Cost of FirstAlert

Sukie · Trooper Joined: Feb 16, 2004 Posts: 11 Location: USA

Hi--I have posted several times but couldn't find my password etc. so I reregistered just now. I was a bit miffed anyway as under my original member info it showed me as a "guest." I am not a "guest." I have had Mailwasher, then purchased Mailwasher Pro, and had signed up for First Alert's trial program from the beginning.

I do have a question. I live on disability and just don't have any more money to pay for new software programs. My pocket is empty. If when the FA has to be purchased I just keep my Mailwasher Pro, and when that runs out if I switch back to Mailwasher, will that be enough to give me some protection from all the spam? I don't need MW Pro anymore as I only got it so I could have more than one email address.

Ikeb · Posted: Mon Feb 16, 2004 6:03 pm Post subject:

My suggestion would be to stick with MWP. No need to give that up if you drop FA!. You can easily turn off the FA! feature and rely on other Spam Tools such as Blacklist/Friends list, regex filters, and "coming to your area soon", Bayesian filters.

stan_qaz · Posted: Mon Feb 16, 2004 10:37 pm Post subject:

The old mailwasher isn't being updated much any more, only an occaisional bugfix as time permits.

Mailwasher Pro comes with a year (minimum) of updates and as Ikeb said the Firstalert component is completely optional, you can turn it off with one check mark if you don't want to use it. Stay with the Pro version and you'll be much happier.

Sukie · Trooper Joined: Feb 16, 2004 Posts: 11 Location: USA

In response to both Ikeb's and Stan-qaz's responses (last two above) to my original questions about First Alert and Mailwasher Pro, could you please explain (1) what is Bayesian filters and how do I will them and (2) if after my year of having Mailwasher Pro is up and I no longer am eligible for the updates, then wouldn't that be the same as having to purchase another year's full Mailwasher Pro to get new updates? IE, MWP is an annual subscription in reality....

stan_qaz · Posted: Tue Feb 24, 2004 1:55 pm Post subject:

Ikeb · Posted: Tue Feb 24, 2004 10:39 pm Post subject:

AbdLomax · Private Joined: Mar 10, 2004 Posts: 35 Location: USA

I've just popped into this forum. I've been a very happy Mailwasher Pro user, the latest release was a vast improvement. I just learned about First Alert and have been very pleased by the idea, it is close to what I've been writing about elsewhere as a solution to the spam problem.

The organization of large numbers of people to solve certain social problems is a major interest of mine, see www.beyondpolitics.org. The First Alert network does have some characteristics of the kinds of networks that interest me.

Anyway, the topic here is the cost of First Alert. The First Alert system requires a on-duty administrator, and has other costs as well. Somebody's got to pay for that. The First Alert concept is pretty close to my ideas, and in my ideas, we, as users, would pay the costs of a spam-fighting organization, *plus* we would volunteer a *small* amount of time without any compensation other than the satisfaction of public service, plus of course, the resulting vast reduction in spam made possible if large numbers of us do, in fact, participate.

I do think that the system will need administrative review of spam reports. But the need for that review could be minimized by having user classes. We need to remember that spammers *will* try to gum up any system we set up, but it is still possible to have validated and qualified users whose reports would be given special credence. Perhaps if N validated users report the same spam, that spam would automatically be added to the spam database. If the source IP is also on a reliable origin blacklist, that would seal the doom of this spam.

SpamCop's origin database is excellent, but it suffers from administrative red tape that slow it down. I was excited to discover that Mailwasher automates SpamCop reporting; I started using this immediately. Then I found that every such report must be followed up by a web login to validate the report (mainly to confirm that I was a human being, not a spamer trying to gum up the system). Since I was *already* validated as part of the registration process, not only did this requirement create *way* too much work for me, it seems to be overkill.

The SpamCop database, properly used, is *not* reliable for autodeletion of messages. Rather, if mail IP is on that list, it is at least 99.9% likely to be spam. The problem is the other 0.1%, which consists of, for example, unfortunate AOL users who happened to be logged into a blacklisted AOL server being used by a spammer. AOL is pretty fast, but, still, legitimate mail does get tagged by SpamCop. So the key to SpamCop improvement is to speed it up, to make it easy to use without making it vulnerable to spammer sabotage. To do that, the vast power of large numbers of volunteers, each one contributing a very small amount of work, needs to be effectively harnessed. Right now, I get, when I log in in the morning, perhaps 300 spams. About 90% are tagged by SpamCop. Maybe once every few weeks -- not more, maybe less -- I see a legitimate mail also tagged, it is pretty rare. Anyway, I see about 30 spams that are not yet tagged by SpamCop. When I was reporting that, the report from SpamCop always came back "Yum! Fresh Spam." But because of the SpamCop red tape, my reports were really useless. They were being ignored unless I spent a *lot* more time on each one.

$20 per year is less that $2 per month. Right now, I spend maybe five minutes per day dealing with spam (it used to be a lot more before I got Mailwasher Pro. First Alert could easily cut that time in half, if it is effective, including the time to report spam (if it is as easy as SpamCop reporting. The key will be speed. If there are First Alert users all over the world, the first users to receive spam will get it long before *most* users. If their reports can be quickly processed and confirmed, most users will never see the spam, just the few for which they would be first reporters. I'd guess that this could reduce unidentified spam volume, even with a fairly modest number of reporters, by better than 90%. The more the reporters, the larger the reduction, *if* the system is not depending upon a few possibly overworked administrators. There must be administrators, but they are better relegated to watching for phoney reporters, and possibly, if time is available, to a post-blacklist review. With most mail, falsely adding the mail to a blacklist for a short time is *not* terribly harmful *if* the sender is informed that their mail may have been wrongfully blocked, we apologise, please resend. In other words, *zero* false positives is not a necessary goal, it would be enough if false positives are quite rare.

Sender blacklists are very, very dangerous. If it were up to me, I'd *never* have Mailwasher default to add mail to a blacklist. Once a mail is on my local blacklist, especially if the blacklist hides the mail, mail from that sender will simply disappear. As an example of how harmful this can be, I've found legitimate senders in my blacklist. How did they get there? The most likely cause was a temporary SpamCop blacklisting of their mail server, which can happen in various ways that do not prove that the sender is a spammer. So this new customer sends me a mail, gets blacklisted, then keeps sending mail and wonders why we never reply. That is not tolerable. Once I realized that my local blacklist was tagging less than one mail on the average per day, whereas SpamCop tagged 90 percent of spam or more, I cleaned out my blacklist and I only add to it the very few sources which are *not* spam but from which I still want to discard mail. (With a legitimate business or other legitimate sender, it is generally better to request to be removed, but sometimes that is too much trouble or doesn't work -- some nonprofits don't clean their lists very well.)

The First Alert blacklist is not a source blacklist, it is a *content* blacklist. One of my suggestions for Mailwasher improvement is that it become possible to combine content filtering with source IP filtering. I.e., if a mail is tagged by SpamCop, tag for deletion and display for confirmation. If a mail is identified as spam by local filtering, is not tagged by First Alert, tag for deletion, for report to First Alert, and display for confirmation. If a mail is tagged by SpamCop *and* is identified as spam by strong local filtering or is tagged by First Alert database, tag for deletion and hide. Etc. Right now, Mailwasher cannot combine SpamCop tagging with other criteria; such combinatorial analysis could be used to greatly reduce the need for user intervention.

With good combinatorial rules (which might even be required for reporting First Alert members), and if First Alert becomes large enough and is properly administered, the labor required of volunteers could get very, very low. It really could kill the spam problem.

So if it saved me four minutes a day, day in and day out, that would be 20 hours per year. Is this worth $20 per year? Do I really have to ask the question? (Properly administered, the cost of running the system, including profit for Firetrust, could be quite a bit lower than $20 per year. I'd suggest, in fact, charging $19.95, and if it turns out that this is more than enough, lower the price and *extend the current subscriptions.* By lowering the price, more people will join. The other approach would be to start with a low price, perhaps for a shorter subscription time.

Ikeb · Posted: Thu Mar 11, 2004 2:04 am Post subject:

Welcome AbdLomax. Gad! Did you say you were a writer ... as in a professional writer? You could at least put in some subtitles or something. I felt like I was reading a book! Razz

... and almost as long as some of my responses to posts regarding subjects that interest me, I hasten to add before someone else does it for me .... Embarassed

Anyway to your main point -- voluntarily spending time to report SPAM to FA!: Why should I spend time to report SPAM if I can just wait until someone else reports it? Not a very "community-oriented" approach to be sure but I'd save lots of time if I just auto-delete. Besides, I'm just one user -- my input would be insignificant. Anyway, why should I have to do anything? After all, I paid for this service and I expect service.

Of course if that's the approach most users take, the service fails. ... As it seems to be doing now. 20% to 40% hit rate is not a very good track record. Many folks have posted their disappointment here regarding current FA! performance.

I admire the altruistic approach many folks have advocated, but let's get realistic. Money makes the world go 'round. And I suspect it wouldn't take much. Reward solid contributers (i.e. whoever first reports lots of SPAM but who also takes care to avoid reporting false positives) with a reduction in the next year's subscription fee proportional to the amount of SPAM reported. Yes this would reduce revenues. But many more non-contributers would subscribe to a successful service, more than making up the difference.

Reward also with recognition awards. The FireTrust site would list handles of top performers so as to attract those whose motivations are higher on the Maslov scale. Wink

BTW, I agree that the FA! administrators can easily get overwhelmed with the minutia. I'd say the FA! system should better be based on three subscriber reports for the same message, rather than the current one subscriber plus FA! administrator approval. That would allow the system to scale more easily, and, I suspect, become more responsive.

Anyway, this has been discussed already so before I end up writing my own book, allow me to suggest that, using the search engine, check out previous posts regarding this subject.

Oh, and happy reading! Smile

AbdLomax · Private Joined: Mar 10, 2004 Posts: 35 Location: USA

Writing is what I love to do. Occasionally I've been paid, more often any compensation is indirect....

It was said, rhetorically: "Why should I spend time to report SPAM if I can just wait until someone else reports it?" This view is rational *if* the time it takes to report spam is enough to be a burden. This is why it is so important that it be made *extremely* easy to report spam. This is where SpamCop has failed, in my view. (More accurately, it's easy to report, but the system ignores reports unless followed up with a *lot* more work.)

Now, if it is easy to report, it will also be easy to erroneously report. So reports must be verified. They can be verified by a paid administrator. If the level of fresh spam is low, this could be cost-effective, but it should also be noted that a paid administrator can *also* make mistakes. I think it will be more cost-effective -- as well as being safer -- to have a system that is a little more complex, but less expensive to operate. This would involve a number of levels of validation of spam.

(1) I'll call reporters of spam "volunteers." A means must be in place to validate volunteers as identifiable human beings. One elementary means is to charge a fee, it need not be large. The fee can also be the same fee by which one becomes a user of the service. If it's paid by credit card, that does not immediately prove identity (because it might be a stolen credit card number), but after some delay, it does create a reasonable presumption of identity.

(2) Volunteers who have correctly reported spam (as validated) for a period and a minimum number of reports would be recognised as "expert" volunteers or something like that.

(3) To add a spam to the database, a minimum number of reports from independent volunteers would be required. Expert reports would be weighted higher, *perhaps* as few as two expert reports would be required. When the minimum number of reports is reached, the spam is added. This is temporarily considered a validated report, and First Alert users would stop seeing the spam.

(4) The apparent sender of the spam is notified by a condensed email report that refers to a web document. The report would provide enough information that a spoofed sender would not need to do anything further. (this is why the First Alert system is much better than a sender blacklist, sender blacklists are a major nuisance, and will continue to get worse.)
A standard non-automatable login would allow the sender to protest the tagging as spam. If a protest is filed, *then* a paid administrator investigates and rules. If the system is properly designed, administrators would rarely have to intervene. If the alleged spammer is apparently a business, I might require a small bond to be posted before an administrator will look at the matter. There are more details that could be added here, for sure.

(5) If an administrator rules that a mail was spam, the designation becomes permanent unless the administrator is subsequently over-ruled. If there is no protest within a certain period, a designation may be presumed permanent.

(6) The first Alert system should, if possible, keep enough of blacklisted mail headers and content that if an erroneous spam tagging is determined to have occurred, the senders and the recipients can be notified so that permanent damage is limited. Once a designation has become permanent, and if storage becomes a burden, such information could be discarded.

It is essential in such a system that the burden on volunteers be minimized. The easier it is for volunteers to identify and report spam, the more volunteers will be willing to do so. The unavoidable minimum is the time necessary to recognise clearly that a piece is spam. Sometimes the subject line is quite enough, sometimes it is necessary to look at the body. Mailwasher does make all this easy. If the reporting is as easy as is the Mailwasher part of SpamCop reporting, it will be good enough. It is possible that certain validated content filters could be allowed, i.e., very strong, unmistakeable recognition of spam content by an automated filter, in addition to as little as one expert volunteer confirmation, could be sufficient. A great deal of spam that I receive could be automatically identified with a filter with very low or non-existent false positives, particularly if there is also source IP match to a spam list. This is why Mailwasher needs to allow more complex combinatorial filtering (i.e., OnIPblacklist * SmellsLikeSpam = Autodelete. And maybe Autoreport, if SmellsLikeSpam is a validated, approved, strong content filter. (This content filter could be running on the system receiving spam reports, but if it is also running on First Alert user systems, it will speed up spam reporting.)

one more item:

First Alert should keep track of the volume of mail being tagged by a particular spam pattern match, as well as the sender IP. A mail that is being received by large numbers of recipients may have stronger requirements in some ways to be removed from the database.

The details will be worked out as the system grows, but I think the basic First Alert concept is really good. I just don't think that it is necessary to have a paid administrator look at everything. That will slow down the system as well as raising very substantially its cost.

As to paying volunteers, expert volunteers who continue to report might be paid by an extension of their subscription.

What was really irritating about the SpamCop system, for me, was that the delay introduced by the necessity of manually validating all reports with a tedious log-in process meant that much more spam was getting through. SpamCop misses about 10% of my spam. That could be *vastly* reduced if the reporting process were made more efficient, thus reducing all the wasted work while hundreds or thousands of SpamCop users tediously wade through the process. Volunteer labor may not be costing SpamCop anything -- indeed, the volunteers may be paying -- but it is still *very* valuable and should be efficiently applied. There were plenty of SpamCop volunteers writing on the SpamCop mailing lists about how they were spending all day reporting spam, tediously copying headers into a mail, then doing the web validation for each one. To them, the web validation was not a problem, because it was the easiest part of the process.

When I wrote to the list mentioning that Mailwasher made it trivially easy to submit a SpamCop report, the only answer I got was "Mailwasher! Mailwasher creates all these bounces, which increase the damage that spam does." It was true, but short-sighted. Mailwasher makes bouncing optional, and, in my opinion, bouncing is indeed *usually* a bad idea. I get a *lot* of bounces for mail I did not send. It does indeed add to spam traffic. Bounce messages should be configurable and should never be the default, and users should be warned about the harm that bounces can do. I'd like to bounce certain kinds of mail with a customized message. It would look something like this: "I'm sorry, but it appears that you or someone impersonating you have sent mail to , or have for some other cause been added to our spam blacklist, and all mail from you is being automatically deleted. If you are not a spammer and would like us to read your mail, please send a piece of mail to spamtrap-appeal[at]texturatrading[dot]com, making the appropriate corrections to the address. Do NOT reply to this mail. We apologise for the inconvenience. Unfortunately, any mail which is receiving this response has been lost." This mail would be sent, of course, from , which would also need to be configurable in Mailwasher (right now, if I am correct, bounces are automatically appearing to come from a mail system).

This would allow me to use a spamtrap. Mail to this trap would cause the sender to be added to my blacklist without further ado, it would be one of the exceptions to my avoidance of sender blacklists.

The First Alert system, by the way, could be a SpamCop reporter, if SpamCop cooperates....

AlphaCentauri · Captain Joined: Nov 20, 2003 Posts: 300 Location: USA

Does anyone know what the lag time is between a FirstAlert submission by a user and the spam being flagged by First Alert? Is it just missing my spams because I'm one of the first ones submitting, or is it really too delayed to catch most of it?

stan_qaz · Posted: Thu Mar 11, 2004 6:51 pm Post subject:

AbdLomax, you really need to go back (use the search) and look at past suggestions for qualifying users, prioritization of reports based on user performance, freshness of the spam being reported, dealing with duplicates, false reports and such. Putting all of the previous suggestions along with yours and making your case where they differ would be most informative.

AlphaCentauri, I haven't seen a time for posting to the database mentioned lately but they are working on getting it minimized. That would be an interesting statr to see along with how you as a user are performing.

AlphaCentauri · Captain Joined: Nov 20, 2003 Posts: 300 Location: USA

Well, I got my notification of the free trial ending. They're quoting $7 (US) for the first year, and $9.95 the second. I guess I'll go along, since they are pricing it pretty competitively (I assume PayPal will absorb $2 of that). I'd still like to see different pricing (or extensions of subscriptions) for active, early, contributors.

Terryphi · Posted: Fri Mar 12, 2004 3:41 am Post subject:

bobstur · Cadet Joined: Feb 28, 2004 Posts: 2 Location: USA

I too received the notification. In addtition to what's been stated I was told I'll be able to use FA for free until April 15th, "as a thank you for taking part in the Public Trial."

Frankly, I was surprised that the notification had no mention of the status of the FA development or the demonstrated effectiveness (or lack thereof) of FA.

I will leave FA turned on for another month, but at this point I see no basis for making FA a commercial product. Considering how good MailWasher was even at the beginning, I think Nick Bolton is making a mistake selling an ineffective product.

Crying or Very sad

polyglory · Posted: Fri Mar 12, 2004 2:50 pm Post subject:


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 572 pages served in previous 5 minutes. Page Rendered: 0.762 seconds.