GoodbyeSpam's modified challenge-response system should be cheaper and easier to manage than similar products. The company has just modified its enterprise software in a new release for ISPs, which it hopes they will test.

by Alex Goldman ISP-Planet Associate Editor [May 14, 2003]

San Clemente, Calif.-based GoodbyeSpam has built an ISP version of its enterprise anti-spam software. Pricing plans and policies are not yet developed; instead the company is looking for ISP partners to help the company learn what ISPs need in anti-spam software.

The product is a modified challenge-response system that also allows users to build their own blacklists and whitelists and use the software to filter multiple e-mail accounts. It is compatible with the following mail browsers and protocols: POP3, IMAP, AOL, Hotmail, Juno, MSN, Microsoft Outlook, and Yahoo!.

The software can be deployed in two ways. Small ISPs, or those that expect only a small number of their users to subscribe to the service, can deploy a piece of code the company calls a "pre-processor" that checks mail before it reaches the company's mail server. The server redirects the mail of users who have subscribed to GoodbyeSpam to the GoodbyeSpam servers at XO Communications' Irvine, Calif. data center.

ISPs looking to offer the service to all of their customers, or wishing not to direct e-mail to GoodbyeSpam, can acquire a per-mailbox license that will be priced monthly or annually. Jeff Schwartz, the company's founder and CEO, said, "we're looking for ISPs to test our product—and we're not just looking for big ISPs. They can get whichever version they want, and they can run it for a few months at no charge. After that, we'll still offer them a preferred rate." Schwartz's contact information is posted on the website's press page.

Responding to a challenge
The product has some features that are not part of other challenge-response anti-spam software. It offers two levels of challenge (and more could be added in the future). The lower level, which is what most subscribers are using now, simply asks the recipient of the challenge to click on a link. The higher level of security asks the sender what e-mail address they just sent an e-mail to.

"We decided to be prepared," said Schwartz, "in case determined spammers hired cheap labor to type answers to challenges. Our higher level of security will defeat even that. Of course, right now, our lower level of security works fine."

Schwartz said he learned that people who had completed the challenge were calling to see whether their messages had gone through. In response, GoodbyeSpam now allows subscribers to send confirmation messages to people who have completed challenges.

Schwartz said he expects to not need confirmations when people become more familiar with the technology. "Challenge-response is foreign to people," he said. "Anti-spam is now where anti-virus was five years ago. At that time, only techies had anti-virus software. Now, when you buy a computer, it comes with anti-virus. Only irresponsible people do not have anti-virus software on their computer."

Black and white
GoodbyeSpam supplements its challenge-response system with whitelist and blacklist features. Each user gets their own whitelist and blacklist, which they maintain by and for themselves. One beta tester's experience is chronicled in three articles: Give me back my mailbox!, GoodbyeSpam continues to chug along, blasting trash before it gets to my mailbox, and GoodbyeSpam.com at work (in which the author details his policies and lists). The user documents the day to day experience of building and maintaining a blacklist and a whitelist with GoodbyeSpam.

Whitelist and blacklist entries can consist of addresses, domains, or fragments in a message header. The product checks the whitelist first, and then checks the blacklist, a procedure that is standard across most spam software products, because this allows users to block spammy domains but allow individuals in those domains.

To protect against users making their filters too aggressive, the system holds all spam for 24 hours. Users can, if they wish, look at the spam the software has blocked. The software also provides a daily performance report by e-mail (users can turn it off if they wish) covering statistics such as messages blocked, messages in quarantine, and more. ISPs offering anti-spam as a product will want to be able to turn the system off for individual users or to show users what spam has been blocked so that they can appreciate what they're paying for.

Users' whitelists and blacklists are stored on the server, either at GoodbyeSpam's data bank or the ISP's server running GoodbyeSpam

GoodbyeSpam charges an additional fee for a professional version, which can serve someone with many mailboxes. If a user had an ISP account and two Yahoo! accounts, they would use the professional version. "If you're using this for Yahoo!," said Schwartz, "we'd recommend turning off Yahoo!'s bulk mail system so that you only have to manage one set of rules."

Schwartz said that he expects ISPs to be able to offer his professional version as an upsell product, giving them additional monthly per-customer revenue from those subscribers who sign up for the service.

Schwartz said that the combination of an automated challenge-response system, which should reduce spam, and a blacklist and whitelist system that ISPs do not have to manage, should combine to lower bandwidth costs and the customer pain associated with spam without adding the management costs associated with admin-managed lists. "Also," he said, "because it's self-managed, spammers cannot pre-scan their messages to ensure they'll get through as spammers can with SpamAssassin or Brightmail, for example."

—End