Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces spam attacks

From: "Tom Thomson" <[email-masked]>
Date: Fri, 1 Aug 2003 10:43:01 +0100

MessageI didn't intend "ropy" to mean anything more than "layman" or
"amateur", I'm sorry if you took as meaning something I didn't intend.

I'm afraid I can't honestly call myself a statistician as it's getting on
for 40 years since I did any academic statistics and although I have used it
sporadically since I'm not really competent any more.

Comparing against addresses with similar prior exposure using different
anti-spam techniques would be very useful.  As there's no clear upward trend
in the data, I suspect Titan Key is actually doing something useful.
However, behavioue for addresses with no current exposure is only one
measure of an anti-spam system; nehaviour for addresses that have ongoing
current exposure (displayed on websites, listed in directories, used for
posting to bitnet mail lists and usenet news groups) is also important and
may be very different.

I think if you graph your data using 7 day and 14 day moving averages you
will be able to see more clearly what is happening - the avegaing eliminates
a lot of the "noise" of day to day fluctuations.

Looking at your data, the way I would describe it is that it started out at
bit under 40, rose fairly quickly over a couple of weeks to about 50 where
it remained fairly steady for a few weeks, then fell over a couple of weeks
to about 35, where it was steady for a short time but soon began a slow rise
to a bit over 40 and has been pretty stable at that level since. It may be
about to turn down again, or turn up again, or stay fairly stable where it
is - but where it is now is a little higher than where it started, not a
little lower. On that kind of performance I wouldn't want to predict a long
term trend - the envelope may be periodic with a period slightly longer than
we have data for (a fairly long term average has gone up and down and up
again , which may be noise or may be an indication of a cycle) so fitting a
straight line to the data is not productive.

I don't have other unexposed addresses to compare your data with; highly
exposed adresses without something like Titan Key have (in my experience at
least) strong upward spam trends, but there's no knowing on what data I have
whether that's an effect of Titan key or an effect of the different
exposures.

Anyway, keep up the good work - all data is useful if we want to understand
the effects of various anti-spam measures.

Tom

  -----Original Message-----
  From: Peter Kay [mailto:[email-masked]]
  Sent: 31 July 2003 21:07
  To: Tom Thomson; [email-masked]
  Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces
spam attacks

  if you discard days 94 and 106 there is still a downward trend. Now, let
me be the first to raise my hand to say I'm not a statistician. So perhaps
your application of "ropy" might be more accurately expressed as "layman".
  But the numbers are there for everyone to see. And please, if there's
someone here who can honestly call themselves a statistician please step
forward and lend us your wisdom.

  The trend is either up, flat, or down. According to the linear regression
trendline, the trend is down. If there is a statistical definition of
"significant" then of course lets apply it. But if we're going to apply it
then lets also apply this trend against ANYONE elses trend that is not using
Titan Key.

  And then decide if one using a Titan Key email address reduces their spam
over time vs. someone that uses any other anti-spam approach.

  Peter

    -----Original Message-----
    From: Tom Thomson [mailto:[email-masked]]
    Sent: Thursday, July 31, 2003 9:19 AM
    To: Peter Kay; [email-masked]
    Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key
reduces spam attacks

    eems to me that you have done some pretty ropy analysis.

    did you discard the obviously anomalous outlier at day 106?

    I did some quick analysis after discarding day 94 and day 106.
Conclusion: no significant trend.  There may be a slight tren for the counts
to increase, but it certainly isn't something I would bet on from this data.
I certainly wouldn't claim a decreasing trend.

    Tom

      -----Original Message-----
      From: [email-masked] [mailto:[email-masked]]On Behalf Of
Peter Kay
      Sent: 31 July 2003 19:32
      To: [email-masked]
      Subject: [Asrg] 2.a.1 Analysis of Actual Spam Data - Titan Key reduces
spam attacks

      I've posted an updated log file analysis of spam sent to
[email-masked] which is an old email address of mine that is still
in use but under the protection of The Titan Key.

      that log file is at: http://www.titankey.com/misc/logs/logPK.xls

      We're happy to report that with about 100 days of analysis, the trend
of spam attacks to this email address is DOWN.  To our knowledge this is the
only anti-spam software that has demonstrated this capability.

      As we've mentioned before, our technology responds with a 550 no such
user after analyzing the MAIL FROM and RCPT TO against a consent database.
This has the dual benefit of saving bandwidth (email contents are never
sent) and, as shown above, reducing the attacks over time.

      Peter

---

From: "Terry Sullivan" <[email-masked]>
Date: Fri, 01 Aug 2003 15:32:28 -0500

(Oh boy, for my first posting to the list, I get to help stir up 
controversy.)

Hello all...

For my money, there are two disjoint issues here that have sorta 
gotten co-mingled in the discussion:

- statistical power

- absence of control condition

Statistically pedantic point: the number of observations in a sample 
influences the magnitude of the effect that can be detected 
analytically--nothing more, nothing less.  Statistical power 
increases monotonically with sample size.  More data are often handy, 
but a relatively small sample can be used successfully to detect very 
large statistical effects.  (Tangential statistically pedantic point: 
with the exception of 0.0, the slope of a regression line is utterly 
uninformative.)

The thing that precludes any legitimate causal inference with these 
data is the absence of a control condition.  But that's an issue of 
logic, not statistical power.  Observing a correlation is a great way 
to generate testable hypotheses; but a tenable claim of causality 
requires actually testing those hypotheses.

I confess that I've not seen these data.  (The .xls file hoses my 
non-Microsoft spreadsheet, and a platform-neutral format is 
unavailable.)  But seeing/not seeing these data doesn't make the 
causal claim viable.  In point of fact, my logs shows a measurable 
downward trend in total spam received since I installed my latest new 
filtering widget.  I am absolutely confident, however, that my 
filtering widget did not *cause* that decline.  It's just a happy 
coincidence.  

On a more philosophical note, I can't help but suspect that 
daily/weekly spam volume is simply way too "noisy" to serve as a 
meaningful standalone measure of anything.  There are just too many 
uncontrolled variables at play.  I've seen short-term longitudinal 
fluctuations in spam volume of 100% and more, and cross-sectional 
differences in excess of 50%.  Any "measure" with that much noise is 
too unreliable (in a statistical sense) to support meaningful 
analysis.

- Terry

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter Kay" <[email-masked]>
Date: Mon, 4 Aug 2003 06:41:50 -1000

I think the interaction on this topic has been fairly healthy and Paul's
done a good job of summarizing what to do next. I do believe that
techniques using a 550/NSU response are effective in truly reducing spam
attacks over time and would be more than willing to assist w/ a research
project as has been outlined.

And the note on marketing sounding messages has been taken and will
comply. So if we can get a few to step up and participate, lets roll.

We're using the domain "cyber-hawaii.com", which is an old (9 yrs)
domain with several old users that collective get a good spam volume. We
can create additional fresh accounts on this domain to support the tests
below. 

Peter Kay
President of Noticably Absent Marketing Messaged Organization

> From: Paul Judge [mailto:[email-masked]] 
> Sent: Friday, August 01, 2003 8:25 PM
> To: 'Alan DeKok'; [email-masked]'
> Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - 
> Titan Key reduces spam attacks 
> 
> 
> 
> I think the point of Peter's measurement is not an overall 
> comparison of 'spam products' as Alan seems to be suggesting. 
> It is to look at the effect of spam response on future spam volume.
> 
> We've already established that the measurement needs:
> 1. larger sample; ideally all the accounts receive exactly 
> the same spam initially 2. a control set 3. possibly other 
> variables such as systems with other responses such as DSN, 
> no response, or challenge/response etc 4. longer period of 
> time to account for the large short-term fluctations in spam volume
> 
> Peter has volunteered to do this analysis as a member of this 
> research group. The call for a third-party evaluation is 
> unfounded. Sure, in every area of life, folks like to see 
> their work be successful; however, you have to assume that 
> each contributor has a level of integrity that assures that 
> sound process will be used and factual data will be 
> presented. At the same time, I'm sure Peter will be sure to 
> not use such marketing-sounding email subjects in the future.
> 
> > From: Alan DeKok [mailto:[email-masked]]
> > Sent: Friday, August 01, 2003 5:08 PM
> > To: [email-masked]
> > Subject: Re: [Asrg] 2.a.1 Analysis of Actual Spam Data - 
> > Titan Key reduces spam attacks 
> > 
> > 
> > "Peter Kay" <[email-masked]> wrote:
> > > I think you've laid out a good foundation. We would be happy to
> > > provide reasonable computing/account/domain/etc resources 
> to assist.
> > 
> >   I think for transparency, it would be better to have a third party
> > (non-vendor) do the data collection.
> > 
> >   What I would suggest is to collect the data with respect to
> > the use of your product, and to make that data public, where 
> > possible.  If a few vendors do that, then it will not only be 
> > easier to compare solutions, it will be easier to see where 
> > ASRG should focus its efforts.
> > 
> >   Alan DeKok.
> >

