Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article

From: Paul Judge <[email-masked]>
Date: Wed, 13 Aug 2003 11:07:49 -0400

> -----Original Message-----
> From: Brad Knowles [mailto:[email-masked]] 

> 
> 	I am curious -- is there a reason why you tested with a much 
> larger spam archive than your ham archive?

In general, it is difficult to gather a large public ham archive. You
personally have a large ham archive, but chances are that you're not willing
to post it on a public ftp site.

This is a common problem. The question is how can you perform the analysis
in the face of such conditions. There are a few of routes: 

1) Continue to try to persuade people to provide their ham. You end up
getting a subset of the available ham, because people hand-pick stuff.
However, perhaps with a wide enough campaign, you're able to collect a
sufficient amount of information.
2) Provide the analysis tools to the users to run directly on their
mailboxes eliminating the need for collecting their ham.
3) Create tools that sufficiently anonymize the ham so that people are
comfortable submitting it. There is similar work being done in other areas
of networking. One of the difficulties here is anonymizing the data while
preserving the relevant relationships within the data.

Each of these paths is worth pursuing. Anyone out there currently looking
into these or interested in doing so?

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Wed, 13 Aug 2003 17:55:41 +0200

>  preserving the relevant relationships within the data.

	In terms of analyzing black list performance, all we need is the 
IP address(es) found in the headers of the message.  Everything else 
is superfluous, and indeed gets in our way.

	That should be sufficiently anonymous that there shouldn't be any 
problem with people being willing to share that information.  Or, so 
I would think.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)