Subject: Re: [Asrg] spamstones

From: [email-masked]
Date: Tue, 1 Apr 2003 14:34:42 -0500

Need HAM:

After we settle on definitions, the main missing ingredient is a good
HAM corpus attached to similarly-sampled SPAM.  Multi-language ham is
especially needed (I know SpamAssassin team has issued a call for it,
don't know if it will arrive.)

Need SNAPSHOTS:

In addition, time-indexed snapshots of external sources of information
(RBLs, DCC, Razor, etc) would be helpful as well.  Does anyone know
whether the operators of those retain any historical data?

I have been accumulating some of both, I'm not sure whether I'll publish
it yet, or in what form (blinded or clear).  Unfortunately I have very
little non-English ham, so my learning classifiers always lump all
Chinese, Portugese, and Turkish text into the spam category.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Tue, 01 Apr 2003 13:35:39 -0800

> don't know if it will arrive.)

You do know about the SpamAssassin public corpus, right?
http://SpamAssassin.org/publiccorpus/  .  It's a reasonably large
collection of ham and spam from the same accounts, as of late 2002.

--j.

---

From: Liudvikas Bukys <[email-masked]>
Date: Tue, 01 Apr 2003 17:06:51 -0500

Oops, somehow I'd had the idea that all of the ham for
SpamAssassin was private (which was why you had everyone
run their own mass-check genetic algorithm).  Obviously
I was wrong.  I hope you've had good non-English submissions
lately.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 1 Apr 2003 15:34:33 -0700 (MST)

> From: [email-masked]

> ...

Since we can't define "spam," could we please avoid other cute words?
Every time I see "ham" I wonder if it was intended to mean "not-spam,"
"known to be valuable mail," "solicited bulk mail," or something else.
When "ham" is intended to mean "not-spam," please don't compound the
ambiguity by saying something other than "not-spam."

> whether the operators of those retain any historical data?

I disagree.  Historical samples of spam (whatever that is) and not-spam
(ditto) are almost useless after 6 months except to historians unless
you have very modest filtering ambitions.  You need current and future
spam, not what Spamford was sending 7 years ago.

Anyone who wants current or historical spam samples (for spam=whatever
recipients think is spam) can check the Google archives of
news.admin.net-abuse.email or the nearest spool directory.

> Chinese, Portugese, and Turkish text into the spam category.

Thanks to someone at an ISP using the DCC in a country where Spanish
is the native language, the DCC knows enough Spanish for its purposes.
I think anyone with similar problems should do the equivalent.
If you don't have a very good idiomatic command of the language, it
is difficult be certain that a given message is probably unsolicited
bulk email or whatever you define as spam.

I don't see how the operators of DNS blacklists could have any samples
of spam except their own.  Only IP addresses go over the net from
clients to their systems.  A major design goal of the DCC is that
nothing that can be readily converted to mail contents is sent over
the wire, and so DCC users have only their own archives.  I assume
something similar applies to Razor/Pyzor/Cloudmark.  In theory you
might have better luck talking to Postini or Brightmail, but I bet in
practice they consider their archives proprietary as well as secret to
protect the privacy of spam targets and spam senders.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Tue, 01 Apr 2003 15:20:47 -0800

> I was wrong.  I hope you've had good non-English submissions

It generally *is* private -- this is just a small subset that I manually
ensured public availabilty was OK for. ;)

The particular idea behind this collection is to allow comparison of
spam-checking software and techniques, using a "known good" set of mail
that everyone can use and get hold of, with all headers intact (modulo a
minimal amount of address rewriting).

We're still working on the non-English submissions though ;)

--j.

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 3 Apr 2003 16:22:24 -0500

>don't know if it will arrive.)

Just a point.  This process works for testing content classification 
systems.  It's lousy for header analysis.  In the first place, 
archives almost always elide the recipient's address--which we need 
to examine the email's path throught the network.  And secondly, the 
older the message, the more inaccurate any of the IP address 
information is.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg