Re: thoughts on spam

["Jason R. Mastaler" <jason-dated-1005548417.48bbb7@mastaler.com>]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:

> Whitelists have their own risks that I would rather not have to deal
> with at the delivery level.  For example, I post something to a
> mailing list, someone wants clarification about that thing and would
> prefer not to discuss it on the list.  His mail bounces because he
> is not in my whitelist.  Sure, he gets a note saying, "here is how
> to get on Rat's whitelist."  That is a pain in the ass, plain and
> simple.

This is exactly what TMDA's 'dated' addresses are for.  You control
when they expire, and within that interval, anyone can contact you at
that address.  I've found that with my whitelist and using 'dated'
addresses on mailing lists and USENET, very few people actually end up
having to confirm messages.  Confirmation involves the 2-click/key
sequence of replying to a message, and it's only a one time ordeal for
them anyway.  Hardly a pain in the ass IMO.

> Whitelists do not scale well at all, which is why SpamCop is moving
> away from a whitelist/blacklist scheme to an heuristic scheme that
> they have found blocks more spam with fewer false positives than the
> combined white and black lists.

First, SpamCop is different in that they use global lists which end up
much larger than TMDA's per-user lists.  With wildcard expressions and
DBM/CDB support, scalability is not much of a problem anyway, even
with fairly large lists.  Second, as explained on the homepage, TMDA
is "whitelist-centric" which means use of a blacklist is downplayed in
favour of the whitelist.  Whitelists are generally much smaller than
blacklists.

I don't know all the details about the SpamCop decision, but I really
don't see how any heuristic could be more effective than what I'm
doing now.  (I've already mentioned how many SPAMs I now get).  Using
heuristics puts you right back into that "race condition" with the
spammers.  Spam software implementors are just as clever and motivated
as we are.

As far as false positives, I've not had yet (in over 6 months) had
one, and I'm sure any TMDA will tell you the same.  Unnecessary
complexity is what gets you into trouble in that area.  TMDA's
methodology is very simple, which I think is its greatest strength.