Subject: RE: [Asrg] 3. Requirements - Non Spam must go through

From: "Kurt Magnusson" <[email-masked]>
Date: Tue, 08 Jul 2003 09:38:35 -0200

Elric Pedder wrote:
>>Behalf Of Yakov Shafranovich
>>Just ran across this quote from the John Gilmore of the EFF
>>(http://www.politechbot.com/p-04927.html):
>>----snip----
>>"Any measure for stopping spam must ensure that all non-spam
>>messages reach
>>their intended recipients."
>>
>>Perhaps none of us has yet come up with a silver bullet to solve the
>>problem of spam -- but it IS within our power to solve the problem of
>>overzealous anti-spam measures.
>>----snip----
>
>I don't believe you can stop false positives -- if only because
>people will have widely varying opinions on what SPAM (to them)
>is.  It is, however, very dangerous to allow false positives
>because if anything the perceived "reliability" of the Internet
>becomes compromised.
>
>I would recommend
>
>"Any measure for stopping spam must ensure that all messages
>either reach the intended recipient, or are returned to the
>sender, or the sender notified."

Elric

I do agree with you regarding the last, we should return undeliverables,
but I do not agree that we need to live with false positives. Some months
back I refered to a method I called the Earnest method, because it uses the
URL's and phone nos the spammers want us to use. I've run it with a proof
of concept solution since early april and have, since I cleaned out some 
headers
addresses I collected when I consentrated on sender ID, in mid-may not have
had any false positives. It do occational allow new domains, but as long I 
am
sure non-spams get through and I can handle the new ones simply, it isn't
a problem.

But if you to guess what is spam, based on patterns in a letter the issue
is important, but if we can eliminate that guess, working with what the
spammers want us do, contact them, then we lessen the risks of filtering
away Aunti Agathas messages. If people do send a URL with a spammer
domain, pity, or we learn them to write them, so they passthrough. I
have no problem with getting a non-active URL from my dear aunt,
because I know why I need to copy and paste it. But spam with non-
active URL's will not generate the requred traffic to the advertiser. It
is to complicated.

Kurt Magnusson

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online 
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "C. Wegrzyn" <[email-masked]>
Date: Tue, 08 Jul 2003 07:52:10 -0400

I keep seeing the statement being made that spam should be returned to 
the sender. I might suggest something slightly different: why not have 
it delivered and marked as SPAM in the Subject line? In this way at 
least I can check to see if it really is spam? I'm afraid that if it is 
returned and we have false positives some mail might be returned that I 
do want to see.

Chuck Wegrzyn

Kurt Magnusson wrote:

> of concept solution since early april and have, since I cleaned out 
> some headers
> had any false positives. It do occational allow new domains, but as 
> long I am

---

From: "Pete McNeil" <[email-masked]>
Date: Tue, 8 Jul 2003 11:48:16 -0400

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of Kurt Magnusson

<snip>

>I do agree with you regarding the last, we should return 
>undeliverables, but I do not agree that we need to live with 
>false positives. Some months back I refered to a method I 
>called the Earnest method, because it uses the URL's and phone 
>nos the spammers want us to use. I've run it with a proof of 
>concept solution since early april and have, since I cleaned out some 
>headers
>addresses I collected when I consentrated on sender ID, in 
>mid-may not have had any false positives. It do occational 
>allow new domains, but as long I 
>am
>sure non-spams get through and I can handle the new ones 
>simply, it isn't a problem.
>
>But if you to guess what is spam, based on patterns in a 
>letter the issue is important, but if we can eliminate that 
>guess, working with what the spammers want us do, contact 
>them, then we lessen the risks of filtering away Aunti Agathas 
>messages. If people do send a URL with a spammer domain, pity, 

I have a great deal of data on this. It is not fool proof. The Message
Sniffer rule base is populated primarily with rules that follow this
paradigm... however these rules do occasionally cause false positives in
three general cases from rarest to most common:

1. The spammer blatantly uses legitimate contact info to obfuscate their
message, or so obfuscates their original contact info that any matching
rule must be imprecise enough to occasionally match legitimate data or
sources.

2. The spammer is using a "gray" hosting service or services such that
identifying their message based on their contact information also forces
the identification of legitimate messages through the same services.

