Subject: Reputation systems

From: Meng Weng Wong <[email-masked]>
Date: Sun, 15 Aug 2004 23:37:58 -0400

On Thu, Aug 12, 2004 at 09:54:14AM -0500, Ryan Malayter wrote:
| 
| Has anyone ever seen an effective "reputation system for reputation
| systems"? I've seen a few statistical comparisons of DNSBLs, but they
| all seem to ignore the most significant item when it comes to spam
| filtering: the false-positive percentage. Of course, you have to have a
| person manually evaluating whether or not each message *is* spam to get
| this data, so perhaps that's why.

I believe the generally accepted guide to DNSBLs and their
ilk is at
http://www.sdsc.edu/~jeff/spam/Blacklists_Compared.html

| Such "reputation system grading" is probably something that is going to
| be even more necessary as SPF/MARID grow in popularity. People will need
| to know which reputation systems they can trust, right?

I am working with a number of industry leaders on developing
a rottentomatoes for domain-based reputation and
accreditation system.  My initial thoughts are documented at
http:/spf.pobox.com/aspen.html.

Things have moved fast since I wrote that document.
Cloudmark has announced
http://rating.cloudmark.com/senderid/ (a domain-name-based
reputation service) and Verisign has announced its VDL (a
first approximation to domain-name-based accreditation).

In addition there is Gossip: http://www.sufficiently-advanced.net/

So it looks like it's going to happen.

The ultimate communities-based "consensual subjectivity"
spam scoring systems will probably end up with an
Amazon-like "recipients like you thought this message was
spam".  The privacy implications are left as an exercise for
the reader :)

---

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Wed, 18 Aug 2004 20:41:55 -0700

> first approximation to domain-name-based accreditation).

Please also don't forget ISIPP's IDDB (ISIPP Domain Database) which 
presently lists domains (both top level alone, and with subdomain)  and 
both declares the only IP addresses through which mail from that domain 
may properly issue, and cross-references to the IADB and IADB data 
(making it also true domain-name-based accreditation).

Anne