---

From: "Peter Kay" <[email-masked]>
Date: Mon, 4 Aug 2003 06:44:25 -1000

I don't see what's controversial by your below. I had to go to the
dictionary at least once and what I was able to make out by the rest
made sense to me.  And the statistical points are very appreciated.

> From: Terry Sullivan [mailto:[email-masked]] 
> Sent: Friday, August 01, 2003 10:32 AM
> To: [email-masked]
> Subject: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data -

---

From: "Peter Kay" <[email-masked]>
Date: Wed, 6 Aug 2003 14:06:58 -1000

I think you pose some very good questions, although much of your
questions are based on a incorrect assumption: that the  "false-550"
spoof attempts to send an NSU message to the sender, which it does not.

If you hand-type an smtp transaction and attempt to send an email to a
known non-existent recipient you'll see what I mean.

So perhaps after you've gone through that exercise, you will see that an
NSU email is not sent to the recipient and you can restructure your
questions in a tighter context.  

If you need clearer direction don't hesitate to email me off-list.

Peter

> Sent: Wednesday, August 06, 2003 11:19 AM
> To: [email-masked]
> Subject: RE: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - 
> On Mon, 4 Aug 2003 06:41:50 -1000
> >  I do believe that techniques using a
> >  550/NSU response are effective in truly 
> >  reducing spam...
> 
> It'd be interesting to hear a focused, clearly articulated case 
> identifying exactly how a "false-550" spoof could possibly affect 
> spam volume.  Ideally, the case should explicitly address the 
> following points:
> 
> I. The return address on the majority of spam is either:
> 
>      A. utterly nonexistent, consisting of either: 
>         1. forged username (e.g., [email-masked])
>         2. non-existent domain (e.g., [email-masked])
> 
>      B. a legitimate address of an innocent party, pulled at 
>         random from the spammer's database of email addresses
>  
> II. The false-550 notices:
> 
>      A. Cannot possibly be delivered to the nonexistent 
>         addresses identified in I.A, and therefore cannot 
>         possibly affect spam volume.
> 
>      B. Are deliverable to I.B addresses, but since the 
>         I.B recipients are not the source of the original 
>         spam, it's difficult to imagine precisely how the
>         false-550 message would/could influence the amount 
>         of spam sent by someone else.
> 
> III. The small fraction of bulk email that actually bears 
>      the spammer's true return address can be handled and 
>      eliminated without resorting to deceptive, high-volume 
>      automatically-generated email.
> 
> There are also several tangential points that would be crucial in 
> building a business case for the false-550 approach:
> 
>    1. For every spam bearing a I.A.1 forged username, the
>       false-550 approach generates, directly or indirectly, 
>       a minimum of 4 additional automated emails, thus
>       effectively quintupling the burden on shared network 
>       resources.  *Everyone* ends up paying higher costs 
>       associated with a 5-fold increase in unnecessary 
>       automated email.
> 
>    2. When a false-550 message arrives in the InBox of an
>       innocent 3rd party (I.B addresses), it constitutes 
>       an unsolicted, deceptive, automated email, whose sole 
>       purpose is to promote the vested interests of the 
>       sender at the expense of the recipient (i.e., SPAM).
>       Individuals/organizations who send a false-550 should 
>       not be surprised to find that some folks think of them 
>       (and treat them) as spammers.
> 
>    3. Every time a false-550 message is sent to someone who
>       has attempted to undertake an innocent correspondence,
>       the very act of replying with a *false message* impacts 
>       the sender's credibility.  (It amounts to saying, "Some 
>       people take advantage of open communication, so here at 
>       XYZ Corp., we believe that every conversation with a 
>       stranger should begin with a lie.")
> 
> 
>

---

From: "Terry Sullivan" <[email-masked]>
Date: Wed, 06 Aug 2003 20:19:50 -0500

On Wed, 6 Aug 2003 20:11:23 -0400, Elric Pedder wrote:

>How do you arrive at the "minimum of 4 additional automated
>emails" ?  If a 550 response is returned, a maximum of one
>automated e-mail is generated.  (Unless I'm missing something.)

