Re: 95% of User Generated Content is spam or malicious

[Rich Kulawiec <rsk () gsp org>]

[ only slightly overdue ]

On Mon, Feb 22, 2010 at 08:42:19AM -0500, Dan Kaminsky wrote:
> > But this is not the only metric with which to evaluate mail defenses.
>
> I disagree.  This is the only metric that matters: [snip]

I'm sure to those who only care about their own inboxes, it is.  And
that's fine for them: they're not required to care about anything else.

Just as the only metric that matters to anti-spam vendors is profit. [1]

However, to those us who are trying to stop spammers, not merely spam,
and who are trying to do so on a global basis, many other things matter.
Were it otherwise, I wouldn't need to bother: I "solved", for a
reasonable value of "solved", my own spam problems a long time ago.
But there's a huge difference between those two goals (above), one
that necessitates different strategy and tactics.  The problem
(okay, one problem of many) is that precious few people grasp
the difference and as a result they're in much the same situation
as the military: always ready to fight the last war.

---Rsk

[1] There are, of course, naive and foolish individuals who believe
that anti-spam vendors actually care about curtailing spam.  Sensible
people know that these vendors don't: the more of it, the better for
their bottom line.  That's why it's worth noting that no anti-spam
vendor is actually working to stop spammers: it's not in their financial
interest to do so.  It *is* in their financial interest to continue to
hawk ever-more-complex and expensive `"solutions" that of course require
support and continuous updates to function -- thus making sure that
those who buy into them provide a steady revenue stream, and that they
face substantial cost/disruption if they choose to change to anything
else.  This means that they're essentially in a symbiotic relationship
with spammers, whether or not either acknowledges it.
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.