As spam has spiraled into a pandemic problem, many folks have come up with many ways to reduce the sheer volume of spam individuals receive. Six months ago, or so, I wrote about a Challenge/Response Spam Blocking System I wrote to help tide the deluge of spam I was receiving. Since then I have moved to a Bayesian approach, using the Spambayes Outlook Add-In, which I have found to be a wonderous (and free!) product. Spambayes works so well because it is tailored to the email you receive. Since I receive a lot of technical emails from listservs and colleagues, especially on ASP.NET, tokens like ASP.NET, ADO.NET, DataSet, loop, method, object, class, etc. are all strong indications that the email's not spam.
Anywho, one approach that many ISPs are taking is to employ universal sam blocking at the ISP level. I have some reservations about this approach for a couple of reasons.
- It assumes that there's some global spam “signature,” but the spam (and non-spam) one receives, I contend, is personalized. That is, the probability of you getting particular types of spam likely has to do with factors on how a spammer got ahold of your email. For example, I get spams from software companies, which I'd wager others who are not in a technical field receive less of. I'd imagine those who regularly post their email on very high-traffic, entertainment sites, are more likely to get such targetted spam. Too, companies you volunteerly give your email address to might sell your address, or have it obtained by another company when they go out of business.
- Those messages marked as spams never make it to the recepient's inbox. I know this is the intended approach, but what about false negatives? That is, what if a legitimate email gets flagged as a spam by the ISP? It will never reach the recipient's inbox, where, had it, and been marked as spam by, say Spambayes, the recipient would still have an opportunity to find said email in the Junk Email folder and mark it as non-spam.
Now, I have no statistics to back up these claims (namely, that spam is somewhat personalized), but one thing I know doesn't work are universal filters at the ISP level. Yes, these filters are nice because the computer illiterate doesn't have to concern himself with the details of installing and configuring an anti-spam solution, and, yes, these spam filters might weed out the vast majority of the spams, but at the same time they are likely cutting out a handful of legitimate emails that happen to be ensnared by the anti-spam nets. This concern exists both from my personal experiences in issuing challenges in a C/R anti-spam system, and also from emails I've received from folks, noting how emails they send from their Web sites are routinely getting blocked up by spam blockers at the ISP level.
I tend to view spam blocking software like the idealization of the American justice system - I'd rather have a few spams get through than have one legit email be marked as a spam. Clearly, spam blocking at the ISP level does not permit this.