Subject: REDIRECt to ASRG RE: Reputation systems

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 16 Aug 2004 17:28:15 -0700

I think that this is getting into an ASRG question.

If we create a graph of false positives vs false negatives we get
an L shaped curve for most filtering technologies that are
parameterizable and a point for a non perameterized technology
such as a blacklist.

Rather than arguing this point round and round does anyone have
a ready made graph with the various blacklists plotted on it so
that we could make a useful comparison?

There are two reasons why a list would have more false positives,
the listing criteria/application thereof could be wrong or the
list could be more aggressive in listing more spam sources.

If List-A listed 100 addresses and 80 were wrong this would result
in fewer false positives than List-B listing 1,000,000 addresses
with 800 wrong. So there is a discrimination function here...

> >We got a lot of false positives with the SpamCop list, and other BLs
> >are bound to be worse.
> 
> Actually, Spamcop's list is infamous for its vast number of false
> positives.  That's why nobody I know uses it for anything more than
> a fairly low-weight input into a scoring system.
> 
> Try the Spamhaus SBL and XBL and you'll find very few misfires.

---

From: "John R Levine" <[email-masked]>
Date: 16 Aug 2004 21:00:52 -0400

I agree.  It's quite appropriate for the ASRG IAR (identity,
authentication, and reputation) subgroup, on the list [email-masked].

> with 800 wrong. So there is a discrimination function here...

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.