Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread LuKreme
On 10-Feb-2010, at 02:42, Mike Cardwell wrote: > > At SMTP time I return a 5xx code during the "DATA" phase for messages > classified as Spam. However, I also deliver the message into a read only > "Junk E-Mail" folder for the user, This is just wrong. Either accept the message, or reject the

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread --[ UxBoD ]--
- dar...@chaosreigns.com wrote: > http://www.chaosreigns.com/mtx/ > > -- > "Democracy is the theory that the common people know what they want, > and deserve to get it good and hard." - H. L. Mencken > http://www.ChaosReigns.com Like the simplicity and it does appear to be a great idea. Wh

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mike Cardwell
On 11/02/2010 08:27, LuKreme wrote: At SMTP time I return a 5xx code during the "DATA" phase for messages classified as Spam. However, I also deliver the message into a read only "Junk E-Mail" folder for the user, This is just wrong. Either accept the message, or reject the message. Rejecting

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Bernd Petrovitsch
On Don, 2010-02-11 at 10:38 +, Mike Cardwell wrote: > On 11/02/2010 08:27, LuKreme wrote: > >> At SMTP time I return a 5xx code during the "DATA" phase for messages > >> classified as Spam. However, I also deliver the message into a read only > >> "Junk E-Mail" folder for the user, > > > > Th

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mike Cardwell
On 11/02/2010 11:26, Bernd Petrovitsch wrote: At SMTP time I return a 5xx code during the "DATA" phase for messages classified as Spam. However, I also deliver the message into a read only "Junk E-Mail" folder for the user, This is just wrong. Either accept the message, or reject the message

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread RW
On Thu, 11 Feb 2010 12:26:03 +0100 Bernd Petrovitsch wrote: > On Don, 2010-02-11 at 10:38 +, Mike Cardwell wrote: > > On 11/02/2010 08:27, LuKreme wrote: > > >> At SMTP time I return a 5xx code during the "DATA" phase for > > >> messages classified as Spam. However, I also deliver the message

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Per Jessen
RW wrote: >> > >> > Bob could also have just clicked the link in the NDR. >> Some people - e.g. /me - do not try to pass Turing tests. Obviously >> you are not interested in my mails anyway > > But it's only applied to mail classified as spam, and unlike CR it > generates no additional bac

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Darxus
On 02/11, --[ UxBoD ]-- wrote: > Like the simplicity and it does appear to be a great idea. Why do you > believe SPF or DKIM generate breakage ? Thank you. SPF breakage occurs where a user has configured one of their email addresses to automatically forward their mail to another of their email

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Henrik K
On Wed, Feb 10, 2010 at 10:00:05PM -0500, dar...@chaosreigns.com wrote: > http://www.chaosreigns.com/mtx/ What a complex scheme you invented for a simple problem. All you have to do is to require legimate relays to have a FCrDNS entry with an actually identifiable name, like starting with "smtp".

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Per Jessen
Henrik K wrote: > On Wed, Feb 10, 2010 at 10:00:05PM -0500, dar...@chaosreigns.com > wrote: >> http://www.chaosreigns.com/mtx/ > > What a complex scheme you invented for a simple problem. All you have > to do is to require legimate relays to have a FCrDNS entry with an > actually identifiable nam

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Henrik K
On Thu, Feb 11, 2010 at 03:45:32PM +0100, Per Jessen wrote: > Henrik K wrote: > > > On Wed, Feb 10, 2010 at 10:00:05PM -0500, dar...@chaosreigns.com > > wrote: > >> http://www.chaosreigns.com/mtx/ > > > > What a complex scheme you invented for a simple problem. All you have > > to do is to requir

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Matt Garretson
On 2/11/2010 8:08 AM, Per Jessen wrote: > The only minor issue I see is that a lot > of people don't understand NDRs (or can't be bothered to try to). True. Also, a lot of mail relays mangle NDR's beyond usability.

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread David Morton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike Cardwell wrote: > At SMTP time I return a 5xx code during the "DATA" phase for messages > classified as Spam. However, I also deliver the message into a read only What kind of mail load do you service? It takes a significant amount of time for s

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mike Cardwell
On 11/02/2010 15:49, David Morton wrote: At SMTP time I return a 5xx code during the "DATA" phase for messages classified as Spam. However, I also deliver the message into a read only What kind of mail load do you service? On this system, not much. On the scale of about 6,000 messages a day.

