Re: Limitations of filters (was Re: [Asrg] Do we need to do anything?)

["Chris Lewis" <clewis@nortelnetworks.com>]

David F. Skoll wrote:
> On Thu, 6 Mar 2003, wayne wrote:
> David Skoll:
> > > By the time spam hits the MUA, you've paid a significant cost of the
> > > spam burden.
> > I strongly disagree with this.
> You don't run a busy mail server.
I do.  In the vast majority of cases[*], spam volumes are within the 
"breathing room" you should engineer into your mail system.  Yes, it 
forces you to upgrade earlier, but in the scheme of things it's swamped 
by the end-user issues.

For budgeting of anti-spam, we completely disregard the cost savings in 
the infrastructure due to reduced volume, because of this factor, and 
instead come up with a productivity loss cost.

As a benchmark, we use an average of one minute per spam that hits the 
end-user.  That seems absurdly high[+], but once you factor in the 
unusual events (Corporate Security investigations, management chain 
uproars, people unable to cope with being bombarded with _extremely_ 
offensive spam and being unable to focus on work for a day or two, 
popups, mailer freezeups, and even the occasional reconstruction of a 
box), it's stood the test of time.

That works out to (after fudging and rounding of numbers, without 
revealing our LLR) a buck each in rough numbers.

$50,000 worth of productivity saved per day buys a lot more hardware and 
bandwidth than is needed to carry the spam.

[*] Of course there are exceptions.  Striker for example.  Or, if we 
were still trying to conduct business with our spamtrap domains.  Your 
bandwidth would be 80% or higher (99.9999% in the case of striker) for 
spam alone.  This may also be true of places like AOL (one billion spams 
in a day.  Yow!)

[+] Some anti-spam vendors are using a figure of 10-15 seconds each.

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg