Slashdot Mirror

Anyway, what's all the fuss about ID cards? Here in Portugal we've had ID cards since the 19th century.

It's not the cards, it's the bloody great big database behind it, that (despite assurances to the contrary) is allowed to store any data the government likes about you (in the legislation, one of the permitted data elements is foreign keys to any other data source).

Oh, and that it's costing UKP18,000,000,000 or so for no apparent benefit.

Bah, blacklists are for wimps :-)

What you want to do is use it as training data for your bayesian filter, so your filter not only blacklists the email address, it learns more of the spammer's armoury. And as you *know* it's going to be spam, you can run it through half a dozen times marked as spam.

So, spammers, suck on this: yumyum@easyweb.co.uk.

I think for many people (myself included), the problem is not the ID card but the gigantic government-run database that backs them. What we don't want is for the government to amass so much data on us that they can manipulate us.

Bing! We have a winner!

That's exactly the point. And taking the UK ID Card scheme as an example, in the list of data elements scheduled for inclusion on the database (according to Clause 4(i) of the Schedule to the Act) is:

the number of any designated document which is held by him and is a document the number of which does not fall within any of the preceding sub-paragraphs;

Do I need to spell it out? That's Foreign Keys to every single other government database.

And quite besides the Civil Liberties argument, the UK Scheme is going to cost upwards of UKP19bn in setup costs on current scope (and we're already getting feature creep), and no-one's yet come up with a genuine reason for it that can't be achieved through other means, or frankly isn't worth the money (of the financial benefits predicted, only UKP35m is robust).

Nearly forgot to link to my own article on the subject:

What is Profit?

Looking at the linked campaign, I'm extremely supportive (having been against the UK equivalent for quite a while now).

But guys, could you pick the right target, yeah? It's the Government, stupid... businesses wouldn't want to touch it with a stick as it's government mandated extra costs with no business benefit.

SpamAssassin 2.x with well trained (>1 year of spam @ 100+ spams/day) Bayes:
~5% false negative (~95% spam filtering accuracy, 1 in 20 spams let through).

DSPAM with large training corpus (~10k spams from a honeypot) plus 6 weeks of real mail at same spam rate:
0.45% false negative (99.55% spam filtering accuracy, 1 in 222 spams let through).

I now publicise an inoculation honeypot address: yumyum@easyweb.co.uk for spammers to harvest, which adds super-strength training.

I'm very happy with my move to DSPAM.

Further, I don't believe heuristic filtering works any more, particularly if you're using published heuristics/shared rules. Spammers adapt too quickly, and test their spam against known rulebases. The solution is I believe to go entirely statistical, allowing each user to have their own definition of spam that is untestable by spammers.

(Incidentally, ever seen the SpamAssassin header forgery spam now being used?

SpamAssassin 2.x with well trained (>1 year of spam @ 100+ spams/day) Bayes:
~5% false negative (~95% spam filtering accuracy, 1 in 20 spams let through).

DSPAM with large training corpus (~10k spams from a honeypot) plus 6 weeks of real mail at same spam rate:
0.45% false negative (99.55% spam filtering accuracy, 1 in 222 spams let through).

I now publicise an inoculation honeypot address: yumyum@easyweb.co.uk for spammers to harvest, which adds super-strength training.

I'm very happy with my move to DSPAM.

Further, I don't believe heuristic filtering works any more, particularly if you're using published heuristics/shared rules. Spammers adapt too quickly, and test their spam against known rulebases. The solution is I believe to go entirely statistical, allowing each user to have their own definition of spam that is untestable by spammers.

(Incidentally, ever seen the SpamAssassin header forgery spam now being used?