Re: new paradigm

2011-11-23 Thread Dave Warren
On 11/23/2011 7:01 PM, Christian Grunfeld wrote: Define "bypass first level"? Are you suggesting that for every 1 ham you deliver, you deliver 10 spams into user's mailboxes? Or do you do further filtering? I defined it in the part you did not quote! First level, MTA level: check helo, sender do

Re: new paradigm

2011-11-23 Thread Kevin A. McGrail
"Karsten Bräckelmann" wrote: >On Wed, 2011-11-23 at 20:06 -0500, David F. Skoll wrote: >> On Wed, 23 Nov 2011 21:41:43 -0300 Christian Grunfeld wrote: >> >> > Many things become clear to me now ! Are you an antispam vendor? > >> > No offence but ...now I understand why a "simple" solution makes

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
> Define "bypass first level"? Are you suggesting that for every 1 ham you > deliver, you deliver 10 spams into user's mailboxes? Or do you do further > filtering? I defined it in the part you did not quote! First level, MTA level: check helo, sender domain, IP <-> name maps and also greylists !

Re: new paradigm

2011-11-23 Thread Benny Pedersen
On Thu, 24 Nov 2011 02:30:19 +0100, Karsten Bräckelmann wrote: Go for it, Christian. Prove us all wrong, and finally develop the long awaited FUSSP. (No, I am in no way affiliated with Roaring Penguin. I am a SA dev.) Fuck, now I did reply to this thread. I tried hard not to. I tried... +2

Re: new paradigm

2011-11-23 Thread Dave Warren
On 11/23/2011 4:41 PM, Christian Grunfeld wrote: Our (commercial) software has a similar feature, not quite as fancy as amavisd's, but still pretty useful. Many things become clear to me now ! Are you an antispam vendor? No offence but ...now I understand why a "simple" solution makes no sens

Re: new paradigm

2011-11-23 Thread Dave Warren
On 11/23/2011 4:56 PM, Christian Grunfeld wrote: I still have much more spam than ham after all first checks. I have something like 3 total per day. 3000 bypass first level tests and of those 3000, 300 are ham. Define "bypass first level"? Are you suggesting that for every 1 ham you deliv

Re: new paradigm

2011-11-23 Thread Karsten Bräckelmann
On Wed, 2011-11-23 at 20:06 -0500, David F. Skoll wrote: > On Wed, 23 Nov 2011 21:41:43 -0300 Christian Grunfeld wrote: > > > Many things become clear to me now ! Are you an antispam vendor? > > No offence but ...now I understand why a "simple" solution makes no > > sense to you ! You need a big

Re: new paradigm

2011-11-23 Thread David F. Skoll
On Wed, 23 Nov 2011 21:41:43 -0300 Christian Grunfeld wrote: > Many things become clear to me now ! Are you an antispam vendor? My company is, yes. > No offence but ...now I understand why a "simple" solution makes no > sense to you ! You need a big thing wich wastes a lot of resources in > or

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
2011/11/23 Henrik K : > 85% of incoming is extremely simple to block with MTA rules (zen, helo, > dynamic etc).  And no FPs to mention.  You don't need to count this crap in > anything. completely agree on that! I check helo, sender domains, IP <-> names maps and greylists > 12% of incoming is r

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
> Our (commercial) software has a similar feature, not quite as fancy as > amavisd's, but still pretty useful. Many things become clear to me now ! Are you an antispam vendor? No offence but ...now I understand why a "simple" solution makes no sense to you ! You need a big thing wich wastes a l

Re: new paradigm

2011-11-23 Thread Benny Pedersen
On Wed, 23 Nov 2011 13:05:40 -0500, Kevin A. McGrail wrote: An interesting idea. Sort of a challenge and response with the onus on the recipient. But I think this is handled by auto whitelist which SpamAssassin was one of the first to implement. SAGREY plugin is wonderfull with /32 in AWL

Re: new paradigm

2011-11-23 Thread Adam Moffett
On 11/23/2011 02:22 PM, Christian Grunfeld wrote: Undoubtedly it is *easier*, just as I can easily eliminate all my spam by unplugging the ethernet cable. Just keep in mind this method would only be useful for people who already know who they want to talk to. And that is the big % of what peopl

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
2011/11/23 Mark Martinec : > A concept of 'ongoing conversation' or 'replied to' is implemented as > a 'pen pals' feature in amavisd, when it is used in place of spamd > to call SpamAssassin. The idea is to automatically contribute some negative > spam score points to ongoing conversations - based

Re: new paradigm

2011-11-23 Thread David F. Skoll
On Wed, 23 Nov 2011 16:22:38 -0300 Christian Grunfeld wrote: > Do not assume by default that people want spam ! But your proposal *ensures* that people will have to wade through huge quantities of spam to pull out the non-spam they want. That's going backwards. Regards, David.

Re: new paradigm

2011-11-23 Thread David F. Skoll
On Wed, 23 Nov 2011 20:16:06 +0100 Mark Martinec wrote: > A concept of 'ongoing conversation' or 'replied to' is implemented as > a 'pen pals' feature in amavisd, Our (commercial) software has a similar feature, not quite as fancy as amavisd's, but still pretty useful. To be clear: The concept

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
> Undoubtedly it is *easier*, just as I can easily eliminate all my spam by > unplugging the ethernet cable.  Just keep in mind this method would only be > useful for people who already know who they want to talk to. And that is the big % of what people do or want to do ! most people wants to comu

Re: new paradigm

2011-11-23 Thread David B Funk
On Wed, 23 Nov 2011, Christian Grunfeld wrote: If your assumption was true, there was no spam today. If nobody would ever answer to spam messages, there was no reason for spammers to keep spamming. let people who wants spam to answer spam ! if you dont want spam dont reply. Easy ! There are a

Re: new paradigm

2011-11-23 Thread Mark Martinec
A concept of 'ongoing conversation' or 'replied to' is implemented as a 'pen pals' feature in amavisd, when it is used in place of spamd to call SpamAssassin. The idea is to automatically contribute some negative spam score points to ongoing conversations - based on envelope sender and recipients,

Re: new paradigm

2011-11-23 Thread Henrik K
On Wed, Nov 23, 2011 at 02:55:46PM -0300, Christian Grunfeld wrote: > > So the idea is...in this days where the ratio of spam/ham is about 80% > (put the ratio you want but be sure it is high enough) lets start with > marking all incomings as spam ! Maybe you are trolling but whatever.. 85% of i

Re: new paradigm

2011-11-23 Thread Kris Deugau
Christian Grunfeld wrote: Not 100% correct. Now I always check spam folder, dont you? Do you advise your people not to check spam folders? Are you 100% sure that machines can sort 100% efectively what is spam and what is not? SpamAssassin, in the installations I maintain, is accurate *enough* t

Re: new paradigm

2011-11-23 Thread Adam Moffett
Undoubtedly it is *easier*, just as I can easily eliminate all my spam by unplugging the ethernet cable. Just keep in mind this method would only be useful for people who already know who they want to talk to. The idea is as simple as: past days was easier to blacklist...nowdays is easier to

Re: new paradigm

2011-11-23 Thread darxus
Many people have spent many nights lying awake trying to figure out what to do about spam. The the extent that when a person believes they have come up with an idea that is both new and useful, they are usually wrong. This results in some hostile attitudes toward new ideas - I have certainly felt

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
> I don't think AWL does with the original poster is describing, but > implementation would be trivial in the MTA without spamassassin involved at > all. > > If the user expects to receive mail from a limited number of people like > only their relatives (m...@myhome.com) then this actually might ma

Re: new paradigm

2011-11-23 Thread David F. Skoll
On Wed, 23 Nov 2011 15:30:08 -0300 Christian Grunfeld wrote: > > Well, if I have to do *that*, I might as well not do any filtering > > at all. The whole purpose of anti-spam software is to shield me > > from spam. > Not 100% correct. Now I always check spam folder, dont you? I do have a quaran

Re: new paradigm

2011-11-23 Thread spamassassin
On 23/11/11 17:55, Christian Grunfeld wrote: > What do I mean? you never never answer (or it is really strange) a > spam message. On my personal email system, my MSA records Message-Id's of outgoing mail into a database. If a message comes in to my MTA with one of those Message-Id's in the "In-Re

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
>> If your assumption was true, there was no spam today. If nobody would ever >> answer to spam messages, there was no reason for spammers to keep spamming. your assumption is not correct ! Spammers are not there because all the people answer them ! They are there and send HUGE volumes of mails be

Re: new paradigm

2011-11-23 Thread Adam Moffett
An interesting idea. Sort of a challenge and response with the onus on the recipient. But I think this is handled by auto whitelist which SpamAssassin was one of the first to implement. Regards, KAM I don't think AWL does with the original poster is describing, but implementation would

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
> If your assumption was true, there was no spam today. If nobody would ever > answer to spam messages, there was no reason for spammers to keep spamming. let people who wants spam to answer spam ! if you dont want spam dont reply. Easy ! There are a lot of people who wants to sell viagra and send

Re: new paradigm

2011-11-23 Thread Christian Grunfeld
>> *check spam folder always > > Well, if I have to do *that*, I might as well not do any filtering at all. > The whole purpose of anti-spam software is to shield me from spam. Not 100% correct. Now I always check spam folder, dont you? Do you advise your people not to check spam folders? Are you

Re: new paradigm

2011-11-23 Thread Rolf E. Sonneveld
On 11/23/11 6:55 PM, Christian Grunfeld wrote: Hi, I have an idea to discuss here with experts ! What is the main MAIN difference between spam and ham ? ... ... Answer: spam is "one way ticket" and ham is 99.99% "round trip" ! What research can you cite for these figures? I beg to differ. Thi

Re: new paradigm

2011-11-23 Thread David F. Skoll
On Wed, 23 Nov 2011 14:55:46 -0300 Christian Grunfeld wrote: > So the idea is...in this days where the ratio of spam/ham is about 80% > (put the ratio you want but be sure it is high enough) lets start with > marking all incomings as spam ! The cure is worse than the disease, because: > *check

Re: new paradigm

2011-11-23 Thread Kevin A. McGrail
On 11/23/2011 12:55 PM, Christian Grunfeld wrote: Hi, I have an idea to discuss here with experts ! What is the main MAIN difference between spam and ham ? ... ... Answer: spam is "one way ticket" and ham is 99.99% "round trip" ! (legit notifications can be "one way ticket" but you can mark the

new paradigm

2011-11-23 Thread Christian Grunfeld
Hi, I have an idea to discuss here with experts ! What is the main MAIN difference between spam and ham ? ... ... Answer: spam is "one way ticket" and ham is 99.99% "round trip" ! (legit notifications can be "one way ticket" but you can mark them as ham later) What do I mean? you never never ans

Re: Custom rawbody rule in local.cf not triggered

2011-11-23 Thread Ned Slider
In addition to other replies... On 23/11/11 14:13, Simon Loewenthal wrote: I have spam that hits on these rules. X-Spam-Report: * 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist * [URIs: europjobs.eu] * 1.2 URIBL_JP_SURBL Contains an URL listed in the JP SUR

Re: Custom rawbody rule in local.cf not triggered

2011-11-23 Thread Simon Loewenthal
On 23/11/11 16:21, Martin Gregorie wrote: > On Wed, 2011-11-23 at 15:13 +0100, Simon Loewenthal wrote: >> I have spam that hits on these rules. >> >> X-Spam-Report: >> * 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist >> * [URIs: europjobs.eu] >> * 1.2 URIBL_JP_SURB

Re: Custom rawbody rule in local.cf not triggered

2011-11-23 Thread Martin Gregorie
On Wed, 2011-11-23 at 15:13 +0100, Simon Loewenthal wrote: > I have spam that hits on these rules. > > X-Spam-Report: > * 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist > * [URIs: europjobs.eu] > * 1.2 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklis

Re: Custom rawbody rule in local.cf not triggered

2011-11-23 Thread Simon Loewenthal
On 23/11/11 15:31, Axb wrote: > On 2011-11-23 15:13, Simon Loewenthal wrote: >> >> I have spam that hits on these rules. >> >> X-Spam-Report: >> * 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist >> * [URIs: europjobs.eu] >> * 1.2 URIBL_JP_SURBL Contains an URL li

Re: Custom rawbody rule in local.cf not triggered

2011-11-23 Thread Axb
On 2011-11-23 15:13, Simon Loewenthal wrote: I have spam that hits on these rules. X-Spam-Report: * 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist * [URIs: europjobs.eu] * 1.2 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist * [URIs:

Custom rawbody rule in local.cf not triggered

2011-11-23 Thread Simon Loewenthal
I have spam that hits on these rules. X-Spam-Report: * 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist * [URIs: europjobs.eu] * 1.2 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist * [URIs: europjobs.eu] * 0.0 UNPARSEABLE_RELAY Info