From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <5019caffe3f10e82a2ee6ccadc5f1733@yourdomain.dom>
From: steve.simon@snellwilcox.com
To: 9fans@cse.psu.edu
Subject: Re: [9fans] re: spam filtering fs
In-Reply-To: <1270037699@snellwilcox.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="upas-idlufgsmkpbrqkempqehjvzxlp"
Date: Mon,  1 Sep 2003 16:45:33 +0100
Topicbox-Message-UUID: 2838ccb2-eacc-11e9-9e20-41e7f4b1d025

This is a multi-part message in MIME format.
--upas-idlufgsmkpbrqkempqehjvzxlp
Content-Disposition: inline
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

Markov chains are the next generation of spam filtering tools
(some of the GPLed tools already do this).

It involves keeping frequencies for token sequences rather than just
individual tokens. It makes the spammers job a lot harder, though
not impossible. The downside is the increase in filters database size
as the number of tokens increases exponentially with chain length.

It all comes down to making the filters model of written emails have more
parameters and being more accurate than the spammers until in the limit
the spam email looks like a valid one (IE. it contains usefull information :-)

-Steve
--upas-idlufgsmkpbrqkempqehjvzxlp
Content-Type: message/rfc822
Content-Disposition: inline

Date: Mon, 01 Sep 2003 21:31:16 +0100
To: 9fans@cse.psu.edu
bcc: "Steve Simon" <steve.simon@snellwilcox.com>
From: 9fans@cse.psu.edu
Sender: 9fans@cse.psu.edu
Reply-To: 9fans@cse.psu.edu
Importance: normal
Priority: normal
Subject: [9fans] re: spam filtering fs
Message-Id: <1270037699@snellwilcox.com>
X-MIME-Engine: v0.90
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Id: <1270037699-1@snellwilcox.com>
Content-Transfer-Encoding: quoted-printable

in light of recent forged To: & From:
the challenge/response method is going to generate twice as much traffic fo=
r such a mail.

As far as I can tell, without trying it, the example pipeto sends a copy of=
 the message, virus payload and all to whoever the From: headers suggest, o=
bviating the need to infect the plan9 host to spread itself.

You also run the risk of ending up sending to an infected host and throwing=
 your email address into another steaming pot.

The next generation will snarf text from existing mails with the intention =
of defeating Bayes type filters.




--upas-idlufgsmkpbrqkempqehjvzxlp--