Subject: Re: Limitations of filters (was Re: [Asrg] Do we need to do anyth ing?)

From: wayne <[email-masked]>
Date: 06 Mar 2003 12:55:54 -0600

In <4B91B49E5EBCBA448687A033B3C7BC5905F3D558@bremocag> Postmaster <[email-masked]> writes:

>> From: wayne [mailto:[email-masked]]
>>
>> In <[email-masked]> "David F.
>> Skoll" <[email-masked]> writes:
>> 
>> > 
>> > By the time spam hits the MUA, you've paid a significant cost of the
>> > spam burden.
>> 
>> I strongly disagree with this.
>> 
>> By far the most expensive part of spam is the time spent by the end
>> user.  
> 
> --- What?! Wayne... care to pay for the 4 brand new servers I just had to
> put online to handle the sheer volume of the spam?

No, I would not want to pay for your new servers, nor would I want to
pay for your user's lost time.

How much did those servers cost?

How much time would your users have spent dealing with spam if you
didn't filter?

How much is your users' time worth?

All I'm saying is that I, for most situations, the hardware and
bandwidth costs of spam is less than what the users' time is worth.
If this isn't the case, they you don't have a good justification for
spending money to reduce spam.

This means that if you can reduce the amount of spam that the end user
has to deal with by accepting the spam and analyzing it, this is what
you should do.  It also means that spam filtering by the MUA is ok,
since the MUA often can know a lot more about what the user considers
to be spam than a MTA or mail server.

False positives can also be very expensive.  Reduction in bandwidth
and hardware costs by aggressive and early filtering may be penny wise
and pound foolish.  IF the MUA has a good spam filtering system, it
may be most cost effective to let a lot of questionable email through
to it.

We all wish that spam would "just go away".  We resent the money we
have to spend upgrading servers and buying more bandwidth.  We resent
the time spent dealing with it, both as sysadmins and end users.  We
resent having to hide our email addresses.

We shouldn't, however, let our resentment get in the way of doing good
cost/benefit analysis.

-wayne

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 14:23:01 -0500 (EST)

> may be most cost effective to let a lot of questionable email through

Actually, the better solution is to implement per-user filtering on
the mail server.  It's a heck of a lot cheaper to upgrade software
on one or a few servers than supply lots of users with new MUA's.

And if a user is dialing up long-distance to pick up e-mail, he/she
will appreciate systems that trap suspect mail on the server for review
rather than forcing it all to be downloaded first.

--
David.