Subject: [Asrg] keeping it accurate

From: Vernon Schryver <[email-masked]>
Date: Sun, 23 Mar 2003 12:04:06 -0700 (MST)

A recent message contained the following in a context that had something
to do with bandwidth:

> In urban areas, in developed countries, you *might* continue to
> see the increase in bandwidth that you are talking about. But I
> know a lot of people who's internet connections in the past 10
> years have increased by a stunning 2x. (28.8 to 56). And that's in
> the U.S.. Please think globally.

> My daughter has a fifth grade classmate who spends 15-20 minutes
> during lunch break cleaning the spam out of her in-box--every day.
> And she's not the only one doing it. Do you think those email
> accounts are going to be useable by the time they graduate from
> high school?

15 minutes at 28.8 kbit/sec is enough to move about 3 MBytes of
uncompressed or incompressible data.  It's also enough to move more
than 1000 modest but not tiny spam of 2 KBytes each or 60 unusually
large 50 KByte messages.  A lot of spam has far more SMTP headers than
its 200 or 300 bytes of body consisting of URLs and hashbusting strings.
That student's 15-20 minutes/day spent on  has nothing to do with
network bandwidth, but human attention and thinking.

Years ago I flogged the "postage due" bit about spam.  I stopped,
because it's broken. It's not whatever you want to call "broadband"
this week that invalidated it, but mere 28 kbit/sec modems.  The
computer costs per user to process spam are trivial and will remain
trivial, except in unusual cases.  One typical web page of 30-50 KBytes
is several times the average size of spam.  Only when the cost of
bandwidth is so high that the world wide web is too expensive to use
are the computer costs of spam significant for an individual user.
It is only when you have many users that bandwidth, CPU cycles, and
disk space spent on spam are significant.

The costs of spam are in those 15-20 minutes blocks of human attention.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Sun, 23 Mar 2003 15:01:22 -0500

>A recent message contained the following in a context that had something

You're right, I was addressing two different issues in those two 
different paragraphs.  However I believe that spam volume is a 
problem at the edge.  Where the edge includes both small mail servers 
and individuals.  Remember too that bandwidth == user's time for a 
dial-up.  That's time they sit there waiting for their email to 
arrive.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 23 Mar 2003 15:32:00 -0700 (MST)

> From: Kee Hinckley <[email-masked]>

> ...

If you forget the blarney from anti-spam product salesritters and 
netnews spammer fighters, and actually look at the numbers, you'll
see that's wrong.  The time peole spend sitting waiting for their spam
to arrive is insignificant except in unusual cases.  30 seconds is
enough to download a lot of spam, but only 30 seconds is about the
training time for a pre-56K modem.

The volume of spam is a problem, but only in human attention and not
network bits/second, CPU cycles, or disk space, unless you have 
thousands of users' spam to deal with.

---

From: Matt Sergeant <[email-masked]>
Date: Mon, 24 Mar 2003 10:59:17 +0000

> thousands of users' spam to deal with.

It has become a problem CPU-wise for us. We run *very* aggressive 
filters - 4 anti-virus filters, three types of anti-spam filter, and if 
the customer wants it, a porn filter.

It's quite CPU intensive to deal with all the spam. Or put another way, 
we'd certainly rather not have to ;-)

Matt.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 24 Mar 2003 07:52:18 -0700 (MST)

> From: Matt Sergeant <[email-masked]>

> we'd certainly rather not have to ;-)

It's not entirely clear that resources spent on filtering should be
charged to receving spam, but let's assume they should.

How many CPU-seconds do you spend for each incoming mail mesage and
how man users do you have?

If you spend 1000 CPU cycles on every byte of incoming mail, then I
suspect you spend less than 0.01 CPU seconds of a GHz CPU per typical
less than 5 KByte mail message.  However, assume I'm wrong by a factor
of 10 and you spend 10,000 cycles/byte.  That implies that a cheap GHz
server can handle about 800,000 mail messages/day.  Unless you have
thousands of users, how can you have a problem?

