From: "Alan DeKok" <aland(_at_)freeradius(_dot_)org>
One glaring difference in behaviour is volume. But the net isn't
currently set up to even be *aware* of volume.
What about things like the DCC? The fundamental purpose and idea of
the DCC is to measure the volume of mail messages.
That's great, but most of the net isn't running DCC.
It's great for the fraction of the net that is running the DCC. Even more
true than Brad Templeton's observations that spam solutions should not be
100% perfect is the fact that a significant part of the net will never
want or use good spam defenses, not to mention any particular defense.
And notwithstanding my opinions about filters, if most of the net
*did* run something like DCC, we probably wouldn't be in this mess.
Maybe so or not. As others have said, should the DCC or something
similar become seriously popular instead of merely entirely usefully
popular, spammers would pay more attention and more work would be
needed to stay ahead of them.
...
You also said "in such a way as to seriously affect spam". The fact
that all email including spam is a small part of the total bandwidth
used kills the idea of doing much about spam by counting raw bits.
If you assume that you can't distinguish email from any other
traffic, then yes. But I don't think that assumption is true.
You can distinguish most mail from HTTP or other traffic by looking
at TCP headers (exceptions include VPNs), but that's not useful. You
need to distinguish spam. It's not exactly true that "one glaring
difference in [spam] behaviour is volume." Sending 100,000 mail
messages/day is not necessarily spam or otherwise bad. It's not even
remarkable for at least 1000's and probably 10,000's of entirely
reputable, very "anti-spam' outfits.
Vernon Schryver vjs(_at_)rhyolite(_dot_)com
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg