Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks

From: "Peter Kay" <[email-masked]>
Date: Sat, 9 Aug 2003 13:10:29 -1000

Terry,

I'm so grateful we've got a statistician-like brain (yours) on this
list. However, dare I say that your open-ended question below will
prompt only guesses from the many on this that love a good debate but
are oh-so-slow to step up and get some real work done.

So, I say this: you raise a good question.   Lets research it. But lets
not debate it based on " my years and years of using email".

To all: Who will step forward and assist us w/ this research? We've laid
out the rough sketch before. If you want to help, pls let us know. 

But if all we're going to do is debate based on guesses, do it on
slashdot and give us the link.

Peter

> -----Original Message-----
> From: Terry Sullivan [mailto:[email-masked]] 
> Sent: Saturday, August 09, 2003 12:44 PM
> To: [email-masked]
> Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - 
> Titan Key reduces spam attacks
> 
> 
> Two things:
> 
> 1) To the extent that my ignorance of mechanics of 
>    SMTP may have caused a certain... off-topic drift 
>    over the last couple of days, I offer a sincere 
>    apology to the list as a whole.
> 
> 2) I'm still troubled by an anomaly in the notion
>    that 550 -> less spam.
> 
>    All other things being equal, I'm usually the
>    first one on the "We need more data" bandwagon.
>    But it seems to me that there is a very large 
>    base of information (though not true "data") 
>    pertinent to the question and ready-to-hand. 
> 
>    As the 'Net user base has grown over the last, 
>    say, 5-10 years, I daresay that the number of 
>    550s thrown between servers has also grown.  I 
>    would hazard a guess that the number of 550s 
>    has, at the very least, grown as some (unknown) 
>    monotonically-increasing function of the number 
>    of users.  
> 
>    (In the only case for which I have detailed 
>    knowledge, there are at least 10 different email 
>    addresses that legitimately throw a 550 for me, 
>    because I've changed ISPs, left the company, etc.
>    There may be more, but there are at least 10.)
> 
>    Now, for all I know, a 10:1 ratio may very well 
>    be atypical [high or low].  But the thing that
>    keeps buggin' me is this: if there is a robust,
>    substantive inverse relationship between 550s 
>    and spam volume, how has it managed to elude 
>    detection this long, given the sustained growth 
>    in 550s?  (Call me cynical, but I sorta doubt 
>    that it's the result of great QA on those 
>    every-email-address-on-the-planet CDs.)
> 
> (Though I might be wrong...)  :-)
> 
> - Terry
> 
> 
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
> 
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Sun, 10 Aug 2003 01:37:54 +0200

>  not debate it based on " my years and years of using email".

	Hmm.  How would you research something like this?

	Create two e-mail addresses within your domain (e.g., fred@ and 
george@), but one that always results in 550 errors and one that 
accepts the mail (as a honeypot)?  Then wait a year (or three) and 
switch which one bounces and which one accepts?

	Also, I'm a bit confused -- just what exactly would we be 
researching?  Can someone re-formulate this idea into a proposal that 
we can discuss?

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)