Subject: Re: [Asrg] A response to the critique of my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Mon, 13 Dec 2004 13:47:23 -0500

I admit that my knowledge of mail systems is finite, and I am not sure what you mean by "accepted," but this is how I envision current mail systems function as compared to my system:

Current mail systems
Email arrives at the server and white listed email is passed on to the recipients inbox, everything else is passed through a filter >>> A strong filter removes 99% of spam and on a rare occasion a legitimate email.  The filtered spam is either discarded or sent to a bulk mail folder >>> Everything that escapes the filter arrives in the recipients inbox.

My system
Email arrives at the server and white listed email and email that contains a valid sub-address is passed on to the recipients inbox, everything else is passed through a filter >>> A weak filter removes 95% of spam and on an extremely rare occasion a legitimate email.  The filtered spam is discarded >>> A bounce is sent out to the 5% of email that made it through the filter.

Would everyone agree that this is more or less correct?  My system does not require that all email be accepted any more than current email systems.  If your current email system uses a bulk email folder than in actuality your current system is 'accepting everything.'

Sincerely,
Michael Kaplan

> 
> On 13/12/04 11:07 -0500, Michael Kaplan wrote:
> > "The problem with the bounces does not involve the small number of
> > bounces sent in response to emails from legitimate senders who are not
> > on the white list and who used a deactivated sub-address.  The real
> > problem will be with the bounces that are sent in response to the hoard
> > of spam that is being sent using a deactivated sub-address (or with no
> > sub-address at all).
> >
> > All emails that would have generated bounces are first sent through a
> > weak spam filter (meaning one that will almost never generate a false
> > positive).  Let's say that this weak filter identifies 95% of these
> > emails as unambiguously being spam.  Bounces are now generated only to
> > the remaining 5% of emails.  Now this system can only increase a network's
> > traffic up to 5%.  This small increase in traffic should be quite
> > tolerable.  We have also dramatically decreased the number of innocent
> 
> http://nixcartel.org/~devdas/minute.png
> 
> 5% you say? Note that you require all that mail to be accepted in the
> first place.
> 
> Devdas Bhagat
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg

-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Devdas Bhagat <[email-masked]>
Date: Tue, 14 Dec 2004 00:26:48 +0530

On 13/12/04 13:47 -0500, Michael Kaplan wrote:
> Email arrives at the server and white listed email is passed on to the
> recipients inbox, everything else is passed through a filter >>> A strong
> filter removes 99% of spam and on a rare occasion a legitimate email. 
> The filtered spam is either discarded or sent to a bulk mail folder
> >>> Everything that escapes the filter arrives in the recipients inbox.
> 
God no. This approach doesn't scale to reducing spam at high volumes.
You start by filtering out stuff in the SMTP transaction. (Bad HELO/EHLO
names, syntax errors, greeting as the IP of the SMTP server, non
existing recipients). Then you allow whitelisted hosts through.
Then you check against DNSBLs and local IP blacklists and local sender
address and domain based blacklists.
Additionally, you may check for message lines which indicate malicious
content (attachments ending in .exe, .vbs, .hta, etc which generally
indicate malware).
Only mail that goes through this can hit the per user
whitelist/blacklist.

There are usually multiple levels of whitelists and blacklists, and the
global ones are usually dominant over the per user configs.

Only after 90%+ of the crap is rejected at the edge are you looking at
possible bulk mail filtering by content (UBE is about consent, not
content).

Devdas Bhagat

---

From: "David Wall" <[email-masked]>
Date: Mon, 13 Dec 2004 11:11:38 -0800

By accepted he means that your SMTP server will have received all the email
sent to it.

----- Original Message ----- 
From: "Michael Kaplan" <[email-masked]>
To: "Devdas Bhagat" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, December 13, 2004 10:47 AM
Subject: Re: [Asrg] A response to the critique of my anti-spam system

> I admit that my knowledge of mail systems is finite, and I am not sure
what you mean by "accepted," but this is how I envision current mail systems
recipients inbox, everything else is passed through a filter >>> A strong
filter removes 99% of spam and on a rare occasion a legitimate email.  The
filtered spam is either discarded or sent to a bulk mail folder >>>
Everything that escapes the filter arrives in the recipients inbox.
>
> My system
> Email arrives at the server and white listed email and email that contains
a valid sub-address is passed on to the recipients inbox, everything else is
passed through a filter >>> A weak filter removes 95% of spam and on an
extremely rare occasion a legitimate email.  The filtered spam is discarded
>>> A bounce is sent out to the 5% of email that made it through the filter.
>
> Would everyone agree that this is more or less correct?  My system does
not require that all email be accepted any more than current email systems.
If your current email system uses a bulk email folder than in actuality your
current system is 'accepting everything.'