Don't Try to Understand It -- It's Just Magic!

Our favorite device in the "Magic" category is the Turntide system that Symantec acquired just after acquiring Brightmail.  We had a chance to catch up with Carlin Weigner recently (Symantec's Mr. Spam now that Enrique has been called to even bigger challenges). After some struggles productizing Turntide, Carlin now reports the much sought after market traction. If you don't know what we're talking about, the Turntide box sits in an incoming mail stream and builds a model of the reputability of each mail server sending mail.  As a server's reputation diminishes, the Turntide box throttles what they receive from that source. What's really clever about the approach is that since the Turntide box never rejects or quarantines a message (just slows its arrival) it never loses good mail (zero false positives). After the acquisition, Symantec was able to improve the Turntide offering by leveraging all the Brightmail spam detection and reputation capabilities.  Prior to that, each Turntide box independently determined the spaminess of senders using only local Bayesian algorithms with the resulting limitation that it took a lot of protected mailboxes to tune up the reputation. Leveraging the Brightmail algorithms and services a Turntide box can be more effective with many fewer mailboxes in back of it. So you turn on the box and after awhile 70% of your incoming mail volume just doesn't show up anymore (magic!). Carlin reports the biggest problem is that when the service renewal comes up some of the customers, noting that they don't get much spam any more, don't renew. Of course with the box off it isn't long before the mail volumes rise dramatically again illuminating the mistake in reasoning (Carlin denies that a Symantec controlled BotNet fed with subscription renewal information had anything to do with it).