Re: limitations of reputation, was Spam sent from compromised

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In message <[email protected]>, Steve
Atkins <[email protected]> writes

>I might expand it to
>
>1. Types of spam etc it might stop
>  Types of wanted mail it might stop
>  Types of unwanted mail it might stop
>
>2. How much it might stop
>  How much wanted mail it might stop
>  How much unwanted mail it might stop

I'd suggest it's more complicated than that ...

>It's the effectiveness of approaches when they're applied together
>that's interesting

exactly so.

When I looked at the impact of the McColo shutdown in 2008 I found that

     "any system that depended solely on the use of blacklists would
     have seen a lower percentage reduction than if content filtering
     was used. Similarly, discarding email to invalid destinations
     became a far less effective way of reducing the load on spam
     filtering machines once the botnets were disabled"

        http://www.cl.cam.ac.uk/~rnc1/mccolo.pdf

viz: if one merely finds another way of detecting (or suppressing) the
same spam then one has not moved forward.

Another way of looking at it is that 15 years of environmental pressure
on spam has caused it to evolve to make it harder than ever to detect;
and creating subtle new pressures may not make any practical impact.

- -=-=-=-

BTW: some irony here, an earlier contribution to this conversation was
blocked by a simple-minded "I hate everything from that IP" filter
operated by this list's owner -- he's whitelisted me now, but other
users of the same ISP as myself may not be so lucky :(

[[... this is in fact the second time I've sent this second contribution
(the first contribution is too stale now to be useful). It turned out
that the whitelisting was imperfect, and I was still blocked.]]

- -- 
Dr Richard Clayton                         <[email protected]>
                                  tel: 01223 763570, mobile: 07887 794090
                    Computer Laboratory, University of Cambridge, CB3 0FD


-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBUU86+uINNVchEYfiEQJKUgCg72acxCIypC6tRlicgBSWIusfXpYAn0DP
5f9FEUZ6mNghgwzrlKlEPH01
=ms4X
-----END PGP SIGNATURE-----

-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org