I will dissent against some of the amateur netadmins in here offering their opinions about spam… Read_neck, especially. There are many kinds of UCE (unsolicited commercial email) you just can’t avoid, filtering software or not. I know this, because I’ve worked for commercial ISP’s in the past, writing code to help get rid of the crap.
I use a two-pass filtering method for my mailboxes, including a) active spamassasin parsing, and b) Bayesian filtering. I still get 8-15 spams a day, in with the 15 or so ‘real’ emails. Every day, though, my filters catch about 250 spams.
So, how do these people have my address? Simple, I own multiple domain names, and have since 1994 or '95, and my valid email address of registry has been in the public WHOIS databases for nine years. Every spammer on the planet has me in their mailing lists, and likely will, for years.
I also use white lists, black lists, and more… and still I get spam, and not only do I work with technology for a living, I’ve modified the spam catchers I use to work better for my particular needs.
The real problem, however, is the bandwidth and computing time required to filter ou spam. For every message I get, I have to make two outbound network connections, for up to 2-3k of data, to properly block spam by way of the active filtering. Add to that the size of the mail itself, and you’re talking about maybe a couple of megs day of added network traffic. Add to that the fact that the mailserver has to process all of those filter recipes every time mail comes in (about 2 secs of process time each, plus disk access for writing out queue files, mailbox files, logs, et alia), and you can very easily see how anyone not hosting their own mail resources is getting machines absolutely slammed by UCE.
One hint in managing spam… you might try is to send yourself an email with an extended address, ie. if your email is fred@somewhere.com, try fred+testing@somewhere.com. If the email still gets to you, congratulations, your mail server handles extended addresses as defined in the RFC’s. You can use addresses like fred+ebay@somewhere.com, fred+amazon@somewhere.com, and the like when you have to enter an email address on a vendor’s web page.
This makes it much easier to find out who is selling your email address, and using it for spamming… for most people, at least. Plus, if you start getting spam on a particular extended address, you can write a filter to block that extended address. At this time, spammers don’t seem to be stripping out the extended address info.
In any case, accusing the afflicted of being the cause of their own spam is just silly, not to mention just plain rude. Spammers harvest everything from newsgroups, to this message board, to X.500 directory services in order to get email addresses. Beyond that, many of them randomly try common first name + last inital, first initial + last name addresses plus the names of MX hosts as listed in DNS servers to get their spam out.
One other note: Computers are tools, not religions, and it’s not only perfectly acceptable that people use tools with only a modicum of knowledge about them, but it’s to be expected. I certainly don’t see anyone shouting at people to quit driving until they know how to rebuild an engine.
Cheers,