Antispam -- focus on the message, not the messenger!

Richi Jennings disagreed with  my criticsms of Microsoft and SenderID.   After some back and forth, he eventually followed up with a substantive post on his own blog making his case.

My basic argument is twofold.   First of all, I believe that blacklists will inevitably include people who shouldn't actually be on them.  This was my primary theme, and so far as I can tell Richi's primary rebuttal is "Don't worry; it isn't really a blacklist; it's rather more of a dark-gray list, and anyhow it won't be implemented for a few more months. "  At least, that's what I think he was arguing.  

Well I'm sorry, but that's pretty weak.  A good antispam system has 50,000+ rules.  To say that there's one rule which is merely a contributing factor like the other 50,000 isn't worthy of an AP story or a press release or an entire Ferris Research implementation report.   Either the lack of SenderID validation is enough to get you pretty effectively blacklisted, or the whole subject is a huge waste of everybody's time.

Second, I believe that antispam filters focusing entirely on the "call to action" can and do get most of the job done with negligible false positives.  Spammers' motives for sending spam are almost always to get money or information out of you..  Thus, they need to provide a place for you to send the money, enter the information, etc. -- or they need to get you to go to website that will download some malicious code.  Whatever the details of their scheme, there's a "call to action" -- most commonly a URL, sometimes an address or phone number.  Antispam systems focusing on the call-to-action have very high levels of accuracy and reliability..

There are of course a couple of kinds of spam without clear filterable calls to action.  One is stock-hyping; purported stock research reports to drive up the price of some security for pump-and-dump schemes.   But those are pretty easy to filter out strictly by their content.   Another kind is purely political spam -- say, an antisemetic rant that does NOT have a URL to click on for further information.   Well, I'm sorry -- but if the only kind of spam that isn't filtered out by an antispam system is the expression of vile political opinions, I think that antispam system is doing a darned good job.

I must confess that my opinions are based mainly on research that's slightly over a year old, and that I am somewhat puzzled by people's insistence in real life on implementing other kinds of antispam rules that produce way too many false positives.  But for now, I'm standing by these opinions, because I haven't seen anything that resembles convincing evidence to the contrary.

EDIT:   Richi (in the post I linked to above) has responded to some of the points above.   I find his whitelist/blacklist/blocklist argument singularly unconvincing, and so by the way do a lot of other people.  Every description I've seen of the plan, including his, suggests that a message whose sender isn't behaving nicely wil be rejected as spam, period -- and hence Microsoft is indeed the sole arbiter of who gets to send email to Hotmail users, or to anybody else who uses the same implementation of the technology.  

I also find his processing-power argument unconvincing -- searching for a call-to-action is simply not that expensive.

His third argument, I guess, carries a little more weight -- if call-to-action blocking were all that great, why wouldn't the antispam vendors be more in love with it?  But I have at least one theory in response:  Brightmail was by far the biggest advocate of this approach, so Brightmail's competitors have for differentiation pushed different approaches.  Only -- Brightmail was acquired by Symantec in the interim, and has made hardly a marketing peep since, leaving a huge void in the antispam dialogue that still remains to be filled.