Re: An Anti-Spam Heuristic

On Dec 13, 2012, at 2:52 PM, Barry Shein <[email protected]> wrote:

> 
> On December 13, 2012 at 09:21 [email protected] (Michael Thomas) wrote:
>> On 12/13/2012 09:16 AM, Barry Shein wrote:
>>> There's also Jef Poskanzer's greymilter which basically requires one
>>> re-send from each never before seen mail server not in a white list.
>>> 
>>> And sendmail (and others') HELO delay (delay sending HELO a short
>>> period of time) and don't speak until you're spoken to whatever they
>>> call it (I use it, the sender must wait for the SMTP responses, can't
>>> just dump an SMTP conversation at you.)
>>> 
>>> They're basically isomorphic to hashcash type solutions, increase the
>>> sender's cost, but very transparent and quite clever because of that.
>>> 
>> Given botnets, anything that tries to shift burden back onto the
>> sender is not very likely to be effective in the long run. Yes, you
>> might get some short term relief, but the firehose is just a software
>> update away.
> 
> Has this been measured (reference)? Or is this just one of those
> "truisms" that kick around here?
> 
> I'm thinking that a spammer has to put out on the order of a billion
> messages (attempts) per day to be interesting.
> 
> If you slowed those down that would be a blow to them, a billion times
> even a little is a lot.

The cost to spammers using almost free, botted systems is always going
to be a lot lower than the cost to legitimate senders using expensive,
well managed systems.

Anything you do to make sending mail more expensive that isn't
pretty good at differentiating between legitimate and illegitimate
senders is going to harm legitimate senders disproportionately.

You can buy a rooted asian box for <$5. ESP-grade MTAs and
management systems can be up in the tens of K per box - so
if you double the average delivery latency then you've cost the
spammer $5 and the legitimate sender $5000. That doesn't work.

Cheers,
  Steve