False positives (was Re: [Asrg] Re: RMX Records)

"David F. Skoll" <dfs@roaringpenguin.com> Wed, 05 March 2003 02:46 UTC

Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA19676 for <asrg-archive@odin.ietf.org>; Tue, 4 Mar 2003 21:46:12 -0500 (EST)
Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h252uvI04144 for asrg-archive@odin.ietf.org; Tue, 4 Mar 2003 21:56:57 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h252uv504141 for <asrg-web-archive@optimus.ietf.org>; Tue, 4 Mar 2003 21:56:57 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA19647; Tue, 4 Mar 2003 21:45:41 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h252u2504122; Tue, 4 Mar 2003 21:56:02 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h252tl504107 for <asrg@optimus.ietf.org>; Tue, 4 Mar 2003 21:55:47 -0500
Received: from ottawa-hs-209-217-122-117.s-ip.magma.ca (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA19615 for <asrg@ietf.org>; Tue, 4 Mar 2003 21:44:30 -0500 (EST)
Received: from shishi.roaringpenguin.com (shishi.roaringpenguin.com [192.168.2.3]) by shevy.roaringpenguin.com (8.12.8/8.12.8) with ESMTP id h252kXBD025637 for <asrg@ietf.org>; Tue, 4 Mar 2003 21:46:33 -0500
From: "David F. Skoll" <dfs@roaringpenguin.com>
To: asrg@ietf.org
Subject: False positives (was Re: [Asrg] Re: RMX Records)
In-Reply-To: <E18qJqx-0003Lt-00@mail.nitros9.org>
Message-ID: <Pine.LNX.4.53.0303042143080.2979@shishi.roaringpenguin.com>
References: <E18qJqx-0003Lt-00@mail.nitros9.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=unsubscribe>
List-Id: Anti-Spam Research Group - IRTF <asrg.ietf.org>
List-Post: <mailto:asrg@ietf.org>
List-Help: <mailto:asrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=subscribe>
List-Archive: <https://www1.ietf.org/pipermail/asrg/>
Date: Tue, 04 Mar 2003 21:46:33 -0500

On Tue, 4 Mar 2003, Alan DeKok wrote:

>   If my ISP is under serious attack from spammers, then some level of
> "good" mail will probably be thrown out with the spam.  The only way I
> know of to guarantee that no "good" mail is thrown out, is to not
> throw out *any* mail.

Or to have a human sort it out.

>   We have to decide what level of spam we can live with, and what
> level of false positives we can live with in anti-spam filters.  If
> lowering the false positive rate by 2% increases the amount of spam by
> 10x, then that solution doesn't scale.

Yes, but the "we" in "we have to decide" should be we, the end users,
not some ISP.

Automatic filters will get you so far, maybe up to 90-98% accuracy,
depending on which filter you use and what your mail mix looks like.
But they do run out of gas, and if you can't accept false positives,
then the only solution is human sorting.  You just have to figure out
(1) how to do the human sorting as cheaply as possible, and (2) how
much you're willing to pay for human sorting.  That determines the
filter settings you use.

--
David.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg