Subject: RE: False positives (was Re: [Asrg] Re: RMX Records)

From: "Clayton, Nik [IT]" <[email-masked]>
Date: Thu, 6 Mar 2003 15:08:38 -0000

> Nah.  If you're receiving that kind of mail volume, you have big
> machines with under-utilized CPUs anyway.  Content-scanning just uses
> up CPU cycles that would be wasted.  Nik Clayton says he filters
> 2 million messages/day with SpamAssassin; I'd be amazed if fewer
> than 100K of those are spam.

It's about 280,000 a day at the moment.  Which is roughly 25% of our
inbound mail volume.  That's a combination of locally maintained 
blacklists and SpamAssassin -- no network tests (RBL, etc) are in use.

Because of our current mail architecture, that figure of 280,000 doesn't
include messages that will eventually bounce due to being misaddressed.

N
-- 
1        1         2         3         4         5         6         7    7
         0         0         0         0         0         0         0    5
                                                    -- The 75 column-ometer
Global Messaging,                 A: Top posting
120 Cheapside, x83331             Q: What's the most annoying e-mail habit?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Joe St Sauver <[email-masked]>
Date: Thu, 06 Mar 2003 09:04:04 -0800 (PST)

#We have.  As a rough description, the vast majority of it is spam of 
#various types coming from approximately 6000 unique IPs (a day's worth 
#of metrics) going to thousands of different email addresses, highly 
#variable numbers of spam per IP.  There are some indications that it's 
#only a few people behind it all, but not definitive.

We study our email sources as well; unlike the old days, we saw a clear
pattern:

-- spam from dedicated spam houses (easily blocked)
-- spam from open proxies (not open relays, open http proxies or open
   socks proxies) 

We track the dotted quads against a variety of blacklists; to date we've
seen and logged well over 25,000 unique proxies which have been exploited
(see http://darkwing.uoregon.edu/~joe/open-proxies-used-to-send-spam.html )

If you want to control spam, you really need a mechanism for dealing with 
abusable open proxies. 

Regards,

Joe

---

From: Balachander Krishnamurthy <[email-masked]>
Date: Fri, 07 Mar 2003 12:37:25 -0500

In 
 https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00753.html
Keith Moore writes:

  > Requiring senders to pay would make them accountable.

 *not unless you could somehow vary the cost according to how annoying the
 *message is.  if the cost per message is the same no matter who sends it or
 *what the message says, there's no cost I could set which is high enough to
 *deter spammers and low enough to not deter people I want to receive mail from.
 *Keith

Agreed. Thus, there has to be a scheme that would allow people to send
wanted mail at zero cost and at some non-zero cost for unwanted mail. 
A receiver, as busy as Keith, say, could insist validly that cost to 
sender of unwanted mail be high but ensure that wanted mail senders 
bear zero cost. I believe such a scheme is doable if we thought of 
liability rather than cost.

cheers,
bala

Balachander Krishnamurthy