borderline cases?

为什么只在边缘情况下才这样做？

And why only do it once?

为什么只做一次？

As I mentioned in Will Filters Kill Spam?

正如我在过滤器会杀死垃圾邮件吗？

, following all the urls in a spam would have an amusing side-effect.

，跟踪垃圾邮件中的所有 URL 会产生有趣的副作用。

If popular email clients did this in order to filter spam, the spammer's servers would take a serious pounding.

如果流行的电子邮件客户端这样做是为了过滤垃圾邮件，那么垃圾邮件发送者的服务器将遭受严重打击。

The more I think about this, the better an idea it seems.

我越想这个想法，就越觉得这是一个更好的主意。

This isn't just amusing; it would be hard to imagine a more perfectly targeted counterattack on spammers.

这不仅有趣，而且很有趣。很难想象还有比垃圾邮件发送者更有针对性的反击。

So I'd like to suggest an additional feature to those

所以我想建议一个额外的功能

working on spam filters: a "punish" mode which, if turned on, would spider every url in a suspected spam n times, where n could be set by the user.

处理垃圾邮件过滤器：一种“惩罚”模式，如果打开，则会对可疑垃圾邮件中的每个 URL 进行 n 次蜘蛛抓取，其中 n 可以由用户设置。

[1] As many people have noted, one of the problems with the current email system is that it's too passive.

[1] 正如许多人所指出的，当前电子邮件系统的问题之一是它过于被动。

It does whatever you tell it.

你告诉它什么，它就会做什么。

So far all the suggestions for fixing the problem seem to involve new protocols.

到目前为止，解决该问题的所有建议似乎都涉及新协议。

This one wouldn't.

这个不会。

If widely used, auto-retrieving spam filters would make

如果广泛使用，自动检索垃圾邮件过滤器将使

the email system rebound.

电子邮件系统反弹。

The huge volume of the spam, which has so far worked in the spammer's favor, would now work against him, like a branch snapping back in his face.

到目前为止，大量的垃圾邮件对垃圾邮件发送者有利，但现在却对他不利，就像一根树枝折回他的脸上一样。

Auto-retrieving spam filters would drive the spammer's costs up, and his sales down: his bandwidth usage would go through the roof, and his servers would grind to a halt under the load, which would make them unavailable to the people who would have responded to the spam.

自动检索垃圾邮件过滤器会增加垃圾邮件发送者的成本，并导致其销售额下降：他的带宽使用量将达到顶峰，他的服务器将在负载下慢慢停止，这将使那些对垃圾邮件作出响应的人无法使用它们。

Pump out a million emails an hour, get a million hits an hour on your servers.

每小时发出一百万封电子邮件，每小时在您的服务器上获得一百万次点击。

<!--Of course, if any of the urls are "web bugs" they'll suggest to the spammer that the mail got opened, and may result in more spam.

<!--当然，如果任何 URL 是“网络错误”，它们会向垃圾邮件发送者表明邮件已被打开，并可能导致更多垃圾邮件。

(However, they'll also tend to make "open rates" meaningless, thus depriving the spammer of valuable information.) And of course, some links will be unsubscribe links.

（但是，它们也会使“开放率”变得毫无意义，从而剥夺垃圾邮件发送者有价值的信息。）当然，有些链接将是取消订阅链接。

The net effect might be less spam.

最终效果可能是减少垃圾邮件。

--> We would want to ensure that this is only done to suspected spams.

--> 我们希望确保仅对可疑垃圾邮件执行此操作。

As a rule, any url sent to millions of people is likely to be a spam url, so submitting every http request in every email would work fine nearly all the time.

通常，发送给数百万人的任何 URL 都可能是垃圾邮件 URL，因此在每封电子邮件中提交每个 http 请求几乎总是可以正常工作。

But there are a few cases where this isn't true: the urls at the bottom of mails sent from free email services like Yahoo Mail and Hotmail, for example.

但在某些情况下，情况并非如此：例如，从免费电子邮件服务（例如 Yahoo Mail 和 Hotmail）发送的邮件底部的 URL。

To protect such sites, and to prevent abuse, auto-retrieval

为了保护此类网站并防止滥用、自动检索

should be combined with blacklists of spamvertised sites.

应与垃圾邮件广告网站的黑名单结合起来。

Only sites on a blacklist would get crawled, and sites would be blacklisted only after being inspected by humans.

只有黑名单上的网站才会被抓取，并且网站只有在经过人工检查后才会被列入黑名单。

The lifetime of a spam must be several hours at least, so it should be easy to update such a list in time to interfere with a spam promoting a new site.

垃圾邮件的生命周期必须至少为几个小时，因此应该很容易及时更新这样的列表以干扰推广新网站的垃圾邮件。

[2] High-volume auto-retrieval would only be practical for users on high-bandwidth

[2] 大容量自动检索仅适用于高带宽用户

connections, but there are enough of those to cause spammers serious trouble.

