Subject: RE: [Asrg] Requirements for gathering statistics

From: "Sauer, Damon" <[email-masked]>
Date: Mon, 24 Mar 2003 13:34:07 -0500

The reasons that I do not release my numbers is that, if I tell all of you
how good or how bad my numbers are, I may become a target by a spammer that
either a) Wants to take me on as a personal conquest, or b) Accepts my
percentage of spam that I let through as "acceptable".

 I can tell you that most of my trouble comes from my corporate domain name
and ISP domain name are only differentiated by .com and .net. Most AOL size
spammers don't realize that they are spamming the wrong domain and that
their customer base is not here at .com. As a consequence, we have had to
install ISP size gateways on a corporate size mail system.

 I am VERY familiar with the spam problem. I am not sure what statistics
gathering is going to accomplish, other than justify the continued use of
spam as a marketing tool. Will it help us obtain our goal? I don't think so
because it contains no differentiating research and no control sets. 
 
 Now, I may be willing to send you example spams for some repository to be
used in a research setting but I am sure that you get enough of your own ;-)

Warmest Regards,
Damon

-----Original Message-----
From: Ted Gavin [mailto:[email-masked]]
Sent: Monday, March 24, 2003 12:32 PM
To: [email-masked]
Subject: Re: [Asrg] Requirements for gathering statistics 

On Mon, 24 Mar 2003 05:52:14 -0500, "Alan DeKok" <[email-masked]>
wrote:

>Kee Hinckley <[email-masked]> wrote:
>> I assume that we understand that these numbers are going to be very 
>> inaccurate?  Because if they were accurate, then presumably we'd know 
>> how to identify spam and we wouldn't be having this conversation.

[snip]

>  I'm not saying the numbers will be perfect, or perfectly collected.
>I'm coming at it from a method used in physics: A small step forward
>is better than sitting still.
>
>  What amazes me is the number of people who would rather do nothing
>than use an imperfect system, and the number of people who fight
>against something they agree with, because they think it doesn't go
>far enough.
>
>  Can we please learn how to walk before we start running?

To that point, if a comprehensive survey is going to be done, my
impression is it should be as thorough as possible. ASRG's mission
necessarily places a lot on our collective plate. However, I have a
responsibility to SpamCon Foundation's donors to not spend their donated
funds on wasted or frivolous efforts. So, before we start throwing away
dollars (in actual costs, time, resources, or getting a university to do
the research project if it becomes large enough), we need to make sure
that the effort is worthwhile.

This group (ASRG) is part of our constituent population, as are each of
the participants here. That being said, this group needs to not only
learn how to walk, but at least have both legs working on the same
effort. To translate - if it's actual data we're looking for, then we
should at least agree, as a group, what data we want.

So, I recommend that the Chair determine the sense of the group and
state whether a survey of the sort we've been discussing here is germane
to this Research Group fulfilling its mission. If so, then perhaps we
all might have some discussion as to what data is necessary for the
survey to be actually useful to the group is fulfilling its mission.

               Ted Gavin * [email-masked] *
 Trustee & Officer, SpamCon Foundation  <http://www.spamcon.org>
              A California Non-Profit Organization
   Protecting email as a medium of communications and commerce
          Donations: <http://www.spamcon.org/donations>
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

*****
"The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential, proprietary, and/or
privileged material.  Any review, retransmission, dissemination or other use
of, or taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.  If you received
this in error, please contact the sender and delete the material from all
computers."
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 24 Mar 2003 09:47:04 -0500

> percentage of spam that I let through as "acceptable".

  I wasn't proposing to make the names public.  A trusted source can
reasonably be expected to gather the statistics and analyse them,
without compromising privacy.

> spam as a marketing tool.

  <sigh> That's why the statistics I was asking for were at the MTA
end, and were focussed on the scope of the current problem, and the
cost and effectiveness of their current solutions.

  There was NOTHING in what I wrote which could be construed as to
measure the effectiveness of spam as a marketing tool.

> Will it help us obtain our goal? I don't think so because it
> contains no differentiating research and no control sets.

  My goal in collecting statistics would be to get a quantitative
indication of WHERE in the network spam is a problem, and HOW MUCH of
a problem it currently is.  Without those statistics, we will have NO
BASIS for measuring the effectiveness of any solution.  Therefore, we
will also have no basis for comparing the solutions, or for knowing
when we've "solved" the problem.

  As for "control sets", they're irrelevant to the question of "how
bad is the problem".  We wouldn't ask 10 ISP's for their input on
spam, and then not ask another 10 as a "control set".  That
methodology is nonsensical.

  Alan DeKok.