Subject: RE: [Asrg] DCC and IP checksums

From: "Sauer, Damon" <[email-masked]>
Date: Mon, 10 Mar 2003 12:06:39 -0600

I think in this thread Phill and Hadmut bring up another very interesting
point.
 The sharing of technology.
 Some of my dearest and closest friends are other postmasters and system
admins. We can talk about pretty much anything until it come to their
technology and anti-spam techniques. From there, their eyes get squinty and
they start shifting in their seats.
 I would really like to see a technology that does not have to be based on
"My secret anti-spam formula"
Will there be a mechanism or could there be one put into place that would
allow the sharing of information without it being exploited by spammers?
Surely this is a rhetorical question...

Regards,
Damon 

-----Original Message-----
From: Hallam-Baker, Phillip [mailto:[email-masked]]
Sent: Monday, March 10, 2003 11:50 AM
To: Sauer, Damon; 'Hadmut Danisch'
Cc: [email-masked]
Subject: RE: [Asrg] DCC and IP checksums

>  Keeping unique MD5's over the lifetime of the system is 
> impractical and
> will eventually start encroaching on the "hammering distance" 
> issue.

Maybe for some, we have infrastructure that handles 6 billion
transactions on data sets of many Gb. So there is an existence
proof at least :-)

If there is a business model this type of scheme can be 
deployed, my concern is that I would prefer we looked at
mechanisms that did not require such quantities of hardware.

Looking at the various spam gangs on the net there are 
major differences in the level of sophistication. The 
Nigerian gangs don't appear to have got much beyond working
out how to use CAPS LOCK. You can detect a risible proportion
of Nigerian letters simply by scanning for 'modalities of the
transaction'.

Rather than use an MD5 approach I would prefer to use 
something that was rather more adaptive and reactive. The 
spam senders can clearly react faster than we can turn out
standards. I think this is a case where Java or C# mobile
code approaches could have an application. This would allow
the fingerprint matching technology to evolve in response
to attempts to defeat it.

One of the features of the cricumvention technology is that
its use can provide some of the best spam indicators. For
example any subject line that has a string of whitespace and
random non text garbage appended at the end has a huge
probability of being spam.

If we get to the point where the only spam being sent is
being sent by a small number of offshore spam houses using
ever more convoluted tactics to defeat spam filtering
technology the business will start to shrink very quickly.

	Phill
 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

*****
"The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential, proprietary, and/or
privileged material.  Any review, retransmission, dissemination or other use
of, or taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.  If you received
this in error, please contact the sender and delete the material from all
computers."
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Mon, 10 Mar 2003 13:36:41 -0500

>  Some of my dearest and closest friends are other postmasters and  
>  system admins. We can talk about pretty much anything until it come
>  to their technology and anti-spam techniques. From there, their eyes
>  get squinty and they start shifting in their seats.

I suspect this is because many of us realize that 

a) currently, our most effective filters are based on content
   (even acknowledging the problems with this kind of filter)
b) most of these filters only work as long as the spammers don't know
   about them.

so the longer we can keep our spam filters secret, the longer they'll
work for us.

there's also something to be said for diversity.  the more uniform our
filters become, the easier it will be for spammers to avoid them.

Keith