In the September issue of the Ottawa PC
News, I reviewed SpamNet, which uses the collective knowledge of thousands
of Internet e-mail users to determine what is and isn’t spam. In the October
issue, I looked at SpamAssassin Pro, which is based on the open source
SpamAssassin and uses over 400 rules to weigh the likelihood of a particular
piece of e-mail being spam. The rules are laid bare for all to see and
modify as they see fit.
For my final review, I look at Sunbelt
Software’s iHateSpam, which takes what I would consider to be a more traditional
approach. It applies hidden rules to look at inbound e-mail to determine
if it is spam or not. Before I looked at iHateSpam, I assumed the approaches
used by SpamNet and SpamAssassin Pro would be more effective, the former
because real people are making the determination and the latter because
of the flexibility afforded by exposing the rule set. I was wrong. I found
iHateSpam to be at least as effective as SpamNet and SpamAssassin Pro.
iHateSpam comes in two flavours, one for
Outlook and one for Outlook Express. This review covers only the Outlook
version, as that is what I use most of the time. If you use Outlook Express,
you should look at the manual, which is downloadable from the Sunbelt Software
web site. The program operates considerably differently from the version
for Outlook. The Outlook Express version doesn’t have as much functionality
as the Outlook version, and the treatment of rules is different: The OE
version imports rules into the rules engine built-in to OE, unlike the
Outlook version, which uses its own engine. Spam detection rates are not
as high in the Outlook Express version as in the Outlook version.
The license for iHateSpam allows you to run both versions on one machine.
You can put an extra copy on a laptop at no additional charge, as long
as you are the primary user of iHateSpam and don’t use the laptop copy
at the same time as your desktop copy.
The installation program routine for iHateSpam
steps you through a number of options that will get the program configured
more to your liking. It finds your address books and offers to add those
contacts to your Friends list so that e-mail from them will not
be treated as spam. You then choose a threshold level which tells iHateSpam
how aggressive it should be in trying to eliminate spam. Of course, the
more aggressive you set the program, the higher number of false positive
you will get. The lower the setting, the more likely it is that spam will
get through. I left it at the middle, Default level, as I assume
most users will do likewise. Finally, you are given the option of turning
on character set blocking, where anything with a specified foreign character
set, such as Korean or Turkish, is automatically treated as spam.
Once the installation finishes, Outlook
sports a new toolbar with buttons for the most common functions;
-
Clean Folder – check the currently
selected folder for spam. You have the option of just checking unread mail
or all mail and you can choose a date range.
-
Quarantine/Un-Quarantine – if the current
message is in the Inbox, this quarantines it. If in a quarantine folder,
this button will send the message back to the Inbox.
-
Bounce – send the spammer an undeliverable
message. The idea is that the spammer will take you off their mailing list
if it appears the address is invalid. Ya, right… If it makes you feel good,
go ahead. But don’t expect it to really help.
-
Report – this will try to analyze the
source of the message and report the spam to the spammer’s ISP, SpamAbuse.org,
etc. Comparing the results of this to results from Spamcop.net, I would
say avoid this feature. It is wrong more often than it is right. In Sunbelt’s
defence, proper checking is neither easy nor fast.
-
Add to Friends – whitelists the sender’s
address so future e-mails from this address will not be treated as spam.
-
Add to Enemies – blacklists the sender’s
address so future e-mails from this address will be treated as spam.
-
Manage Friends/Enemies Lists – two
buttons that allow you to edit these lists.
-
Options – opens the options dialog.
The Options dialog offers quite a few
ways to control how the program works.
You can control what dialog boxes pop
up to tell you what is going on, set where your quarantine folders are
located and whether to use a single folder, or four folders which categorize
the spam as Adult, Hazardous, Junk, or Subscription.
There are some options for those who access
an Exchange Server, including the option to not quarantine anything from
users on the Exchange Server. It would be really nice if this worked, but
it doesn’t. I received confirmation from tech support that this is their
“number one” bug to work on.
One option allows you to participate in
iHateSpam’s Learning Network. When enabled, the buttons Quarantine
and Un-quarantine switch to Is Spam and Not Spam. Using these buttons
will send the selected e-mail to Sunbelt Software. The idea is that they
can look into why the e-mail was not categorized properly and improve their
filters. If you enable this feature, you should be careful. As with SpamNet,
you could accidentally send confidential information to the vendor. At
least the iHateSpam license agreement does not assign all rights to the
e-mails to them, unlike SpamNet’s.
Automatic Updates to both the software
and filters is enabled by default, and iHateSpam will check for spam filter
updates every time the program starts. You can turn this off and check
for updates manually when you want to with a button in the Options
screen. Automatic program updates only happen for major updates. There
are sometimes minor updates not triggered at program start-up. If you want,
you can use the manual update button to check for minor updates.
One tab in the Options dialog box allows
you to automatically block spam that uses any of 15 foreign character sets.
Finally, there are several options that
can speed your use of the program, such as automatically adding the address
to the Friends list when you mark something as not being spam.
It took me a while to realize it, but there
is another area you should explore in order to get the most out of iHateSpam.
In addition to the toolbar, which includes the Options button as
described above, an iHateSpam menu is added to Outlook. There is
some duplication in functionality between the iHateSpam menu and the Options
dialog, but some configuration options are only available from the menu.
While you had a chance to set the Threshold
level during installation, the Options dialog does not have a means
of modifying that. But it can be found on the menu. There are five levels
available;
-
All Spam – should catch all junk mail,
along with most mass-mailed newsletters and “opt-in” e-mail
-
Most Spam – should catch all junk mail
and a lot of newsletter material
-
Default – should catch most real spam
and possibly some non-spam
-
Explicit Spam – should catch only e-mail
that is for sure spam
-
Some Spam – should catch only e-mail
with big-time spam indicators
If you find you are getting too many false
positives, you can lower the threshold. If you find you are getting too
much spam, you can raise it.
There is a menu option for Personal
Rules which are really powerful. I was initially concerned that iHateSpam
could not whitelist based on the To: address. As mentioned in previous
articles, I receive a lot of mailing list e-mail. This is typically from
a great number of people, but it is always addressed to a single address:
the list address.
The Personal Rules section, once
I found it, allowed me to easily create rules so that anything addressed
to a particular address is never quarantined. There are many options available.
You can check properties such as size, contents of the body, existence
of an attachment, an attachment name, the sender’s domain, etc. Operators
such as “contains”, “>”, and “= true” are available, depending on the property.
The list of actions includes things like “delete”, “quarantine”, “do not
quarantine”, etc. This is very powerful stuff and allows you to fine-tune
the program to handle the type of e-mail you receive.
By default, iHateSpam will only deal with
items that are in your Inbox. If you have Outlook rules automatically moving
items to other folders, check out the menu option for Mailbox Inspectors.
You can easily specify any folders and from then on, iHateSpam will monitor
those folders as well as the Inbox.
Personally, I think all menu options should
be moved into the Options dialog box.
I seriously wonder about how iHateSpam
classifies spam. Examples of items classified as Adult were;
-
An e-mail from an anti-virus vendor on file
system permissions required by their product
-
A newsletter from Windows and .Net Magazine
-
A message from Microsoft Premier Support regarding
Windows 2000 SP3
-
A reply from McAfee’s Anti-Virus research
labs about the Badtrans worm
Unless Sunbelt Software fixes this, I recommend
using a single quarantine folder.
iHateSpam did a very good job of quarantining
real spam, missing only a couple in the several weeks I have been using
it. However, like SpamNet and SpamAssassin Pro, I found it caught quite
a few false positives. Most of these were mass-mailed newsletters that
have many of the characteristics of spam, but I really wish a company would
find an effective way of not treating things like The Daily Dilbert
as spam. After a couple of weeks of diligent use of the Add to Friends
button and a few new Personal Rules, I have seen the false positives
drop dramatically.
I am unwilling to adjust the spam sensitivity
threshold lower, as that will let more spam through. Because of this, I
don’t expect false positives to disappear. A draft of a message I was preparing
for my boss listing my areas of responsibility was treated as spam! Should
I be worried about what that says about my job?
Overall, I am quite happy with iHateSpam.
I find it as effective as SpamNet and SpamAssassin Pro in picking up real
spam. As with SpamNet and SpamAssassin Pro, I have to remain vigilant in
watching the quarantine folders to ensure I find any false positives. I
find the user interface in iHateSpam to be more polished and it offers
more flexibility than the other two programs. Of the three programs, iHateSpam
is the one that will remain on my system, at least for now.
iHateSpam costs US$30, which includes the
first year of updates. It requires Windows 98 or better and Outlook 2000/XP
or Outlook Express 5/6. You need a Pentium 200 or better with at least
32MB RAM and 12MB of disk space.
UPDATE (Jan. 2003): Sunbelt Software
has dropped the price of iHateSpam to US$20.
You can download a fully-functional 30-day
eval of iHateSpam from the web site at www.sunbelt-software.com. As well,
you can download PDF files of the complete documentation.
Choosing the best anti-spam
program
Over the last three months, I have reviewed
three programs that take different approaches to spam filtering. All are
quite effective at significantly reducing the amount of spam that ends
up in your Inbox. All catch some non-spam e-mails. So which one is best?
That all depends…
SpamNet: Great for those who want
to leverage the knowledge of hundreds of thousands of other users.
SpamAssassin Pro: Great for those
who want to roll up their sleeves and fine tune the program rules. The
ability to effectively do so may be beyond most users’ capabilities, however.
iHateSpam: As effective as the other
two and more polished. Much more configurable than SpamNet and much easier
to configure than SpamAssassin Pro. My personal favourite.
But I do have to add; in the coolest name
category, SpamAssassin Pro wins, hands down!
What’s next?
All three programs I looked at operate
in fundamentally the same manner. They look for key indicators in the content
to decide if something is spam. But these indicators are primarily other
people’s indicators and do not necessarily take into account the types
of e-mails you receive. The problem is typified by the following; if I
receive an e-mail with the words penis and Viagra in it, I am 100% sure
it is a spam. However, the same is probably not true for a doctor.
The newest darling in anti-spam is Bayesian
filtering. This is a statistical technique where you teach the program
what is and isn’t spam. The program continually learns from you and keeps
getting better and better over time. For background information, see www.paulgraham.com/spam.html.
A free, working implementation that works with any POP3 e-mail account
and uses Perl scripts can be found at popfile.sourceforge.net. Version
alpha 1.3 of the open source Mozilla includes Bayesian anti-spam filtering.
Personally, I think Bayesian filtering
holds the most promise for the future of anti-spam. I am convinced that
all anti-spam vendors will be either switching to Bayesian filters or including
them as a major weighting factor in their products.
Bottom Line:
iHateSpam
US$20 including the first year of updates
from Sunbelt Software
http://www.sunbelt-software.com
Originally published: December, 2002