Re: Open letter to Trend Micro

From: Les Connor [SBS MVP] (les.connor_at_DEL.cfive.ca)
Date: 05/07/04


Date: Thu, 6 May 2004 20:41:33 -0500

Hi David,

Your points are well taken.

I differ in that I want aggressive spam filtering, and I accept that this is
going to result in some false positives. Your choices are different, is all.

Trend C/S/M is a pretty good product in this light, it does allow us to make
these choices, rather than one size fits all.

-- 
Les Connor [SBS MVP]
-------------------------------------
SBS Rocks !
"David Schrag" <david-no-spam@schrag.net> wrote in message
news:OLU8xr8MEHA.624@TK2MSFTNGP11.phx.gbl...
> "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message
> news:uj6oS96MEHA.936@TK2MSFTNGP11.phx.gbl...
> > That's OK, I don't mind disagreements.
>
> Good ... I love them!
>
> > If you don't get any false positives you either a) don't update your
> > spamrule files, b) have your settings to low, c) have ineffective spam
> > control software.
>
> I completely disagree here. I'd rather have 10-20 spams a day come through
> as "good" than have a single real e-mail get flagged as "bad." I use K9
> (http://keir.net) to filter my POP mail, and of the last 10,400 messages
> it's reviewed, 1,248 have been true positives, 233 have been false
> negatives, and 0 have been false positives. That ratio suits me just fine.
>
> As I mentioned before, the problem with false positives is particularly
> acute when the administrator, rather than the end-user, is the gatekeeper.
I
> don't think my clients want me really want me inspecting all their
incoming
> e-mail and deciding which ones to resend them. I think they'd see this as
an
> invasion of privacy and I don't think they'd want to pay for it.
>
> But this is a digression from the main point, which is that Trend ought to
> make sure that the products meant to improve our lives don't have serious
> side effects.
>
> >
> > When email I expect doesn't show up, it's logical to check the spam
> blocker
> > first. It was a non-issue as far as I'm concerned.
>
> Sure, it's logical to check the spam blocker on the recipient's (my) end,
> but how many spam blockers are designed to prevent SENDING spam as opposed
> to receiving it? As you can tell from the posts to this group, a lot of
> people were baffled as to the cause of the disappearing performance
reports.
>
> >
> > It really has nothing to do with SBS or Trend. In my case, only one SBS
> > server's status report was blocked. All others continued on their merry
> way.
> > Why ? Hell, I don't know !!
>
> I wouldn't expect you or me to know. I wouldn't even expect Microsoft to
> know. But I would expect Trend to know, and I'd expect them to know before
> we do. That's really my only point.
>
> David
> >
> >
> > "David Schrag" <david-no-spam@schrag.net> wrote in message
> > news:u1GW4l6MEHA.2628@TK2MSFTNGP12.phx.gbl...
> > > Gotta disagree with you, Les. I'm not upset with the fact that we have
> to
> > > spend money on Trend's software to deal with the spam problem. I'm
upset
> > by
> > > the fact that Trend's software is causing its own set of problems. And
> > since
> > > both the reboot problem and the performance report quarantine problem
> seem
> > > to affect all SBS03 users, I would think that Trend could have
prevented
> > > these problems through better testing in their own shop. And it's not
> like
> > > these updates had to be rushed out the door in response to new threats
> > like
> > > Sasser. So what's the excuse?
> > >
> > > Is Trend the only software manufacturer to release buggy software? We
> all
> > > know the answer to that one. But I think they could do a better job,
and
> > > they could certainly do better in terms of tech support. (How 'bout a
> > > monitored newsgroup like this one, for example?)
> > >
> > > "Les Connor [SBS MVP]" <les.connor@DEL.cfive.ca> wrote in message
> > > news:uBrf6O6MEHA.2676@TK2MSFTNGP12.phx.gbl...
> > > > David,
> > > >
> > > > I hear your frustration. But ....
> > > >
> > > > The problem is not Trend, the problem lies with those who spam (and
> > > > manufacture malware), and with those who don't take reasonable
> > precautions
> > > > to prevent aiding the spammers. Our problem, A/V manufacturers
> > opportunity
> > > > ;-).
> > > >
> > > > FWIW, you'll have a difficult time beating the protection C/S/M
offers
> > at
> > > > the price. Those with no spam control won't have the occasional
false
> > > > positive. Just a whole lot of spam.
> > > >
> > > > -- 
> > > > Les Connor [SBS MVP]
> > > > -------------------------------------
> > > > SBS Rocks !
> > > >
> > > >
> > > >
> > > > "David Schrag" <david-no-spam@schrag.net> wrote in message
> > > > news:%23vgBFn5MEHA.3312@tk2msftngp13.phx.gbl...
> > > > > Could you folks please improve your testing regimen for C/S/M -
SMB
> > > > updates,
> > > > > specifically on SBS03 servers? A month ago your update caused
> > > spontaneous
> > > > > server reboots, and now an update to eManager is quarantining our
> > server
> > > > > performance reports. You have a lot of fans in the SBS community
...
> > but
> > > > if
> > > > > this keeps up you're likely to lose a bunch of them. Who knows ...
> you
> > > > might
> > > > > even lose your MS Gold Certified Partner status.
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>


Relevant Pages

  • Re: PLUG: PMAS
    ... The state of the art that can be obtained with DNSbsl is> 80% with out a DHCP list, and well into the 90% in spam detection. ... more good mail probably gets lost for other reasons beyond the mail server operator or network administrators control. ... So what DNSbls are you using that generate these higher rates of false positives? ... And most of the mail servers that I have seen allow local customization of the bounce message they send to their internal network users. ...
    (comp.os.vms)
  • Re: IMF and UceArchive folder
    ... could not get it to do what I needed, and decided to give the IMF a try. ... > 138 got a score of 1-3, making them almost certainly not spam. ... > potential false positives in the SCL range of 4-7." ... > It says you're a "Software Development Consultant" in your sig. ...
    (microsoft.public.exchange.admin)
  • Re: IMF and UceArchive folder
    ... The IMF has been running over the weekend at a level of 5. ... checking through every piece of archived email, and have no false positives. ... Some of the spam has been given a rating of 1 or 2, ... These guys are quoting MCP magazine. ...
    (microsoft.public.exchange.admin)
  • Re: SBS 2008 and antivirus
    ... I'll be installing more of these I'm ... Have you seen many false positives? ... Quarantine "Suspect" spam - the Suspect spam is part of the nightly ... Calling an illegal alien an "undocumented worker" is like calling a ...
    (microsoft.public.windows.server.sbs)
  • Re: SBS 2008 and antivirus
    ... Can you recommend settings for email filtering? ... Have you seen many false positives? ... Quarantine "Suspect" spam - the Suspect spam is part of the nightly ...
    (microsoft.public.windows.server.sbs)