3. The end users disagree on what is spam.

_M

---

From: "C. Wegrzyn" <[email-masked]>
Date: Tue, 08 Jul 2003 14:45:16 -0400

I know this is going to sound strange and it might be really off the 
wall but I have been looking at some of the spam that hit my mail box 
this morning. I noticed two kinds of spam:

1) From a legit email address; usually has a email address in the mail 
message;
2) Spammed through a relay; the message never seems to have an email 
address in the message.

In the latter message I always see a postal address and usually a 
telephone number (what idiot spammer would send a mail message without a 
contact?).  What idiot spammer would send an email message with an email 
address in it?

So now I have a three tiered method to getting rid of spam in my inbox. 
First is to use C/R to find a real human. Second is to use a Bayesian 
filter and third is to look for an email address in the message. If I 
check the email address in the message (if one is present) I would 
expect to find the domain part in the email message headers (yes I know 
a stretch but ...).

What do you think?

Chuck Wegrzyn

---

From: Walter Dnes <[email-masked]>
Date: Thu, 10 Jul 2003 06:13:18 -0400

On Tue, Jul 08, 2003 at 07:52:10AM -0400, C. Wegrzyn wrote
> the sender.

  It should be rejected is more appropriate.  In the case of mainsleaze
spammers-in-pinstripe-suits, the sender is using their own MTA.  Most of
the time, however, you have pond-scum using compromised home-users'
machines.

> I might suggest something slightly different: why not have it
> delivered and marked as SPAM in the Subject line? In this way at
> least I can check to see if it really is spam? I'm afraid that if it
> is returned and we have false positives some mail might be returned
> that I do want to see.

  a) Why would I want to wade through 15 megabytes of spam after not
     reading my mail for a few days ?

  b) My inbox may be the *TARGET* of 15 megs of spam, but it can only
     hold 10 megabytes in total... oops.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: "C. Wegrzyn" <[email-masked]>
Date: Thu, 10 Jul 2003 07:47:08 -0400

>     hold 10 megabytes in total... oops.
Because detecting spam isn't exact. I can get the number down - to a 
mere handful - but I know for certain that I have seen email from this 
list be tagged as SPAM on my client. There was some feature in it that 
classified it as spam...until I trained the system I would have lost 
them all or not even known about them.

Chuck Wegrzyn

---

From: Walter Dnes <[email-masked]>
Date: Fri, 11 Jul 2003 06:30:19 -0400

On Thu, Jul 10, 2003 at 07:47:08AM -0400, C. Wegrzyn wrote
> them all...

  Welcome to...

  Walter's 1st (f)law of content-based spam detection;
  You can *NOT* use content-based spam detection against email from a
mailing list that discusses spam.

  Think about it for a minute.  On any spam-discussion mailing list, it
is on topic to show examples of spam.  If a spam-detector is working
properly, it *WILL* detect the spam-samples, and flag the spam-discussion
email as spam.

  Corallary 1
  Content-based spam detection is imperfect, but if you *INSIST* on
using it, the best approach requires that you...
  a) absolutely whitelist any spam-discussion mailing-lists
  b) do *NOT* include emails from spam-discussion mailing-lists in the
     filter's "learning" mode.

  Item a) is obvious.  Item b) becomes obvious with a little thought.
By including the spam-discussion list, and its spam samples, in your
"not-spam" corpus, you pollute the "not-spam" database, and encourage
the filter to accept email that contains spammy content.

  Walter's 2nd (f)law of content-based spam detection;
  Even 100% correct (0% false positives and 0% false negatives) content-
based spam detection that properly flags 14 megabytes of spam and 1
megabyte of non-spam is useless given an inbox with 5 or 10 megabytes of
capacity.

  Think about it for a minute,  If your inbox can hold 5 or 10 megabytes
total, enough spam can fill it up, and cause legitimate email to be
bounced/rejected due to insufficient disk space.

  As you can tell, I use an MTA-based approach that blocks, rather than
accepts-and-tags, email considered to be spam.  In addition to avoiding
the 2 (f)laws of content-based spam detection, it doesn't contribute to
the mailbombing of innocent 3rd parties whose addresses have been forged
spammers.