Re: [mailop] Do we need Spam folders?

[Michael Rathbun via mailop]

On Mon, 21 Oct 2019 12:15:14 +0200, Alessandro Vesely via mailop
 wrote:

>Perhaps, a possibility could be to reject if the message is SPF and/or DKIM
>authenticated, still drop otherwise.  Would that make sense?  I find
>non-authenticated messages where I happen to know that the sending mailbox
>belongs to the same person as the recipient one.

Local practices:

1.  If MAIL FROM is a local address, the connection is dropped unless the user
has authenticated.

2.  If local users want to receive a file of one of the quarantined types,
then either the sender will need to change the extension to something
considered harmless, or drop a note to postmaster requesting the quarantined
file to be sent to them.

The "drop a note to posmaster" bit doesn't scale well, but at this site it
doesn't need to.

mdr
-- 
 "There are no laws here, only agreements."  
-- Masahiko


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Alessandro Vesely via mailop]

On Fri 18/Oct/2019 14:58:01 +0200 Michael Rathbun via mailop wrote:
> On Fri, 18 Oct 2019 10:21:47 +0200, Alessandro Vesely via mailop
>  wrote:
> 
>> For blatantly viral attachments, silently dropping the message still seems to
>> be the most appropriate action.  Is that a best practice?
> 
> Absolutely not.  And the message disappearance I mention above can happen for
> a message of any description.


I started dropping instead of rejecting when I saw people getting infected
after opening an attachment in a bounce message.  At the time, viruses were
mainly spread by open relays.  Sender and recipient seemed to be rather
interchangeable, so bouncing such messages would just increase the spreading
likelihood.

Perhaps, a possibility could be to reject if the message is SPF and/or DKIM
authenticated, still drop otherwise.  Would that make sense?  I find
non-authenticated messages where I happen to know that the sending mailbox
belongs to the same person as the recipient one.

Best
Ale
-- 

















___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Michael Rathbun via mailop]

On Fri, 18 Oct 2019 21:11:24 +0200, Thomas Walter via mailop
 wrote:

>If you don't look at them anyway, why don't you reject them at the gate
>at first sight?

"Except for research purposes..."  You can't look at data you discarded before
it even came to your posession.

OTOH, machines that HELO as me, or USER or throwawaymail or other manifest
atricities, don't even get to the MAIL FROM stage.

mdr
-- 
  ...you don't have to be nuts to believe something crazy.
  --Tom Bartlett


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Michael Wise via mailop]

Because for most high volume mailbox providers (think multiple millions of 
mailboxes), they don't make that call at the gate.

It's all done inside, when refusing it is no longer an option.

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Open a ticket for Hotmail<http://go.microsoft.com/fwlink/?LinkID=614866> ?



-Original Message-
From: mailop  On Behalf Of Thomas Walter via mailop
Sent: Friday, October 18, 2019 12:11 PM
To: mailop@mailop.org
Subject: Re: [mailop] Do we need Spam folders?







On 18.10.19 14:56, Michael Rathbun via mailop wrote:

> My personal client has rules that send messaged from CBL-listed IPs to

> the junk folder and marks them "read".  Other than for research

> purposes, I've not looked at one of those in well over a decade.



If you don't look at them anyway, why don't you reject them at the gate at 
first sight?



Regards,

Thomas Walter



--

Thomas Walter

Datenverarbeitungszentrale



FH Münster

- University of Applied Sciences -

Corrensstr. 25, Raum B 112

48149 Münster



Tel: +49 251 83 64 908

Fax: +49 251 83 64 910

https://nam06.safelinks.protection.outlook.com/?url=www.fh-muenster.de%2Fdvz%2F&data=02%7C01%7Cmichael.wise%40microsoft.com%7Cd7d09760a00848784c7108d753ff7299%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637070228916189025&sdata=osEyxBHXHqrm0hFRBll%2F9AgxAEPzeUD5kgtgpix%2B9BU%3D&reserved=0



___

mailop mailing list

mailop@mailop.org<mailto:mailop@mailop.org>

https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop&data=02%7C01%7Cmichael.wise%40microsoft.com%7Cd7d09760a00848784c7108d753ff7299%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637070228916189025&sdata=x%2BxLFcln89hPgEx87xOJAn8%2F0WPFjdfTJws5EYSJJ4o%3D&reserved=0
<>___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Thomas Walter via mailop]

On 18.10.19 14:56, Michael Rathbun via mailop wrote:
> My personal client has rules that send messaged from CBL-listed IPs to the
> junk folder and marks them "read".  Other than for research purposes, I've not
> looked at one of those in well over a decade.

If you don't look at them anyway, why don't you reject them at the gate
at first sight?

Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Michael Rathbun via mailop]

On Fri, 18 Oct 2019 11:56:17 +0200, Renaud Allard via mailop
 wrote:

>No, dropping an email without anyone knowing is still probably the worst 
>thing that can be done, whatever the case is. Refusing at SMTP time with 
>a 5XX message is still the best practice.
>Because your antivirus tells you this is "blatantly viral" doesn't mean 
>it really is.

The server I run removes and quarantines attachments that meet characteristics
I specify, sends the message to its intended recipient, and notifies the
Postmaster account of the event.

My personal client has rules that send messaged from CBL-listed IPs to the
junk folder and marks them "read".  Other than for research purposes, I've not
looked at one of those in well over a decade.

mdr
-- 
   "There will be more spam."
  -- Paul Vixie


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Michael Rathbun via mailop]

On Fri, 18 Oct 2019 10:21:47 +0200, Alessandro Vesely via mailop
 wrote:

>For blatantly viral attachments, silently dropping the message still seems to
>be the most appropriate action.  Is that a best practice?

Absolutely not.  And the message disappearance I mention above can happen for
a message of any description.

mdr
-- 
My study of life and history inclines me to the apothegm "If you insist on
burning bridges, it is often best to cross them before engaging the
incendiaries." --  Shebardigan


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Renaud Allard via mailop]

On 10/18/19 10:21 AM, Alessandro Vesely via mailop wrote:

On Thu 17/Oct/2019 04:35:53 +0200 Michael Rathbun via mailop wrote:

On Thu, 17 Oct 2019 13:11:31 +1100, Michelle Sullivan via mailop
 wrote:


Worse when they (the receiver) silently discards them... user checks the
spamfolder and their inbox and the sender thinks it all went through and
the email is never seen despite people looking for it and wanting it.


For at least one provider, unfortunately, that is due to the system's
architecture being such that there are situations in which the system's
behaviour is essentially indeterminate, and "completely losing the message
without hope of tracing what happened" is a predictable outcome in some
percentage of cases.



For blatantly viral attachments, silently dropping the message still seems to
be the most appropriate action.  Is that a best practice?


No, dropping an email without anyone knowing is still probably the worst 
thing that can be done, whatever the case is. Refusing at SMTP time with 
a 5XX message is still the best practice.
Because your antivirus tells you this is "blatantly viral" doesn't mean 
it really is.




smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Alessandro Vesely via mailop]

On Thu 17/Oct/2019 04:35:53 +0200 Michael Rathbun via mailop wrote:
> On Thu, 17 Oct 2019 13:11:31 +1100, Michelle Sullivan via mailop
>  wrote:
> 
>> Worse when they (the receiver) silently discards them... user checks the 
>> spamfolder and their inbox and the sender thinks it all went through and 
>> the email is never seen despite people looking for it and wanting it.
> 
> For at least one provider, unfortunately, that is due to the system's
> architecture being such that there are situations in which the system's
> behaviour is essentially indeterminate, and "completely losing the message
> without hope of tracing what happened" is a predictable outcome in some
> percentage of cases.


For blatantly viral attachments, silently dropping the message still seems to
be the most appropriate action.  Is that a best practice?


Ale
-- 






















___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Michael Rathbun via mailop]

On Thu, 17 Oct 2019 13:11:31 +1100, Michelle Sullivan via mailop
 wrote:

>Worse when they (the receiver) silently discards them... user checks the 
>spamfolder and their inbox and the sender thinks it all went through and 
>the email is never seen despite people looking for it and wanting it.

For at least one provider, unfortunately, that is due to the system's
architecture being such that there are situations in which the system's
behaviour is essentially indeterminate, and "completely losing the message
without hope of tracing what happened" is a predictable outcome in some
percentage of cases.

mdr
-- 
The Duckage Is Feep.
   -- Vaul Pixie


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Michelle Sullivan via mailop]

Luis E. Muñoz via mailop wrote:


On 14 Oct 2019, at 9:29, Chris Wedgwood via mailop wrote:

as things stand today, i think we do

technology has gotten very good but it's not perfect; sometimes spam
isn't detected, and sometimes real messages are detected as spam

I would rather have the email bounce during SMTP transaction. At least 
that way, the sender knows that the recipient won't get the message. 
Otherwise, the message will sit unread for 14 days before being 
auto-deleted with nobody ever looking at it.


Not having spam folders also nails the "I moved this bazillion emails 
into the  folder because I don't want them anymore".


Unfortunately, the user moving messages in and out of spam folders is 
a useful signal for the mailbox providers. I wonder if using the \Spam 
flag would be a better option. Allowing the MUA to control 
presentation altogether.



Worse when they (the receiver) silently discards them... user checks the 
spamfolder and their inbox and the sender thinks it all went through and 
the email is never seen despite people looking for it and wanting it.


--
Michelle Sullivan
http://www.mhix.org/


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Brandon Long via mailop]

Or the "power" users who go through their spam folder and forward every
message in it to 20 abuse/postmaster addresses plus the FBI?  Messages that
were automatically determined to be spam.

User's are weird.

Brandon

On Wed, Oct 16, 2019 at 7:19 AM Alexander Zeh via mailop 
wrote:

> The thing is.. maybe technically savvy users don’t need spam folders. But
> having „normies“ in mind, like I’m thinking of my parents or friends who
> work in a totally different industry, I’m sure we need spam folders.
> Why? Because most people are kind of lazy. They don’t want to move spam
> away, even if it’s only one click. They want the provider to do it for
> them. And if they can choose from multiple providers (e.g. Google vs.
> outlook.com vs. Yahoo …) they will choose the more convenient option.
> (Just think of WhatsApp or messengers in general.. WA was so extremely
> successful, because it was the first who’s was really convenient for the
> users).
>
> And (especially big) providers do whatever the majority of the users want,
> because that’s what enables their business.
> If you run a server for a couple of users, simply try the approach you’re
> suggesting here and wait for the reaction. I’m pretty sure most users won’t
> be very happy and ask you to bring back the old behavior.
>
>
> Am 16.10.2019 um 14:19 schrieb Jaroslaw Rafa via mailop  >:
>
> Dnia 16.10.2019 o godz. 13:01:49 Paul Smith via mailop pisze:
>
> In your first situation, rejecting the messages is very bad. In the
> second situation, rejecting the messages *may* be better than
> accepting and semi-hiding - but only if you have another viable way
> of contacting the recipient. So, in general, rejecting is the worse
> option.
>
>
> I'm not in favour of rejecting.
>
> I would rather be in favour of only *marking* the possible spam as spam,
> without auto-moving it to the spam folder, and leaving the option to do so
> to the user. It may be a single-click setup that turns on automatical
> moving
> of messages marked as spam to the spam folder, but still if this would
> require user's decision, the user will be more aware that such thing as
> spam
> folder exists at all, and more likely to check this folder periodically
> than
> in case when this is set up automatically by email provider and the user
> might even don't know about it.
> --
> Regards,
>   Jaroslaw Rafa
>   r...@rafa.eu.org
> --
> "In a million years, when kids go to school, they're gonna know: once there
> was a Hushpuppy, and she lived with her daddy in the Bathtub."
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 16.10.2019 o godz. 16:17:03 Alexander Zeh via mailop pisze:
> Why? Because most people are kind of lazy. They don’t want to move spam
> away, even if it’s only one click.

But it's one click only once. Not everytime you open your mailbox. I think
about it as working as follows: when you create a new email account, spam is
not automatically moved to spam folder, but remains in inbox marked as spam
(there isn't even a spam folder). The user can click on a button that
creates the spam folder and automatically sets up a filtering rule to move
all messages that are marked as spam to that folder.

So, after clicking that button the behaviour is *exactly* as current default
- messages marked as spam are automatically moved to spam folder. The
difference is that the user *knows* that spam folder has been created and
that some messages are automatically moved there without hitting the inbox.
So he/she is more likely to look into that folder from time to time.

As currently the providers do this setup by default and there's no need for
that click, I would suppose that most "normies" - as you called them :) -
after creating an account on Google/Yahoo/Outlook.com etc. *don't even
know* what is spam folder and how it works/what is it's purpose. So they
don't look into it. If they had to click on that button - and they wouldn't
have a reason to do it until they receive first spam messages - they would
at least have a kind of idea that such a mechanism exists.

> If you run a server for a couple of users, simply try the approach you’re
> suggesting here and wait for the reaction. I’m pretty sure most users
> won’t be very happy and ask you to bring back the old behavior.

They could bring it back with that one click, so no reason to ask anybody :)
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Alexander Zeh via mailop]

The thing is.. maybe technically savvy users don’t need spam folders. But 
having „normies“ in mind, like I’m thinking of my parents or friends who work 
in a totally different industry, I’m sure we need spam folders.
Why? Because most people are kind of lazy. They don’t want to move spam away, 
even if it’s only one click. They want the provider to do it for them. And if 
they can choose from multiple providers (e.g. Google vs. outlook.com 
 vs. Yahoo …) they will choose the more convenient option. 
(Just think of WhatsApp or messengers in general.. WA was so extremely 
successful, because it was the first who’s was really convenient for the users).

And (especially big) providers do whatever the majority of the users want, 
because that’s what enables their business.
If you run a server for a couple of users, simply try the approach you’re 
suggesting here and wait for the reaction. I’m pretty sure most users won’t be 
very happy and ask you to bring back the old behavior.


> Am 16.10.2019 um 14:19 schrieb Jaroslaw Rafa via mailop :
> 
> Dnia 16.10.2019 o godz. 13:01:49 Paul Smith via mailop pisze:
>> In your first situation, rejecting the messages is very bad. In the
>> second situation, rejecting the messages *may* be better than
>> accepting and semi-hiding - but only if you have another viable way
>> of contacting the recipient. So, in general, rejecting is the worse
>> option.
> 
> I'm not in favour of rejecting.
> 
> I would rather be in favour of only *marking* the possible spam as spam,
> without auto-moving it to the spam folder, and leaving the option to do so
> to the user. It may be a single-click setup that turns on automatical moving
> of messages marked as spam to the spam folder, but still if this would
> require user's decision, the user will be more aware that such thing as spam
> folder exists at all, and more likely to check this folder periodically than
> in case when this is set up automatically by email provider and the user
> might even don't know about it.
> -- 
> Regards,
>   Jaroslaw Rafa
>   r...@rafa.eu.org
> --
> "In a million years, when kids go to school, they're gonna know: once there
> was a Hushpuppy, and she lived with her daddy in the Bathtub."
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 16.10.2019 o godz. 13:01:49 Paul Smith via mailop pisze:
> On 16/10/2019 12:30, Jaroslaw Rafa via mailop wrote:
> >Second case is when you want to*send*  mail to someone. Someone is selling
> >something on the Internet, you want to buy it, but in order to do it, you
> >have to send e-mail to the seller's address provided in the ad.
> 
> If the person is wanting to receive emails from you (as in the case
> of them selling something) they should be regularly checking their
> spam folders - if not, they are losing out on sales. That's their
> loss.

Not necessarily. If my message falls to spam folder, and a message from
other potential buyer stays in the inbox, the result is that someone other
would buy the stuff and not me. In that case, it's my loss.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 16.10.2019 o godz. 13:01:49 Paul Smith via mailop pisze:
> In your first situation, rejecting the messages is very bad. In the
> second situation, rejecting the messages *may* be better than
> accepting and semi-hiding - but only if you have another viable way
> of contacting the recipient. So, in general, rejecting is the worse
> option.

I'm not in favour of rejecting.

I would rather be in favour of only *marking* the possible spam as spam,
without auto-moving it to the spam folder, and leaving the option to do so
to the user. It may be a single-click setup that turns on automatical moving
of messages marked as spam to the spam folder, but still if this would
require user's decision, the user will be more aware that such thing as spam
folder exists at all, and more likely to check this folder periodically than
in case when this is set up automatically by email provider and the user
might even don't know about it.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Paul Smith via mailop]

On 16/10/2019 12:30, Jaroslaw Rafa via mailop wrote:

Second case is when you want to*send*  mail to someone. Someone is selling
something on the Internet, you want to buy it, but in order to do it, you
have to send e-mail to the seller's address provided in the ad.


If the person is wanting to receive emails from you (as in the case of 
them selling something) they should be regularly checking their spam 
folders - if not, they are losing out on sales. That's their loss.



If the message
ends in his/her spam folder, he/she has no clue to look there for it -
unless you have another way to contact the recipient and tell him to look
there. That's a more problematic case.


So, if you don't have another way to contact the recipient, how is it 
better that the recipient has zero chance of seeing the message than it 
going into their spam folder where they do have a chance of seeing it?



We can think of two quite opposite cases here.
The problem is that the receiving system can't tell the difference. So, 
you either accept "spam" and semi-hide it, or you reject it meaning that 
the user has no chance of finding the message (or you break SMTP and 
fake a rejection when you have really accepted it). In your first 
situation, rejecting the messages is very bad. In the second situation, 
rejecting the messages *may* be better than accepting and semi-hiding - 
but only if you have another viable way of contacting the recipient. So, 
in general, rejecting is the worse option.




--


Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53

Sign up for news & updates at http://www.pscs.co.uk/go/subscribe

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 16.10.2019 o godz. 03:43:10 Ángel via mailop pisze:
> 
> Suppose you bought service/product X, but didn't receive the
> confirmation email.
> Note: You are an end user, and don't have access to the server logs. ;)
> 
> Did the have an issue sending you the mail? Was it rejected locally as
> spam? Is it pending that their financial department actually approves
> the operation?
> 
> For the case where it ended up detected as spam:
>  a) if it was filed into a Spam folder, the user can find it there
> directly
>  b) if it was rejected at smtp-level, you would need to hope that the
> sender cared and implemented some logic to do something with it, rather
> than ignore delivery errors. The email sender probably doesn't care
> contacting you -it is *you* who requested to be mailed- and is likely to
> assume that you provided a wrong email address. In fact, from their
> point of view, your email address is invalid, since they can't write to
> you (they are blocked by the spam filter).7
> 
> As such, the spam folder provides a self-service option that benefits
> sysadmins and smart users.

We can think of two quite opposite cases here.
First one is what you describe. You bought something, want to register on
some website etc. - in short, you are *expecting* a message from a
particular sender and it's *you* who is interested in getting the message.
Then you may actually look for the message in your spam folder if you don't
see it in your inbox.

Second case is when you want to *send* mail to someone. Someone is selling
something on the Internet, you want to buy it, but in order to do it, you
have to send e-mail to the seller's address provided in the ad. Someone
published an article on a website, and you want to send him/her your comments
via e-mail address published under the article. Or you just want to contact
some person on any matter, and someone gave you their email address. In that
case the recipient is *not* expecting mail from you, and you are the one
interested that your message actually gets to the recipient. If the message
ends in his/her spam folder, he/she has no clue to look there for it -
unless you have another way to contact the recipient and tell him to look
there. That's a more problematic case.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Ángel via mailop]

On 2019-10-14 at 18:02 -0700, Brandon Long via mailop wrote:
> I mean, we do offer with sectioned inbox to move other messages out of
> the default view (since we're using
> labels, everything is still in the label, just different views), so we
> could offer that for spam as well... but frankly,
> why?  We also had "bundles" in Inbox, which is could also have been
> used for spam... but why?
> 
> Having a spam folder has been the standard user interface design for
> 20 years at this point.  Increasing user's cognitive
> load for using email doesn't help anyone.  It would likely mean we'd
> have to have much smaller spam folders, we'd likely need
> to spend more effort on prioritizing spam (how spammy is it)... 

The spam folder is a magic one. Once upon a time, it was a normal
folder, where messages matching a few static rules would place things.
Nowadays, moving a message inside or outside of that folder, has
sideffects such as training to [not] treat it as spam and even send a
complaint through a FBL. But users are not aware of that.
We should (the community in general) improve the
interfaces/documentation for that (a taught task, though).
Most users still won't read, but a few do!

Cheers



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Ángel via mailop]

Yes, it is.

Suppose you bought service/product X, but didn't receive the
confirmation email.
Note: You are an end user, and don't have access to the server logs. ;)

Did the have an issue sending you the mail? Was it rejected locally as
spam? Is it pending that their financial department actually approves
the operation?

For the case where it ended up detected as spam:
 a) if it was filed into a Spam folder, the user can find it there
directly
 b) if it was rejected at smtp-level, you would need to hope that the
sender cared and implemented some logic to do something with it, rather
than ignore delivery errors. The email sender probably doesn't care
contacting you -it is *you* who requested to be mailed- and is likely to
assume that you provided a wrong email address. In fact, from their
point of view, your email address is invalid, since they can't write to
you (they are blocked by the spam filter).7

As such, the spam folder provides a self-service option that benefits
sysadmins and smart users.

It is true that there are other options. For instance, you might share
with your users a excerpt of the mail log, so that they can see what
mails to them are rejected (but beware, some will start requesting to
see the rejected message!).


Also, you are also assuming that senders will view and understand NDR. I
recently got a user noting that they were contacted externally whose
email they weren't able to receive (but could with an external account).
The mail log showed a clear inline rejection: message too big.

This was the *first* email sent. I can only guess, but I suppose it
included a big attachment or image. It should have been trivial to retry
without that, perhaps sending only a link to it, since _email is not the
right tool for sharing files_.



You got a very good point at:
> Most users are really bad in managing that.

I would expand that to: some people doesn't know how to handle mail
(efficiently). It should be an obligatory subject on all schools
nowadays.

However, I'm afraid most people don't know how to change their MUA
default mail view (eg. to a threaded view) nor how to create email
rules.

I have felt silly for asking the obvious "Have you checked the spam
folder?", with the receiving not only not having done that
apparently-not-so-obvious step, but not even aware they had a spam
folder at all! (and yes, the mail was there)

And yet some people doing silly things when determining spam
[supposedly] are technical people that should know better.

Personally, my problem is the opposite: I receive a good number of spam
mails from purposefully unfiltered email addresses, and even for clear
spam campaigns we have the issue that we may be contacted by someone
about receiving such spam, which is a query that should be answered
rather than discarded as spam.
We are outliers, though.



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Steven Champeon via mailop]

on Mon, Oct 14, 2019 at 12:58:51PM -0700, Brandon Long via mailop wrote:
> I used to think, when I ran my own server, that five or so spam messages a
> day, what's the big deal... until I just got tired of it.  It was often
> more than the actual useful messages in my mailbox every time I checked.

I've had the same email address since oh, 1996 or so? I've run my own
email services since 1997, and have invested a great deal of time into
making sure my filters are good, at one point for our company and its
hosting clients and nowadays for a very small userbase (think in terms
of single-digits).

We block according to a wide variety of criteria, and quarantine/flag on
some others. We eat our own dog food and don't rely on anyone else's
filters, though we do query a few for stats purposes and the very
occasional quarantine exception.

Yesterday (FSVO "yesterday") we blocked 12 messages for being sent from
known-bad ASNs alone (after a couple of months in which said ASNs sent
288 that we let in and tried to send another thousand or so). That's out
of a total of 310 rejections today. And that doesn't count the 6 419s we
got from random sources, the several offers of sales lead lists and
contact lists, SEO offers, loan/financing offers and other garbage, that
we quarantined and blacklisted. This out of a total mail load of 649
messages - not bad compared to the bad old days when spam accounted for
over 95% of all inbound, but bear in mind I've also got about a full
quarter of IPv4 blocked at the packet level, so I should also include in
that number another 59 unique IPs that made port 25 connections,
bringing us up to 708, or around 60% spam/ham if you don't account for
any filtering at all. And the vast majority of the ham was from lists,
such as this one. So for practical purposes, non-list mail was probably
still in that 95% neighborhood.

Dealing with the stuff I had to quarantine ate up at least half an hour,
in various chunks, while I'm in Montreal at M3AAWG to talk to other
people who are either trying to send or block or manage and should be
down on the floor talking to them instead of sitting in a hotel room.

And that's NOW. Imagine what a waste of time it's been over the past 23
years, given that we have already invested in filtering (14+K lines of
sendmail m4 code, a dataset of classifications for ~96.3% of IPv4's PTR
space for filtering and quarantining, a set of ~90K blacklisted domains,
etc., etc.) and for the most part ONLY have to handle the edge cases
(419s, cold calls, and new idiots) and imagine how tired I am of it. And
I've never had a userbase more than a few hundred or several thousand if
you include the various mailing lists we hosted over the years, which we
still had to provide filtering for.

Everyone has different spam loads and tolerances, as you mentioned. To
extrapolate from an obviously VERY light load to anyone else's actual
experience is misguided. It just smacks of "JHD" and comes off as the
sort of dismissive and disrespectful attitudes we've been trying for
decades to rid ourselves and our various communities of. 

As for whether we still need spam folders, I can see all sides - you
do risk missing FPs, and senders need feedback (or not, depending on
if you think the sender is legit), and users deal with their own spam
tolerances in wildly different ways. We still have a quarantine folder,
mostly because I would rather waste my own time than both mine and that
of the other users I serve. Without quarantine, they have to forward
the stuff they think is spam to me AND I have to deal with it. YMMV. I
make no claim to understand what a Yahoo! or GMail have to deal with.

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2553 w: http://hesketh.com/
Internet security and antispam hostname intelligence: http://enemieslist.com/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Chris Wedgwood via mailop]

> The problem isn't lack of honoring the bounce. The problem is what
> to make out of it when multiple recipients are present.

that's quite rare

usually it's 1:1

> Also, assuming that a reject after DATA is strictly content-related
> is, well, an assumption.

historically it could/did happen with sendmail and low disk space

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Chris Wedgwood via mailop]

> What MTAs do not honor this?

sorry, i don't know what's sending when this happens

> How does 550 after DATA result in backscatter?

perhaps because domain is 'old' spammers sometimes spam from $random@

those messages hit various providers which do *not* check dmarc, but
then forward (either as a forwarding service or an internal system) to
places that do check dmarc

that causes bounces to be generated inside their systems which come
back to me

sometimes i go for days without seeing them, sometimes i get 100s an
hour

now i added code to detect this at the smtp level and 5xx respond

> Not returning a 250 OK after DATA is still well within limits of the
> SMTP dialog. How else are you supposed to reject a mail that could
> be saved because of its size or because it has a virus?

most software is pretty terrible

more frequent of a problem are things that don't retry on a 4xx from
greylisting

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Lili Crowley via mailop]

I agree with Laura, Brandon and Michael. Spam folders give receivers
options and adding user features to them only adds confusion for most
users.



On Tue, Oct 15, 2019 at 6:13 AM Jaroslaw Rafa via mailop 
wrote:

> Dnia 15.10.2019 o godz. 09:44:10 Paul Smith via mailop pisze:
> >
> > However, our spam filter actually sends me an email containing a
> > list of filtered emails every day, to prod me to take a look. It's
> > sorted and colourised by 'spamminess', so the most likely to be
> > false positives are shown at the top. So, two seconds before I
> > delete that message lets me look for something that may not be
> > actual spam. I don't have to do anything (like click on a 'spam
> > folder') to check this, I get it thrown at me. Now, I do know that
> > some people don't like this (we actually get some people reporting
> > this daily email as spam), but we keep telling them that one day
> > they'll be happy they were prompted to take a look - usually they
> > are.
> >
> > So, I think a similar 'daily spam report' should at least be a
> > default option, even if people can turn it off if it annoys them.
> > I've seen many systems that don't even have it as an option that can
> > be turned on. The sorting by spamminess is important - a spam folder
> > is generally sorted by date or whatever, which means you have to
> > look through it all. If it's sorted by spamminess, then a quick
> > glance can catch the majority of false positives.
>
> Great idea. Actually, I haven't seen it implemented anywhere at major email
> providers. Maybe they actually should?
> --
> Regards,
>Jaroslaw Rafa
>r...@rafa.eu.org
> --
> "In a million years, when kids go to school, they're gonna know: once there
> was a Hushpuppy, and she lived with her daddy in the Bathtub."
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
-- 
Lili Crowley
Postmaster
Verizon Media
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 15.10.2019 o godz. 09:44:10 Paul Smith via mailop pisze:
> 
> However, our spam filter actually sends me an email containing a
> list of filtered emails every day, to prod me to take a look. It's
> sorted and colourised by 'spamminess', so the most likely to be
> false positives are shown at the top. So, two seconds before I
> delete that message lets me look for something that may not be
> actual spam. I don't have to do anything (like click on a 'spam
> folder') to check this, I get it thrown at me. Now, I do know that
> some people don't like this (we actually get some people reporting
> this daily email as spam), but we keep telling them that one day
> they'll be happy they were prompted to take a look - usually they
> are.
> 
> So, I think a similar 'daily spam report' should at least be a
> default option, even if people can turn it off if it annoys them.
> I've seen many systems that don't even have it as an option that can
> be turned on. The sorting by spamminess is important - a spam folder
> is generally sorted by date or whatever, which means you have to
> look through it all. If it's sorted by spamminess, then a quick
> glance can catch the majority of false positives.

Great idea. Actually, I haven't seen it implemented anywhere at major email
providers. Maybe they actually should?
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Thomas Walter via mailop]

On 15.10.19 10:44, Paul Smith via mailop wrote:
> Ditto. Yesterday, I got 400 emails. About 200 were spam that was
> filtered, about 15 were spam that wasn't filtered, the rest I wanted at
> one level or another.  No way do I want 200 spam messages shoved into my
> Inbox.

So instead of rejecting these 200 mails directly and inform the sender
that you didn't see them, you rather go through a list (doesn't matter
if it's folder content or an email with details) daily and check them?
And possibly miss an important one?

And provide resources for them to be handled on your site?

If you reject them, it's the sending MTAs problem (which might be abused
and the postmaster learns about it this way).

Even false positives would be handled by the sender who can either
contact you in a different way or fix the reason for the false positive
and resend the mail? Or you can just whitelist them if you are sure they
are not bad guys?


Here I thought, us IT guys are lazy and love to have someone else do the
work? Why don't you in this case? ;-)

Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Paul Smith via mailop]

On 14/10/2019 19:39, Philip Paeps via mailop wrote:

On 2019-10-14 06:07:31 (-0700), Thomas Walter via mailop wrote:

Do we even need Junk/Spam-Folders?

I mean how much mail gets through the first "block directly" level on 
your site? Every now and then a wave comes through and results in a 
bad mail or two more, but can't people handle 3 or 5 spams in their 
inbox per day?


While I'm clearly not a representative sample of the average email user,
3 or 5 spam messages per day is two orders of magnitude short of the
mark on a bad day for me.

So ... Yes: we need spam folders. 


Ditto. Yesterday, I got 400 emails. About 200 were spam that was 
filtered, about 15 were spam that wasn't filtered, the rest I wanted at 
one level or another.  No way do I want 200 spam messages shoved into my 
Inbox.


However, our spam filter actually sends me an email containing a list of 
filtered emails every day, to prod me to take a look. It's sorted and 
colourised by 'spamminess', so the most likely to be false positives are 
shown at the top. So, two seconds before I delete that message lets me 
look for something that may not be actual spam. I don't have to do 
anything (like click on a 'spam folder') to check this, I get it thrown 
at me. Now, I do know that some people don't like this (we actually get 
some people reporting this daily email as spam), but we keep telling 
them that one day they'll be happy they were prompted to take a look - 
usually they are.


So, I think a similar 'daily spam report' should at least be a default 
option, even if people can turn it off if it annoys them. I've seen many 
systems that don't even have it as an option that can be turned on. The 
sorting by spamminess is important - a spam folder is generally sorted 
by date or whatever, which means you have to look through it all. If 
it's sorted by spamminess, then a quick glance can catch the majority of 
false positives.



--


Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53

Sign up for news & updates at http://www.pscs.co.uk/go/subscribe

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Luis E. Muñoz via mailop]

On 14 Oct 2019, at 23:39, Thomas Walter via mailop wrote:


On 15.10.19 00:34, Chris Wedgwood via mailop wrote:

Doesn't "550 Requested action not taken: We don't like you." apply
after DATA?


it does

most severs honor this but not all

(i experience this sometimes, my domain somtimes gets a lot of
backscatter)


What MTAs do not honor this? How does 550 after DATA result in 
backscatter?


The problem isn't lack of honoring the bounce. The problem is what to 
make out of it when multiple recipients are present. Also, assuming that 
a reject after DATA is strictly content-related is, well, an assumption.


Best regards

-lem

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Thomas Walter via mailop]

On 15.10.19 00:34, Chris Wedgwood via mailop wrote:
>> Doesn't "550 Requested action not taken: We don't like you." apply
>> after DATA?
> 
> it does
> 
> most severs honor this but not all
> 
> (i experience this sometimes, my domain somtimes gets a lot of
> backscatter)

What MTAs do not honor this? How does 550 after DATA result in backscatter?

Not returning a 250 OK after DATA is still well within limits of the
SMTP dialog. How else are you supposed to reject a mail that could be
saved because of its size or because it has a virus?


Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Brandon Long via mailop]

On Mon, Oct 14, 2019 at 3:26 PM Jaroslaw Rafa via mailop 
wrote:

> Dnia 14.10.2019 o godz. 19:48:03 Laura Atkins via mailop pisze:
> >
> > What one recipient sees as spam another recipient not only wants,
> they’ve actually gone through a COI process to confirm they want it.
> >
> > Spamfolders allow consumer mailbox providers to filter mixed mailstreams
> in a more effective and user friendly way.
>
> I guess the original question was not about if we need to *mark* messages
> as
> spam by the spam filter (and optionally correct that marking by user). It's
> obvious that we need it.
>
> The question was about if we really need to *move* the messages marked as
> spam into a separate folder and hide it from user's view by default.
>
> I suggest it shouldn't be done by default. Let the user decide if he/she
> just wants the message marked as spam, or both marked and hidden in Spam
> folder.
>

I mean, we do offer with sectioned inbox to move other messages out of the
default view (since we're using
labels, everything is still in the label, just different views), so we
could offer that for spam as well... but frankly,
why?  We also had "bundles" in Inbox, which is could also have been used
for spam... but why?

Having a spam folder has been the standard user interface design for 20
years at this point.  Increasing user's cognitive
load for using email doesn't help anyone.  It would likely mean we'd have
to have much smaller spam folders, we'd likely need
to spend more effort on prioritizing spam (how spammy is it)...

I just don't think your average user thinks this is a problem worth
solving, but you've suddenly greatly increased the
incentive of spammers to spam, no more spam folder means their spam is in
front of users all of the time.

That seems like a horrible trade-off.

Brandon
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Brandon Long via mailop]

On Mon, Oct 14, 2019 at 3:19 PM Thomas Walter via mailop 
wrote:

>
>
> On 14.10.19 23:59, Luis E. Muñoz via mailop wrote:
> > This is not a pure performance issue. It's more a matter of not having
> > the data at hand to decide whether the message is ham or spam. To do so,
> > filters need user feedback.
>
> You can still have feedback if you don't move emails to a spam folder
> and rely on a user checking that regularly.
>
> Recipients can still mark email as spam or explicitely allow mails from
> specific senders.
>
> And senders learn if there are problems with their delivery and can
> either fix that or ask the user to allow them.
>
> Either type of mail wouldn't just get lost in a spam folder that way.
>
> > Protocol-wise, what is a sender supposed to do with a post-DATA
> > rejection? Is that rejection associated to one of the RFC-5321 RCPT TOs?
> > All of them? None, because it's actually a content issue? What if the
> > policies for each recipient differ?
>
> He is supposed to handle it like any other rejection too?
>
> Doesn't "550 Requested action not taken: We don't like you." apply after
> DATA?
>
> > MTAs know how to deal with a post-RCPT rejection. A post-DATA is an
> > entirely different thing.
>
> MTAs should be able to handle rejections at all stages. Which doesn't?
>
> > There's also the option of sending a NDR after accepting the message,
> > which is undesirable for a plethora of other reasons.
>
> That's why I suggested to not accept an email like that at all.
>
>
> I am also not a fan of "unread mails can still be taken out of the users
> mailbox". I wouldn't want my postman to fish mail out of my letterbox
> just because he thinks my neighbour didn't like it, so I won't either.
>

Note it's not "unread", it's "hasn't looked at their mail".

So there's no chance you might see it or think you saw it and it's gone.

And really, there are places where the metaphor to postal mail doesn't do
you
any favors when thinking about these things.

Also note that that was kind of the anti-wiretap legal arguments some folks
tried to make against Gmail,
they basically wanted everything done post "delivery" instead of
"in-transit".

Brandon
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jeremy Harris via mailop]

On 14/10/2019 22:59, Luis E. Muñoz via mailop wrote:
> Protocol-wise, what is a sender supposed to do with a post-DATA
> rejection? Is that rejection associated to one of the RFC-5321 RCPT TOs?
> All of them? None, because it's actually a content issue? What if the
> policies for each recipient differ?
> 
> SMTP does not allow for this level of granularity in the signaling.

It does if you support PRDR.  Though frankly, multi-RCPT message
are a surprisingly small proportion.
-- 
Cheers,
  Jeremy

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Luis E. Muñoz via mailop]

On 14 Oct 2019, at 15:18, Thomas Walter via mailop wrote:


On 14.10.19 23:59, Luis E. Muñoz via mailop wrote:
This is not a pure performance issue. It's more a matter of not 
having
the data at hand to decide whether the message is ham or spam. To do 
so,

filters need user feedback.


You can still have feedback if you don't move emails to a spam folder
and rely on a user checking that regularly.

Recipients can still mark email as spam or explicitely allow mails 
from

specific senders.


This requires accepting the message and putting it on recipients' 
mailboxes. This would not be possible if you rejected the message. In 
order to get feedback, you need to accept a sample.



Protocol-wise, what is a sender supposed to do with a post-DATA
rejection? Is that rejection associated to one of the RFC-5321 RCPT 
TOs?

All of them? None, because it's actually a content issue? What if the
policies for each recipient differ?


He is supposed to handle it like any other rejection too?

Doesn't "550 Requested action not taken: We don't like you." apply 
after

DATA?


It does apply. Understanding what it means is perhaps another 
discussion. Why did the 550 happen? Was it the content? Some of the 
recipients? All the recipients?



MTAs should be able to handle rejections at all stages. Which doesn't?


Most of them do. Most of them will cause a multi-recipient message with 
a 550 post-DATA rejection to drop out of the queue. Now, suppose you're 
the person sending that email: What would you do with such a rejection? 
Again, was it the content? Was it the policy of one of the receivers?


I am also not a fan of "unread mails can still be taken out of the 
users

mailbox". I wouldn't want my postman to fish mail out of my letterbox
just because he thinks my neighbour didn't like it, so I won't either.


Why? At least where I live, the letterbox is owned by the post office. 
As long as I haven't picked up the message, they could remove it from my 
box and I would not know about it. There's no material difference for me 
between the postman refusing delivery or the letter being fished out of 
my box before I see it.


Keep in mind that mailbox providers are trying to ease the burden on 
users of their services.


Best regards

-lem

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 14.10.2019 o godz. 15:32:07 Chris Wedgwood pisze:
> > The question was about if we really need to *move* the messages
> > marked as spam into a separate folder and hide it from user's view
> > by default.
> 
> silently hiding messages would be very frustrating and hard to
> understand and debug

Hiding == moving into Spam folder. That's exactly what is done now.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Chris Wedgwood via mailop]

> Doesn't "550 Requested action not taken: We don't like you." apply
> after DATA?

it does

most severs honor this but not all

(i experience this sometimes, my domain somtimes gets a lot of
backscatter)

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 14.10.2019 o godz. 11:17:36 Jay Hennigan via mailop pisze:
> 
> >Depending on your client you might even just mark or group them in the
> >Inbox, so people can take a quick glance and delete them if they want to.
> 
> The result will be the same, particularly if grouped.

No, it won't be the same, because the user will *see* the messages in
his/her inbox. With messages movead automatically to Spam folder, the
average user never sees them and they get auto-deleted after 30 days (in
case of Google), providing virtually no feedback on how good the spam
filtering actually is.

> I'd prefer not to get that crap AT ALL, but the spam folder is a far
> better place for it than the inbox. With a quick glance through the
> spam folder I can spot the occasional false positive.

The difference is that technical person like you and we all here on this
list know that we have to look into our Spam folders. An average,
non-technical user does not know that and he/she never looks into that
folder. So he/she can never spot the occasional false positive. If a message
goes into Spam folder of an average user, and the sender does not know about
it (and how he/she could know?), it is gone for good.

And probably falsely counting up to the reputation of the sender as someone
sending spam...
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Chris Wedgwood via mailop]

> The question was about if we really need to *move* the messages
> marked as spam into a separate folder and hide it from user's view
> by default.

silently hiding messages would be very frustrating and hard to
understand and debug

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 14.10.2019 o godz. 19:48:03 Laura Atkins via mailop pisze:
> 
> What one recipient sees as spam another recipient not only wants, they’ve 
> actually gone through a COI process to confirm they want it.
> 
> Spamfolders allow consumer mailbox providers to filter mixed mailstreams in a 
> more effective and user friendly way.

I guess the original question was not about if we need to *mark* messages as
spam by the spam filter (and optionally correct that marking by user). It's
obvious that we need it.

The question was about if we really need to *move* the messages marked as
spam into a separate folder and hide it from user's view by default.

I suggest it shouldn't be done by default. Let the user decide if he/she
just wants the message marked as spam, or both marked and hidden in Spam
folder.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jaroslaw Rafa via mailop]

Dnia 14.10.2019 o godz. 15:07:31 Thomas Walter via mailop pisze:
> 
> Do we even need Junk/Spam-Folders?
> 
> I mean how much mail gets through the first "block directly" level on
> your site? Every now and then a wave comes through and results in a bad
> mail or two more, but can't people handle 3 or 5 spams in their inbox
> per day?
> 
> Depending on your client you might even just mark or group them in the
> Inbox, so people can take a quick glance and delete them if they want to.
> 
> Is it necessary to sort these and lots of false positives into an extra
> folder that people regularly have to look into anyway so they don't miss
> an important mail? And where you regularly have to remind them to do so?

Agreed. I think that best approach could be just marking suspected spam
messages as spam, for example by adding the word SPAM to the subject (like
SpamAssassin does), but leave the decision to sort out those emails to a
separate folder to the user.

Web based environments like Gmail may even include a button which, when
clicked by the user, automatically creates a filtering rule that moves all
messages marked as spam to the Spam folder. But it's still the conscient
decision of the user to do so and it's not done by default. If user decides
him/herself to move potential spam messages out to Spam folder he/she is
more likely to check that folder occasionally than in the case when it's set
up automatically by default and messages land in that folder without (often)
the user even knowing about this.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Thomas Walter via mailop]

On 14.10.19 23:59, Luis E. Muñoz via mailop wrote:
> This is not a pure performance issue. It's more a matter of not having
> the data at hand to decide whether the message is ham or spam. To do so,
> filters need user feedback.

You can still have feedback if you don't move emails to a spam folder
and rely on a user checking that regularly.

Recipients can still mark email as spam or explicitely allow mails from
specific senders.

And senders learn if there are problems with their delivery and can
either fix that or ask the user to allow them.

Either type of mail wouldn't just get lost in a spam folder that way.

> Protocol-wise, what is a sender supposed to do with a post-DATA
> rejection? Is that rejection associated to one of the RFC-5321 RCPT TOs?
> All of them? None, because it's actually a content issue? What if the
> policies for each recipient differ?

He is supposed to handle it like any other rejection too?

Doesn't "550 Requested action not taken: We don't like you." apply after
DATA?

> MTAs know how to deal with a post-RCPT rejection. A post-DATA is an
> entirely different thing.

MTAs should be able to handle rejections at all stages. Which doesn't?

> There's also the option of sending a NDR after accepting the message,
> which is undesirable for a plethora of other reasons.

That's why I suggested to not accept an email like that at all.


I am also not a fan of "unread mails can still be taken out of the users
mailbox". I wouldn't want my postman to fish mail out of my letterbox
just because he thinks my neighbour didn't like it, so I won't either.

Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Luis E. Muñoz via mailop]

On 14 Oct 2019, at 14:20, Thomas Walter via mailop wrote:

Of course I don't have the experience in the last category, but I'd 
like

to learn. Why can't you reject emails post-DATA?

Is it a performance issue? Google or Bing find 935.000.000 search
results in 0,60 seconds for the word "spam", but they can't do a spam
check in that amount of time?


This is not a pure performance issue. It's more a matter of not having 
the data at hand to decide whether the message is ham or spam. To do so, 
filters need user feedback.


In order to have the data, a trickle of those suspicious messages are 
allowed to get in. What the recipients do with them is used to decide 
what to do with future messages.


Protocol-wise, what is a sender supposed to do with a post-DATA 
rejection? Is that rejection associated to one of the RFC-5321 RCPT TOs? 
All of them? None, because it's actually a content issue? What if the 
policies for each recipient differ?


SMTP does not allow for this level of granularity in the signaling.

MTAs know how to deal with a post-RCPT rejection. A post-DATA is an 
entirely different thing.


There's also the option of sending a NDR after accepting the message, 
which is undesirable for a plethora of other reasons.


Best regards

-lem

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Thomas Walter via mailop]

On 14.10.19 20:57, Michael Wise via mailop wrote:
> Having the mail bounce at the edge is a VERY useful signal for any spammers 
> trying to enhance their deliverability.

Not bouncing mails at edge is a very useful signal for any spammer too,
because he delivered an email and is getting paid?

Spammers also enhance their deliverability by all kinds of tracking
nonsense you still allow them to use.

> This question has different answers depending on if you're guarding 1 
> mailbox, 10 - 100,000 or over a million.
> The larger the number of mailboxes, the more we need to do filtering 
> post-DATA.

Of course I don't have the experience in the last category, but I'd like
to learn. Why can't you reject emails post-DATA?

Is it a performance issue? Google or Bing find 935.000.000 search
results in 0,60 seconds for the word "spam", but they can't do a spam
check in that amount of time?

You can still have users mark mails as spam and improve your filters.

And you can still learn about false positives - just not by your user,
but the sender of an email (or by the user after the sender contacted
him in a different way). Or if the user explicitely allows a sender by
adding them to their address book or whatever - as you do already.


And yes, I am trolling a little or playing devils advocate in this
matter. Reason being that I feel that we just rely on a mechanism that
has a lot of issues and that might be done better if someone more
intelligent and experienced than me did think about it instead of
accepting this as given.

Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Philip Paeps via mailop]

On 2019-10-14 13:43:18 (-0700), Thomas Walter via mailop wrote:

On 14.10.19 20:39, Philip Paeps via mailop wrote:
While I'm clearly not a representative sample of the average email 
user,

3 or 5 spam messages per day is two orders of magnitude short of the
mark on a bad day for me.

So ... Yes: we need spam folders.


But you still have to check these regularly?

Why not reject those instead and have the sender deal with it?


I reject thousands more.

What ends up in spam is what I couldn't reasonably identify as spam at 
SMTP time.


If I could reject, I would.

Philip

--
Philip Paeps
Senior Reality Engineer
Alternative Enterprises

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Luis E. Muñoz via mailop]

On 14 Oct 2019, at 13:43, Thomas Walter via mailop wrote:


Why not reject those instead and have the sender deal with it?


Because filter error rates and the need for the feedback signal from the 
recipient.


-lem

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Thomas Walter via mailop]

On 14.10.19 20:39, Philip Paeps via mailop wrote:
> While I'm clearly not a representative sample of the average email user,
> 3 or 5 spam messages per day is two orders of magnitude short of the
> mark on a bad day for me.
> 
> So ... Yes: we need spam folders.

But you still have to check these regularly?

Why not reject those instead and have the sender deal with it?

Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Thomas Walter via mailop]

On 14.10.19 20:17, Jay Hennigan via mailop wrote:
> A lot, in my case a good portion is "targeted" B2B spam, more than half
> of which is sent via ESPs. If people can handle 3 or 5 spams per day,
> can they handle 30 or 50? 300 or 500? How does it scale?

Yes, but you still have to handle these by checking the spam folder?

You might feel it's easier since it is "pre-sorted", but how often did
you miss a FP in that pile of junk or because you didn't check it?

If that mail is a huge contract for your company, do you want to even
have the slightest chance of missing it?

After all you don't want most of these in the first place. So why not
block "maybe"s directly during delivery. That way it's the sender's
problem and not yours.

Since the sender will get informed that his email did not get delivered
for whatever reason, he still has a chance to fix it - if he _really_
wants you to read that mail.

> Ideally, the vast majority aren't false positives. They are spam.
> Filtering algorithms sort into yes - no - maybe. It's the "maybe" group
> that's sent to the spam folder for the user to decide. If the user finds
> email incorrectly (based on that user's decision) routed there, a good
> algorithm will keep track of that for that recipient and route future
> similar mail to the inbox for that recipient.

Most users are really bad in managing that. I get more or less daily
reports that a user doesn't like that he has to be reminded to return a
book or that his lecture X got moved. Because to them "Junk" means
"stuff I do not want", not "bulk email I received unsolicited".

> It may not have just vanished. It may have been delivered, but the
> recipient isn't loading remote images or other spyware. Or the recipient
> saw the sender's address and subject and deleted it unopened. Maybe it
> was routed to spam by an obscure AI that got it right, and the user saw
> it in the spam folder and ignored it. Maybe the first one made it to the
> inbox and the user marked it as spam, training the AI to route similar
> cruft to the same place.

There's no tracking stuff in my emails. I send text only and I'd rather
prefer to receive that too. Whoever thought HTML in emails might be a
good idea needs to get a real good paddling.

Either way as a regular sender I'd rather be informed that a user did
not receive my email. If he trained whatever AI to do so, I'd still like
to know. I can't do anything about him ignoring it, but I'd rather know
if someone else decided to not show him in the first place.

> Do you open every envelope that arrives in your postal mailbox, or do
> you discard some of it unopened and unread as obviously junk mail? The
> same thing happens with email. The post office doesn't give me the same
> thing that my email client does. With email I get two mailboxes, one for
> first class mail, another for "presorted standard". Rarely, the
> electronic postman algorithm gets it wrong (in both directions), but at
> least I can train it.

I do have a "no advertising" sign on my postal mailbox and I sometimes
return mails unopened by adding "return to sender" (and optionally a
reason). I understand that in some countries it's way worse than over
here, but I guess I'd have a stamp then - to have a least some fun while
returning them.

That way I if I mistook a "your fee has been raised" from my insurance
company, they have to figure that out instead of telling me: It

Just as I do with emails, I guess.

Regards,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Phil Pennock via mailop]

On 2019-10-14 at 15:07 +0200, Thomas Walter via mailop wrote:
> Even more interesting: In Germany, this can be seen as not delivering an
> email to the recipient which is against the law. The user might be using
> POP3 or is not subscribed to the IMAP folder and therefore does not see
> the SPAM folder at all. To him the email never existed in the first
> place - even worse if it gets deleted automatically after a few days.
> 
> I am not a lawyer and wouldn't know how to translate the legal text into
> English, but basically the law states that as soon as you accept a
> letter to be transported, you have to forward it to the recipient. The
> only way to avoid that responsibility is to not accept the letter in the
> first place. Me using the word "letter" in this is a hint on what times
> the law is based on, but it counts for email nonetheless.

A similar law in The Netherlands is why, when the ISP I was a postmaster
at introduced spam filtering something like 15 years ago, we diverted
accepted-but-suspect email into a spam folder and set up a parallel
"Spam-POP" service on port 666.

We could reject, or accept and deliver to spam, and because the mail was
accessible by customers, it complied with the law.  Everyone benefited.

A spam-folder visible within a normal web UI is _significantly_ easier
to use and set up than a separate POP3 service to connect to, just to
retrieve spam.  So if our Spam-POP service passed muster under Dutch
law, then modern Spam Folders seem "likely" to pass muster too.

I am not a lawyer, I am a practising professional in the field who has
had to talk to legal counsel about such matters in the past; take what I
say with appropriate amounts of salt.

The mail system needs to "make available" all the mail which it
accepted, it does not need to mingle it in or revert to pure
reject-or-inbox or anything else.

-Phil

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Brandon Long via mailop]

Agreed with Laura and Michael, mixed mail streams to large numbers of users
mean that treating the same message to different recipients the same way is
just wrong.
In fact, we even have a setting for GSuite where we let customers turn
their spam blocking up, since businesses and consumers have different
tolerances and different expectations (almost no one wants a Target sales
letter at work, an example that kept coming up before we introduced that).

Also, you need to know how good your filtering is, which means you need to
let some messages in that you think are spam so that users can act on it to
tell you one way or the other... and it can't just be a percentage, it has
to scale with the spam campaign, otherwise the spammers will just sent you
1000x the spam just trying to get enough through your 0.1% ... (it's odd
how much effort spammers make just to get into the spam folder some times,
it's all a numbers game at that level).

Also, how do you handle messages you've already delivered that you figure
out after the fact are spam?  If user's haven't looked at their mail yet,
you can move it to the spam folder before they do.

I used to think, when I ran my own server, that five or so spam messages a
day, what's the big deal... until I just got tired of it.  It was often
more than the actual useful messages in my mailbox every time I checked.
Now, I look at the spam label either when I'm expecting something and
haven't seen it, or every other week or so.

And you are correct, the better our spam filtering is, the less people look
at the spam folder, and the worse false positives are... and the less
signal we have about how our spam filter is doing.  Not only does driving
down false positives get more expensive, but it might ruin your pipeline,
making it much harder to know when your filter has gone wrong.

Brandon

On Mon, Oct 14, 2019 at 11:59 AM Michael Wise via mailop 
wrote:

>
>
> Having the mail bounce at the edge is a VERY useful signal for any
> spammers trying to enhance their deliverability.
> This question has different answers depending on if you're guarding 1
> mailbox, 10 - 100,000 or over a million.
> The larger the number of mailboxes, the more we need to do filtering
> post-DATA.
> And yes, seriously agree with Laura.
>
> Aloha,
> Michael.
> --
> Michael J Wise
> Microsoft Corporation| Spam Analysis
> "Your Spam Specimen Has Been Processed."
> Open a ticket for Hotmail<http://go.microsoft.com/fwlink/?LinkID=614866> ?
>
> From: mailop  On Behalf Of Luis E. Muñoz via
> mailop
> Sent: Monday, October 14, 2019 10:18 AM
> To: MailOp 
> Subject: Re: [mailop] Do we need Spam folders?
>
>
> On 14 Oct 2019, at 9:29, Chris Wedgwood via mailop wrote:
>
> as things stand today, i think we do
>
> technology has gotten very good but it's not perfect; sometimes spam
> isn't detected, and sometimes real messages are detected as spam
>
> I would rather have the email bounce during SMTP transaction. At least
> that way, the sender knows that the recipient won't get the message.
> Otherwise, the message will sit unread for 14 days before being
> auto-deleted with nobody ever looking at it.
>
> Not having spam folders also nails the "I moved this bazillion emails into
> the  folder because I don't want them anymore".
>
> Unfortunately, the user moving messages in and out of spam folders is a
> useful signal for the mailbox providers. I wonder if using the \Spam flag
> would be a better option. Allowing the MUA to control presentation
> altogether.
>
> Best regards
>
> -lem
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Brandon Long via mailop]

I won't speak to that interesting interpretation of postal mail applying to
email (and here I thought Germany thought email was a telco)...

but we've witnessed a quite opposite effect, which is that users treat
their email as unreliable, even if it is reliable, so they can tell people
they didn't get a message or it must have gone to the spam folder or
whatever as a way out of avoiding acting on it.  Consider it "the right to
ignore it" or "the right to act like I missed it"

Brandon

On Mon, Oct 14, 2019 at 6:09 AM Thomas Walter via mailop 
wrote:

> Hello fellow email-enthusiasts,
>
> all this discussion about emails being marked as spam or not and why
> always makes me think about one thing:
>
> Do we even need Junk/Spam-Folders?
>
> I mean how much mail gets through the first "block directly" level on
> your site? Every now and then a wave comes through and results in a bad
> mail or two more, but can't people handle 3 or 5 spams in their inbox
> per day?
>
> Depending on your client you might even just mark or group them in the
> Inbox, so people can take a quick glance and delete them if they want to.
>
> Is it necessary to sort these and lots of false positives into an extra
> folder that people regularly have to look into anyway so they don't miss
> an important mail? And where you regularly have to remind them to do so?
>
> As a sender I am a little annoyed when someone blocks my mails during
> delivery, but at least I know about it and can look into it or contact
> the recipient in a different way.
>
> I feel that's a lot better than not knowing if an email just vanished
> (not calling names this time...), is being ignored or just not seen
> because some obscure AI thought the recipient might want to be saved
> from it and he doesn't even know about it?
>
>
> Even more interesting: In Germany, this can be seen as not delivering an
> email to the recipient which is against the law. The user might be using
> POP3 or is not subscribed to the IMAP folder and therefore does not see
> the SPAM folder at all. To him the email never existed in the first
> place - even worse if it gets deleted automatically after a few days.
>
> I am not a lawyer and wouldn't know how to translate the legal text into
> English, but basically the law states that as soon as you accept a
> letter to be transported, you have to forward it to the recipient. The
> only way to avoid that responsibility is to not accept the letter in the
> first place. Me using the word "letter" in this is a hint on what times
> the law is based on, but it counts for email nonetheless.
>
> This might be a dark grey area and I don't have the resources to fight
> something like this in court to have it clarified, but it is something
> us postmasters here have to consider.
>
> Perhaps you should too?
>
> Regards from Germany,
> Thomas Walter
>
> --
> Thomas Walter
> Datenverarbeitungszentrale
>
> FH Münster
> - University of Applied Sciences -
> Corrensstr. 25, Raum B 112
> 48149 Münster
>
> Tel: +49 251 83 64 908 <+49%20251%208364908>
> Fax: +49 251 83 64 910 <+49%20251%208364910>
> www.fh-muenster.de/dvz/
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Luis E. Muñoz via mailop]

On 14 Oct 2019, at 11:57, Michael Wise via mailop wrote:

Having the mail bounce at the edge is a VERY useful signal for any 
spammers trying to enhance their deliverability.


It's a great signal for anybody caring for the fate of a message. This 
is why we cannot have nice things :-)


-lem

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Michael Wise via mailop]

Having the mail bounce at the edge is a VERY useful signal for any spammers 
trying to enhance their deliverability.
This question has different answers depending on if you're guarding 1 mailbox, 
10 - 100,000 or over a million.
The larger the number of mailboxes, the more we need to do filtering post-DATA.
And yes, seriously agree with Laura.

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Open a ticket for Hotmail<http://go.microsoft.com/fwlink/?LinkID=614866> ?

From: mailop  On Behalf Of Luis E. Muñoz via mailop
Sent: Monday, October 14, 2019 10:18 AM
To: MailOp 
Subject: Re: [mailop] Do we need Spam folders?


On 14 Oct 2019, at 9:29, Chris Wedgwood via mailop wrote:

as things stand today, i think we do

technology has gotten very good but it's not perfect; sometimes spam
isn't detected, and sometimes real messages are detected as spam

I would rather have the email bounce during SMTP transaction. At least that 
way, the sender knows that the recipient won't get the message. Otherwise, the 
message will sit unread for 14 days before being auto-deleted with nobody ever 
looking at it.

Not having spam folders also nails the "I moved this bazillion emails into the 
 folder because I don't want them anymore".

Unfortunately, the user moving messages in and out of spam folders is a useful 
signal for the mailbox providers. I wonder if using the \Spam flag would be a 
better option. Allowing the MUA to control presentation altogether.

Best regards

-lem
<>___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Laura Atkins via mailop]

> On 14 Oct 2019, at 17:29, Chris Wedgwood via mailop  wrote:
> 
> as things stand today, i think we do
> 
> technology has gotten very good but it's not perfect; sometimes spam
> isn't detected, and sometimes real messages are detected as spam

And, sometimes… 

What one recipient sees as spam another recipient not only wants, they’ve 
actually gone through a COI process to confirm they want it.

Spamfolders allow consumer mailbox providers to filter mixed mailstreams in a 
more effective and user friendly way.

laura 

-- 
Having an Email Crisis?  We can help! 800 823-9674 

Laura Atkins
Word to the Wise
la...@wordtothewise.com
(650) 437-0741  

Email Delivery Blog: https://wordtothewise.com/blog 







___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Philip Paeps via mailop]

On 2019-10-14 06:07:31 (-0700), Thomas Walter via mailop wrote:

Do we even need Junk/Spam-Folders?

I mean how much mail gets through the first "block directly" level on 
your site? Every now and then a wave comes through and results in a 
bad mail or two more, but can't people handle 3 or 5 spams in their 
inbox per day?


While I'm clearly not a representative sample of the average email user,
3 or 5 spam messages per day is two orders of magnitude short of the
mark on a bad day for me.

So ... Yes: we need spam folders.

Philip

--
Philip Paeps
Senior Reality Engineer
Alternative Enterprises

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Bill Cole via mailop]

On 14 Oct 2019, at 9:07, Thomas Walter via mailop wrote:


Hello fellow email-enthusiasts,

all this discussion about emails being marked as spam or not and why
always makes me think about one thing:

Do we even need Junk/Spam-Folders?


It depends on who "we" are...

