off topic - what about privacy compliance scanning?

[Marc <Ma...@f1-outsourcing.eu>]

I was wondering if it could be interesting for spamassassin to get also into the business of scanning for personal/sensitive data. Maybe as a separate project?

I have the impression there is growing demand for "personal identifiable information" services. I have the impression that such scanning is really close to the stuff spamassassin is already doing. No idea if there are already such open source projects.

Re: off topic - what about privacy compliance scanning?

[Bill Cole <sa...@billmail.scconsult.com>]

On 2025-02-13 at 06:28:15 UTC-0500 (Thu, 13 Feb 2025 11:28:15 +0000)
Marc <Ma...@f1-outsourcing.eu>
is rumored to have said:

> I was wondering if it could be interesting for spamassassin to get 
> also into the business

No, never, not at all.

SA is NOT a business. we are not "in the business" of anything.

> of scanning for personal/sensitive data. Maybe as a separate project?

SA is not fit for such use. The job is entirely different than detecting 
spam.

Personally, I find that problem space uninteresting, but that's just me.

> I have the impression there is growing demand for "personal 
> identifiable information" services. I have the impression that such 
> scanning is really close to the stuff spamassassin is already doing.

Not really. SA operates on email. It is designed only for email.

If you don't want to send *email* with PII, just don't. If frequently 
seen data patterns in *email* is not your problem, SA cannot be your 
solution.

If you want to handle data transfer that is not using discrete 
RFC822/2822/5322 email messages traveling via a predictable and hookable 
path, you need some other tool. I don't even see how one would use SA as 
a basis for a tool to find PII in anything, but the problem is deeper 
than just not having suitable rules.

> No idea if there are already such open source projects.

Every commercial product I've seen in for doing this is worse than 
nothing, because they all claim to catch surreptitious transmission of 
PII and all fail as much as they work. I don't believe it is a feasible 
class of tools, but rather a way to extract money from people who don't 
really understand the problem.

As such, I doubt that there are or ever will be worthwhile open source 
tools for this sort of scanning. No tool can cure human carelessness.


-- 
  Bill Cole
  bill@scconsult.com or billcole@apache.org
  (AKA @grumpybozo@toad.social and many *@billmail.scconsult.com 
addresses)
  Not Currently Available For Hire

Re: off topic - what about privacy compliance scanning?

[Benny Pedersen <me...@junc.eu>]

Matus UHLAR - fantomas skrev den 2025-02-13 17:26:
> On 13.02.25 11:28, Marc wrote:
>> I was wondering if it could be interesting for spamassassin to get 
>> also into the business of scanning for personal/sensitive data.  Maybe 
>> as a separate project?
>> 
>> I have the impression there is growing demand for "personal 
>> identifiable information" services.  I have the impression that such 
>> scanning is really close to the stuff spamassassin is already doing.  
>> No idea if there are already such open source projects.
> 
> ClamAV has StructuredDataDetection option that is supposed to catch 
> this kinds of data.
> 
> further, amavis can use output of clamav to map to spam score:
> 
> - added to @virus_name_to_spam_score_maps :
>     /^Structured\.(SSN|CreditCardNumber)\b/
>     /^Sanesecurity.TestSig_/
>     /^Email\.Spammail\b/
>     /^winnow\.(phish|spam)\./
>     /^INetMsg\.SpamDomain/

not currect amavisd syntax :/

> there is clamav plugin to SA but I don't know its current state.

ading this plugin needs scanning in clamav one more time, the plugin 
must be rewrited to use first time results

Re: off topic - what about privacy compliance scanning?

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 13.02.25 11:28, Marc wrote:
> I was wondering if it could be interesting for spamassassin to get also 
> into the business of scanning for personal/sensitive data.  Maybe as a 
> separate project?
>
> I have the impression there is growing demand for "personal identifiable 
> information" services.  I have the impression that such scanning is really 
> close to the stuff spamassassin is already doing.  No idea if there are 
> already such open source projects.

ClamAV has StructuredDataDetection option that is supposed to catch this 
kinds of data.

further, amavis can use output of clamav to map to spam score:

- added to @virus_name_to_spam_score_maps :
     /^Structured\.(SSN|CreditCardNumber)\b/
     /^Sanesecurity.TestSig_/
     /^Email\.Spammail\b/
     /^winnow\.(phish|spam)\./
     /^INetMsg\.SpamDomain/

there is clamav plugin to SA but I don't know its current state.

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"They say when you play that M$ CD backward you can hear satanic messages."
"That's nothing. If you play it forward it will install Windows."