Reviewing Anti-Spam Offerings

Re:SpamAssassin? by stupidfoo · 2004-12-20 06:47 · Score: 5, Informative

RTFA:
We also reached out to the SpamAssassin community (see "What about SpamAssassin?"), but couldn't find someone who could act as a representative for support and configuration assistance. However, two commercial vendors, Roaring Penguin (on Unix) and NoSpamToday! (on Windows) sent products that exposed their SpamAssassin cores.

They have a whole page discussing this.

InboxCop by Marthisdil · 2004-12-20 06:47 · Score: 1, Informative

Does great for Windows

Re:SpamAssassin? by ack154 · 2004-12-20 06:48 · Score: 3, Informative

I never thought I'd get to use it... but... RTFA jackass. Don't just see a question and post something about it. Answer: http://www.nwfusion.com/reviews/2004/122004spamsid e6.html

Thunderbird very good by thedudemrl · 2004-12-20 06:50 · Score: 2, Informative

Using Thunderbird greatly cuts down on the amount of spam you see in the inbox. After using for only about a month, 90% of spam was automatically deposited in the "junk mail" folder. Surely this isn't as good as a paid spam-prevention service, but its free :)

Avoiding spam by narcolept · 2004-12-20 06:52 · Score: 2, Informative

Maybe it's just me and I'm one of the few lucky people in the world, but out of 5 regular email addresses that I use on a daily basis, I rarely if ever recieve spam, and during the workday, watching mailserver logs, the only people in my company getting silly amounts of spam (to me, one or two messages a day is just a minor annoyance) are people who click every popup and put their email addresses in every form available. If it wasn't for the built in spam filtering of Kerio Mail server, which is what we use here, it would probably be impossible for them to get any real work done, as out of 200 people, these 5 or so get more spam directed towards them than the rest of the company gets regular emails. Some common sense goes a long way in avoiding spam.

Re:Avoiding spam by Yaztromo · 2004-12-20 07:21 · Score: 4, Informative

Maybe it's just me and I'm one of the few lucky people in the world, but out of 5 regular email addresses that I use on a daily basis, I rarely if ever recieve spam, and during the workday, watching mailserver logs, the only people in my company getting silly amounts of spam (to me, one or two messages a day is just a minor annoyance) are people who click every popup and put their email addresses in every form available.

There are many ways in which spammers harvest and generate spam messages, and not all of them require entering your e-mail address into web forms.
I have a number of e-mail addresses, some of which date back to the early 90's and use daily, and others which are more recent and which I've never used at all.
My oldest e-mail address was my primary e-mail adddress for newsgroup postings for many, many years. I haven't given or used that address in roughly 2 years now (as I'm using a different address that forwards to this old mailbox), and yet I still get dozens of spam messages being sent to this address daily (all of which are thankfully auttomatically filtered).
On the other end of the spectrum is my Gmail account. I have never used this account for anything at all. I've never sent an e-mail from it, or used it to register for anything. And yet it too receives spam (all of which Google also does a good job of filtering automatically). An old e-mail account I got from my ISP when I signed up for my first cable modem was similar -- I already had a mailbox and never used that account. I never even bothered _checking_ it, until one day nearly a year later out of curiousity to see how many spam messages it may have received -- only to find the mailbox was filled with hundreds of spam messages.
I often see messages where the list of recipients was obviously generated by attaching a list of user names to each entry in a list of domains and then sending the results. And who knows how many Windows e-mail worms out there are sending users address book entries back to spammers.
Best practices can reduce your spam load from certain vectors, but not all of them, making some form of filtering good policy. When even unused mailboxes are getting clogged with spam, however, you know that best practices alone just aren't enough.
Yaz.

Re:Objective by joel_snyder · 2004-12-20 06:55 · Score: 2, Informative

> From deep within the article:
>"Although these tests were conducted with the
> assistance of Borderware, we where careful to
> ensure results where fair and objective."

So deep that... they must be in some other article. I don't know where you cut-and-pasted that out of, but it sure wasn't the article referenced in this post.

Re:SpamAssassin? by Anonymous Coward · 2004-12-20 07:02 · Score: 2, Informative

From TFA:
"However, two commercial vendors, Roaring Penguin (on Unix) and NoSpamToday! (on Windows) sent products that exposed their SpamAssassin cores. Although neither met our false-positive threshold for inclusion in the top 12 finalists (probably because of difficulty of tuning Bayesian engines and neural networks in a test lab setting), we were very pleased to have them participate in the project."

Still, a poster that does not RTFA before making such a comment is not a poster I would put much stake in.

Re:Thunderbird by ack154 · 2004-12-20 07:02 · Score: 2, Informative

I don't think I've seen any false-positives since about 0.7 - but it does miss some emails now and then, so it's not really 100% success rate, but really, what is?

But I do see your point... however, you also have to understand that with Thunderbird, you're not really running a separate application to filter your spam (or running anything on your server for it) - this is just a free email client that does it's own filtering.

Though as I said, I'm quite satisfied. And of course, your mileage may vary.

Did you read the article? by Anonymous Coward · 2004-12-20 07:04 · Score: 1, Informative

They tried to get it to work well enough to review, but couldn't. You can flame them for not spending more time on it, but not for not trying, because they did.

Re:Thunderbird by fireduck · 2004-12-20 07:05 · Score: 2, Informative

Thunderbird's anti-spam is nice, but I wouldn't call it excellent, at least from my experience. I've been using the junk mail feature since 0.7 or thereabouts, on a mail account that gets anywhere from 10 to 30 messages a day, 90% of which are spam. When I recently downloaded 300 or so messages, I still had 25 junk mails that it didn't flag. After several months of training, I'd think it should be more effective than that.

Spam Solution by MightyMartian · 2004-12-20 07:07 · Score: 3, Informative

Easy. A Postfix server running Postgrey and Anvil. Before mail ever hits a mailbox most spam (and a lot of viruses too) are weeded out. It can protect against distributed dictionary attacks.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.

Bullshit review inclusion criteria by rich42 · 2004-12-20 07:09 · Score: 2, Informative

Seems like a lot of decent-sized players were left out... Ie - where is SpamKiller (client-side), SpamBully or SpamButcher?

"We invited every anti-spam vendor in our online Buyer's Guide to participate"

And what is there "online Buyer's Guide"? - a pay for inclusion directory!

Between that and their #1 choice helping them with the review process - I have serious questions as to the value of this report

. Accurately simulating a bunch of different anti-spam systems all getting the same e-mail is a bit of a trick. If one of the major players is helping set the rules - its way to easy for them to stack the deck.

Re:Bullshit review inclusion criteria by joel_snyder · 2004-12-20 07:14 · Score: 1, Informative

Thanks for reading the article so carefully.

The Buyer's Guide is free and there is no fee to be included. Any spam product can be in it, and all were invited.

We didn't have a #1 choice, but NO ONE helped us with the review process. Where do you see that we had a choice, and where do we say that they helped us with the article?

Do you actually read the article, or do you just post?

bspam also excellent by brw12 · 2004-12-20 07:14 · Score: 3, Informative

Though it's a small project, bspam is an excellent Bayesian filter for *nix... I tried bogofilter and some others but nothing jived with my qmail/procmail/pine setup as nicely as bspam.

Reject on SMTP. by eddy · 2004-12-20 07:15 · Score: 2, Informative

RBL (list.dsbl.org : bl.spamcop.net : blackholes.mail-abuse.org : sbl-xbl.spamhaus.org : multihop.dsbl.org : cbl.abuseat.org) + greylistd == average 0 spam in inbox/day.

What I like best about this approach is that you reject most of the spam at SMTP-time without accepting it. If I could I'd add spam-assassin-on-SMTP to the end of the chain, but my server is tight on memory :-(

(Unfortunately there's a bug somewhere between the debian greylistd and python whereby the daemon shuts down on me all the time, but I've lodged a bug report and hope to get some help tracking it down.)

--
Belief is the currency of delusion.

Re:In-line SPAM filtering - never hits your server by joel_snyder · 2004-12-20 07:19 · Score: 2, Informative

MX Logic participated last year, but didn't get into the "final fab five" or whatever it was. I am not sure why they didn't participate this year. You'd have to ask them.

Re:Too bad by joel_snyder · 2004-12-20 07:24 · Score: 3, Informative

GFI got a horrible review last year. The product they submitted was a pure 'word checker' (i.e., if you've got Viagra anywhere, you're spam) and so their false positive rate went through the roof. They also had some horrible heuristics, such as "if you're not on the "to:" line, it must be spam." My experience is that it was architected for a small office where you can tune it out the wazoo. They have since (I have heard) fixed their product, but they were so heavily burned by last year that they didn't want to come and play this year. I can't really blame them; once burned, twice shy. But we'll never really know, will we?

I don't know how much I trust their conclusions by CerebusUS · 2004-12-20 07:27 · Score: 3, Informative

The one product that I am familiar with is Barracuda, as we run that where I work. They claim that Barracuda doesn't support SSL for management, which is dead wrong. In fact it's very simple to _force_ the Barracuda to use SSL for this purpose.

It's only one point, but they make a fairly big deal out of it.

Smart Spam Usage. by jellomizer · 2004-12-20 07:28 · Score: 2, Informative

My Spam Level Rarely gets out of control. With Some Basic Filtering.

First I setup my own domain Name which I only give to people who I want to email me, and I have it point to a mail server that will allowing emails to me@mydomain.com, but also has a different more/popular domain name accessed to it. So Whenever I need to put my Email Address in a possible Spam Area I give it me@populardomain.com So when Spam is sent the to tag will be me@populardomain.com even for the Spams that just try to guess your name it will go to popular domain to my longer domain. Next I setup my email client to filter all emails to me@populardomain.com and put them in a spambox then forward them to spam@ftc.gov. I could go further and delete them. But in the case I might get a false positive I can receive it. But normally I just highlight all and delete them. I have never gotten Spam on me@mydomain.com and 99.99999% all emails at me@populardomain.com are Spam. With the exception of the site that gives your confirmation password by email. (In that case I normally use a hotmail, yahoo account to check for the password.)
Never Ever give put your email in textmode. Always make a graphic to post your email address if you really want an email contact. Or make a recording of it by voice if you are communicating to people who are visually impared. Or when you want people to email you have them go to a web form and fill out the form. (Make sure the form is programmed so people cannot make it relay to an other person)
Pick a good email address. Use similar rules like you use to make a good password try to mix letters and numbers and avoid common names such as bob, ted, todd, bill, jim, max, john, jeff... these are the ones that get the most Spam.
Use an email client that allows you to choose not to load images. So they cannot verify that you got the message.
Report all Spam to spam@ftc.gov. If you want the spammer to go to jail then you should at least get him on the governments radar
Windows user make sure you have proper virus protection. And if you give your email address to another user make sure they are doing the same.
Don't send Spam yourself! if you send Spam to other people you will get Spam back as well. (And combined with other nasties)
Check the privacy agreement on the website and make sure that they will not give you email address to everyone
Check those checkboxes and make sure that you will not receive Spam from them they may be worded funny so that you will check yes to them.
Anonymous cowards Don't get Spam! On the Internet try to maximize you anonymously.

Spammers will Spam you if they can Guess or Get your Email Address so the trick is to make it hard for them to get it.

--
If something is so important that you feel the need to post it on the internet... It probably isn't that important.

Where's SpamAssassin? by Anonymous Coward · 2004-12-20 07:32 · Score: 2, Informative

FROM TFA:

The short answer is that no one submitted it, but of course there's more to it than that. This year we reached out to the SpamAssassin community and asked them to participate. Although a few well-meaning souls volunteered to be the contacts for SpamAssassin, when it came time to test no one would step up to the plate and represent the product at a level that would make it competitive to the other enterprise-focused vendors.

Interest in SpamAssassin is understandable. In the small-business market, the open source SpamAssassin dominates many anti-spam systems. When well tuned and integrated by a value-added reseller (VAR) that knows what it is doing, it turns out to be a very effective system. SpamAssassin users routinely report 100% spam reduction and 0% false positives (although these self-reported statistics are probably biased), and are generally overjoyed with the results.
Advertisement:

By itself, SpamAssassin is little more than the software implementation of an interesting idea: apply statistics, neural networks and Bayesian probabilities to the problem of classifying mail as spam or not. Train the engine by giving it desirable and undesirable mail, and it can tell you for each new message what pile it most resembles. It turns out to work astonishingly well, especially in small businesses where mail flow is very homogeneous. SpamAssassin's Bayesian engine even redefines the meaning of spam by letting you say, "This is the mail I want," and "This mail I don't want." SpamAssassin also mixes other tools into its scoring system, such as DNS-based blacklists and collaborative scoring, as well as more traditional keyword searches and formatting tests.

The key to SpamAssassin's success, though, is a smart VAR or IT person installing it. SpamAssassin requires a significant amount of integration work to make an enterprise-class installation succeed. Without a GUI, database, quarantine, anti-virus scanner, policy or per-user configuration, SpamAssassin is a great tool for those who want to build their own anti-spam system, but is in no way a solution by itself.