As you pointed out later in your reply, each faux-550 response must 
be followed by an automated email message, addressed to 
whatever-the-return-address was.  That autoresponder message, 
intended to avoid (well, diminish) false positives, outlines the 
"procedure" necessary to actually send email to the address.  (Mea 
cupla, in the heat of the moment, I counted server responses as 
messages, and I shouldn't have.)  Still, for each hijacked return 
address, the sheer number of automated messages being passes around 
(and the corresponding burden on shared resources) is not diminished; 
at best, it is merely redirected. 

[snip]

>In an effective system I would imagine the 550 response to
>include details informing the sender on what has happened,
>rather than simply dropping the message.

Perzactly.

- Terry

---

From: "Peter Kay" <[email-masked]>
Date: Wed, 6 Aug 2003 15:40:01 -1000

Eric,

> From: Elric Pedder [mailto:[email-masked]] 
> 
> Given all that, I also fail to see how such responses would 
> actually reduce the spam volume.  Perhaps when we have more 
> data this will become clearer.
> 
> 

It's the "more data" where this whole group falls on its face. There's
so many of us that are so quick to throw in our $0.02, but oh-so-slow to
come forward with some real effort. As you probably know, we've had an
open offer to work with others that want to assist w/ this "more data"
part, and the list has been un-surprisingly quiet in those regards.

I offered to wager $1 with one of the members off-list that no one would
step forward. That member wisely did not accept my wager.  :(

Peter

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 07 Aug 2003 00:20:40 -0400

>at best, it is merely redirected.

Titankey's system is also a C/R system in addition to the 550s. Greylisting 
is a proposal that floated earlier on the list, which is similar. It issues 
445 and waits for the server to retry, but does not send out automated 
messages.

As mentioned before, all C/R system have the detriment of extra automated 
email messages passed around. Its a disadvantage of C/R, but the benefits 
may outweigh it.

---

From: "Terry Sullivan" <[email-masked]>
Date: Sat, 09 Aug 2003 17:44:19 -0500

Two things:

1) To the extent that my ignorance of mechanics of 
   SMTP may have caused a certain... off-topic drift 
   over the last couple of days, I offer a sincere 
   apology to the list as a whole.

2) I'm still troubled by an anomaly in the notion
   that 550 -> less spam.

   All other things being equal, I'm usually the
   first one on the "We need more data" bandwagon.
   But it seems to me that there is a very large 
   base of information (though not true "data") 
   pertinent to the question and ready-to-hand. 

   As the 'Net user base has grown over the last, 
   say, 5-10 years, I daresay that the number of 
   550s thrown between servers has also grown.  I 
   would hazard a guess that the number of 550s 
   has, at the very least, grown as some (unknown) 
   monotonically-increasing function of the number 
   of users.  

   (In the only case for which I have detailed 
   knowledge, there are at least 10 different email 
   addresses that legitimately throw a 550 for me, 
   because I've changed ISPs, left the company, etc.
   There may be more, but there are at least 10.)

   Now, for all I know, a 10:1 ratio may very well 
   be atypical [high or low].  But the thing that
   keeps buggin' me is this: if there is a robust,
   substantive inverse relationship between 550s 
   and spam volume, how has it managed to elude 
   detection this long, given the sustained growth 
   in 550s?  (Call me cynical, but I sorta doubt 
   that it's the result of great QA on those 
   every-email-address-on-the-planet CDs.)

