Gmail, How do I Love Thee? Let me Count the Ways...

Here's a quick Gmail goodness grab-bag top-10...

1. Spam filtering. It just works. I estimate it kills more than 99% of my spam, and the only occasional false positives I get are from Yahoo Groups (which is a spam cesspit anyway) and mailing lists that include spam samples (uhhh...)
   
   
2. IMAP access. Yay, we've been asking and asking and asking for it, but it finally arrived yesterday.
   
   
3. Local front-end servers. Recently, Google moved the POP/IMAP/SMTP servers I connect to. They're not now in the U.S., but much closer to me (in the UK?). Some sort of routing cleverness, I dare say. This means downloading a load of messages is now very, very fast.
   
   
4. Search and Filters. Fast, flexible, frequently-very-useful. Especially when combined with the saved search extension for Firefox (using Greasemonkey or the Better Gmail extension).
   
   
5. Labels. I know some people hate 'em, to which I say, "Just think of them as folders." But they're so much better than folders, mainly 'cos you can "file" a message in more than one of them.
   
   
6. Fetchmail. Integrated, as way of grabbing your email from other accounts, using POP. Saves auto-forwarding, which is increasingly broken.
   
   
7. AJAX. Not as ground-breaking as OWA, not as flashy as Oddpost/Yahoo/SWA, not as mashable as Zimbra, but fast and usable all the same.
   
   
8. Keyboard shortcuts. A big productivity saver. I hate to move my hands off the keyboard to find my mouse -- that's a key reason why I don't "do" Mac OS.
   
   
9. Google Apps. A white label version of Gmail is included in Google's hosted applications service.
   
   
10. Free. Yes, as a confirmed cheapskate, this is a good thing. Even Google Apps is free for up to 50 mailboxes. No more do vanity domain owners have to suffer the slings and arrows of outrageous email forwarders.
    

Email Sender Reputation at all, David?

David Berlind sounds like he's sick of talking to hyperbole-fuelled anti-spam vendors. Can't say I blame him.

It is probably true that if everyone in the world ran just one solution, we’d be able to tweak that solution in such a way that we’d finally get a handle on the inbound and outbound problems associated with spam. When everyone has access to the same technology, there’s a name for that. It’s called a standard. There is zero chance of some proprietary solution becoming the defacto antispam solution for the world. But, if only AOL, Google, Microsoft, and Yahoo (the world’s leading e-mail solution/service providers) would get together and decide on what the non-proprietary standards should be and implement them in their systems, it wouldn’t be long before every other e-mail solution provider would have to follow suit (in order for their e-mails to interoperate).

Well, the thing is, in many ways, AOL, Google and Yahoo are doing what he asks (and even Microsoft is making encouraging noises).

The "standard" the industry's heading towards is "true" sender reputation (i.e., not the DNS-IP-blacklists-on-drugs that we have today). Being able to store and share opinions about the "goodness" of an individual sender and/or sender domain would be incredibly useful, but we're not there yet -- mainly because email is to easy to forge. This is where sender authentication comes in.

So the necessary precursor to sender reputaion is to get everyone using DKIM, so we have a strong method of sender authentication (not just the relatively weak-but-easy SPF/SenderID) -- this is where the big three mentioned above is right now (and as I said, Microsoft is making encouraging noises, despite its wedded bliss with SenderID).

For more, see:

• CNET's Error Explaining DKIM
• Locally-Maintained Reputation

Phishing via Instant Messaging

I just got an IM from a buddy. He told me to go to www(dot)geocities(dot)com(slash)picc_81(slash)index.htm

This appeared to be a Yahoo 360 login page. "Odd," I thought, "Why do I need to login to see a Geocities page? And anyway, aren't I already logged into Yahoo?"

Let's view the source. Oh. It sends the login credentials to a script on www2.fiberbit.net -- looks like it emails them to ggeocitiees@gmail.com

Nice job, phish boy.

I've reported it to PIRT, the Gmail guys, and the Google Safe Browsing folks.

Now to contact my buddy and give him the bad news.

Is Spam Blocking at Odds with Common Carrier Status?

ISPs in many countries, including the U.S. enjoy a legal status often known as "Common Carrier." Simply put, this absolves the ISP of responsibility if it assists in the transfer of illegal materials, such as copyrighted works or child pornography. The philosophy is that as long as the ISP simply moves data from one place to another -- not making any judgment or discrimination about whether to move one type of data or another -- the ISP should enjoy a "safe harbour."

From time to time, some wag gets the idea that email filtering of spam and viruses would cause ISPs to lose this legal protection. In other words, if an ISP chooses not to deliver a message because it's "spam," the ISP is discriminating based on the content or source, which may remove the safe harbour. When one thinks about it, this is complete nonsense, but stranger things have happened in various legal systems around the world.

This debate is happening again. Thanks to the good work done by MAAWG and others, ISPs are being encouraged to set up outbound spam filtering, to prevent zombified PCs sending spam from their networks, and to encourage users to clean their infected machines with walled gardens. Naturally, some are expressing concern that such discrimination would count as another chink in their common carrier armour.

It's time for the FCC and similar regulators in other countries to step up and make it clear that such genuinely useful -- some would say essential -- discrimination would not affect an ISP's common carrier status.

BTW, sorry for the long hiatus. Call it Blogger's Block. Thanks to Kevin Soo Hoo for helping break it.

Inadvertent Spamming: a Cautionary Tale

I learned today of a well-known software vendor whose business has suffered as a result of poor list management practices. It's not the first, and probably won't be the last. This sorry tale only goes to illustrate the importance of avoiding becoming an inadvertent spammer.

It appears that, although it had been legitimately sending mailings to its customers, the vendor had been ignoring unsubscribe requests. As I've said before, any unwanted bulk email sent by an organization after an appropriate unsubscribe request is spam -- an organization that fails to act on unsubscribe requests in this way is a spammer.

As a result of its failure to honour unsubscribe requests, complaints about the spam began to accumulate at the feet of the various organizations that track spammers' activity. Crucially, these include sender reputation services, such as DNSBLs (also known as IP blacklists). Inevitably, despite the fact that the majority of email it sent was legitimate, the vendor gained a negative reputation as a spammer.

This caused some recipients of its email to reject or otherwise filter these legitimate messages. Not only were legitimate direct marketing messages filtered, but also messages containing customers' license keys, technical support replies, etc.

This is indeed a cautionary tale: the lesson for senders is that the unsubscribe process is truly a mission-critical part of your direct marketing or transactional email workflow. Failure to ensure its integrity can not only cause legal problems, but damage your customer relationships and your business.