Ottawa PC Users' Group, Inc.
 Product Review 


iHateSpam
by
Chris Taylor

In the September issue of the Ottawa PC News, I reviewed SpamNet, which uses the collective knowledge of thousands of Internet e-mail users to determine what is and isn’t spam. In the October issue, I looked at SpamAssassin Pro, which is based on the open source SpamAssassin and uses over 400 rules to weigh the likelihood of a particular piece of e-mail being spam. The rules are laid bare for all to see and modify as they see fit.

For my final review, I look at Sunbelt Software’s iHateSpam, which takes what I would consider to be a more traditional approach. It applies hidden rules to look at inbound e-mail to determine if it is spam or not. Before I looked at iHateSpam, I assumed the approaches used by SpamNet and SpamAssassin Pro would be more effective, the former because real people are making the determination and the latter because of the flexibility afforded by exposing the rule set. I was wrong. I found iHateSpam to be at least as effective as SpamNet and SpamAssassin Pro.

iHateSpam comes in two flavours, one for Outlook and one for Outlook Express. This review covers only the Outlook version, as that is what I use most of the time. If you use Outlook Express, you should look at the manual, which is downloadable from the Sunbelt Software web site. The program operates considerably differently from the version for Outlook. The Outlook Express version doesn’t have as much functionality as the Outlook version, and the treatment of rules is different: The OE version imports rules into the rules engine built-in to OE, unlike the Outlook version, which uses its own engine. Spam detection rates are not as high in the Outlook Express version as in the Outlook version.  The license for iHateSpam allows you to run both versions on one machine. You can put an extra copy on a laptop at no additional charge, as long as you are the primary user of iHateSpam and don’t use the laptop copy at the same time as your desktop copy.


The installation program routine for iHateSpam steps you through a number of options that will get the program configured more to your liking. It finds your address books and offers to add those contacts to your Friends list so that e-mail from them will not be treated as spam. You then choose a threshold level which tells iHateSpam how aggressive it should be in trying to eliminate spam. Of course, the more aggressive you set the program, the higher number of false positive you will get. The lower the setting, the more likely it is that spam will get through. I left it at the middle, Default level, as I assume most users will do likewise. Finally, you are given the option of turning on character set blocking, where anything with a specified foreign character set, such as Korean or Turkish, is automatically treated as spam.

Once the installation finishes, Outlook sports a new toolbar with buttons for the most common functions;

  • Clean Folder – check the currently selected folder for spam. You have the option of just checking unread mail or all mail and you can choose a date range.
  • Quarantine/Un-Quarantine – if the current message is in the Inbox, this quarantines it. If in a quarantine folder, this button will send the message back to the Inbox.
  • Bounce – send the spammer an undeliverable message. The idea is that the spammer will take you off their mailing list if it appears the address is invalid. Ya, right… If it makes you feel good, go ahead. But don’t expect it to really help.
  • Report – this will try to analyze the source of the message and report the spam to the spammer’s ISP, SpamAbuse.org, etc. Comparing the results of this to results from Spamcop.net, I would say avoid this feature. It is wrong more often than it is right. In Sunbelt’s defence, proper checking is neither easy nor fast.
  • Add to Friends – whitelists the sender’s address so future e-mails from this address will not be treated as spam.
  • Add to Enemies – blacklists the sender’s address so future e-mails from this address will be treated as spam.
  • Manage Friends/Enemies Lists – two buttons that allow you to edit these lists.
  • Options – opens the options dialog.
The Options dialog offers quite a few ways to control how the program works.

You can control what dialog boxes pop up to tell you what is going on, set where your quarantine folders are located and whether to use a single folder, or four folders which categorize the spam as Adult, Hazardous, Junk, or Subscription.

There are some options for those who access an Exchange Server, including the option to not quarantine anything from users on the Exchange Server. It would be really nice if this worked, but it doesn’t. I received confirmation from tech support that this is their “number one” bug to work on.

One option allows you to participate in iHateSpam’s Learning Network. When enabled, the buttons Quarantine and Un-quarantine switch to Is Spam and Not Spam. Using these buttons will send the selected e-mail to Sunbelt Software. The idea is that they can look into why the e-mail was not categorized properly and improve their filters. If you enable this feature, you should be careful. As with SpamNet, you could accidentally send confidential information to the vendor. At least the iHateSpam license agreement does not assign all rights to the e-mails to them, unlike SpamNet’s.

Automatic Updates to both the software and filters is enabled by default, and iHateSpam will check for spam filter updates every time the program starts. You can turn this off and check for updates manually when you want to with a button in the Options screen. Automatic program updates only happen for major updates. There are sometimes minor updates not triggered at program start-up. If you want, you can use the manual update button to check for minor updates.

One tab in the Options dialog box allows you to automatically block spam that uses any of 15 foreign character sets.

Finally, there are several options that can speed your use of the program, such as automatically adding the address to the Friends list when you mark something as not being spam.

It took me a while to realize it, but there is another area you should explore in order to get the most out of iHateSpam. In addition to the toolbar, which includes the Options button as described above, an iHateSpam menu is added to Outlook. There is some duplication in functionality between the iHateSpam menu and the Options dialog, but some configuration options are only available from the menu.

While you had a chance to set the Threshold level during installation, the Options dialog does not have a means of modifying that. But it can be found on the menu. There are five levels available;

  • All Spam – should catch all junk mail, along with most mass-mailed newsletters and “opt-in” e-mail
  • Most Spam – should catch all junk mail and a lot of newsletter material
  • Default – should catch most real spam and possibly some non-spam
  • Explicit Spam – should catch only e-mail that is for sure spam
  • Some Spam – should catch only e-mail with big-time spam indicators
If you find you are getting too many false positives, you can lower the threshold. If you find you are getting too much spam, you can raise it.

There is a menu option for Personal Rules which are really powerful. I was initially concerned that iHateSpam could not whitelist based on the To: address. As mentioned in previous articles, I receive a lot of mailing list e-mail. This is typically from a great number of people, but it is always addressed to a single address: the list address.

The Personal Rules section, once I found it, allowed me to easily create rules so that anything addressed to a particular address is never quarantined. There are many options available. You can check properties such as size, contents of the body, existence of an attachment, an attachment name, the sender’s domain, etc. Operators such as “contains”, “>”, and “= true” are available, depending on the property. The list of actions includes things like “delete”, “quarantine”, “do not quarantine”, etc. This is very powerful stuff and allows you to fine-tune the program to handle the type of e-mail you receive.

By default, iHateSpam will only deal with items that are in your Inbox. If you have Outlook rules automatically moving items to other folders, check out the menu option for Mailbox Inspectors. You can easily specify any folders and from then on, iHateSpam will monitor those folders as well as the Inbox.

Personally, I think all menu options should be moved into the Options dialog box.

I seriously wonder about how iHateSpam classifies spam. Examples of items classified as Adult were;

  • An e-mail from an anti-virus vendor on file system permissions required by their product
  • A newsletter from Windows and .Net Magazine
  • A message from Microsoft Premier Support regarding Windows 2000 SP3
  • A reply from McAfee’s Anti-Virus research labs about the Badtrans worm
Unless Sunbelt Software fixes this, I recommend using a single quarantine folder.

iHateSpam did a very good job of quarantining real spam, missing only a couple in the several weeks I have been using it. However, like SpamNet and SpamAssassin Pro, I found it caught quite a few false positives. Most of these were mass-mailed newsletters that have many of the characteristics of spam, but I really wish a company would find an effective way of not treating things like The Daily Dilbert as spam. After a couple of weeks of diligent use of the Add to Friends button and a few new Personal Rules, I have seen the false positives drop dramatically.

I am unwilling to adjust the spam sensitivity threshold lower, as that will let more spam through. Because of this, I don’t expect false positives to disappear. A draft of a message I was preparing for my boss listing my areas of responsibility was treated as spam! Should I be worried about what that says about my job?

Overall, I am quite happy with iHateSpam. I find it as effective as SpamNet and SpamAssassin Pro in picking up real spam. As with SpamNet and SpamAssassin Pro, I have to remain vigilant in watching the quarantine folders to ensure I find any false positives. I find the user interface in iHateSpam to be more polished and it offers more flexibility than the other two programs. Of the three programs, iHateSpam is the one that will remain on my system, at least for now.

iHateSpam costs US$30, which includes the first year of updates. It requires Windows 98 or better and Outlook 2000/XP or Outlook Express 5/6. You need a Pentium 200 or better with at least 32MB RAM and 12MB of disk space.

UPDATE (Jan. 2003): Sunbelt Software has dropped the price of iHateSpam to US$20.

You can download a fully-functional 30-day eval of iHateSpam from the web site at www.sunbelt-software.com. As well, you can download PDF files of the complete documentation.



Bottom Line:

iHateSpam
US$20 including the first year of updates
from Sunbelt Software
Web site:http://www.sunbelt-software.com



Choosing the best anti-spam program

Over the last three months, I have reviewed three programs that take different approaches to spam filtering. All are quite effective at significantly reducing the amount of spam that ends up in your Inbox. All catch some non-spam e-mails. So which one is best? That all depends…

SpamNet: Great for those who want to leverage the knowledge of hundreds of thousands of other users.

SpamAssassin Pro: Great for those who want to roll up their sleeves and fine tune the program rules. The ability to effectively do so may be beyond most users’ capabilities, however.

iHateSpam: As effective as the other two and more polished. Much more configurable than SpamNet and much easier to configure than SpamAssassin Pro. My personal favourite.

But I do have to add; in the coolest name category, SpamAssassin Pro wins, hands down!

What’s next?
All three programs I looked at operate in fundamentally the same manner. They look for key indicators in the content to decide if something is spam. But these indicators are primarily other people’s indicators and do not necessarily take into account the types of e-mails you receive. The problem is typified by the following; if I receive an e-mail with the words penis and Viagra in it, I am 100% sure it is a spam. However, the same is probably not true for a doctor.

The newest darling in anti-spam is Bayesian filtering. This is a statistical technique where you teach the program what is and isn’t spam. The program continually learns from you and keeps getting better and better over time. For background information, see www.paulgraham.com/spam.html. A free, working implementation that works with any POP3 e-mail account and uses Perl scripts can be found at popfile.sourceforge.net. Version alpha 1.3 of the open source Mozilla includes Bayesian anti-spam filtering.

Personally, I think Bayesian filtering holds the most promise for the future of anti-spam. I am convinced that all anti-spam vendors will be either switching to Bayesian filters or including them as a major weighting factor in their products.


Copyright and Usage
Ottawa Personal Computer Users' Group (OPCUG), Inc.
3 Thatcher Street, Ottawa, ON  K2G 1S6

The opinions expressed in these reviews may not necessarily
represent the views of the OPCUG or its members.