连接，但这些连接数量足以给垃圾邮件发送者带来严重的麻烦。

Indeed, this solution neatly mirrors the problem.

事实上，这个解决方案巧妙地反映了问题。

The problem with spam is that in order to reach a few gullible people the spammer sends mail to everyone.

垃圾邮件的问题在于，为了接触到少数容易上当受骗的人，垃圾邮件发送者向所有人发送邮件。

The non-gullible recipients are merely collateral damage.

不易受骗的接受者只是附带损害。

But the non-gullible majority won't stop getting spam until they can stop (or threaten to stop) the gullible

但不易受骗的大多数人不会停止收到垃圾邮件，除非他们能够阻止（或威胁阻止）容易受骗的人

from responding to it.

从回应它。

Auto-retrieving spam filters offer them a way to do this.

自动检索垃圾邮件过滤器为他们提供了一种实现此目的的方法。

Would that kill spam?

这会杀死垃圾邮件吗？

Not quite.

不完全是。

The biggest spammers could probably protect their servers against auto-retrieving filters.

最大的垃圾邮件发送者可能会保护他们的服务器免受自动检索过滤器的影响。

However, the easiest and cheapest way for them to do it would be to include working unsubscribe links in their mails.

然而，对他们来说，最简单、最便宜的方法是在邮件中包含有效的取消订阅链接。

And this would be a necessity for smaller fry, and for "legitimate" sites that hired spammers to promote

对于规模较小的鱼苗以及雇佣垃圾邮件发送者进行推广的“合法”网站来说，这将是必要的

them.

他们。

So if auto-retrieving filters became widespread, they'd become auto-unsubscribing filters.

因此，如果自动检索过滤器变得普遍，它们就会变成自动取消订阅过滤器。

In this scenario, spam would, like OS crashes, viruses, and popups, become one of those plagues that only afflict people who don't bother to use the right software.

在这种情况下，垃圾邮件将像操作系统崩溃、病毒和弹出窗口一样，成为只会困扰那些懒得使用正确软件的人的瘟疫之一。

Notes [1] Auto-retrieving filters will have to follow redirects, and should in some cases (e.g. a page that just says "click here") follow more than one level of links.

注释 [1] 自动检索过滤器必须遵循重定向，并且在某些情况下（例如仅显示“单击此处”的页面）应该遵循多个级别的链接。

Make sure too that the http requests are indistinguishable from those of popular Web browsers, including the order and referrer.

还要确保 http 请求与流行的 Web 浏览器的请求没有区别，包括顺序和引用者。

If the response doesn't come back within x amount of time, default to some fairly high spam probability.

如果在 x 时间内没有返回响应，则默认为相当高的垃圾邮件概率。

Instead of making n constant, it might be a good idea to make it a function of the number of spams that have been seen mentioning the site.

与其让 n 为常量，不如将其设为提及该网站的垃圾邮件数量的函数。

This would add a further level of

这将进一步增加

protection against abuse and accidents.

防止滥用和事故。

[2] The original version of this article used the term "whitelist" instead of "blacklist".

[2] 本文最初版本使用术语“白名单”而不是“黑名单”。

Though they were to work like blacklists, I preferred to call them whitelists because it might make them less vulnerable to legal attack.

尽管它们的工作方式类似于黑名单，但我更愿意将它们称为白名单，因为这可能使它们更不易受到法律攻击。

This just seems to have confused readers, though.

但这似乎让读者感到困惑。

There should probably be multiple blacklists.

应该有多个黑名单。

A single point of failure would be vulnerable both to attack and abuse.

单点故障很容易受到攻击和滥用。

<!--[6] I don't pretend to have worked out all the details of this scheme.

<!--[6] 我不会假装已经弄清楚了这个计划的所有细节。

I can't claim to be certain it will work.

我不能保证它一定会起作用。

(Who could till it has been tried in practice?) Fortunately, unlike solutions that require new protocols, this one can be tested on a subset of the problem.

（在实践中尝试之前谁能做到？）幸运的是，与需要新协议的解决方案不同，这个解决方案可以在问题的子集上进行测试。

Why not try using FFBs on, say, domains that begin with A?

为什么不尝试在以 A 开头的域上使用 FFB？

If spammers start to avoid such domains, we'll know we're winning, and we can roll

如果垃圾邮件发送者开始避开此类域，我们就会知道我们赢了，我们可以继续前进

down the rest of the alphabet one letter at a time.

一次一个字母地顺着字母表的其余部分。

--> Thanks to Brian Burton, Bill Yerazunis, Dan Giffin, Eric Raymond, and Richard Jowsey for reading drafts of this.

--> 感谢 Brian Burton、Bill Yerazunis、Dan Giffin、Eric Raymond 和 Richard Jowsey 阅读本文的草稿。