(Though I might be wrong...)  :-)

- Terry

---

From: Scott Nelson <[email-masked]>
Date: Sun, 10 Aug 2003 01:30:13 -0700

At 11:00 PM 8/9/03 -0400, Yakov Shafranovich wrote:
>At 09:50 PM 8/9/2003, Terry Sullivan wrote:
>>On Sun, 10 Aug 2003 01:37:54 +0200, Brad Knowles wrote:
>>
>> >  Hmm.  How would you research something like this?
>>[snip]
>> > Also, I'm a bit confused--just what exactly would we be
>>researching?
>>
>>Peter has a system called Titan Key that responds to all incoming
>>email (spam or not) from any unknown source with a 550.  He posted a
>>message to the list a while back that made what seemed a fairly
>>extraordinary claim (as per the subject line, "Titan Key reduces spam
>>attacks").
>>
>>Now, he had a modest sample of data (one account, one server, for
>>~100 days), and the consensus I saw on the list seemed to be "we need
>>more data."  Several folks have suggested a design along the same
>>lines you did (multiple addresses, of equal visibility, etc.).
>
>This may also apply to another proposal - Greylisting which rejects emails 
>with a 445 response and forces the spammers to redeliver.
>

(quibble: greylisting uses a 451 response, not 445.)

Right now, I'm conducting a study of greylisting to try and determine
(or at least gather /some/ evidence of) it's effect on the volume of spam.

The approach I'm using is this;
I have a number of spam trap addresses, which I split into four groups;
spam0, spam1, spam2, and spam3 
In the first two weeks, spam0 and spam1 accept all email,
and spam2 and spam3 use greylisting.
After two weeks, I switched spam0 and spam2 to accept all email,
while spam1 and spam3 use greylisting.
(The experiment is still under way, I expect to publish final 
 results in a week or two.)

I'm hoping that comparisons will allow me to overcome most of
the "noise" inherent in the data.  I expect that spam0 and spam3
will receive close to the same relative percentage of spam,
and that can be used to refine the difference in the before
and after periods.  Of course, I could be dead wrong, but we'll see.

If it works, a similar procedure could be done for 550 blocking -
4 groups, one never blocks, one always blocks, and the other
two switch between blocking and non-blocking.
However, I think the time would need to be longer.
(though perhaps several experiments could be done concurrently 
 each with successively longer time periods)

>>But my thoughts keep coming back to the sheer amount of statistical
>>noise in something as volatile as spam volume.  That level of noise
>>will make meaningful analysis extremely difficult.  (My area of
>>specialization is statistical language processing, so I routinely
>>encounter the frustrations associated with trying to analyze really,
>>really noisy data.)
>>

No offense, but how do you know there's a large amount of noise
in the data until after you attempt to measure it?
I mean, sure we all /expect/ there will be a lot of noise,
but has anybody actually tried to measure how much noise there is?

>>In statistical terms, all that noise constitutes unexplained (aka
>>"within-group") variance.  So, even if an effect exists, it will be
>>very difficult to detect.  (Conversely, if the effect doesn't exist,
>>the absence of clear results can always be blamed on the noise in the
>>data.)  To make matters worse, given the amount of data that would
>>have to be collected, a *statistically* significant effect would not
>>necessarily be a *substantively* significant effect.  (The p-value
>>might be tiny, but R^2 might be just as tiny.)
>>
>>Now, it's always possible that the effect is so astonishingly large
>>that it will somehow be able to shine thru all that noise.  But if it
>>were really all *that* big, it strikes me as odd that no one's ever
>>noticed it before (at least in any shared forum).  It would simply be
>>be a matter of some mail admin at some slowly failing company saying,
>>"Wow, have you noticed that, after every new round of layoffs, our
>>spam volume plummets, and never bounces back?"  (Sorry, bad pun.)
>>
>>So the point of my posting was: if the effect's big enough to be
>>detected by a practicable amount of effort, then I can't but wonder
>>why nobody's ever tripped over it, even accidentally, at some point.
>>(Phrased differently: given [any] two variables observed to increase
>>monotonically over time, what would it take for the "true
>>state-of-nature" to be "huge negative correlation"?)
>>

Consider what the effect is you're looking for here.
An address that rejects messages with 550 gets less spam.
To see that, you'd need to compare the spam load on two addresses.
It's not hard for me to imagine that a 40% decrease in spam
volume would go unnoticed until someone looked for it explicitly.
Especially when you consider that it might well be that it's
a 40% decrease only in comparison to what it would have been had
you not done the magic thing (what ever that might be.)
On the other hand, it's also not hard to imagine that people
could be mislead by local variances and claim 40% when the
real number is closer to 10%.

