Re: False positives (was Re: [Asrg] Re: RMX Records)

"David F. Skoll" <dfs@roaringpenguin.com> Wed, 05 March 2003 19:55 UTC

Received: from www1.ietf.org (ietf.org [132.151.1.19] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25308 for <asrg-archive@odin.ietf.org>; Wed, 5 Mar 2003 14:55:11 -0500 (EST)
Received: (from mailnull@localhost) by www1.ietf.org (8.11.6/8.11.6) id h25K5oe14952 for asrg-archive@odin.ietf.org; Wed, 5 Mar 2003 15:05:50 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h25K5oO14949 for <asrg-web-archive@optimus.ietf.org>; Wed, 5 Mar 2003 15:05:50 -0500
Received: from www1.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25281 for <asrg-web-archive@ietf.org>; Wed, 5 Mar 2003 14:54:40 -0500 (EST)
Received: from www1.ietf.org (localhost.localdomain [127.0.0.1]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h25K21O14766; Wed, 5 Mar 2003 15:02:01 -0500
Received: from ietf.org (odin.ietf.org [132.151.1.176]) by www1.ietf.org (8.11.6/8.11.6) with ESMTP id h25K1VO14735 for <asrg@optimus.ietf.org>; Wed, 5 Mar 2003 15:01:31 -0500
Received: from ottawa-hs-209-217-122-117.s-ip.magma.ca (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25116 for <asrg@ietf.org>; Wed, 5 Mar 2003 14:50:20 -0500 (EST)
Received: from shishi.roaringpenguin.com (shishi.roaringpenguin.com [192.168.2.3]) by shevy.roaringpenguin.com (8.12.8/8.12.8) with ESMTP id h25JqJBD031802 for <asrg@ietf.org>; Wed, 5 Mar 2003 14:52:19 -0500
From: "David F. Skoll" <dfs@roaringpenguin.com>
To: asrg@ietf.org
Subject: Re: False positives (was Re: [Asrg] Re: RMX Records)
In-Reply-To: <E18qYqt-0003gY-00@mail.nitros9.org>
Message-ID: <Pine.LNX.4.53.0303051448220.4869@shishi.roaringpenguin.com>
References: <E18qYqt-0003gY-00@mail.nitros9.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Sender: asrg-admin@ietf.org
Errors-To: asrg-admin@ietf.org
X-BeenThere: asrg@ietf.org
X-Mailman-Version: 2.0.12
Precedence: bulk
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=unsubscribe>
List-Id: Anti-Spam Research Group - IRTF <asrg.ietf.org>
List-Post: <mailto:asrg@ietf.org>
List-Help: <mailto:asrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/asrg>, <mailto:asrg-request@ietf.org?subject=subscribe>
List-Archive: <https://www1.ietf.org/pipermail/asrg/>
Date: Wed, 05 Mar 2003 14:52:19 -0500

On Wed, 5 Mar 2003, Alan DeKok wrote:

> > Automatic filters will get you so far, maybe up to 90-98% accuracy,
> > depending on which filter you use and what your mail mix looks like.

>   Automatic filters only work if you're not receiving any significant
> amount of spam.

Delegation is the key.  You delegate spam handling down to the level
that minimizes your cost.  It's not cost-effective for a few people to
handle 100K spams.  It's not cost effective for 20,000 end-users to
handle 50 spams each.  It's probably cheapest for 1000 department-level
clerical people to deal with 1,000 spams each.

Note that you cannot eliminate the cost of dealing with spam.  But
you can minimize it.

>   If you're receiving 100K+ spams a day, then the machines to run the
> filters cost a fair amount of money.

Nah.  If you're receiving that kind of mail volume, you have big
machines with under-utilized CPUs anyway.  Content-scanning just uses
up CPU cycles that would be wasted.  Nik Clayton says he filters
2 million messages/day with SpamAssassin; I'd be amazed if fewer
than 100K of those are spam.

>   With the spam volume Chris Lewis is saying Nortel gets, I'd be
> surprised if their infrastructure costs were less than $100K.
> Large companies can afford that.  Small ones can't.

Small companies don't get 100K spams/day.

--
David.
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg