On 12/03/2012 09:43 PM, David F. Skoll wrote: > On Mon, 3 Dec 2012 22:03:25 +0200 > Henrik K <h...@hege.li> wrote: > >> On Mon, Dec 03, 2012 at 01:54:44PM -0500, Kevin A. McGrail wrote: > [Test loadavg in filtering decisions] > >> Seems kind of pointless. Have you actually measured how larger >> messages affect cpu usage? Especially since usually there are much >> less messages the larger they get. > I agree. LoadAVG is a pretty useless measurement. And relaxing your > filtering based on load gives spammers a clear signal how to defeat > your filter. > >>> Two, I'm trying a system that also truncates messages mid-message at >>> the threshold to scan them anyway. >> Why is it controversial? Amavisd-new 2.6.3 had this feature since >> 2009, so it's used probably very widely - even without users knowing >> it. I've never seen any ill effects. > We truncate overly-long messages too, but we try to be intelligent > about it. We shrink non-text MIME parts first and then if the message > is still too large, we give up. Just blindly cutting a message in the > middle might wreck the MIME structure and give unexpected and unwanted > results.
Have you tried/considered scoring based on "headers only"? I think many MTA implements limit on total headers' size. Also "extra speed" in reporting over-sized/big spam messages had seemed to deter "big size" spammers. [based on experience with my personal mailboxes only and reports to spamcop.net of spams >40KB]
