Subject: RE: [Asrg] Measurements on spam

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 13:38:29 -0800

I was hoping we could use the figures to get away from discussions like
'that does not work 99% of spam comes through open relays'.

Evidence that 20% or more of spams already have countermeasures against a
technique is pretty useful.

		Phill

> -----Original Message-----
> From: Jason Hihn [mailto:[email-masked]]
> Sent: Monday, March 10, 2003 4:08 PM
> To: Hallam-Baker, Phillip
> Cc: [email-masked]
> Subject: RE: [Asrg] Measurements on spam
> 
> 
> It doesn't matter. The nature is transient. If you make spam 
> improbable in
> one category, it'll get flooded because it's improbable. If 
> you try to base
> your anti-spam tactics on the statistics of today, tomorrow it'll be
> different.
> 
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Mon, 10 Mar 2003 16:49:31 -0500

Sadly, still, it's a moving target. If one does, then they all can. Spam is
like life. It evolves to fit a niche, and it evolves to survive.
Fortunately, spam differs in that people propagate it, it doesn't propagate
itself. (Excluding of course the MS Outlook fiasco, but that will only exist
until a viable OSS groupware component emerges. A change of client is
easy...)

20% is irrelevant. If it can be circumvented, it will be.
Spammers are very much like script kiddies. If there is an exploit for a
system, you have to patch it because the exploit is a nice and easily
packaged implementation fit for general consumption.

-----Original Message-----
From: Hallam-Baker, Phillip [mailto:[email-masked]]
Sent: Monday, March 10, 2003 4:38 PM
To: 'Jason Hihn'; Hallam-Baker, Phillip
Cc: [email-masked]
Subject: RE: [Asrg] Measurements on spam

		Phill

---

From: Justin Mason <[email-masked]>
Date: Mon, 10 Mar 2003 22:35:06 +0000

> technique is pretty useful.

Based on my spamtraps, and the figures we get back for rule effectiveness
across the SpamAssassin developers' corpora, I can tell you that each
technique varies massively.  On some people's mail, a given technique
could yield 50% effectiveness; on others, < 1%.

I reckon this is because there's a high degree of locality between
(a) a list of addresses and (b) the spammer (or spamming contractor)
in question.

This also indicates that some of the bigger spam outfits write (or
pay to have written) their own spamware.

--j.