On Saturday, September 25, 2004, 9:42:35 AM, Ryan Thompson wrote:
Meaning, whitelisting is usually just about as difficult as blacklisting.
Whitelisting is sometimes harder than blocklisting. Most pure spams are extremely obvious. We've all seen the many nearly identical pill, mortgage, and warez spams, right? Those ones are clearly spams and easy to blocklist.
There are some spammy-mentioned legitimate sites that are harder to identify as legitimate, like those that appear in stock newsletters, joke-of-the-day type, mailing lists, newsletters, etc.
Those require more research to find out if the reporter forgot they were subscribed, whether the domain belongs to spam gangs, whether there is a Joe Job going on, or any number of other factors. But the decision needs to be made if we are to prevent or fix false positives.
The decision to whitelist is often difficult and usually requires at least some research. Fortunately some of our research tools like GetURI and others help quite a bit, but classification still requires human judgement and effort.
Jeff C. -- "If it appears in hams, then don't list it."