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Darxus
On 02/11, Henrik K wrote: > What a complex scheme you invented for a simple problem. All you have to do > is to require legimate relays to have a FCrDNS entry with an actually > identifiable name, like starting with "smtp". Much simpler to take advantage > of that and it actually is somewhat used t

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Henrik K
On Thu, Feb 11, 2010 at 09:49:32AM -0600, David Morton wrote: > > This is why amavisd* variants always accept the mail and then process You are wrong: amavisd-milter works fine here. Pre-queue filtering is generally well understood with it's pros and cons, no point taking it up here.

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread David Morton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike Cardwell wrote: > On this system, not much. On the scale of about 6,000 messages a day. Very light duty then. :) > Even if SpamAssassin isn't used during SMTP, there's nothing stopping > somebody who wants to DOS you from just setting their DOS

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mike Cardwell
On 11/02/2010 16:23, David Morton wrote: On this system, not much. On the scale of about 6,000 messages a day. Very light duty then. :) Even if SpamAssassin isn't used during SMTP, there's nothing stopping somebody who wants to DOS you from just setting their DOS tool to hold open connection

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Bowie Bailey
dar...@chaosreigns.com wrote: > On 02/11, Henrik K wrote: > >> What a complex scheme you invented for a simple problem. All you have to do >> is to require legimate relays to have a FCrDNS entry with an actually >> identifiable name, like starting with "smtp". Much simpler to take advantage >> o

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Wed, 10 Feb 2010, dar...@chaosreigns.com wrote: http://www.chaosreigns.com/mtx/ You know, just for a moment I thought I would take a look, just for curiosity sake, and instead got this moronic jack-ass ATTITUDE page. You are welcome to your opinions on browsers, and are free to whine abou

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Bowie Bailey
Charles Gregory wrote: > On Wed, 10 Feb 2010, dar...@chaosreigns.com wrote: >> http://www.chaosreigns.com/mtx/ > > You know, just for a moment I thought I would take a look, just for > curiosity sake, and instead got this moronic jack-ass ATTITUDE page. What page were you looking at? All I see at

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Henrik K
On Thu, Feb 11, 2010 at 11:57:47AM -0500, Bowie Bailey wrote: > dar...@chaosreigns.com wrote: > > On 02/11, Henrik K wrote: > > > >> What a complex scheme you invented for a simple problem. All you have to do > >> is to require legimate relays to have a FCrDNS entry with an actually > >> identif

Re: Spam filtering similar to SPF, less breakage

2010-02-11 Thread Matus UHLAR - fantomas
On 09.02.10 11:42, dar...@chaosreigns.com wrote: > I apparently need to clarify that I think this is a good idea because I am > concerned about the number of people (who control DNS records) who are very > strongly against creating SPF records specifically because of forwarding > breakage. The ema

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Jeff Mincy
From: Charles Gregory Date: Thu, 11 Feb 2010 11:55:10 -0500 (EST) On Wed, 10 Feb 2010, dar...@chaosreigns.com wrote: > http://www.chaosreigns.com/mtx/ You know, just for a moment I thought I would take a look, just for curiosity sake, and instead got this moronic jack-as

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Matus UHLAR - fantomas
> On Wed, Feb 10, 2010 at 10:00:05PM -0500, dar...@chaosreigns.com wrote: > > http://www.chaosreigns.com/mtx/ On 11.02.10 16:06, Henrik K wrote: > What a complex scheme you invented for a simple problem. All you have to do > is to require legimate relays to have a FCrDNS entry with an actually > i

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Henrik K
On Thu, Feb 11, 2010 at 06:25:07PM +0100, Matus UHLAR - fantomas wrote: > > On Wed, Feb 10, 2010 at 10:00:05PM -0500, dar...@chaosreigns.com wrote: > > > http://www.chaosreigns.com/mtx/ > > On 11.02.10 16:06, Henrik K wrote: > > What a complex scheme you invented for a simple problem. All you have

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Matus UHLAR - fantomas
> > > On Wed, Feb 10, 2010 at 10:00:05PM -0500, dar...@chaosreigns.com wrote: > > > > http://www.chaosreigns.com/mtx/ > > On 11.02.10 16:06, Henrik K wrote: > > > What a complex scheme you invented for a simple problem. All you have to > > > do > > > is to require legimate relays to have a FCrDNS

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Bernd Petrovitsch
On Don, 2010-02-11 at 11:52 +, Mike Cardwell wrote: [...] > Let me explain this in simple terms. > > Normal behaviour: > > Spam filtering causes a 5xx rejection. You get an NDR. You either > contact the user some other way or not at all. Spam filtering rejects valid non-spam because it mis-i

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Henrik K
On Thu, Feb 11, 2010 at 06:42:44PM +0100, Matus UHLAR - fantomas wrote: > > > > On Wed, Feb 10, 2010 at 10:00:05PM -0500, dar...@chaosreigns.com wrote: > > > > > http://www.chaosreigns.com/mtx/ > > > > On 11.02.10 16:06, Henrik K wrote: > > > > What a complex scheme you invented for a simple probl

Re: [sa] Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, Bowie Bailey wrote: What page were you looking at? All I see at that URL is a fairly straightforward description of how to implement his MTX system. The page 'redirects' to this one: http://www.chaosreigns.com/fail It's a rant page telling the visitor that you cannot read

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mike Cardwell
On 11/02/2010 17:08, Bernd Petrovitsch wrote: >> Let me explain this in simple terms. >> >> Normal behaviour: >> >> Spam filtering causes a 5xx rejection. You get an NDR. You either >> contact the user some other way or not at all. > Spam filtering rejects valid non-spam because it mis-identified

Re: Spam filtering similar to SPF, less breakage

2010-02-11 Thread Per Jessen
Matus UHLAR - fantomas wrote: > On 09.02.10 11:42, dar...@chaosreigns.com wrote: >> I apparently need to clarify that I think this is a good idea because >> I am concerned about the number of people (who control DNS records) >> who are very strongly against creating SPF records specifically >> bec

Re: Spam filtering similar to SPF, less breakage

2010-02-11 Thread Matus UHLAR - fantomas
> Matus UHLAR - fantomas wrote: > > Imho, SPF does NOT break forwarding. On 11.02.10 19:37, Per Jessen wrote: > Hmm, the SRS people seem to disagree: > > http://www.openspf.org/SRS : SPF "breaks" email forwarding. I think those quotes say it all. SRS is a way to create correct and trackable fo

Re: Spam filtering similar to SPF, less breakage

2010-02-11 Thread Mike Cardwell
On 11/02/2010 18:52, Matus UHLAR - fantomas wrote: >>> Imho, SPF does NOT break forwarding. > > On 11.02.10 19:37, Per Jessen wrote: >> Hmm, the SRS people seem to disagree: >> >> http://www.openspf.org/SRS : SPF "breaks" email forwarding. > > I think those quotes say it all. SRS is a way to c

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Ted Mittelstaedt
Mike Cardwell wrote: On 11/02/2010 17:08, Bernd Petrovitsch wrote: Let me explain this in simple terms. Normal behaviour: Spam filtering causes a 5xx rejection. You get an NDR. You either contact the user some other way or not at all. Spam filtering rejects valid non-spam because it mis-ide

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Bernd Petrovitsch
On Don, 2010-02-11 at 18:26 +, Mike Cardwell wrote: [...] > I want you to describe a scenario where the sender or recipient are > actually worse off because of the particular two features I've The point is: The sender is worse off because he needs to invest time for the workaround which is caus

Re: Spam filtering similar to SPF, less breakage

2010-02-11 Thread Per Jessen
Matus UHLAR - fantomas wrote: >> Matus UHLAR - fantomas wrote: >> > Imho, SPF does NOT break forwarding. > > On 11.02.10 19:37, Per Jessen wrote: >> Hmm, the SRS people seem to disagree: >> >> http://www.openspf.org/SRS : SPF "breaks" email forwarding. > > I think those quotes say it all. SRS

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread LuKreme
On 11-Feb-2010, at 09:55, Charles Gregory wrote: > > You are welcome to your opinions on browsers, and are free to whine about the > evils of microsoft all you want, but if you are going to post a link > with the intent for the 'average' person to read it, then you better make it > *accessible*

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread LuKreme
On 11-Feb-2010, at 11:11, Charles Gregory wrote: > > It's a rant page telling the visitor that you cannot read the site using > Internet Explorer, Good. Get a real browser. > with major (large font) attitude that this is the fault of the browser. It is, and this is explained clearly. IE does

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Bowie Bailey
LuKreme wrote: > On 11-Feb-2010, at 11:11, Charles Gregory wrote: > >> It's a rant page telling the visitor that you cannot read the site using >> Internet Explorer, >> > > Good. Get a real browser. > > >> with major (large font) attitude that this is the fault of the browser. >>

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, LuKreme wrote: Erm.. The string "microsoft" doesn't even exist on that page. "No Microsoft browser supports this 9 year old standard." Obviously you are't using IE and so you weren't subjected to the arrogant refusal of his server to deliver the requested page. (shrug) -

Re: [sa] Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, LuKreme wrote: It's a rant page telling the visitor that you cannot read the site using Internet Explorer, Good. Get a real browser. Like I said, he (and you) can rant all you want about the evils of Microsoft, and frankly I wouldn't be inclined to argue with you. (grin)

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Darxus
On 02/11, Henrik K wrote: > method of whitelisting. You can't seriously expect to block on some > attribute that not everyone can or bothers to change (DNS). None of this Correct. I am not suggesting that anyone block anything based on MTX at this time. I suggest using it for whitelisting (small

Pipe characters in From and To's

2010-02-11 Thread Spiro Harvey
We're getting a boatload of To and From addresses starting with pipe characters on one of our clients' mailservers. The messages themselves don't appear particularly malicious -- the ones we've seen are just pill spam -- but there are craploads of them. I was thinking about configuring an SA rule

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Charles Gregory
On Thu, 11 Feb 2010, Bowie Bailey wrote: I would blame whoever set up the website. The page in question does not even attempt to use the features that the "fail" page refers to. (nod) I guess that really says it all Thanks for mentioning this. Now my 'vague feeling' is confirmed. - C

Re: MTX plugin created (Re: Spam filtering similar to SPF, less breakage)

2010-02-11 Thread Ted Mittelstaedt
Bowie Bailey wrote: LuKreme wrote: On 11-Feb-2010, at 11:11, Charles Gregory wrote: It's a rant page telling the visitor that you cannot read the site using Internet Explorer, Good. Get a real browser. with major (large font) attitude that this is the fault of the browser.

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mike Cardwell
On 11/02/2010 19:29, Ted Mittelstaedt wrote: > Secondly with regards to this reject-but-save system that Mike is > expounding on - it is an instance of a system that only works because > a few people (or one person) is doing it. It is totally worthless as > anything that can be scaled to multiple

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Kris Deugau
Bernd Petrovitsch wrote: On Don, 2010-02-11 at 18:26 +, Mike Cardwell wrote: [...] I want you to describe a scenario where the sender or recipient are actually worse off because of the particular two features I've The point is: The sender is worse off because he needs to invest time for the

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mike Cardwell
On 11/02/2010 19:52, Bernd Petrovitsch wrote: >> I want you to describe a scenario where the sender or recipient are >> actually worse off because of the particular two features I've > The point is: The sender is worse off because he needs to invest time > for the workaround which is caused by the

sa-learn error.

2010-02-11 Thread fchan
I was trying to teach spamassassin 3.3.0 today with a rather large spam message and I got this error message when I did sa-learn: Feb 11 14:47:51.262 [5414] info: archive-iterator: skipping large message The message is 279959 bytes and about 20% is Russian text and other 80% is two gif image a

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread David Morton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ted Mittelstaedt wrote: > The claim that amavisd* variants accept then process mail > is nonsense, nobody who runs a large mailserver with amavisd could > possibly have their server configured in this manner without it melting > down, so please no mor

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Mark Martinec
On Friday February 12 2010 00:28:24 David Morton wrote: > Of course you 5xx reject unknown users and other low hanging fruit > that identifes bad stuff - but then the rest is accepted to process > later. This is exactly how most amavisd variants work. Btw, with the most recent advances in SpamAs

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Ted Mittelstaedt
David Morton wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ted Mittelstaedt wrote: The claim that amavisd* variants accept then process mail is nonsense, nobody who runs a large mailserver with amavisd could possibly have their server configured in this manner without it melting down, s

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread Ted Mittelstaedt
Mike Cardwell wrote: On 11/02/2010 19:29, Ted Mittelstaedt wrote: All I can see above is a long list of dubious predictions of what spammers would do if everybody used the same system as me. I can't be bothered with this thread anymore. You can't be bothered - yet you continued responding

Re: Pipe characters in From and To's

2010-02-11 Thread Ralph Bornefeld-Ettmann
Am 11.02.2010 22:37, schrieb Spiro Harvey: > We're getting a boatload of To and From addresses starting with pipe > characters on one of our clients' mailservers. The messages themselves > don't appear particularly malicious -- the ones we've seen are just > pill spam -- but there are craploads of

Re: Newest spammer trick - non-blank subject lines?

2010-02-11 Thread RW
On Thu, 11 Feb 2010 16:40:04 -0800 Ted Mittelstaedt wrote: > case - but I sure as hell would never be foolish enough to try and > defend it. These hacks simply scream "I got mine and I don't give > a damn if you got yours", Isn't that really your position - that 5xx responses make the botnet