Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 20 Oct 2006 00:27:35 -0700
From:      "Ted Mittelstaedt" <tedm@toybox.placo.com>
To:        "Erik Norgaard" <norgaard@locolomo.org>
Cc:        Beech Rintoul <freebsd@alaskaparadise.com>, freebsd-questions@freebsd.org
Subject:   Re: Non English Spam
Message-ID:  <003401c6f419$4d2dba40$3c01a8c0@coolf89ea26645>
References:  <200610131712.46822.freebsd@alaskaparadise.com><4530DA30.7060004@locolomo.org><001c01c6eff4$f77cd590$3c01a8c0@coolf89ea26645><453211C9.8030102@locolomo.org><000001c6f1c1$c55e46b0$3c01a8c0@coolf89ea26645> <4534A0D8.2070909@locolomo.org>

next in thread | previous in thread | raw e-mail | index | archive | help

----- Original Message ----- 
From: "Erik Norgaard" <norgaard@locolomo.org>
To: "Ted Mittelstaedt" <tedm@toybox.placo.com>
Cc: "Beech Rintoul" <freebsd@alaskaparadise.com>;
<freebsd-questions@freebsd.org>
Sent: Tuesday, October 17, 2006 2:22 AM
Subject: Re: Non English Spam


>
> Also this means that later filtering on the first Received field is
> double work: You already accepted the mail based on that information.
>
> In short: Writing header filtering rules for the Received field is
> simply waste of time and proof of inefficiency.
>

I agree with this but unfortunately the real world often screws this up.

For example, SpamCop is one of the most effective blacklists on the
Internet because of it's high user participation.  Unfortunately, it
repeatedly blocks yahoomail, craigslist, and ebay because spammers
hate it and try to stuff it up so as to get people to stop using it.

As a result, you cannot use Spamcop to reject at the HELO.  Instead
you have to post-filter the mail and do your spamcop lookups, so
you can exempt domains like ebay that are legitimate.

> Just as Sendmail, Postfix is not designed for spam filtering. Postfix
> provides simple filtering mechanisms, keeping it simple postfix provides
> an effective and reliable MTA that doesn't suffer the track record of
> security bugs Sendmail does.
>
> When the native filters does not suffice you can combine with any number
> of "policy services": External filtering mechanisms such as postgrey,
> spam assassin etc. This design is clean, reliable and easy to manage.
>

Same for Sendmail, you can use milters to add all this stuff in.  Or you
can do it in the local delivery agent.

>
> OP requested a way to filter away the spam in foreign character sets
> because for some reason these were not caught by Spam Assassin or
> procmail. I gave a solution that solves that problem, and I mentioned
> the problem of false negatives for this list.
>
> Rather than get pissed, do try to offer an alternative solution to a
> real problem.
>

There really is no solution.  Fundamentally, well written spam is
not distinguishable from non-spam by a computer.  What has saved our asses
so
far is that there's not a spammer alive who has been able to resist the
temptation
to use bold, colors, blinking test, hot phrases, and other attention-getting
devices in their spams.  Since you can program a computer to look for the
attention getting stuff, what has happened is a little social engineering.

Most people today have abandonded use of attention-getting devices
in their e-mails because when they use HTMLized text and such,
their mails tend to get blocked as spam by everyone and their dog.
So, the spam content filters can still distinguish spam from non-spam
by looking for these differences.

But it is only a matter of time before the spammers all wake up and
smell the coffee, and start using standard ASCII pure text for their
spams, and then all these charset filters your loving will go gurgling
down the drain.

Granted that might make their spams less effective so they might
get less respondents.

Frankly, I think there is no technical solution, I think there are only
political solutions.  We've already made spam illegal in the US, and
the CAN-SPAM act defines the "advertised" party in the spams
also as a spammer, in addition to the actual spammer sending the
stuff.

It would be childs play for the FBI to work with the major ISP's
to create thousands of dummy e-mail addresses and use these
to capture spam runs.  Then they just go arrest the people in the
company that is being advertised and hang a few of them high.
There's no need to even go after the actual spammers themselves.

When this happens enough times, the supply of companies that
are willing to pay spammers to send spam will dry up, and the
spammers will go find some other criminal activity to engage in.

But, the FBI isn't doing this because many of the companies that
are hiring spammers have lots of money, and that gives them lots of
political power.  So, the will to curb spam just isn' t there even though
money "earned" by spammers is undoubtedly going into organized
crime, feeding terror cells, and other more nasty stuff.

>
> I asked politely if there were any consensus or best practices etc. on
> this issue. You have the regular mail on "how to get the best results"
> there are recommendations on how to use this list, they are not enforced
> but only serve as guidelines.
>
> I don't try to force people to use particular character sets, I merely
> ask whether such recommendation exist for "the best results when using
> the list", in which case filtering on charsets may be the least
> imperfect solution (until you share your perfect filter, that is).
>

Your continuing to try to muddy the issue by inferring that personal
filters are the same as requirements to post.

You snipped all my explanation of what the differences are and responded
with a snotty request for a perfect filter, when I never said I ever had
one.

As I already stated, what people do on their own mailserver is their
business.  If they want to filter Asian charsets, then fine.  Go ahead.
But, telling people they can't use them when posting to the list is
crossing the line.

Certainly a "best results when using the list" document is a good thing.
But, that is a recommendation, not a requirement.  The response that
got me pissed was speculating that the list server should filter on Asian
charsets,
and we should order, not recommend, to
people that they don't use Asian charsets.  I'm glad to see your
backwatering from that.

The charset filtering may well be a "least imperfect" filter, but it
must be implemented on the recipients of the list mailservers and
mail clients.

Ted




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?003401c6f419$4d2dba40$3c01a8c0>