Re: Email Web of Trust - Defining the metrics

Mark Baugher wrote:

> ...
> Regarding the counters, I think this is something that the entire 
> subgroup needs to participate in and contribute to.  If it were up to 
> me, I would have two classes of counters, one for the mail that the 
> relay flagged as "probably spam" and the second class of counters 
> would be for mail that the user rejected as "spam."  This is probably 
> naive.  And it assumes that there is some authenticated means for a 
> user agent to communicate the disposition of a message to a designated 
> MTA.
>
> There are probably other objects appropriate for an "antispam MIB" 
> that have nothing to do with reputation such as counts of messages 
> labelled as "probably forged."
>
> I'm fine with this if some other people are willing to contribute.  
> Several postings to this thread tell me that several people are at 
> least thinking about this problem.
>
...

Regarding the counters, I would like to see number of messages 
successfully sent and the number of messages successfully received.  My 
observation is that spammers send thousands of messages and receive few 
- normal people receive few messages and send fewer.  So, in my mind, 
the ratio of inbound to outbound messages is telling.  The other nice 
thing about the ratio of inbound to outbound messages is that it yields 
a floating point number which is directly related to the probabilty that 
a messages is spam.  If a given MTA has an outbound to inbound ratio of 
a thousand, then probably, it is a spammer.  If a given MTA has an 
outbound to inbound ratio of 0.5, then it is probably not a spammer.  
The ISP that runs the MTA can look at these numbers himself and, if he 
finds one of his users is spamming, can invoke a contract provision to 
Do Something about it.

It is not clear to me who maintains the SNMP server that holds the 
counters, could somebody please address that question?


Jeff