In other words, are you disagreeing with me?

---

From: Matt Sergeant <[email-masked]>
Date: Mon, 24 Mar 2003 17:24:22 +0000 (GMT)

> how man users do you have?

We average about 1 second per email. We process over 10 million emails a 
day for about 1.2 million users. IIRC our average processor is a 1.2Ghz 
Pentium.

Yes, this is an inordinately long period of time.

> In other words, are you disagreeing with me?

I'm never sure ;-) Hence I'm not drawing any conclusions, just trying to 
give the facts as we see them.

Matt.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 24 Mar 2003 15:10:10 -0700 (MST)

> Yes, this is an inordinately long period of time.

It certainly is!  Are you user you're not counting other costs in that
1 second?  For example, the 3 or more DNS lookups per incoming mail message
(not counting DNS blacklists) can be time consuming.  

On the other hand, from the outside looking in at a bunch of ISPs running
SpamAssassin+DCC, SpamAssassin filtering seems to run at ~1 sec/msg.

> give the facts as we see them.

I don't see any disagreement with my claim that the computer and network
costs of spam per user are trivial and trivial in the aggregate until
you have thousands of users.  Multiplying a trivial cost by 1,200,000
can yield something non-trivial.

I think the most interesting number you've offered is the 10
msgs/user/day average.  What is the average spam load?  For U.S.
retail ISPs it seems to be 70-85%.  Are your numbers similar to
what I can see of other European ISPs? 
(see http://www.dcc-servers.net/dcc/graphs/comp-rates )

---

From: Matt Sergeant <[email-masked]>
Date: Mon, 24 Mar 2003 22:53:26 +0000 (GMT)

> (not counting DNS blacklists) can be time consuming.  

Right. We don't count those as they vary so wildly as to sometimes skew 
the stats, and also we do those lookups in the smtp server, whereas 
scanning takes place in the "backend" (this is qmail-ish). The DNS lookups 
probably push it up a bit, though we try and keep large local caches where 
possible.

> what I can see of other European ISPs? 

We're an international company, so I can give you a fairly good worldwide 
view...

Spam to overall ratio for December was 1 in 2.13 emails for the US. That's
detected spam (we detect about 95% with low enough FP rates to make errors
insignificant).

For the UK December was 1 in 6.0 emails. Unfortunately this figure gets 
badly skewed because we generate about 1.2 million emails a day in 
server-to-server notices (I've whined about why this is a bad idea, so it 
may get changed eventually), and they end up in the UK pile.

For our Asian customers it was 1 in 6.9, though I'm not convinced by that 
figure - the asian customers may have turned off our heuristics as they're 
very aggressive against asian emails (or at least they have been in the 
past).

Overall that gave us a December figure of 1 in 4.2 emails detected as 
spam.

I can try and get more up to date figures tomorrow - these are just the 
spreadsheets I had to hand. And I have a feeling these spreadsheets count 
total emails as inbound and outbound, and since our customers don't spam 
that skews things a bit too (or does it? - perhaps you'd like both figures 
for completeness sake).

The only issue is generating these figures is time consuming for our stats 
guy, and he is in demand a lot from marketing, so I have to subpeona (sp?) 
his time ;-)

Matt.

---

From: Dave Crocker <[email-masked]>
Date: Tue, 25 Mar 2003 12:12:06 -0800

Vernon,

Sunday, March 23, 2003, 2:32:00 PM, you wrote:
VS> The volume of spam is a problem, but only in human attention and not
VS> network bits/second, CPU cycles, or disk space, unless you have 
VS> thousands of users' spam to deal with.

even with spamassassin doing its thing, i find that resulting stream of
downloadable mail, over a dialup, to have enough false-negative spam to
be a problem.

that's strictly subjective, as well as representing only a single user's
experience, but it's important to *me*...

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>