I have worked primarily in the "business mailbox" sector, on systems 
with a dozen to a few dozen-thousand users, and for those systems? No. 
They usually cause more trouble than they are worth. To make them work 
well requires real spam-filtering expertise and attention, along with a 
willingness to spend the money that implies.


Big "consumer mailbox" providers have a different situation that makes 
spam folders useful because they don't need to hit any sort of 
meaningful quality targets.



I mean how much mail gets through the first "block directly" level on
your site?


Not a lot. The bulk of spam filtering done by systems I manage is done 
before DATA. The bulk of the work I do in maintaining spam filtering is 
aimed at whole-message analysis, which is only decisive on about 10% of 
mail.



Every now and then a wave comes through and results in a bad
mail or two more, but can't people handle 3 or 5 spams in their inbox
per day?


No. That pace of spam getting past even very conservative filtering is a 
sign of something gone wrong. There are some people whose addresses get 
onto particularly bad target lists and have the misfortune of addresses 
starting with 'a' ( or in decreasing severity, any letter of the 
alphabet before about 'g') but those are special cases that can be 
handled as such.


Most users of the systems I've managed in the past dozen years have had 
false negatives (i.e. spam being delivered) closer to one per week. Of 
course, this IS a biased sample: workplace email.



Depending on your client you might even just mark or group them in the
Inbox, so people can take a quick glance and delete them if they want 
to.


Is it necessary to sort these and lots of false positives into an 
extra
folder that people regularly have to look into anyway so they don't 
miss
an important mail? And where you regularly have to remind them to do 
so?


What you describe is not my experience at all. Where I've had a spam 
folder as a user I have not seen many FPs personally. Where I've been 
required to implement them to catch borderline mail, they've caught 
almost entirely spam.


The "lots of false positive" problem is a big part of why the behemoth 
free mailbox providers (and to a lesser extent, their adjunct paid mail 
services) are better off with spam folders. There's no way to staff for 
investigating and fixing 1 FP per week per user if you have a million 
users. If your filters are that bad, you need some way for the users to 
work around and/or fix their own FP issues.



As a sender I am a little annoyed when someone blocks my mails during
delivery, but at least I know about it and can look into it or contact
the recipient in a different way.


Right. As a mail admin, I prefer working this way because it helps make 
me aware of the worst problems my filtering systems might have. FPs in a 
spam folder that people don't check because it's overwhelmingly spam are 
very quiet, particularly with "ham" that people don't know to expect on 
any particular day, but want to see if and when it is sent to them.




I feel that's a lot better than not knowing if an email just vanished
(not calling names this time...),


Yeah, but we all know you mean Microsoft. No one else just vanishes mail 
by design.



(no comment on the DE legal issues because all I know about it is that 
I'm not subject to DE law. Whee!)


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Jay Hennigan via mailop]

On 10/14/19 06:07, Thomas Walter via mailop wrote:


Do we even need Junk/Spam-Folders?

I mean how much mail gets through the first "block directly" level on
your site? Every now and then a wave comes through and results in a bad
mail or two more, but can't people handle 3 or 5 spams in their inbox
per day?


A lot, in my case a good portion is "targeted" B2B spam, more than half 
of which is sent via ESPs. If people can handle 3 or 5 spams per day, 
can they handle 30 or 50? 300 or 500? How does it scale?



Depending on your client you might even just mark or group them in the
Inbox, so people can take a quick glance and delete them if they want to.


The result will be the same, particularly if grouped.


Is it necessary to sort these and lots of false positives into an extra
folder that people regularly have to look into anyway so they don't miss
an important mail? And where you regularly have to remind them to do so?


Ideally, the vast majority aren't false positives. They are spam. 
Filtering algorithms sort into yes - no - maybe. It's the "maybe" group 
that's sent to the spam folder for the user to decide. If the user finds 
email incorrectly (based on that user's decision) routed there, a good 
algorithm will keep track of that for that recipient and route future 
similar mail to the inbox for that recipient.



As a sender I am a little annoyed when someone blocks my mails during
delivery, but at least I know about it and can look into it or contact
the recipient in a different way.


As a recipient, I'd much prefer pre-filtering that mostly gets it right.

In my case, most of the spam that gets through filters is "targeted" B2B 
cruft. Outfits I've either never heard of or interacted with, mostly 
using ESPs, pitching product, services, whitepapers, webinars, trade 
shows, and whatever. It's bulk, it's unsolicited, and it's email. In 
other words, spam. This comes from the big names. One very recent 
example, Microsoft spammed me multiple times via Marketo to an address 
purchased from a spam list seller.


I'd prefer not to get that crap AT ALL, but the spam folder is a far 
better place for it than the inbox. With a quick glance through the spam 
folder I can spot the occasional false positive.


I'd much prefer that Microsoft not spam to purchased lists at all. I'd 
much prefer that Marketo not take on spammers as customers. The spam 
folder is probably the best place for these "too big to block" senders 
choosing to use "cold email" which is of course simply a euphemism for 
spam. And as long as Microsoft's checks don't bounce, you can bet that 
Marketo is going to keep cashing them.


I do agree that on the user side, a greater distinction needs to be made 
for users between "delete" and "junk" buttons for discarding email. The 
"junk" button should be relabeled "Report as spam" or similar to avoid 
tilting the scales too far the other way.



I feel that's a lot better than not knowing if an email just vanished
(not calling names this time...), is being ignored or just not seen
because some obscure AI thought the recipient might want to be saved
from it and he doesn't even know about it?


It may not have just vanished. It may have been delivered, but the 
recipient isn't loading remote images or other spyware. Or the recipient 
saw the sender's address and subject and deleted it unopened. Maybe it 
was routed to spam by an obscure AI that got it right, and the user saw 
it in the spam folder and ignored it. Maybe the first one made it to the 
inbox and the user marked it as spam, training the AI to route similar 
cruft to the same place.


Do you open every envelope that arrives in your postal mailbox, or do 
you discard some of it unopened and unread as obviously junk mail? The 
same thing happens with email. The post office doesn't give me the same 
thing that my email client does. With email I get two mailboxes, one for 
first class mail, another for "presorted standard". Rarely, the 
electronic postman algorithm gets it wrong (in both directions), but at 
least I can train it.


--
Jay Hennigan - j...@west.net
Network Engineering - CCIE #7880
503 897-8550 - WB6RDV

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Luis E. Muñoz via mailop]

On 14 Oct 2019, at 9:29, Chris Wedgwood via mailop wrote:


as things stand today, i think we do

technology has gotten very good but it's not perfect; sometimes spam
isn't detected, and sometimes real messages are detected as spam


I would rather have the email bounce during SMTP transaction. At least 
that way, the sender knows that the recipient won't get the message. 
Otherwise, the message will sit unread for 14 days before being 
auto-deleted with nobody ever looking at it.


Not having spam folders also nails the "I moved this bazillion emails 
into the  folder because I don't want them anymore".


Unfortunately, the user moving messages in and out of spam folders is a 
useful signal for the mailbox providers. I wonder if using the \Spam 
flag would be a better option. Allowing the MUA to control presentation 
altogether.


Best regards

-lem
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Do we need Spam folders?

[Chris Wedgwood via mailop]

as things stand today, i think we do

technology has gotten very good but it's not perfect; sometimes spam
isn't detected, and sometimes real messages are detected as spam

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Do we need Spam folders?

[Thomas Walter via mailop]

Hello fellow email-enthusiasts,

all this discussion about emails being marked as spam or not and why
always makes me think about one thing:

Do we even need Junk/Spam-Folders?

I mean how much mail gets through the first "block directly" level on
your site? Every now and then a wave comes through and results in a bad
mail or two more, but can't people handle 3 or 5 spams in their inbox
per day?

Depending on your client you might even just mark or group them in the
Inbox, so people can take a quick glance and delete them if they want to.

Is it necessary to sort these and lots of false positives into an extra
folder that people regularly have to look into anyway so they don't miss
an important mail? And where you regularly have to remind them to do so?

As a sender I am a little annoyed when someone blocks my mails during
delivery, but at least I know about it and can look into it or contact
the recipient in a different way.

I feel that's a lot better than not knowing if an email just vanished
(not calling names this time...), is being ignored or just not seen
because some obscure AI thought the recipient might want to be saved
from it and he doesn't even know about it?


Even more interesting: In Germany, this can be seen as not delivering an
email to the recipient which is against the law. The user might be using
POP3 or is not subscribed to the IMAP folder and therefore does not see
the SPAM folder at all. To him the email never existed in the first
place - even worse if it gets deleted automatically after a few days.

I am not a lawyer and wouldn't know how to translate the legal text into
English, but basically the law states that as soon as you accept a
letter to be transported, you have to forward it to the recipient. The
only way to avoid that responsibility is to not accept the letter in the
first place. Me using the word "letter" in this is a hint on what times
the law is based on, but it counts for email nonetheless.

This might be a dark grey area and I don't have the resources to fight
something like this in court to have it clarified, but it is something
us postmasters here have to consider.

Perhaps you should too?

Regards from Germany,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop