spf-discuss
[Top] [All Lists]

Re: how blacklisting will work in the future

2004-01-12 14:13:25
In 
<2A1D4C86842EE14CA9BC80474919782E011132D8(_at_)mou1wnexm02(_dot_)vcorp(_dot_)ad(_dot_)vrsn(_dot_)com>
 "Hallam-Baker, Phillip" <pbaker(_at_)verisign(_dot_)com> writes:

In <20040112200356(_dot_)GB18595(_at_)dumbo(_dot_)pobox(_dot_)com> Meng Weng 
Wong 
<mengwong(_at_)dumbo(_dot_)pobox(_dot_)com> writes:

But if a provider also gives the total mail volume seen, 
you can do a ratio.

Getting accurate mail volumes is A Very Hard Task.

You don't need to be very accurate.

[...]

Even so, orders of magnitude will serve fine for almost all purposes.

I've been active on the spamcop newsgroups/mailing lists for a fair
while now.  SpamCop uses just such a ratio system that is being
described here.  It *does* work reasonably well, but it takes a lot of
effort to keep it working as spammers actively try and destroy it.


As I have mentioned in the post you replied to, there are trivial
cases of sample traffic being off by orders of magnitude.

Senderbase.org says that midwestcs.com sends out a magnitude of 4.0
email per day.   That is off by 3 orders of magnitude.

Koreans will certainly see many orders of magnitude difference in
legitimate email from Korean ISPs than folks here in the US see.


Besides the problems with sampling mentioned above, SpamCop has been
fighting real hard with a much more important issue.  The people who
report spam is not random and not large.  Many of the big spammers
have listwashed many of the anti-spammers and spam traps from their
lists.  According to Julian Haight (founder of SpamCop), many of the
known big spammers have smaller "foot prints" than most two-bit
spammers.  This is a very serious problem for them.



Anyway, when I say that getting accurate mail volumes is A Very Hard
Task, it comes from following this particular issue fairly closely.

It is certainly a hard enough problem that SPF will be just one part
of any reliable RHSBL.  This is an issue that is best left up to
people who run such RHSBLs.


-wayne

-------
Sender Permitted From: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Latest draft at http://spf.pobox.com/draft-mengwong-spf-02.9.4.txt
To unsubscribe, change your address, or temporarily deactivate your 
subscription, 
please go to 
http://v2.listbox.com/member/?listname(_at_)©#«Mo\¯HÝÜîU;±¤Ö¤Íµø?¡