You are viewing a plain text version of this content. The canonical link for it is here.
Posted to community@apache.org by Antonio Gallardo <an...@apache.org> on 2004/04/17 02:10:05 UTC
ASF use spamassassin?
Hi:
The motivation to write this mail and ask about is: 2 days ago, I
installed the spamassassin -
http://incubator.apache.org/projects/spamassassin.html Because as many of
us I really hate the spam. But what I found is more interesting:
I get mails from to my apache.org address that in spamassassin got more
than 40 points! This clearly signs to me we are not eating our own
dogfood. And spamassassin is really very tasty and nutritive! ;-).
Will the ASF use Spamassassin?
Best Regards,
Antonio Gallardo.
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Nicola Ken Barozzi <ni...@apache.org>.
Stefano Mazzocchi wrote:
> Antonio Gallardo wrote:
...
>> http://wiki.apache.org/spamassassin/CommercialProducts
>>
>> And we (on the ASF) are discusing right not about if will be fine to eat
>> our own food. :-(
>
> I didn't say we aren't not going to use it.
>
> I just said that given the size of the email traffic and the variety of
> people (almost a thousand) that this move will impact, the ASF
> infrastructure team is considering this with great care and, as usual,
> doesn't want to rush things, but try to do them right.
+1
In any case, we are using Apache HTTPD to run our servers, and this is a
good test for developers. I guess the SA guys would benefit from using
it at Apache, as it seems to be a good testbed.
--
Nicola Ken Barozzi nicolaken@apache.org
- verba volant, scripta manent -
(discussions get forgotten, just code remains)
---------------------------------------------------------------------
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Stefano Mazzocchi <st...@apache.org>.
Antonio Gallardo wrote:
> Stefano Mazzocchi dijo:
>
>>David Crossley wrote:
>>
>>>Surely we can tune SA to minimise false-positives, especially
>>>since we have the experts themselves at Apache.
>>
>>Being an expert in pattern matching doesn't make you an expert in
>>understanding what is spam or not for somebody.
>
>
> AFAIK, if anti-spam expert existed, the SPAM problem will be solved years
> ago and this is not the case. People is trying to find the anti-spam
> solution. The progress in the area is good, but nobody found the right
> solution. I personally think the one (or team) who will solve the
> anti-spam problem will be part of the computer history for ever!
>
> Sometime I found you very reluctant to some technologies. Please look
> around and you will find that spamassassin is the best we can have right
> now in anti-spam technology. This is not casuality that many companies are
> building anti-spam product using spamassassin to stop spam around the
> world. Currently, spamassassin is scaning millions of mail per day and is
> sucessful in that:
>
> http://wiki.apache.org/spamassassin/CommercialProducts
>
> And we (on the ASF) are discusing right not about if will be fine to eat
> our own food. :-(
I didn't say we aren't not going to use it.
I just said that given the size of the email traffic and the variety of
people (almost a thousand) that this move will impact, the ASF
infrastructure team is considering this with great care and, as usual,
doesn't want to rush things, but try to do them right.
Besides, there is no hurry since, as I said, you still do all you want
from your end without impacting everybody else.
--
Stefano.
Re: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
Stefano Mazzocchi dijo:
> David Crossley wrote:
>> Surely we can tune SA to minimise false-positives, especially
>> since we have the experts themselves at Apache.
>
> Being an expert in pattern matching doesn't make you an expert in
> understanding what is spam or not for somebody.
AFAIK, if anti-spam expert existed, the SPAM problem will be solved years
ago and this is not the case. People is trying to find the anti-spam
solution. The progress in the area is good, but nobody found the right
solution. I personally think the one (or team) who will solve the
anti-spam problem will be part of the computer history for ever!
Sometime I found you very reluctant to some technologies. Please look
around and you will find that spamassassin is the best we can have right
now in anti-spam technology. This is not casuality that many companies are
building anti-spam product using spamassassin to stop spam around the
world. Currently, spamassassin is scaning millions of mail per day and is
sucessful in that:
http://wiki.apache.org/spamassassin/CommercialProducts
And we (on the ASF) are discusing right not about if will be fine to eat
our own food. :-(
Best Regards,
Antonio Gallardo.
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Stefano Mazzocchi wrote:
> David Crossley wrote:
> > Stefano Mazzocchi wrote:
> > <snip/>
> >
> >>But my biggest concern is about false positives.
> >>
> >>One solution would be to use spamassassin for tagging purposes only, but
> >>at that point it's much better to let people do the filtering
> >>themselves. There is no reason in wasting precious CPU power for that.
> >>
> >>A more socially-acceptable compromise would be to leave the "threshold
> >>level" of the cutoff point to the various people to set (you could set a
> >>.spam_threshold file in your home directory with the cut-off point). So,
> >>if you keep the threshold low and complain, well, that was your own fault.
> >
> > I would prefer to see server-side filtering because i don't
> > want to even receive the volume of junk. It is a big waste
> > of precious bandwidth.
>
> True, but keep in mind that you can still do server-side filtering, just
> you have to do it on your own (as I do already today, for example).
Bing ... the sound of light being switched on :-)
Thanks, that comment helped immensely. I keep forgetting that we
committers have server accounts where we can configure tools to
manage our own workflows.
Is that where you mean, or on your own mail server?
Are you able to give any tips about how you do it? We should
document that in cvs://committers/docs/ to help us all work
more efficiently. I see that tetsuya has already started
one doc there.
> > Surely we can tune SA to minimise false-positives, especially
> > since we have the experts themselves at Apache.
>
> Being an expert in pattern matching doesn't make you an expert in
> understanding what is spam or not for somebody.
>
> My point is that no matter what, there is only so much you can do on a
> centralized spam filter and you should not, IMO, attempt to do to much.
>
> That's why I think leaving the threshold configurable by person is the
> best approach since it leaves you the ability to "turn the nob" in how
> selective your filter is.
Good, thanks for clarifying. Your comment above about "wasting CPU"
had lead me to believe that you meant doing the filtering on the
local desktop.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Stefano Mazzocchi <st...@apache.org>.
David Crossley wrote:
> Stefano Mazzocchi wrote:
> <snip/>
>
>>But my biggest concern is about false positives.
>>
>>One solution would be to use spamassassin for tagging purposes only, but
>>at that point it's much better to let people do the filtering
>>themselves. There is no reason in wasting precious CPU power for that.
>>
>>A more socially-acceptable compromise would be to leave the "threshold
>>level" of the cutoff point to the various people to set (you could set a
>>.spam_threshold file in your home directory with the cut-off point). So,
>>if you keep the threshold low and complain, well, that was your own fault.
>
> I would prefer to see server-side filtering because i don't
> want to even receive the volume of junk. It is a big waste
> of precious bandwidth.
True, but keep in mind that you can still do server-side filtering, just
you have to do it on your own (as I do already today, for example).
> Surely we can tune SA to minimise false-positives, especially
> since we have the experts themselves at Apache.
Being an expert in pattern matching doesn't make you an expert in
understanding what is spam or not for somebody.
My point is that no matter what, there is only so much you can do on a
centralized spam filter and you should not, IMO, attempt to do to much.
That's why I think leaving the threshold configurable by person is the
best approach since it leaves you the ability to "turn the nob" in how
selective your filter is.
--
Stefano.
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Stefano Mazzocchi wrote:
<snip/>
>
> But my biggest concern is about false positives.
>
> One solution would be to use spamassassin for tagging purposes only, but
> at that point it's much better to let people do the filtering
> themselves. There is no reason in wasting precious CPU power for that.
>
> A more socially-acceptable compromise would be to leave the "threshold
> level" of the cutoff point to the various people to set (you could set a
> .spam_threshold file in your home directory with the cut-off point). So,
> if you keep the threshold low and complain, well, that was your own fault.
I would prefer to see server-side filtering because i don't
want to even receive the volume of junk. It is a big waste
of precious bandwidth.
Surely we can tune SA to minimise false-positives, especially
since we have the experts themselves at Apache.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
Noel J. Bergman dijo:
>> Hmm. The new machines are right for the work. AFAIK, one of them is
>> intended to be used only as mail server.
>
> The new mail server is an IBM xSeries with dual Xeon processors and 2GB
> RAM.
> The old mail server is a dual Pentium III. Under the current "normal"
> load,
> which includes dealing with spam, I rarely see less than 10% usage. Often
> it will spike to over 50% usage. I just watched the system get entirely
> consumed for a few minutes. And that is on a Friday night with light
> load,
> and without a major worm
The percentages are related to the old or to the new server? If they are
related to the old server we can divide by 4 the values, right?
>> Instead of being afraid of the load, I think we really need to test it
>> and
>> see if the new machines can work with spamassassin or not.
>
> That's already on the docket.
:-D
>> > There is no reason in wasting precious CPU power for that.
>
>> precious CPU power? I really want to see where we use it.
>> From minotaur, right now
>
> minotaur isn't the mail server. And average isn't te problem.
I know minotaur is not running the main server. But it runs a MTA. We get
some mail from it. I discover it because when daedalus was blocked by
spamcop I was able to get mail to the Cocoon PMC maillist. I wonder why
and discovered that mail was sent from minotaur.
But what about distribute the load of spamassassin? AFAIK, with the
"spamc" we can be able to use other machine to analyze the mail. I think
it is posible. Of course if there is other machine that has a low load.
> The problem is when the worms are running. I've got to chart it out
> sometime, but we have been seeing a 4x higher than normal rate of spam for
> a
> while now. But that is a fraction of what we've seen when things get
> really
> bad, and the mail server is backed up for hours.
I know what happen when things goes really, really bad. And I can tell you
I saw often how well they manage the situation. I had experiences
deploying anti-virus+anti-spam appliances before, on and after a peak
virus and/or spam epidemias.
In "nano" sized companies sometimes you see the one-man shows: he sell,
drive, develop, deploy, configure, fix, teach, etc. ;-)
> Personally, I am in favor of blocking all DHCP pools at the interface, and
> not allowing direct connections. That is one of the lowest cost means of
> stopping spambots running on Windows. If they want to send e-mail, they
> should be told to go through their ISP, company server, or get a static
> IP.
Not sure. DHCP pools are still used for many people around the world and
can make a "digital-divide world" (the a new fashion meme ;-).
Seriously, I think lot of people is using fixed IP nows, but this will not
be fine for a far more lot people that connect mainly via DHCP pools. For
them the only solution is to share the IPs.
About spambots on windows and other I really will appreciate to be able to
view the current mailserver config in the ASF and see if I can help there.
Please don't be ofended about this request. I know the ASF members
managing the infraestructure is very competent, but I think we can apply
the power of OSS development in the ASF server config.
WDYT?
Best Regards,
Antonio Gallardo.
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Lars Eilebrecht {unsecured} <la...@hyperreal.org>.
According to Noel:
> Really? Do you have any examples? I have never encountered that
> behavior. What do they re-write it to, and are you talking about the RFC
> 2821 envelope, or the RFC 2822 header?
Well, there is t-online.de (Deutsche Telekom) which rewrites envelope
and body from address to the @t-online.de address (unless you pay
for their extra smtp-relay service which let's you choose your own
address). And there is GMX.net, an email provider.
ciao...
--
Lars Eilebrecht - Some Windows were made to be broken.
lars@hyperreal.org
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by "Noel J. Bergman" <no...@devtech.com>.
> According to Noel:
> > AFAIK, ISPs using DHCP pools provide a mail gateway.
> That's probably true in most cases, but in many cases
> ISPs rewrite outgoing mail addresses to their own
> assigned email address/domain to mitigate the risk of
> abuse.
Really? Do you have any examples? I have never encountered that behavior.
What do they re-write it to, and are you talking about the RFC 2821
envelope, or the RFC 2822 header?
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Lars Eilebrecht {unsecured} <la...@hyperreal.org>.
According to Noel:
> AFAIK, ISPs using DHCP pools provide a mail gateway.
That's probably true in most cases, but in many cases
ISPs rewrite outgoing mail addresses to their own
assigned email address/domain to mitigate the risk of
abuse.
ciao...
--
Lars Eilebrecht - Real programmers don't need comments
lars@hyperreal.org - ...the code is obvious.
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by "Noel J. Bergman" <no...@devtech.com>.
> >Personally, I am in favor of blocking all DHCP pools at the interface
>
> I for one, will no longer be able to participate if the Apache email
> server decides to block DHCP pools.
That's why we haven't done it. :-) Not for you specifically, but
generally.
I am curious. Doesn't your ISP provide a mail server you could use? In
your case, you could use SSH tunneling to minotaur, but that isn't available
to a normal user, so I am curious as to scale of the problem with legitimate
DHCP users. AFAIK, ISPs using DHCP pools provide a mail gateway.
> As for my @apache email address, it only accepts input from
> apache mailing lists. All other incoming messages get an
> autoreply for consumption by an "intelligent" being.
Seems reasonable.
-- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by Ceki Gülcü <no...@qos.ch>.
At 05:14 AM 4/17/2004, you wrote:
> > Hmm. The new machines are right for the work. AFAIK, one of them is
> > intended to be used only as mail server.
>
>The new mail server is an IBM xSeries with dual Xeon processors and 2GB RAM.
>The old mail server is a dual Pentium III. Under the current "normal" load,
>which includes dealing with spam, I rarely see less than 10% usage. Often
>it will spike to over 50% usage. I just watched the system get entirely
>consumed for a few minutes. And that is on a Friday night with light load,
>and without a major worm
>
> > Instead of being afraid of the load, I think we really need to test it and
> > see if the new machines can work with spamassassin or not.
>
>That's already on the docket.
>
> > > There is no reason in wasting precious CPU power for that.
>
> > precious CPU power? I really want to see where we use it.
> > From minotaur, right now
>
>minotaur isn't the mail server. And average isn't te problem.
>
>The problem is when the worms are running. I've got to chart it out
>sometime, but we have been seeing a 4x higher than normal rate of spam for a
>while now. But that is a fraction of what we've seen when things get really
>bad, and the mail server is backed up for hours.
>
>Personally, I am in favor of blocking all DHCP pools at the interface, and
>not allowing direct connections. That is one of the lowest cost means of
>stopping spambots running on Windows. If they want to send e-mail, they
>should be told to go through their ISP, company server, or get a static IP.
I for one, will no longer be able to participate if the Apache email
server decides to block DHCP pools.
There are at least two distinct problems here. One is harvesting by
spammers of email addresses of those participating on our email lists,
the other is the spam we get through our @apache email address.
I am much more worried about harvesting of my non-apache email address
by spammers. As for my @apache email address, it only accepts input from
apache mailing lists. All other incoming messages get an autoreply for
consumption by an "intelligent" being.
> --- Noel
--
Ceki Gülcü
For log4j documentation consider "The complete log4j manual"
ISBN: 2970036908 http://www.qos.ch/shop/products/clm_t.jsp
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
Stefano Mazzocchi dijo:
> Antonio Gallardo wrote:
>
>> Hi:
>>
>> The motivation to write this mail and ask about is: 2 days ago, I
>> installed the spamassassin -
>> http://incubator.apache.org/projects/spamassassin.html Because as many
>> of
>> us I really hate the spam. But what I found is more interesting:
>>
>> I get mails from to my apache.org address that in spamassassin got more
>> than 40 points! This clearly signs to me we are not eating our own
>> dogfood. And spamassassin is really very tasty and nutritive! ;-).
>>
>> Will the ASF use Spamassassin?
>
> the ASF infrastructure team is currently testing one of the new IBM
> boxes (hermes.apache.org) to test the load. spamassassin is a pretty
> resource intensive beast and even if we do have those new shiny boxes,
> there is concern about load.
Hmm. The new machines are right for the work. AFAIK, one of them is
intended to be used only as mail server. Also, you will wonder what
hardware you get for a US$ 60,000 anti-virus, anti-spam appliance.
On the consuming resources, there is a daemond (spamd/spamc) that consume
far less resources on the server side. spamd use 11 MB I think this is
almost nothing.
Instead of being afraid of the load, I think we really need to test it and
see if the new machines can work with spamassassin or not. It can be very
easily turned on and off.
> But my biggest concern is about false positives.
Yep. This is the first question showed in the table when we talk about a
"anti-spam" software.
(warning: too far to be a spamassassin guru...):
In fact the too few (almost nothing) I learned of spamassassin is that can
be configured per user. That way you can set it as benevolent or strict
you want. Spamassassin IS NOT the "final anti-spam solution", but if a
spam rank more than 40 points you can be sure it is a spam!
> One solution would be to use spamassassin for tagging purposes only, but
> at that point it's much better to let people do the filtering
> themselves. There is no reason in wasting precious CPU power for that.
precious CPU power? I really want to see where we use it.
>From minotaur, right now:
$uptime
7:04PM up 35 days, 20:04, 15 users, load averages: 0.42, 0.59, 0.62
Hmm. looks like our precious CPU power is going to the basket, right?. :-(
Can we use it in a better way?
> A more socially-acceptable compromise would be to leave the "threshold
> level" of the cutoff point to the various people to set (you could set a
> .spam_threshold file in your home directory with the cut-off point). So,
> if you keep the threshold low and complain, well, that was your own fault.
AFAIK,spamassassin can do this and more.:-D
Seriously, I really think the ASF need to step up the anti-spam policy.
>From my POV will be fine to think in spamassassin.
Best Regards,
Antonio Gallardo
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Stefano Mazzocchi <st...@apache.org>.
Martin Kraemer wrote:
> On Fri, Apr 16, 2004 at 09:18:17PM -0400, Stefano Mazzocchi wrote:
>
>>>Will the ASF use Spamassassin?
>>
>>But my biggest concern is about false positives.
>
>
> That is why I switched from SA to using *only* bogofilter since
> last summer. I never regretted it, because the heuristic approach of SA
> needs rule updates everytime a new pattern arises. (Or did I miss a new
> SA development?)
>
> Well, I still use SA because it is invoked by amavisd, but I ignore its
> decisions completely (because of the false positives, and because of its
> suboptimal detection rate overall).
that has been my experience as well, but spammers are becoming more
creative and they figured a way to make bayesian blind.
does anybody know if SA is able to update rules automatically now?
--
Stefano.
Re: ASF use spamassassin?
Posted by Martin Kraemer <ma...@apache.org>.
On Fri, Apr 16, 2004 at 09:18:17PM -0400, Stefano Mazzocchi wrote:
> >
> >Will the ASF use Spamassassin?
>
> But my biggest concern is about false positives.
That is why I switched from SA to using *only* bogofilter since
last summer. I never regretted it, because the heuristic approach of SA
needs rule updates everytime a new pattern arises. (Or did I miss a new
SA development?)
Well, I still use SA because it is invoked by amavisd, but I ignore its
decisions completely (because of the false positives, and because of its
suboptimal detection rate overall).
Martin
--
<Ma...@Fujitsu-Siemens.com> | Fujitsu Siemens
Fon: +49-89-636-46021, FAX: +49-89-636-47655 | 81730 Munich, Germany
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Stefano Mazzocchi <st...@apache.org>.
Antonio Gallardo wrote:
> Hi:
>
> The motivation to write this mail and ask about is: 2 days ago, I
> installed the spamassassin -
> http://incubator.apache.org/projects/spamassassin.html Because as many of
> us I really hate the spam. But what I found is more interesting:
>
> I get mails from to my apache.org address that in spamassassin got more
> than 40 points! This clearly signs to me we are not eating our own
> dogfood. And spamassassin is really very tasty and nutritive! ;-).
>
> Will the ASF use Spamassassin?
the ASF infrastructure team is currently testing one of the new IBM
boxes (hermes.apache.org) to test the load. spamassassin is a pretty
resource intensive beast and even if we do have those new shiny boxes,
there is concern about load.
But my biggest concern is about false positives.
One solution would be to use spamassassin for tagging purposes only, but
at that point it's much better to let people do the filtering
themselves. There is no reason in wasting precious CPU power for that.
A more socially-acceptable compromise would be to leave the "threshold
level" of the cutoff point to the various people to set (you could set a
.spam_threshold file in your home directory with the cut-off point). So,
if you keep the threshold low and complain, well, that was your own fault.
--
Stefano.
Re: ASF use spamassassin?
Posted by Stefano Mazzocchi <st...@apache.org>.
Antonio Gallardo wrote:
> I just hope soon the spam problem will find a final solution.
The final solution is to render it obviously ineffective and this battle
is done on your end.
Why do you think google gives you a Gb-worth of storage? so that you
don't delete anything.
Why that? have way more subsymbolic semantic data to train their
networks, so that not only they can be the best search engine, but also
the best spam filter in the world.
I've been doing this myself for more than a year now and I could not
imagine a world without this, it would be impossible for me to find a
single email in the pile of shit I receive.
The hope is not that spammers will go away, but that those who *pay*
them for spamming will find the thing so ineffective that will put them
out of business.
And you win this battle only with with better content-based filters, not
obfuscation, nor whitelists, nor blacklists.
Or you make sending email more expensive or you have authorities
regulating digital identies. But those might create more problems than
they solve.
What we need is a web of distributed identity control.
But that's the hardest thing in the history of technology applied to
society.
Luckily Apache hosts a few people that have been working extensively in
the area... so well, something might turn out from that too.
For now, I just filter the hell out of them ;-)
--
Stefano.
RE: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
Noel J. Bergman dijo:
>> because of spam via address harvesting and spoofing.
>
> Or just plain dictionary attacks. As an experiment, create a hotmail
> address, and never use. See how long it is before it gets spam.
>
> I keep a tail -f monitor on the logs for my mail server. It just scrolls
> by
> in a corner of the screen, but I recognize good and bad pattens, so if
> something looks odd, I can check the logs for the details. Mostly I'm
> after
> anything that indicates a bug to fix, but I notice other patterns.
>
> One pattern I have been noticing is that I see more dictionary attacks
> than
> anything else. One filters I want to write is to check all of the RCPT TO
> commands for a message. If a message has too high a ratio of bad
> recipients
> to valid ones, that would be flagged as spam. With 10-20 recipients in an
> typical attack, and 1-2 good addresses, I consider that to be a fairly
> good
> indicator.
>
> I want to do is review my logs to see how often the same IP address spams
> me. If it turns out that spammers are stupid enough to use the same IP
> often enough, I could cache IP addresses so that once an IP has been
> flagged
> as spamming by my filters it is blocked for a period of time, and then
> released. An attempt at a self-maintaining block list.
Good idea! The lasts days, I saw recently this kind of attacks too. They
uses from 3 to 20 diferent account guess.
>> We need to focus on good filtering techniques and also try to
>> minimise our exposure, e.g. removing author tags from javadoc;
>> obfuscating web pages especially the who.html in each project.
>
> And what makes you think that there aren't harvesters that scan CVS change
> logs?
:-D
Of course they are! But I think that out there are diferent "level" of
spammers from the most experienced that uses the most sofisticated to the
newbies that only try to find the classics regexp containing @ and dots.
I also think the most sophisticated are mainly well know and they are
listed in many blacklists. The newbies or new starters are the worse,
because they started just yesterday and they need time to go on a
blacklist. Here is where I see the utility of a tool like SA.
> Hiding your e-mail address as if it were an unlisted phone number is just
> a
> form of security through obscurity, and the wrong place to address the
> problem. It works better for spammers who hide their origins through
> criminal activity, than recipients.
I agree. I think we really need good anti-spam tool rather than hidding
our identities.
I just hope soon the spam problem will find a final solution.
Best Regards,
Antonio Gallardo
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: Announcing Erathostenes 1.0
Posted by Stefano Mazzocchi <st...@apache.org>.
Andrew Savory wrote:
> Hi,
>
> On 17 Apr 2004, at 18:59, Stefano Mazzocchi wrote:
>
>> Find out how this works here:
>>
>> http://www.betaversion.org/~stefano/software/erathostenes/index.html
>
>
> Interesting! But when you say "the assumption is that you *never* delete
> anything" ... do you mean in perpetuity? How realistic do you think this
> is, given the ~40kb payload of most virus mails these days? Over the
> last 6 months, I've accumulated over a gigabyte of such mail ... that's
> a pretty high cost in disk space!
>
> Or do you discard after retraining?
In this version of the script, if you remove an email from the spam
folder, the spam database is untrained. This allows you to avoid the
escalation of false positives (if you can still spot them!).
In the previous incarnation, the script was not doing this, but the
problem was that if you had a false positive (or, much more frequent,
you moved your ham in the spam folder by mistake and you didn't notice
before cron called the trainer) this "pollutes" the database.
In order to be able to perform "undo" in training (this is not frequent
but it's a nice feature) you need to save everything at all time.
Actually, the way the script works today is that it makes a local copy
of the email in your server, so not only you save everything, but you
have two copies of it.
Note that it is entirely possible, in case your disk space is limited,
to modify the script to remove binary attachments from email.
Anyway, In my case, I have 320mb of spam in the last 6 months. Disk
space is not that big of a deal these days, especially on servers.
--
Stefano.
Re: Announcing Erathostenes 1.0
Posted by Serge Knystautas <se...@lokitech.com>.
Andrew Savory wrote:
> On 17 Apr 2004, at 18:59, Stefano Mazzocchi wrote:
>
>> Find out how this works here:
>>
>> http://www.betaversion.org/~stefano/software/erathostenes/index.html
>
> Interesting! But when you say "the assumption is that you *never* delete
> anything" ... do you mean in perpetuity? How realistic do you think this
> is, given the ~40kb payload of most virus mails these days? Over the
> last 6 months, I've accumulated over a gigabyte of such mail ... that's
> a pretty high cost in disk space!
Checking buy.com, a 120 GB EIDE 7200 RPM harddrive is about $100, even
250 GB HD is about $250. You might buy faster/redundant storage as
well, but same order of magnitude.
So over a gigabyte in 6 months is between $2 and $4 annually per user.
That could be expensive based on the number of users, but if it works,
I'm sure even the most conscious ISPs would spend $4 annually per user
to mitigate spam complaints or related costs.
--
Serge Knystautas
President
Lokitech >> software . strategy . design >> http://www.lokitech.com
p. 301.656.5501
e. sergek@lokitech.com
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: Announcing Erathostenes 1.0
Posted by Andrew Savory <an...@luminas.co.uk>.
Hi,
On 17 Apr 2004, at 18:59, Stefano Mazzocchi wrote:
> Find out how this works here:
>
> http://www.betaversion.org/~stefano/software/erathostenes/index.html
Interesting! But when you say "the assumption is that you *never*
delete anything" ... do you mean in perpetuity? How realistic do you
think this is, given the ~40kb payload of most virus mails these days?
Over the last 6 months, I've accumulated over a gigabyte of such mail
... that's a pretty high cost in disk space!
Or do you discard after retraining?
Andrew.
--
Andrew Savory, Managing Director, Luminas Limited
Tel: +44 (0)870 741 6658 Fax: +44 (0)700 598 1135
Web: http://www.luminas.co.uk/
Orixo alliance: http://www.orixo.com/
Announcing Erathostenes 1.0
Posted by Stefano Mazzocchi <st...@apache.org>.
My email address gets 3,820 references in google. Security by obscurity
doesn't work, nor fighting spam via obfuscation.
My counter indicates 4534 spam message since monday.
Of these, only 45 reached my inbox (and half of those are those damn
Vicodin strains! grrr)
Of all the 27000 spam messages that my spam repo has, I was not able to
find a single false positive in the last 6 months.
Find out how this works here:
http://www.betaversion.org/~stefano/software/erathostenes/index.html
Hope this helps.
--
Stefano.
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Brian Behlendorf wrote:
<snip/>
>
> It's just not that hard to figure out why and how. Go to Google and type
> in your email address and see what comes up. In the case of
> crossley@apache.org, 149 separate references come up. ...<snip/>
..........^
:-) thanks, now it is 150 and rising with every person who replies
to this email.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Brian Behlendorf wrote:
> ...The top hits in both cases come from
> marc.theaimsgroup.com.
Actually only two hits, despite my many postings, so
MARC does a great job. Interesting, those two pages
are generated lists of my postings.
The majority of hits were Apache project Who.html pages
and copies of those on other websites. Apart from mailing
lists, i think that these "Who we are" pages are one of the
main sources for harvesting. Thankfully Forrest has been
obfuscating it recently so these are all old duplicate docs.
Obfuscations probably only stops Google, but that is a start.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
Brian Behlendorf dijo:
> On Fri, 17 Apr 2004, David Crossley wrote:
>> Antonio Gallardo wrote:
>> > David Crossley dijo:
>> > > I also made a bigger effort to use my apache.org address
>> > > for all Apache-related stuff.
>> >
>> > I almost never use my apache.org address and I am getting spam. ...
>>
>> This is what i was intending to say. Not necessarily because of
>> my use of the apache.org address, but because of spam via address
>> harvesting and spoofing.
>
> It's just not that hard to figure out why and how. Go to Google and type
> in your email address and see what comes up. In the case of
> crossley@apache.org, 149 separate references come up. In Antonio's case,
> there are 15 hits to his name. The top hits in both cases come from
> marc.theaimsgroup.com. So long as the From: line in email mailing
> lists has a valid email address, there will be spam sent to that address.
>
> One thing that users may not be aware of is that qmail allows them to use
> variants of their addresses - basically they can extend
> username@apache.org with username-anything@apache.org. Mail to that
> address would be handled with a .qmail-anything file in your home dir on
> minotaur. You could decide to bitbucket that easily, if you were using
> e.g. antonio-NOSPAM@apache.org or antonion-R3M0V3Me@apache.org or
> something that clearly indicated the idea that it should be stripped out.
Hi Brian:
Thanks for the tip. I was wondering why I got spam with:
aptmail-antonio@apache.org or similars.
Best Regards,
Antonio Gallardo
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Antonio Gallardo wrote:
> Brian Behlendorf dijo:
>
> > And jeez, lay off the demands on volunteers, already.
>
> Not understand this. Are you asking help? I gladly will volunteer on that.
I suggest to discuss high-level ideas here on community@a.o
and implementation details on infrastructure@a.o where you can
volunteer to your heart's delight. It sounds like you have
expertise and enthusiasm ... that would be very welcome.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
Brian Behlendorf dijo:
> On Sat, 17 Apr 2004, Antonio Gallardo wrote:
>> Brian Behlendorf dijo:
>> > Yeah, me too. But even with aggressive filtering I still get 200-300
>> a
>> > day. I abandoned my brian@apache.org address for this reason.
>>
>> This is why I think we need to go hard on spam policies. Please, turn on
>> spamassassin. :-D
>
> This is post-spamassassin.
I wonder if this a post spamassassin (I assume then "better") why he is
sending me spam that on spamassassin ranks more than 40 points!
> And jeez, lay off the demands on volunteers, already.
Not understand this. Are you asking help? I gladly will volunteer on that.
> You're coming
> across very poorly, and I'll assume that's not your intention. You're
> acting very much like someone who has no idea what it means to just "turn
> on" something for 800 active users.
I told before that I already setted some anti-virus, anti-spam appliances
for more than 20 companies. Ranging from just 20 to 10,000 users. Is this
diferent than for 800 users? I really don't think so. You need to see the
crappy hardware you got on the appliance just for US$ 5,000 - US$ 80,000.
I guess the new IBM machines are better than this and yes there is inside
the appliance is a SA version.
> If you're not happy, you can run it
> yourself, today, on minotaur. /usr/local/bin/spamassassin.
Thanks for the tip. I will be glad to try it. :-D
Best Regards,
Antonio Gallardo
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Brian Behlendorf <br...@collab.net>.
On Sat, 17 Apr 2004, Antonio Gallardo wrote:
> Brian Behlendorf dijo:
> > Yeah, me too. But even with aggressive filtering I still get 200-300 a
> > day. I abandoned my brian@apache.org address for this reason.
>
> This is why I think we need to go hard on spam policies. Please, turn on
> spamassassin. :-D
This is post-spamassassin.
And jeez, lay off the demands on volunteers, already. You're coming
across very poorly, and I'll assume that's not your intention. You're
acting very much like someone who has no idea what it means to just "turn
on" something for 800 active users. If you're not happy, you can run it
yourself, today, on minotaur. /usr/local/bin/spamassassin.
Brian
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
Brian Behlendorf dijo:
> Yeah, me too. But even with aggressive filtering I still get 200-300 a
> day. I abandoned my brian@apache.org address for this reason.
This is why I think we need to go hard on spam policies. Please, turn on
spamassassin. :-D
Best Regards,
Antonio Gallardo.
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Brian Behlendorf <br...@collab.net>.
On Sat, 17 Apr 2004, [ISO-8859-1] Ask Bj�rn Hansen wrote:
> Most of the .qmail files in ~apmail are not setup to allow that
> directly on @apache.org...
Oh yeah, you're right. That's not hard to fix, though it's a pain to
maintain. It means having files on daedalus:~apmail for each user that
fits a pattern:
.qmail-brianb-default
| forward "brianb-$EXT2@locus.apache.org"
in addition to the regular
.qmail-brianb
brianb@locus.apache.org
> (Personally I favor aggressive spam filtering; I get more than a
> thousand spams a day to my various addresses and if I am not
> aggressive about filtering them I can't find my real mail!)
Yeah, me too. But even with aggressive filtering I still get 200-300 a
day. I abandoned my brian@apache.org address for this reason.
Brian
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Ask Bjørn Hansen <ah...@gmail.com>.
On Sat, 17 Apr 2004 00:08:17 -0700 (PDT), Brian Behlendorf
<br...@collab.net> wrote:
[...]
> One thing that users may not be aware of is that qmail allows them to use
> variants of their addresses - basically they can extend
> username@apache.org with username-anything@apache.org.
Most of the .qmail files in ~apmail are not setup to allow that
directly on @apache.org...
(Personally I favor aggressive spam filtering; I get more than a
thousand spams a day to my various addresses and if I am not
aggressive about filtering them I can't find my real mail!)
- ask
--
http://askask.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Stefano Mazzocchi <st...@apache.org>.
David Crossley wrote:
> Stefano Mazzocchi wrote:
>
>>David Crossley wrote:
>>
>>>It is a classic isn't it. A search at http://pgp.mit.edu/ for "apache"
>>>does the trick. So we are doomed.
>>>
>>>Stefano, i notice that you are not on the list. Is that deliberate?
>>
>>no, I just never got serious enough with PGP to actually be able to say
>>"this is my key" and never felt the urge for it.
>
>
> Ah, and also that you are using S/MIME not PGP.
> Sorry for asking silly questions, i am new to this minefield.
eheh, it's a field you learn fast, nothing better than some good itches
to scratch to stimulate your creativity ;-)
--
Stefano.
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Stefano Mazzocchi wrote:
> David Crossley wrote:
> >
> > It is a classic isn't it. A search at http://pgp.mit.edu/ for "apache"
> > does the trick. So we are doomed.
> >
> > Stefano, i notice that you are not on the list. Is that deliberate?
>
> no, I just never got serious enough with PGP to actually be able to say
> "this is my key" and never felt the urge for it.
Ah, and also that you are using S/MIME not PGP.
Sorry for asking silly questions, i am new to this minefield.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Stefano Mazzocchi <st...@apache.org>.
David Crossley wrote:
> Noel J. Bergman wrote:
>
>>>Sounds like a *contest* to me! :-) Can anyone (besides Stefano, who's
>>>in a class by himself :-) beat my 1,540 references
>>
>>I found 2 unique references for my @apache.org address. I was hoping for
>>none, since I never use it. One is because I simply hadn't noticed that
>>someone had used that address when adding me to a page. The other can't be
>>helped: it is in the KEYS file. You know ... as in:
>>
>> pub 1024D/23CB7A2A 2004/04/17 David Crossley <--...@apache---->
>>
>>PGP key servers are also a list of e-mail addresses for spammers.
>
>
> It is a classic isn't it. A search at http://pgp.mit.edu/ for "apache"
> does the trick. So we are doomed.
>
> Stefano, i notice that you are not on the list. Is that deliberate?
no, I just never got serious enough with PGP to actually be able to say
"this is my key" and never felt the urge for it.
--
Stefano.
RE: ASF use spamassassin?
Posted by Felipe Leme <ja...@felipeal.net>.
On Sat, 2004-04-17 at 22:16, David Crossley wrote:
> It is a classic isn't it. A search at http://pgp.mit.edu/ for "apache"
> does the trick. So we are doomed.
Yet, that's a spammer's heaven we can't hide from. What I do in these
cases is create a unique address for each of these public places (either
using sneakemail.net or my own domain - felipeal.net) and then set my
mail client to filter mails coming to these address.
For instance, I use 'jakartalists1' for all public Apache lists (and my
@apache.org address only for private ones), 'nagoya' for filling bugs,
'gpgkey_jakarta' for PGP, 'javanet' and 'weblogs'for java.net-related
projects, and so on...
Felipe
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Noel J. Bergman wrote:
> > Sounds like a *contest* to me! :-) Can anyone (besides Stefano, who's
> > in a class by himself :-) beat my 1,540 references
>
> I found 2 unique references for my @apache.org address. I was hoping for
> none, since I never use it. One is because I simply hadn't noticed that
> someone had used that address when adding me to a page. The other can't be
> helped: it is in the KEYS file. You know ... as in:
>
> pub 1024D/23CB7A2A 2004/04/17 David Crossley <--...@apache---->
>
> PGP key servers are also a list of e-mail addresses for spammers.
It is a classic isn't it. A search at http://pgp.mit.edu/ for "apache"
does the trick. So we are doomed.
Stefano, i notice that you are not on the list. Is that deliberate?
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by "Noel J. Bergman" <no...@devtech.com>.
> Sounds like a *contest* to me! :-) Can anyone (besides Stefano, who's
> in a class by himself :-) beat my 1,540 references
I found 2 unique references for my @apache.org address. I was hoping for
none, since I never use it. One is because I simply hadn't noticed that
someone had used that address when adding me to a page. The other can't be
helped: it is in the KEYS file. You know ... as in:
pub 1024D/23CB7A2A 2004/04/17 David Crossley <--...@apache---->
PGP key servers are also a list of e-mail addresses for spammers.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Craig McClanahan <cr...@apache.org>.
Brian Behlendorf wrote:
>On Fri, 17 Apr 2004, David Crossley wrote:
>
>
>>Antonio Gallardo wrote:
>>
>>
>>>David Crossley dijo:
>>>
>>>
>>>>I also made a bigger effort to use my apache.org address
>>>>for all Apache-related stuff.
>>>>
>>>>
>>>I almost never use my apache.org address and I am getting spam. ...
>>>
>>>
>>This is what i was intending to say. Not necessarily because of
>>my use of the apache.org address, but because of spam via address
>>harvesting and spoofing.
>>
>>
>
>It's just not that hard to figure out why and how. Go to Google and type
>in your email address and see what comes up. In the case of
>crossley@apache.org, 149 separate references come up. In Antonio's case,
>there are 15 hits to his name. The top hits in both cases come from
>marc.theaimsgroup.com. So long as the From: line in email mailing
>lists has a valid email address, there will be spam sent to that address.
>
>
>
Sounds like a *contest* to me! :-) Can anyone (besides Stefano, who's
in a class by himself :-) beat my 1,540 references for
"craigmcc@apache.org"? And yes, I get to deal with several hundred
spams per day on this address, above and beyond the spam I get because
I'm moderating a couple of Apache mailing lists.
>One thing that users may not be aware of is that qmail allows them to use
>variants of their addresses - basically they can extend
>username@apache.org with username-anything@apache.org. Mail to that
>address would be handled with a .qmail-anything file in your home dir on
>minotaur. You could decide to bitbucket that easily, if you were using
>e.g. antonio-NOSPAM@apache.org or antonion-R3M0V3Me@apache.org or
>something that clearly indicated the idea that it should be stripped out.
>
>
>
That's a pretty clever idea. Unfortunately, it doesn't help if you
actually respond to questions on our mailing lists, and therefore gets
archived in the "collected addresses" lists of individual user mailboxes
(which is where the virii get it).
Beyond that, I don't think obfuscation would do anything at all to help;
my experience with throwaway addresses tells me that the address
collecting robot that can't read <craigmcc AT apache DOT org> has been
retired for a long time.
> Brian
>
>
>
Craig
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Brian Behlendorf <br...@collab.net>.
On Fri, 17 Apr 2004, David Crossley wrote:
> Antonio Gallardo wrote:
> > David Crossley dijo:
> > > I also made a bigger effort to use my apache.org address
> > > for all Apache-related stuff.
> >
> > I almost never use my apache.org address and I am getting spam. ...
>
> This is what i was intending to say. Not necessarily because of
> my use of the apache.org address, but because of spam via address
> harvesting and spoofing.
It's just not that hard to figure out why and how. Go to Google and type
in your email address and see what comes up. In the case of
crossley@apache.org, 149 separate references come up. In Antonio's case,
there are 15 hits to his name. The top hits in both cases come from
marc.theaimsgroup.com. So long as the From: line in email mailing
lists has a valid email address, there will be spam sent to that address.
One thing that users may not be aware of is that qmail allows them to use
variants of their addresses - basically they can extend
username@apache.org with username-anything@apache.org. Mail to that
address would be handled with a .qmail-anything file in your home dir on
minotaur. You could decide to bitbucket that easily, if you were using
e.g. antonio-NOSPAM@apache.org or antonion-R3M0V3Me@apache.org or
something that clearly indicated the idea that it should be stripped out.
Brian
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Noel J. Bergman wrote:
> David Crossley wrote:
> > We need to focus on good SA filtering techniques and also try to
> > minimise our exposure, e.g. removing author tags from javadoc;
> > obfuscating web pages especially the who.html in each project.
>
> And what makes you think that there aren't harvesters that scan CVS change
> logs?
I am absolutely sure that there are. Any method that we can conceive
is already being done.
> Hiding your e-mail address as if it were an unlisted phone number is just a
> form of security through obscurity, and the wrong place to address the
> problem. It works better for spammers who hide their origins through
> criminal activity, than recipients.
Every place that we address is yet another piece of the
multi-faceted puzzle.
There is an analogy with personal hygiene. If we get in the
habit of washing our hands after going to the toilet and get
creative with ways to open the door without touching the handle
then we minimise our risk of disease.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
RE: ASF use spamassassin?
Posted by "Noel J. Bergman" <no...@devtech.com>.
> because of spam via address harvesting and spoofing.
Or just plain dictionary attacks. As an experiment, create a hotmail
address, and never use. See how long it is before it gets spam.
I keep a tail -f monitor on the logs for my mail server. It just scrolls by
in a corner of the screen, but I recognize good and bad pattens, so if
something looks odd, I can check the logs for the details. Mostly I'm after
anything that indicates a bug to fix, but I notice other patterns.
One pattern I have been noticing is that I see more dictionary attacks than
anything else. One filters I want to write is to check all of the RCPT TO
commands for a message. If a message has too high a ratio of bad recipients
to valid ones, that would be flagged as spam. With 10-20 recipients in an
typical attack, and 1-2 good addresses, I consider that to be a fairly good
indicator.
I want to do is review my logs to see how often the same IP address spams
me. If it turns out that spammers are stupid enough to use the same IP
often enough, I could cache IP addresses so that once an IP has been flagged
as spamming by my filters it is blocked for a period of time, and then
released. An attempt at a self-maintaining block list.
> We need to focus on good filtering techniques and also try to
> minimise our exposure, e.g. removing author tags from javadoc;
> obfuscating web pages especially the who.html in each project.
And what makes you think that there aren't harvesters that scan CVS change
logs?
Hiding your e-mail address as if it were an unlisted phone number is just a
form of security through obscurity, and the wrong place to address the
problem. It works better for spammers who hide their origins through
criminal activity, than recipients.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Antonio Gallardo wrote:
> David Crossley dijo:
> > I also made a bigger effort to use my apache.org address
> > for all Apache-related stuff.
>
> I almost never use my apache.org address and I am getting spam. ...
This is what i was intending to say. Not necessarily because of
my use of the apache.org address, but because of spam via address
harvesting and spoofing.
We need to focus on good filtering techniques and also try to
minimise our exposure, e.g. removing author tags from javadoc;
obfuscating web pages especially the who.html in each project.
> > Since then my only real source of spam is via apache.
> >
> > It all originates from stupid anti-virus software telling
> > me that my spoofed apache address had sent them bad stuff.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by Antonio Gallardo <ag...@agssa.net>.
David Crossley dijo:
> Thanks for starting this discussion Antonio.
Thanks to you and Stefano for participate on it. ;-)
> A couple of months ago i side-stepped spam by dumping
> my old personal email address and moving to a new one.
The same history happend to me long time ago. I think many people have the
same problem over and over. This make me think that spammers are winning
the war. :-(
Currently, I am too paranoic enough, that I am able to create a new email
address as the last resource when a website ask me for a valid email
address. After getting my password or doing what I needed at the website,
I close the mail forever.
When I fill a form on a company (bank or whatever) I almost always tell I
have no email!
and even other resources.... This is what I learned as anti-spam policies
in my life. :-(
But this does not work! I am getting spamed too!
> I also made a bigger effort to use my apache.org address
> for all Apache-related stuff.
I almost never use my apache.org address and I am getting spam. Wonder how
much spam is getting people as Stefano. I think it must be too much.
Recently, even Torsten Curdt and others bloged about this. Is sad people
need to blog about spam instead of other interesting things. Spam is a
epidemia in this century.
> Since then my only real source of spam is via apache.
In my case it is not just apache. I need to read also some "public" mail
address to find between the crap some mails. Some days I got 175 or more
spams there. Fortunately, before spamassassin, I blocked most of the spam
using some blacklists as spamcop.com, etc. and this helped enough, but as
currently seems like spammers are using new technics, the spam is
increasing and this is why I decided to switch to spamassassin. I know it
is very early to said how is my new life with spammassassin but the
results in this 2 days was great, better than using only blacklists.
blacklist are blind and recently happened that spamcop.com blocked
daedalus.apache.org The issue is already solved.
> It all originates from stupid anti-virus software telling
> me that my spoofed apache address had sent them bad stuff.
Yep.
> Oh, and there is the stack of spam from volunteering
> to be moderator of a few lists, especially general@xml.a.o
Yep. I really appreaciate the job of people that currently is filtering
spam in the ASF maillist you are doing a great job. But I think you will
welcome for sure a little of help with tools like spamassassin. That way
the work will be easier than today. :-D
> So i am very keen that we address this as a group.
+1 too :-D
Best Regards,
Antonio Gallardo
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org
Re: ASF use spamassassin?
Posted by David Crossley <cr...@apache.org>.
Thanks for starting this discussion Antonio.
A couple of months ago i side-stepped spam by dumping
my old personal email address and moving to a new one.
I also made a bigger effort to use my apache.org address
for all Apache-related stuff.
Since then my only real source of spam is via apache.
It all originates from stupid anti-virus software telling
me that my spoofed apache address had sent them bad stuff.
Oh, and there is the stack of spam from volunteering
to be moderator of a few lists, especially general@xml.a.o
So i am very keen that we address this as a group.
--David
---------------------------------------------------------------------
To unsubscribe, e-mail: community-unsubscribe@apache.org
For additional commands, e-mail: community-help@apache.org