Spammed to death

[fanf]

Here are the counts of messages that landed in my spam folder each day in the last few weeks. I recently moved my personal email from Chiark to Hermes because I needed the content filtering. Note that these numbers do not include the thousand-or-so viruses each day that are forwarded from Chiark and deleted by Hermes.



37 Fri Feb 20 2004
42 Sat Feb 21 2004
37 Sun Feb 22 2004
26 Mon Feb 23 2004
15 Tue Feb 24 2004
25 Wed Feb 25 2004
35 Thu Feb 26 2004
41 Fri Feb 27 2004
45 Sat Feb 28 2004
58 Sun Feb 29 2004
33 Mon Mar 01 2004
49 Tue Mar 02 2004
110 Wed Mar 03 2004
371 Thu Mar 04 2004
452 Fri Mar 05 2004
348 Sat Mar 06 2004
287 Sun Mar 07 2004
556 Mon Mar 08 2004
441 Tue Mar 09 2004
377 Wed Mar 10 2004
265 Thu Mar 11 2004

Comments

[pm215]

I suspect that quite a bit of SAUCE's effectiveness is just due to the greylisting it does. The admins at work recently put a simple greylist in place (first time it sees you it gives you a 4xx error) and this has hugely reduced my spam volumes.

Unfortunately you can't configure SAUCE to give you the greylisting without the RFC-policing.

[sparrowsion]

The other thing which contributes to SAUCE's effectiveness is use of RBLs -- I have a lax policy but for the last three months have been filtering out anything that triggers RBL warnings. This catches about 95% of spam, and has had one false positive so far (official ntlworld customer announcement).

Demon's new spam filtering is probably doing about as well (but I can't see false positives) -- where it's really failing me is in letting through what look to me are going to be viruses. Including one allegedly from esr....

[lusercop.livejournal.com]

I'd disagree. I think that greylisting has to work in conjunction with blacklisting. Many more systems are trying again and again (maybe they use random data which isn't, or some such). You want to give them the opportunity to blacklist themselves. In my reckoning, it takes around a year or two from an address appearing on an indexed webpage to being in sufficient numbers of spam lists to make this useful, but I see lots of hits to my bait addresses.

What is irritating about SAUCE is that things like SpamAssassin, and other IDS systems (eg looking for default.ida or cmd.exe in your web access logs) can't easily feed information back into it.

[fanf]

I'm planning to maintain my own blacklist of virus-emitting hosts, on the basis that they are likely to become spam-emitting hosts in the future. I'll probably create some bait addresses too, which will also feed into the blacklist.