RE: [Asrg] Re: Spam send/receive ratio

["Chris" <asrg at rebel.com.au>]

> > No what I was saying is that using the statistics of mail
> volume to try and
> > pinpoint a spammer is a bogus test.
>
>   When used alone.  I never said it should be used alone.  In fact, I
> said the exact opposite.

I never said you did. alone its useless, combined with other "triggers" its
still useless.
All I said is that no matter how it is used "Mail Volume" is unreliable to
the point it should not be considered.

Perhaps you could quieten this critic if you explain how Mail Volume can be
used to *reliably* detect spam.
I have tried my best to explain why it would fail. surely a counter point is
required at this stage.

Anti Spam systems that chuck out the baby with the bathwater should not be
considered as acceptable(IMHO).

As a mail user I would prefer to skim through a few spam mails KNOWING I
haven't lost anything important, than getting no spam and missing out on a
vital business/personal message.

You include another example V*gra

If you were a medical student discussing some of the finer points of V*gra
with a collegue, would you not wish for your mail to go through. or should
the word be censored from this moment forward.


Chris



> -----Original Message-----
> From: asrg-admin at ietf.org [mailto:asrg-admin at ietf.org]On Behalf Of Alan
> DeKok
> Sent: Saturday, 22 May 2004 10:09 PM
> To: asrg at ietf.org
> Subject: Re: [Asrg] Re: Spam send/receive ratio
>
>
> "Chris" <asrg at rebel.com.au> wrote:
> > No what I was saying is that using the statistics of mail
> volume to try and
> > pinpoint a spammer is a bogus test.
>
>   When used alone.  I never said it should be used alone.  In fact, I
> said the exact opposite.
>
> > Now your good intentioned MTA say "hey I got mail from xyz,
> I'll check his
> > volumes". and it comes up with "normal volume = 20, last hours volume =
> > 5000". "Ooops" the MTA says "Spammer alert" and tosses my email.
>
>   Then it's not "my good intentioned MTA".  It's an MTA you invented
> by explicitly ignoring my statements about how MTA's should deal with
> high-volume spam.  I hate it when people read my messages, and
> conclude that I believe the exact opposite of what I've said.
>
>   Can you please explain why you're arguing that I believe high-volume
> to be a near-perfect indicator of spam?  I just can't understand how
> you come to that decision.
>
> > Perhaps it also looked for other statistically telltale clues such
> > as an embedded URL and/or a perhaps the words '/special.*price/' and
> > combined with the sudden high volume it decides 'spam!'.
>
>   If an MTA decides that a message is spam, that's it's perogative.
>
>   In this (badly defined, hypothetical) case, I could agree that the
> "spam" determination is probably not the bes thing to do.
>
> > My argument is simple. Mail Volumes can *in no way* be used to indicate
> > spam. it is simply flawed logic.
>
>   By the same argument, the word "v**gr*" cannot be used to indicate
> spam, because normal people use it in normal messages.
>
>   The reality is different.  Keywords are strongly correlated with
> "spamminess" of a message.  But they're not perfectly correlated.
> Similarly, suddenly receiving a high volume of mail from a host which
> usually sneds low-volume traffic is strongly correlated with spam from
> zombied machines, or a new account buy a spammer, etc.  See the ASRG
> archives for ISP admins discussion of this exact scenario.
>
> > Again to return to the Tattoo 'statistic'. Imagine a Judge in a
> murder trial
> > telling the jury that statistically more murderers have
> tattoos.  and as the
> > defendant has a tattoo he is more likely to be the murderer.
>
>   The first statement may be correct.  The second does not follow from
> the first.  You are arguing from flawed logic.  I tried to explain why
> in my previous message, and it looks like I failed to communicate.
>
>   Please read books by Marilyn Vos Savant on logic, or Jon Paulos
> Allen.
>
>   I suggest:
>
> http://www.amazon.com/exec/obidos/tg/detail/-/0679726012/102-93211
11-1748922?v=glance
http://www.alibris.com/search/search.cfm?qwork=5268032&matches=21&qsort=r

> The statistic may be absolutely correct,

  There is no statistic in your argument.  There is simply flawed
logic.  Correlation does not imply causation.

  Alan DeKok.

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg


_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg