Re: [Asrg] An "ideal" false positive (TMGRS take 2)

[Rich Kulawiec <[e-mail]>]

On Thu, Jan 28, 2010 at 07:04:42PM +0100, Alessandro Vesely wrote:
> Alice reports as spam a message from Bob, either by mistake or out
> of curiosity. 

But there is no way to know that Alice actually filed the report
or that Bob actually sent the message.

If either Alice's or Bob's system is a zombie, which -- if they're
running Windows -- already has a two-digit percentage probability which
has been monotonically increasing for most of a decade -- then there is
no way for any external observer to distinguish between:

	- Alice pushed the report-as-spam button
	- Malware resident on Alice's system pushed the report-as-spam button

Nor is there any way for any external observer to distinguish between:

	- Bob sent the message
	- Malware resident on Bob's system sent the message

We already know that the latter case happens billions of times a day
(at least) on hundreds of millions of systems.  There is no reason
to think that the former won't happen too, if report-as-spam buttons
become ubiquitous/standardized, and every reason to think it *will* happen.

There are even some reasons to think it has already happened.

Let me also note in passing that there is no way for any external
observer to distinguish between:

	- Alice did not push the report-as-spam button
	- Alice pushed the report-as-spam button, but malware
		resident on Alice's system intercepted the push,
		prevented the information from being transmitted,
		yet told Alice that it had been sent

My point being that even if we accept that users are reliable classifiers
of spam/not-spam (and I've already expressed in another thread that I
think they're utterly incompetent, but let's ignore that for now) there
is no way to know that apparently-user-originated input via such a mechanism
is in fact user-originated.  There are at minimum 100M zombies out there
(lesser estimates should be laughed out of the room) and more every minute.
I see no reason -- at the moment -- why that number won't steadily continue
to increase over the next several years, which is as far as my crystal ball
will let me see. ;-)  Given that, setting up a mechanism that spammers and
other abusers can co-opt for their own purposes *at will* appears to me
to be a pointless exercise.

---Rsk