>>It's fairly easy for me to imagine an expenditure of enormous
>>quantities of effort, the harvest from which is vast amounts of
>>low-quality data... all to no avail, because the "measure" being
>>analyzed is so statistically unreliable that inconclusive results are
>>just about guaranteed.
>
>I think that before commencing on a spam study or analysis of spam data, we 
>would have to discuss the scientific and statistical principles which will 
>be used to do the study. This would also apply to any data from third party 
>sources such as Brightmail.
>

I would argue for only one principle - any study should be
described in sufficient detail that someone else can repeat the study.

Scott Nelson <[email-masked]>

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 10 Aug 2003 04:48:29 -0400

At 04:30 AM 8/10/2003, Scott Nelson wrote:
> >...............

Sorry, my mistake - I got the error codes wrong. Mea Culpa.

>..................

What kind of spam volumes are you working with?

Yakov

---

From: Scott Nelson <[email-masked]>
Date: Sun, 10 Aug 2003 23:53:14 -0700

>What kind of spam volumes are you working with?

In the data set that I'll be posting shortly a few thousand,
though it depends on how you count.

In the first two weeks, group 3 (50 addresses) accepted 120 spams,
out of 1900 RCPT TO attempts.

---

From: "Terry Sullivan" <[email-masked]>
Date: Mon, 11 Aug 2003 14:51:22 -0500

On Sun, 10 Aug 2003 12:00:05 -0400, 
Scott Nelson <[email-masked]> wrote:

TS>>But my thoughts keep coming back to the sheer amount 
TS>>of statistical noise in something as volatile as spam 
TS>>volume.  That level of noisewill make meaningful 
TS>>analysis extremely difficult.

SN>No offense, but how do you know there's a large amount of noise
SN>in the data until after you attempt to measure it?
SN>I mean, sure we all /expect/ there will be a lot of noise,
SN>but has anybody actually tried to measure how much noise there is?

Well, first I used the time-honored (if admittedly crude) method of 
direct inspection; short-term fluctations of 100% and more can be 
spotted just by visually scanninng down a list of frequencies.

A somewhat more rigorous (and conveniently scale-invariant) 
"back-of-the-envelope" measurement of the amount of noise in a 
dataset can be obtained from Fisher's coefficient of variation 
(C.V.).  The C.V. for the two (recent) longitudinal samples I happen 
to have handy (from two totally independent sources) are both right 
about 0.30.  So, 30% of the total variance is pure noise (and thence 
"unavailable" for inferential purposes).

To appreciate the impact of a C.V. of 0.3, remember the "research 
question" here: does _A_ cause a reduction in _B_?  It'd be almost 
exactly equivalent to trying to tell how well (or even IF) your new 
diet is working, when the only scale you have to weigh yourself on 
reads 120 pounds one day and 230 the next, when your "actual" weight 
is about 170.  

All of which may help to explains why I've tried (up 'til now) to 
raise a cautionary flag: to have even the tinest hope of being 
detectable, this is gonna hafta be the "800-pound gorilla" of 
effects.  But having said my piece, I hereby resign as chairman of 
the Committee to Try to Save Other Folks' Time/Effort, and return to 
lurker mode.

- Terry

---

From: "Peter Kay" <[email-masked]>
Date: Wed, 13 Aug 2003 05:33:25 -1000

Can you just give us the "cliff notes version"?  Or possibly just your
summary of what that document is saying? That's a helluva lot of reading
to do on that page just to figure out what your point is.

> From: Walter Dnes [mailto:[email-masked]] 
> Sent: Saturday, August 09, 2003 6:07 PM
> To: ASRG list
> Subject: Re: [Asrg] RE: 2.a.1 Analysis of Actual Spam Data - 
> On Sat, Aug 09, 2003 at 08:50:55PM -0500, Terry Sullivan wrote
> 
http://www.honet.com/Nadine/ 'The story of "Nadine"' gives food for
thought.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: [email-masked]
Date: Wed, 13 Aug 2003 13:47:36 -0500

> Does anyone present would like to assist in the analysis work? Aside from 
this data graciously being offered, we have access to many other source of 
spam data from Brightmail, Postini, and such. Any help with analyzing it 
would help greatly!

I'd be glad to help provide SPITBOL programs (executables, and/or source) to 
help extract data for analysis.

SPITBOL is a very fast SNOBOL4 implementation, which offers greater speed and 
far superior pattern matching and textual manipulation compared to (say) Perl.

The SPITBOL programs I'd write would be command line apps and would run on any 
32-bit-capable Wintel-class machine.

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.