Re: limitations of reputation, was Spam sent from compromised

> How good is good enough?
>
> Is there any way to suggest a threshold a spam-fighting technique
> should reach before we as a group (?) would issue a seal of approval?

For me to consider a new anti-spam technique useful, it has to either

1) improve the current situation

or

2) work against changes in spam and/or the email infrastructure.

Ways to deal with spam sent over IPv6 fall into the latter category.

Regarding the former, I think that spam filters are actually doing
really well. The overwhelming majority of spam is blocked before it
reaches the user; false positive rates are relatively low. (Disclaimer:
in my job I measure such things.) I'm not saying things can't be
improved, but improvements will always be small.

Very few spam-filters are based on one Big Idea to stop spam. Many might
be pretty useless against all sorts of spam that could have been sent,
but they're pretty good against the spam that is sent, and are
updated[1] if and when spam changes. That, I think, is what matters.

[1] This tends to happen automatically and in real-time. The 'bulk' part
of spam really works against spammers here.

At the same time, as discussed recently, global spam levels seem have
come down. So I think email is not about to collapse under the amount of
spam that is being sent.

Because of this, I tend to be rather sceptical about new ideas to fight
spam that don't take into account how well we're actually doing
already.

I'm much more inclined to get excited about ideas on how to deal with
spam that is harder to filter including, but not limited to:
- spam sent from compromised accounts (even worse: to people in the
address book);
- spam that is more targeted and (therefore) sent in lower volumes;
- 'bacn' [2].

[2] I hadn't seen this term used in years, but the BBC wrote about it
the other day: http://www.bbc.co.uk/news/technology-21830739 It's
definitely a problem.

Martijn.

PS I make various implicit or explicit claims in this email. They may be
wrong. This is a research group: if you think I'm wrong, prove that that
is the case, or challenge me to prove that I'm right.

________________________________

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.
-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org