On Thu, 6 Mar 2003, Clayton, Nik [IT] wrote:
Many of the suggestions and proposals are acknowledged as taking years
before they're widely deployed.
Right. It's a research group, so the view is long-term. However, I am
pessimistic that the necessary infrastructure changes will take place
within two decades, or indeed ever.
IPv6 has been around for five years. It hasn't penetrated to any extent.
IPSec has been around for eight years, and is not widely used. PGP
has been around for ages, and hardly anyone signs or encrypts e-mail.
At the same time, MUAs are getting smarter. In particular, the presence
of language classifiers (Bayes, et al) in desktop-user (as opposed to
technical-user) MUAs is likely to become much more prevalent over the next
few years.
By the time spam hits the MUA, you've paid a significant cost of the
spam burden.
As soon as these become widely deployed, and the majority of recipients
have filters that are so customised that it's nigh-on-impossible for a
spammer to guarantee that their e-mail will get through, doesn't spamming
then become so uneconomical as to die out?
Paper-mail advertisers pay money for their campaigns, and are happy with
a very low response rate. As long as spamming costs the spammer next
to nothing, even a minuscule response rate makes it worthwhile.
And it's pretty easy to defeat filters if you're determined enough,
even Bayesian ones. Coming up with ways to do this is left as an
exercise for the reader. Let me rephrase that: Cominge upp withe
wayse too du thiss iz leftt az an xrcize four thuh reeder.
Creative mis-spelling will either pass undetected through Bayesian
filters (the first time) or can be used to grow the Bayesian databases
to unmanageable sizes. Even smart filters that prune out mis-spelled
words can be attacked by sending random stuff out of /usr/dict/words.
(Not to say that filters are useless; on the contrary, they're very
valuable. They catch the majority of spam that is unsophisticated.)
--
David.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg