From: Nathaniel Borenstein <nsb(_at_)guppylake(_dot_)com>
You might be ignorant instead of dishonest.
How very kind of you to consider two possibilities, thank you.
My original words that you felt labelled you dishonest explicitly
included that possibility. Most people have strong opinions about
spam, but have not really looked at it, and are quite wrong about it.
...
(And, by the way, I consider *any* false positives unacceptable if
there's no suitable mechanism for detecting and correcting them.)
That wisdom applies to a lot more than spam defenses.
However, it is worth noting that many and perhaps most email users
value avoiding false negatives more than avoiding false positives in
their spam defenses. That is one reason why the blunt, high false
positive blacklists are popular. One also must not try to reduce false
positives from spam filters much below the error rate of SMTP in the
real world (e.g. not just bounces but blackholes).
This discussion is going nowhere, so I'm going back to more serious
work on comprehensive spam control.
That's fine, but it would be wise to recognize the overall situation
while developing those comprehensive controls. Railing against the
evil conspiracy of big monopolistic ISPs using blacklists against
themselves isn't productive. Except for organizations that run their
own private blacklists, public anti-spam blacklists will remain quite
popular. MAPS used to claim 45% of the Internet used the RBL. I
suspect that at least that much uses the RBL+, CRL, XBL, SBL, and/or
SPEWS. Public blacklists are here to stay, because they work.
The only likely tactic for reducing the use of blunt blacklists such
as those listing dynamic IP addresses is to convince ISPs to take network
abuse seriously. As long as big ISPs make listing their own IP adddresses
"dynamic" lists their main response to their own bad customers, those
blunt, high false positive blacklists will remain popular.
Talk about transition plans to IPv6, comprehensive spam controls,
the evils of NAT, the evils of blacklists, media conglomerate ISPs
distributing NAT boxes to break VoIP, and monopolisitic ISPs using
blacklists is one thing. Actually doing something is something else.
Vernon Schryver vjs(_at_)rhyolite(_dot_)com