This doesn't mean that SpamAssassin wasn't well represented in our test. The important core of SpamAssassin, a Bayesian engine, was recognizable in at least one-third of the products we tested and might well have been hidden in the guts of more. The strategy of combining multiple tests to identify spam is in nearly all modern, anti-spam products, including SpamAssassin.

The difficulty in testing or recommending products that require heavy engine training, or ones based on trained neural networks, is that companies with many employees have very diverse mail flows, and the training will likely generate false positives or negatives across large numbers of users. For example, a multinational company might have many employees who don't read or speak Italian, and might train all their Italian mail as spam - something that would upset the Milan and Rome offices. Or imagine IDG, which owns many publications, all which have specialized vocabularies. No one set of training mail would work for the different communities.

Products that successfully include a Bayesian recognizer, such as SpamAssassin, do so by considering it as one factor in the larger cocktail of spam identification. By weighting the Bayesian verdict with other information, vendors have followed the trail that SpamAssassin blazed and made it enterprise-ready.

Re:Postini by joel_snyder · 2004-12-20 07:59 · Score: 2, Informative

RTFA. Postini was in it, both in the big table and in the Dirty Dozen finalists.

Re:Copycat, clueless cat by joel_snyder · 2004-12-20 08:08 · Score: 2, Informative

Thanks for the compliment... because, you see, I first used the methodology in 2003, in the original Network World test (see http://www.nwfusion.com/reviews/2003/0915spam.html ).

Or, you could go back to February, 2003, and see the same methodology being prototyped at the Demo conference (http://www.nwfusion.com/reviews/2003/0224antispam demo.html)

Let's see: Feb 2003: 2 products.
Sept 2003: 16 products, with 4 top overall performers.
Dec 2004, 36 products, with 12 top overall performers.

And Network Computing? 23 products with 10 finalists, in between my two reviews for Network World.

Yeah, I'm feeling like what Network Computing does in between my reviews makes me a copycat...not.

What are you, a NWC ad salesman? Or just a bit clueless yourself?

Re:SpamAssassin? by Elwood+P+Dowd · 2004-12-20 10:05 · Score: 2, Informative

What he's really saying is that they couldn't find anyone willing to PAY them to review SpamAssassin on Apache.

You did not read the article. From the Who got left out or opted out page:

IronPort Systems, a messaging appliance vendor, was asked not to participate in the test because Opus One has an existing consulting contract with this company - including them in the test would have created a conflict of interest. If you are interested in IronPort's spam catch rates, you can infer them from Borderware or Symantec's numbers because all three are based on the same anti-spam engine.
...
Full disclosure statement - After last year's test naming the Postini anti-spam service as one of the top products, Opus One signed up as a paying customer of Postini. Some of the companies participating in the test thought that this would present a conflict of interest. We feel that any test lab that hasn't already implemented an anti-spam system by now could hardly be considered qualified to evaluate how such a product would work. In addition to Postini, Opus One is a customer or purchases products or services from Symantec, Sophos, NetIQ, Ipswitch, and Process Software, all of which participated (or wanted to participate) in this test.

I'd say that given these two statements, their motives are impeccable. They did review SpamAssassin-based products. They did not review SA on it's own because there was no way to make it fit with their methodology. There were many other products that also got left out for these reasons, and their reasons make sense.

You are full of shit.

--

There are no trails. There are no trees out here.

Sigh... STILL no assp! by heavyboots · 2004-12-20 10:59 · Score: 2, Informative

IMHO, these guys run rings around everyone else. Sure it's not dirt simple to install, but it's certainly simpler than Spam Assassin used to be (I haven't tried 3.0 so I can't comment on the ease of installation of that). And it blocks spam quite effectively on any OS that can run perl. More to the point, it rejects spam immediately, so you're not dealing with messages piling up in the queue waiting to be filtered. They either make it onto the mail server or they don't. Also, if it's a real, valid mail server at the other end, the user should get a notice that their message was rejected, generated by that mail server. However, a spam zombie isn't going to care that you rejected its message with a 550 error and you aren't going to generate an outgoing piece of email to the wrong reply-to address.

http://assp.sourceforge.net

Slashdot Mirror

Reviewing Anti-Spam Offerings

25 of 311 comments (clear)