I need a good email spam filter

[otter]

What is the best email spam blocker to download?

[pornrex]

That's a good question otter.

Come on folks, recommend something to otter and myself please!

[ecchi]

Best recommendation : None.

If you have a spam filter it is going to occasionally filter something you don't want filtered. If it is a personal account you are going to get a friend or two stopping talking to you because you failed to reply to an email they felt was important. If it is a business account you are going to loose customers.

[cd34]

echhi: that assumes you use one that matches patterns.

dspam and crm114 are statistical, meaning, you train them. my false positive rate on dspam is probably 1:4500. They are server based but there is a popserver proxy, so, you could check mail through their proxy which would pass it through the spam filtering. There may be companies offering that service. Email is again useful for me and, I don't think there is a better way out there than dspam.

http://nuclearelephant.com/projects/dspam/
http://crm114.sourceforge.net/ (I loved the Dr. Strangelove reference here. Funny how that reference keeps coming up eh Cleo?)

The biggest thing, by far, was adding Greylisting. I would have to say that knocked out almost 80% of the spam right off the bat. The downside is that any 'new' person that contacts you will have thier first email delayed 5-30 minutes. Any subsequent email for whatever timeout period you specify will come through immediately. The benefits far outweigh the detriments.

http://projects.puremagic.com/greylisting/

[ecchi]

Basically this means that if 100 friends never send you an email using the word "free" then it assumes no friend ever will. Hmmm

[cd34]

if that is the only text in the message, sure.

However, most messages that I receive have more than 1 word.

I don't know why your friends would be sending you 1 word messages.

[chilihost]

I use the built in filters in Outlook 2003 and they do a bloody good job. It took a few weeks of "teaching" it that certain domains could be trusted even though they were porn domains, but now all I have to do is once a day go thru my junk mail folder to make sure it is all junk mail.

cheers,
Luke

[ecchi]

Cd34 - I was being simplistic rather than bore everyone by going into it too deep. Yeah, your friends or customers have to use a "forbidden" word more than spammers, but this is a bad thing, not a good one. Spammers know how these thing work, so work at beating them, your friends will just use the words blindly. For example "free" and "Viagra" are common words for them to count. A spammer will say something like "f-ree o'ffer with our vi@gr@ prescriptions". A friend may say "..but on the bright side it means I get free viagra from the health service". However clever your filter is, the "friend's message" is going to ring more alarms than the genuine spam.

chilihost - but that takes as long as deleting spam manually as it comes in.

[cd34]

ecchi: I suggest you reread his methods specifically regarding chained tokens and statistical analysis. His chi square method is quite accurate.

Briefly, every piece of data in the header and body of the message that your friend sends is grouped into tokens. Each of those tokens is assigned a statistical value for each message received. When you receive email from your friend, it might have 90 tokens. Each spam will consist of a number of tokens as well. The statistical guess at the end decides whether the email has more spam tokens than antispam tokens + a deviation of the weight/confidence that a given token is a spam indicator. You can also adjust the Noise Reduction to bias that determination.

So, if you get a lot of spam routed through tivoli.co.uk's open relay, a valid message from a friend working for IBM/Tivoli will have a higher spam probability, but, because of the spam/non-spam score, those tokens won't be weighted as highly. That means, that other portions of the content would be dealt with.

Because of the way emails are written, no matter how many 419 emails I receive, its the pattern of the 419 email that gives it away. Doesn't matter whether it mentions Nigeria, Sumatra, or any other international city, statistically, there are things in the email that give it away. Since training dspam, I have only had 2 419 emails that it has missed in the last month, all of the rest were properly tagged.

As for false positives, I had one that it tagged as spam that wasn't. Short of that, my emails go into the right folders, every time, I don't have to deal with setting up rules or anything. When I was using spamassassin, my Citibank statement, bellsouth statement, etc were all considered spam. I was amazed at how much mail I was losing with spamassassin.

The main advantage to statistical versus pattern matching is the diversity of your email versus mine. Emails that you receive might be considered spam if I received them, and vice versa. With Spamassassin, you are using a shared corpus among people that have culled this from their inbox to feed it and generate the weights.

There are other more advanced analysis methods, covered in detail in their whitepapers.

[ecchi]

Yes but this still relies on two untrue premises:

1. People who send spam do not spend time deconstruction the way the anti spam software works, in order to beat it.

2. All your friends are basically the same and all think alike, to a very small deviation from the group "norm". (a good example is that very few men are prepared to talk about erectile dysfunction, but a lot of spam does. So when a friend of yours gets depressed and writes to you for sympathy it will be tagged as spam. You won't see it, so won't reply, and your friend will go through life thinking that in his hour of need, you shunned him).

Also, I looked into a couple of spam filters using this method a while back (I get 1K+ spam a day). Maths was one of the few subjects I excelled at in school, and when you really studied the maths they quoted as "making them work" it was all gobbledygook hiding a basically flawed mathematical premise.

[dareutwo]

I use Safety Bar from Cloudmark. formerly called SpamNet
A few bucks a month, and it does exactly what it says it will do.
With OE, simply make a few rules and your set.