Subject: RE: Reputation systems

From: "Ryan Malayter" <[email-masked]>
Date: Mon, 16 Aug 2004 12:11:37 -0500

[Meng Weng Wong]
>I believe the generally accepted guide to DNSBLs and their
>ilk is at
>http://www.sdsc.edu/~jeff/spam/Blacklists_Compared.html

I've seen that page, but as I mentioned, there's no analysis of the
false-positive ratio. A very high false-postive rate, in my experience,
is what makes IP-based blacklisting unworkable. Yes, a good blacklist
stops a lot of spam, but it also stops a significant amount of ham.

We got a lot of false positives with the SpamCop list, and other BLs are
bound to be worse.

I guess I'll have to try to do this analysis on my own. Someone wrote a
SpamBayes tokeinzer module that adds tokens for blacklist membership;
this will automate the process for me if I get it working.

Regards,
--
Ryan Malayter
Bank Administration Institute
Chicago, Illinois, USA
=========================
All problems can be solved by diplomacy, but violence and treachery are
equally effective, and more fun.
      -Anonymous

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Mon, 16 Aug 2004 19:28:57 +0200

Ryan Malayter writes:
> We got a lot of false positives with the SpamCop list,

(That echoes my experience while I used the SC list.)

> and other BLs are bound to be worse.

Why?

Arnt

---

From: Tony Finch <[email-masked]>
Date: Mon, 16 Aug 2004 18:27:08 +0100

> We got a lot of false positives with the SpamCop list, and other BLs are

The SpamCop list is one of the worst for false positives. We get very few
complaints from using the MAPS RBL+ and the Spamhaus SBL-XBL, and they are
both quite effective (accounting for about half of our SMTP-time
rejections). The following graph is fairly interesting:

http://canvas.csi.cam.ac.uk/stats/ppsw/img/dnsbl.15.gif

The y axis is in messages per second. A week ago I swapped the order of
the blacklists in my configuration so that the RBL+ is checked first.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
BERWICK ON TWEED TO WHITBY: WEST OR SOUTHWEST 2 OR 3 INCREASING 3 OR 4. FAIR.
GOOD. SLIGHT OR SMOOTH.

---

From: John Levine <[email-masked]>
Date: 16 Aug 2004 22:16:37 -0000

>We got a lot of false positives with the SpamCop list, and other BLs
>are bound to be worse.

Actually, Spamcop's list is infamous for its vast number of false
positives.  That's why nobody I know uses it for anything more than
a fairly low-weight input into a scoring system.

Try the Spamhaus SBL and XBL and you'll find very few misfires.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com