Subject: [Asrg] Re: Anti-spam comparison

From: "Ian Rogers" <[email-masked]>
Date: Tue, 19 Apr 2005 17:24:16 +0100 (BST)

> --- I wrote: ---
> Is there any kind of central resource that attempts to compare all the
> anti-spam techniques and/or algorithms in one place?
>
> I know many people have their own websites arguing for/against their
> favourite/most-hated scheme, but has there ever been an attempt to bring
> all the arguments together *dis*-passionately?

As there was no answer to my post above I've gone ahead and created an AS
comparison site - www.fussp.info

It's only just starting so comments are *extremely* welcome at this point.
For example:

Has this been done elsewhere? What are the key functions/features you'd
like to see on the site? Where should I be concentrating/prioritising my
efforts? etc.

Regards,

Ian.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matthew Elvey <[email-masked]>
Date: Tue, 19 Apr 2005 23:43:45 -0700

>comparison site - www.fussp.info
Hi, Ian.
I don't think it reached the list; I didn't get it and I don't filter 
list traffic.
Cute domain. :) 
Go here:
http://wiki.fastmail.fm/index.php/EvaluationsOfCSV
to find info on previous evaluation efforts - ASRG evaluation criteria 
(a must read!), plus some good stuff from Meng Wong, and from me on CSV.
Just looked at the site. The scenarios are a good idea too.  I think the 
site's content should boil down to a  2-axis chart:
schemes on one axis, evaluation criteria (e.g. scenarios) on the other. 
Oh, and is the site content open? (I.e. Creative commons licensed?  To 
be considered as IETF WG work?  Who's in control?)

---

From: "Ian Rogers" <[email-masked]>
Date: Wed, 20 Apr 2005 13:33:31 +0100 (BST)

Matthew Elvey wrote:
>>I've gone ahead and created an AS comparison site - www.fussp.info
>>
>>
> Go here:
> (a must read!),

Thanks, I've added it to the todo list.

> schemes on one axis, evaluation criteria (e.g. scenarios) on the other.

Yes, that's exactly what I had in mind - plus a database and description
language so that when someone says "oh but surely we can just make a
hybrid of this, this and this" we'll be able to plug a description
straight in and see if it comes up "green light" against all the scenarios
- no more long-winded arguments after that...

> Oh, and is the site content open? (I.e. Creative commons licensed?

Yes: CC, GPL, whatever. It's just a case of picking the most appropriate
one (I guess I'll have to pick one before I can accept any new authors -
is there a license comparison site??).

> To be considered as IETF WG work?

I'd love it to become a WG community site.

> Who's in control?)

Err, me :-) Benign Dictator I hope :)

Ian.

Ps.

> Cute domain. :)

:) I tried to contact to owner of fussp.net and fussp.com, as he's doing
nothing with the domains, to see how generous he'd be in return for good
karma but got no reply...

---

From: Jonathan Morton <[email-masked]>
Date: Wed, 20 Apr 2005 19:20:29 +0100

> It's only just starting so comments are *extremely* welcome at this 

Cheers.  You now have a resident hashcash expert (me), busily making 
posts and comments.  I wonder if article/comment authors get 
notification when someone else posts something relevant?

There's a slight problem with the site layout, in that comments to a 
short article are hidden right at the bottom of a long scroll, due to 
the extremely long right-hand banner.  It'd be rather a good idea to 
fix that.

--------------------------------------------------------------
from:     Jonathan "Chromatix" Morton
mail:     [email-masked]
website:  http://www.chromatix.uklinux.net/
tagline:  The key to knowledge is not to rely on people to teach you it.

---

From: Matthew Elvey <[email-masked]>
Date: Wed, 20 Apr 2005 17:36:32 -0700

As long as we're talking about comparisons: Here's an interesting take 
on spam-fighting:
http://wiki.fastmail.fm/wiki/index.php/FightSpam  Shows the upside and 
downside of wikis... (note the hit-man references).
=-=-=-=-=
Apropos fussp.info:
A few schemes and scheme tweaks I've thought of.

Universal adoption says:
"A whitelist scheme can only be used to reject spam when *every* 
legitimate mail sender is part of the scheme. "
Well, no.  Having a whitelist scheme in place means you can turn up the 
sensitivity on your spam-detection tools (i.e. lower SpamAssassin score 
thresholds and reject more spam) and maintain the same FP rate, or keep 
them at the current level and have a lower FP rate.  Also, what does 
"Universal" mean?  Every sender? user? recipient? server? domain? needs 
to adopt it?

New scheme:
"User support is expensive"
e.g. Large ISPs will not adopt schemes that require each end-user make 
changes to their setups, such as installing new software or even just 
reconfiguring current software.  They are not willing to do something 
that will precipitate a deluge of support calls.

BTW, the current TOU (Terms of Use) are unreasonable:
Too long.
Undated.
changes w/o notice???
Usage of my account by another due to a security flaw in your system is 
not my responsibility.
12. Reservation of rights - NOT compatible with open content...

Privacy policy:
too long, etc.

---

From: "Ian Rogers" <[email-masked]>
Date: Thu, 21 Apr 2005 11:28:02 +0100 (BST)

> downside of wikis... (note the hit-man references).

An interesting article (and with anonymising communications and payment
escrow the "go to jail" risk could be minimised :)

> Universal adoption [ http://www.fussp.info/Article20.html ]  says:
> them at the current level and have a lower FP rate.

Yes that's exactly correct - a whitelist doesn't increase the positive
rate (ie. you can't use it on its own to reject spam) though it can be
used to lower the false-positive rate for next layer (though the whitelist
needs to be backed up by a working authenticated-sender scheme (which
doesn't exist yet??) to be reliable).

> Also, what does

Yes, good comment, I am vague there (though perhaps usefully so :-) I'll
extend the article in due course.

> that will precipitate a deluge of support calls.

That's a scenario as opposed to a scheme, but please go ahead an submit
that as an article on the site (I'm keen not to steal authorship kudos for
myself).

> 12. Reservation of rights - NOT compatible with open content...

I rushed up the current T&C as a guideline before people started writing
articles (I have a day-job so can't spend 8 hours a day on this :)  I'm
finding your comments very useful so please get in touch "offline" so to
speak and we'll work out an appropriate T&C.

Cheers,

Ian.