Date: Fri, 31 Jan 2003 17:03:08 -0500
To: WSFA members <WSFAlist at keithlynch.net>
From: Candy Madigan <candymadigan at mindspring.com>
Subject: [WSFA] Re: Nigerian Letters
Reply-To: WSFA members <WSFAlist at keithlynch.net>

At 09:17 PM 01/29/2003 -0500, you wrote:
>Ivy Yap <yapivy at techemail.com> wrote:
> > Wow, all this talk of spam and letters from Nigeria.  I think I've
> > gotten less than 10 spam messages since I started using e-mail.
> > I feel unloved! ;)
>
>Your email address has apparently never appeared in any newsgroup
>posting, on any public web page, or anywhere else that spammers
>scrounge addresses from.
>
> > And where's all the porn spam that people keep complaining about?
> > How come I never get any? :D
>
>How many would you like?  I have plenty I'm not using.
>
>Like Rich, I currently get far more Spanish Prisoner ("Nigerian") spam
>than "four reports" chain letters.  But this may be because the latter
>are far more stereotypical, thus easier to filter out.  The "Nigerian"
>ones tend to all be slightly different.  The ones that are actually
>*from* Nigeria can easily be blocked.  I discard everything from that
>country or from Argentina, China, Korea, and Taiwan, as those are all
>major source of spam, and seem to have few if any non-spammer email
>users.

Glad I'm not still stationed in Korea.

>As of a year and a half ago, I had received over a hundred thousand
>spams from those countries, and not one single non-spam.  Since then,
>my filters have blocked more than another hundred thousand emails from
>those countries, and I assume all of them were spams.
>
>I currently average about half an hour a day updating my filters.
>Whenever a spam slips through, which fifty to a hundred do each day,
>I try to find a rule which would have blocked them.  Then I make sure
>that rule would not have blocked even one non-spam email in the past
>five years.  Including every one of the 3800 messages posted to this
>list over the past year.
>
>Simply blocking everything containing the word "Nigeria" is obviously
>unacceptable, since it would have blocked this discussion thread,
>among much else.  But if any of you were to start quoting chunks of
>text from actual spams, your posting might get filtered, so watch out.
>
>The one filtering rule I use that I know has caused false positives is
>blocking all HTML email.  Unfortunately, I really have no alternative,
>as that stops more spams than all other rules put together.  (Over
>200,000 spams blocked in the past year.)  And since HTML email can
>spread viruses, worms, and web bugs.
>--
>Keith F. Lynch - kfl at keithlynch.net - http://keithlynch.net/
>I always welcome replies to my e-mail, postings, and web pages, but
>unsolicited bulk e-mail (spam) is not acceptable.  Please do not send me
>HTML, "rich text," or attachments, as all such email is discarded unread.

Candy