You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by durwood <du...@berzerker.net> on 2010/10/06 23:38:16 UTC
Re: Question about Max msg size
>> What amavisd-new finally did was to pass the first (x) bytes to SA so
?> that at least the spam didn't get a RBL free pass.
>>
>> Nothing like that in spamd/spamc, but why not open a bug?
> Because it *is* filed already. Please first search bugzilla, then open
> a bug report.
Pinging this thread to see if there's been any progress or decision on this
bug.
I too am starting to see quite a bit of spam that's *just* over the 500k
threshold due to ~4K-sized image attached to the spam. It almost makes me
wonder if they are doing this just to get it over the standard SpamAssassin
threshold.
It seems like the size limit should be applied to the searchable parts of
the email, not any attached images.
--
View this message in context: http://old.nabble.com/Question-about-Max-msg-size-tp25095294p29901057.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Question about Max msg size
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Wed, 2010-10-06 at 17:38 -0700, jdow wrote:
> From: "Karsten Bräckelmann" <gu...@rudersport.de>
> > > It seems like the size limit should be applied to the searchable parts of
> > > the email, not any attached images.
> >
> > This is rather unlikely to happen. There is *no* size limit in SA. There
> > is, however, one in the lightweight spamc client. Not taking binary
> > attachments into account would require spamc to understand and parse the
> > MIME structure.
> >
> > Granted, there are good libs for that out there -- but the overhead,
> > code wise and as a build dependency, is non-trivial.
>
> Karsten, haven't you figured out that you CAN code "good if frustrating
> and cryptic" tools that drive SpamAssassin to send the rare very large
> messages off to spamassassin itself rather than spamc?
I have. I can. I do not see any need for this.
Joanne, this is open source. If you believe it would be necessary, feel
free to contribute the code. Or, if you prefer to start slow, file a
bug.
Referring to your other post: That's exactly what I told "durwood" to
do. Tweak the default setting to his specific needs. Plus, reasoned why
it likely would be worthwhile for him, and giving him data points to
decide about this on and for his own.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Question about Max msg size
Posted by jdow <jd...@earthlink.net>.
From: "Karsten Bräckelmann" <gu...@rudersport.de>
Sent: Wednesday, 2010/October/06 16:20
> On Wed, 2010-10-06 at 14:38 -0700, durwood wrote:
>> > Because it *is* filed already. Please first search bugzilla, then open
>> > a bug report.
>>
>> Pinging this thread to see if there's been any progress or decision on
>> this
>> bug.
>
> Wow, that thread's more than a year old. :) A lot of folks are likely
> to miss this follow-up, somewhere deep in the mail folder.
>
>> I too am starting to see quite a bit of spam that's *just* over the 500k
>> threshold due to ~4K-sized image attached to the spam. It almost makes me
>> wonder if they are doing this just to get it over the standard
>> SpamAssassin
>> threshold.
>
> If it's just over the threshold, why not just raise it? It's a default,
> but configurable for a reason.
>
> To reiterate some related statements from that thread and others since:
> With a higher threshold, overall memory consumption by SA will raise as
> well. However, with attachments like that, only a very few rules will be
> affected at all, namely rawbody rules. Anything else will never even get
> to see that data blob.
>
> IMHO, it should be perfectly safe in most cases to raise the threshold,
> if you're seeing spam just over it. Like, say, 600k? 750k?
>
> It's a trade-off, and you have to decide. However, think about it. How
> many messages (both spam and ham) do you receive over 500k a day? Over
> 1M? Would the overhead be worth it, to catch that spam, or would taking
> care of them manually be ok?
>
> What *is* that overhead anyway? Even if you are wasting cycles on one
> larger ham per user per day (those between old and new threshold) after
> raising the threshold, would you even notice the additional load? Would
> you notice 10 of them? Is your system that maxed out?
>
>
>> It seems like the size limit should be applied to the searchable parts of
>> the email, not any attached images.
>
> This is rather unlikely to happen. There is *no* size limit in SA. There
> is, however, one in the lightweight spamc client. Not taking binary
> attachments into account would require spamc to understand and parse the
> MIME structure.
>
> Granted, there are good libs for that out there -- but the overhead,
> code wise and as a build dependency, is non-trivial.
Karsten, haven't you figured out that you CAN code "good if frustrating
and cryptic" tools that drive SpamAssassin to send the rare very large
messages off to spamassassin itself rather than spamc?
{^_-}
Re: Question about Max msg size
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Wed, 2010-10-06 at 14:38 -0700, durwood wrote:
> > Because it *is* filed already. Please first search bugzilla, then open
> > a bug report.
>
> Pinging this thread to see if there's been any progress or decision on this
> bug.
Wow, that thread's more than a year old. :) A lot of folks are likely
to miss this follow-up, somewhere deep in the mail folder.
> I too am starting to see quite a bit of spam that's *just* over the 500k
> threshold due to ~4K-sized image attached to the spam. It almost makes me
> wonder if they are doing this just to get it over the standard SpamAssassin
> threshold.
If it's just over the threshold, why not just raise it? It's a default,
but configurable for a reason.
To reiterate some related statements from that thread and others since:
With a higher threshold, overall memory consumption by SA will raise as
well. However, with attachments like that, only a very few rules will be
affected at all, namely rawbody rules. Anything else will never even get
to see that data blob.
IMHO, it should be perfectly safe in most cases to raise the threshold,
if you're seeing spam just over it. Like, say, 600k? 750k?
It's a trade-off, and you have to decide. However, think about it. How
many messages (both spam and ham) do you receive over 500k a day? Over
1M? Would the overhead be worth it, to catch that spam, or would taking
care of them manually be ok?
What *is* that overhead anyway? Even if you are wasting cycles on one
larger ham per user per day (those between old and new threshold) after
raising the threshold, would you even notice the additional load? Would
you notice 10 of them? Is your system that maxed out?
> It seems like the size limit should be applied to the searchable parts of
> the email, not any attached images.
This is rather unlikely to happen. There is *no* size limit in SA. There
is, however, one in the lightweight spamc client. Not taking binary
attachments into account would require spamc to understand and parse the
MIME structure.
Granted, there are good libs for that out there -- but the overhead,
code wise and as a build dependency, is non-trivial.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Question about Max msg size
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Wed, 6 Oct 2010, durwood wrote:
> I too am starting to see quite a bit of spam that's *just* over the 500k
> threshold due to ~4K-sized image attached to the spam. It almost makes me
> wonder if they are doing this just to get it over the standard SpamAssassin
> threshold.
>
> It seems like the size limit should be applied to the searchable parts of
> the email, not any attached images.
If you have 3rd party image extensions installed (EG imageinfo, FuzzyOCR)
then the image content -is- searchable and a valid part of spam filtering.
Given the processing demands of those modules you care very much about
the size of images attached to messages. With modern 10Megapixel cameras
it's not unusual to find 2~4Mbyte pictures attached to messages.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Question about Max msg size
Posted by jdow <jd...@earthlink.net>.
From: "durwood" <du...@berzerker.net>
Sent: Wednesday, 2010/October/06 14:38
>
>>> What amavisd-new finally did was to pass the first (x) bytes to SA so
> ?> that at least the spam didn't get a RBL free pass.
>>>
>>> Nothing like that in spamd/spamc, but why not open a bug?
>
>> Because it *is* filed already. Please first search bugzilla, then open
>> a bug report.
>
> Pinging this thread to see if there's been any progress or decision on
> this
> bug.
>
> I too am starting to see quite a bit of spam that's *just* over the 500k
> threshold due to ~4K-sized image attached to the spam. It almost makes me
> wonder if they are doing this just to get it over the standard
> SpamAssassin
> threshold.
>
> It seems like the size limit should be applied to the searchable parts of
> the email, not any attached images.
As I see it, Durwood, you have a "default settings" problem. Perhaps you
need to customize a little. I've no problem with the concept because I
tend to change default passwords and things like that as well. (Default
passwords is what made Stuxnet so dangerous to SCADA tools from Seimans.)
{^_-}