On 26 May 2016, at 13:53, Andy Balholm wrote:
Spamass-milter or spamass-milt (http://savannah.nongnu.org/projects/spamass-milt/) seems to be the de-facto standard for using SpamAssassin as a milter for Sendmail or Postfix,
I'm not sure that's really true. I've never seen any sort of surveys, but I think MIMEDefang is probably a more popular choice because of its more comprehensive filtering feature set: no need for other milters for AV or other filtering or custom .cf code or lame Postfix {header,body}_check filters. It certainly has a more active user community and developer.
On the other hand, as much as I personally love MD, it's a bit heavy and complex, where spamass-milter is much less so. There's a LOT that can break in MD. To configure it you need to learn *a little* Perl. Of course, one could argue that running SA without knowing some Perl is a risky adventure. MD's greater complexity is substantially offset by the fact that whileits is roughly the same chronological age as spamass-milter, it is much more *mature* code in that it has had more vigorous and dedicated development as a core element of Roaring Penguin's commercial offerings. It's GPL2-licensed, but it also has had the motivating force of paying customers behind its maintenance and advancement for over a dozen years.
but it is woefully under-maintained. (The security problem mentioned on https://wiki.apache.org/spamassassin/IntegratedInMta has been fixed, though.)
MINOR PEEVE: Stable and under-maintained are 2 very different things. It may well be that some of the 27 open "bugs" are real, reproducible, and worth solving, but a quick skim gives me a hunch that for the most part they are not. And while on one hand, the note on the 0.4.0 release was probably encouraging at the time, on the other, predicting more releases to come does start to cut the other way after such a long silence. Yet it is used by many people who seem satisfied with it as-is, and there's a lot to be said for that sort of software: handles a well-defined task well, needs no regular attention. If I were putting together a micro-server mail system with spam filtering, spamass-milter would probably beat out MIMEDefang for its size & simplicity.
I recently sent an email to the two previous maintainers and to the mailing list inquiring about the status of the project, and got no response.
And *THAT* is a more disconcerting issue than the lack of code churn.
It seems like something should be done about this situation. I am considering putting a fork of the project on GitHub, and trying to maintain it there. Is anyone else here interested in seeing that happen? Or do you have other ideas about what should be done?
IMHO forking first is the wrong approach. The biggest problem with small mature OS projects is that maintainers lose focus because there's not really much to be done beyond tedious bug report triage that largely means figuring out weird ways people break their systems without noticing until they try to build one particular package. I think that you're right to be using the mailing list first and trying to get the attention of one of the formal maintainers. More than one FOSS maintainer has received commit rights by being a pest with patch submissions.
