Please /dev/null html-only mail rather than sending it out on this list

Please /dev/null html-only mail rather than sending it out on this list

[Whit Blauvelt]

Hi,

That a lot of spam has been coming through this list is one thing. That the
list daemon threatens to cut people from the list whose systems refuse to
accept some of the spam is another.

Might I suggest a simple category of stuff to throw out before forwarding to
the list: HTML-only mail. 99%+ of it is spam, and the other <1% isn't the
sort of people who have any interest in advanced file systems.

Two easy ways to block a lot of it: 

1. With procmail:

# HTML only message are most probably spam.
:0
* ^Content-Type:.*text/html
{      
  LOG="(HTML) "
  :0
  /dev/null
}

2. With SpamAssassin by setting the score for MIME_HTML_ONLY high and then
either /dev/null'ing or refusing to even accept such mail (providing you're
running it as a milter). (Which is what I do and why the listserv is getting
impatient with me.)

Other mail filtering methods will have equally easy ways to just toss this
trash where it belongs.

Whit

Re: Please /dev/null html-only mail rather than sending it out on this list

[Pierre Abbat]

On Sunday 18 April 2004 17:26, Whit Blauvelt wrote:
> Hi,
>
> That a lot of spam has been coming through this list is one thing. That the
> list daemon threatens to cut people from the list whose systems refuse to
> accept some of the spam is another.
>
> Might I suggest a simple category of stuff to throw out before forwarding
> to the list: HTML-only mail. 99%+ of it is spam, and the other <1% isn't
> the sort of people who have any interest in advanced file systems.
>
> Two easy ways to block a lot of it:
>
> 1. With procmail:
>
> # HTML only message are most probably spam.
>
> :0
>
> * ^Content-Type:.*text/html
> {
>   LOG="(HTML) "
>
>   :0
>
>   /dev/null
> }

Also, multipart mail that consists of an HTML part and no text part is *all* 
spam. (I have one sender that sends a legitimate HTML-only mail.) To get rid 
of this, use this procmail rule:

:0 B
* H ?? Content-Type: multipart
* Content-Type: text/html
* ! Content-Type: text/plain
* ! ^Received:
/dev/null
#The Received check is there because I am a postmaster.

Also block mail from IP addresses known to be open relays, open proxies, 
rooted boxes, etc.

phma
-- 
li fi'u vu'u fi'u fi'u du li pa

Re: Please /dev/null html-only mail rather than sending it out on this list

[The Amazing Dragon]

I suspect this is the more general problem that SpamAssassin on Namesys
needs to be updated, since a *lot* is getting through now.

Most servers get patches to fix security holes. SpamAssassin gets patches
to spam holes. Both are annoying.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \   (    |         EHeM@cs.pdx.edu      PGP 8881EF59         |    )   /
  \_  \   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
    \___\_|_/82 04 A1 3C C7 B1 37 2A*E3 6E 84 DA 97 4C 40 E6\_|_/___/

Re: Please /dev/null html-only mail rather than sending it out on this list

[Hendrik Visage]

On Sun, Apr 18, 2004 at 11:58:08PM -0700, The Amazing Dragon wrote:
> 
> Most servers get patches to fix security holes. SpamAssassin gets patches
> to spam holes. Both are annoying.

Or get DSPAM that the users train and the SysAdmin can got fix security holes ;^)

Re: Please /dev/null html-only mail rather than sending it out on this list

[Alexander Lyamin]

Sun, Apr 18, 2004 at 05:45:04PM -0400, Pierre Abbat wrote:
> On Sunday 18 April 2004 17:26, Whit Blauvelt wrote:
> > Hi,
> >
> :0 B
> * H ?? Content-Type: multipart
> * Content-Type: text/html
> * ! Content-Type: text/plain
> * ! ^Received:
> /dev/null
> #The Received check is there because I am a postmaster.

procmail is BAAAAD :)

we use a really small bit of shell instead
# we check if message was spoiled by spamassassin in previous
# round of spamcheck (qmailq).

preflag=`printf "%s\n" "$input" | $M822FIELD X-Spam-Flag | sed 's/^ //'`
if [ "$preflag"  = "YES" ]; then
# .. and if its spammy enough already, we reinject.
printf "%s\n" "$input" | $FORWARDBIN $FORWARD
  if [ $? -eq 0 ]; then
   #so qmail will not do any further deliveries in .qmail file
   exit 99
  fi
  # problem calling inject - temp failure
 exit 111
fi

#


i cant send HTML only to /dev/null cause Hans Reiser thinks
ASCII (we are all using) is obsoleted by *ML's ;)

but we do a lil tweakig there and there, changing weights and
writing new spamassassin rules.

for example for today spamassassin blocked 162 spam messages
that were sent to this list ;)

well some got through. we are not perfect, but i'm working on it
(being perfect)..


> Also block mail from IP addresses known to be open relays, open proxies, 
> rooted boxes, etc.

its intresting discussion, but lets move it off the list.


-- 
"the liberation loophole will make it clear.."
lex lyamin

Re: Please /dev/null html-only mail rather than sending it out on this list

[Alexander Lyamin]

Sun, Apr 18, 2004 at 05:26:59PM -0400, Whit Blauvelt wrote:
> Hi,
> 
> That a lot of spam has been coming through this list is one thing. That the
> list daemon threatens to cut people from the list whose systems refuse to
> accept some of the spam is another.
> 
> Might I suggest a simple category of stuff to throw out before forwarding to
> the list: HTML-only mail. 99%+ of it is spam, and the other <1% isn't the
> sort of people who have any interest in advanced file systems.
> 
> Two easy ways to block a lot of it: 
> 
> 1. With procmail:
> 
> # HTML only message are most probably spam.
> :0
> * ^Content-Type:.*text/html
> {      
>   LOG="(HTML) "
>   :0
>   /dev/null
> }
> 
> 2. With SpamAssassin by setting the score for MIME_HTML_ONLY high and then
> either /dev/null'ing or refusing to even accept such mail (providing you're
> running it as a milter). (Which is what I do and why the listserv is getting
> impatient with me.)
> 
> Other mail filtering methods will have equally easy ways to just toss this
> trash where it belongs.

you've being heard. its actually was done quite a time ago.
but in a different way.

plus i simply cant junk 99%  cause of purely administrative reasons
(Hans loves the Markup Languages :)

but we do trash all sort of windows-os  junk right away ;))))

> 
> Whit

-- 
"the liberation loophole will make it clear.."
lex lyamin

Re: Please /dev/null html-only mail rather than sending it out on this list

[Alexander Lyamin]

Mon, Apr 19, 2004 at 09:18:39AM +0200, Hendrik Visage wrote:
> On Sun, Apr 18, 2004 at 11:58:08PM -0700, The Amazing Dragon wrote:
> > 
> > Most servers get patches to fix security holes. SpamAssassin gets patches
> > to spam holes. Both are annoying.
> 
> Or get DSPAM that the users train and the SysAdmin can got fix security holes ;^)
oh... actually i found out that bayesian rules for spamassiasin is also whole lot
of security grief.. and simply could be source of problem when someone does something
simply stupid (not evil).

world isnt perfect.
but thats just yet... ;)

-- 
"the liberation loophole will make it clear.."
lex lyamin

Re: Please /dev/null html-only mail rather than sending it out on this list

[Cami]

>>On Sun, Apr 18, 2004 at 11:58:08PM -0700, The Amazing Dragon wrote:
>>
>>>Most servers get patches to fix security holes. SpamAssassin gets patches
>>>to spam holes. Both are annoying.
>>
>>Or get DSPAM that the users train and the SysAdmin can got fix security holes ;^)
> 
> oh... actually i found out that bayesian rules for spamassiasin is also whole lot
> of security grief..

Huh? What specifically are you referring to here?

> and simply could be source of problem when someone does something
> simply stupid (not evil).

Using SpamAssasin+custom rulesets (ask me if you want them) and
then combined with Bayes, you'll eliminate close to 99% of the
spam that hits the reiser mailing list..

Regards,
Cami

Re: Please /dev/null html-only mail rather than sending it out on this list

[Alex Zarochentsev]

On Mon, Apr 19, 2004 at 03:45:51PM +0400, Alexander Lyamin wrote:
> Sun, Apr 18, 2004 at 05:45:04PM -0400, Pierre Abbat wrote:
> > On Sunday 18 April 2004 17:26, Whit Blauvelt wrote:
> > > Hi,
> > >
> > :0 B
> > * H ?? Content-Type: multipart
> > * Content-Type: text/html
> > * ! Content-Type: text/plain
> > * ! ^Received:
> > /dev/null
> > #The Received check is there because I am a postmaster.
> 
> procmail is BAAAAD :)
> 
> we use a really small bit of shell instead
> # we check if message was spoiled by spamassassin in previous
> # round of spamcheck (qmailq).
> 
> preflag=`printf "%s\n" "$input" | $M822FIELD X-Spam-Flag | sed 's/^ //'`
> if [ "$preflag"  = "YES" ]; then
> # .. and if its spammy enough already, we reinject.
> printf "%s\n" "$input" | $FORWARDBIN $FORWARD
>   if [ $? -eq 0 ]; then
>    #so qmail will not do any further deliveries in .qmail file
>    exit 99
>   fi
>   # problem calling inject - temp failure
>  exit 111
> fi
> 
> #
> 
> 
> i cant send HTML only to /dev/null cause Hans Reiser thinks
> ASCII (we are all using) is obsoleted by *ML's ;)

More strong anti-spam rules for the mailing list may help.  As an example
rejecting HTML-only e-mails may be wrong for filtering private e-mail and good
for the reiserfs-list.

> but we do a lil tweakig there and there, changing weights and
> writing new spamassassin rules.
> 
> for example for today spamassassin blocked 162 spam messages
> that were sent to this list ;)
> 
> well some got through. we are not perfect, but i'm working on it
> (being perfect)..
> 
> 
> > Also block mail from IP addresses known to be open relays, open proxies, 
> > rooted boxes, etc.
> 
> its intresting discussion, but lets move it off the list.
> 
> 
> -- 
> "the liberation loophole will make it clear.."
> lex lyamin

-- 
Alex.

Re: Please /dev/null html-only mail rather than sending it out on this list

[Alexander Lyamin]

Mon, Apr 19, 2004 at 04:10:06PM +0400, Alex Zarochentsev wrote:
> 
> More strong anti-spam rules for the mailing list may help.  As an example
> rejecting HTML-only e-mails may be wrong for filtering private e-mail and good
> for the reiserfs-list.

yes. likely. but it wasnt liked by Hans...
oops.

-- 
"the liberation loophole will make it clear.."
lex lyamin

Re: Please /dev/null html-only mail rather than sending it out on this list

[Alexander Lyamin]

Mon, Apr 19, 2004 at 02:04:29PM +0200, Cami wrote:
> >>On Sun, Apr 18, 2004 at 11:58:08PM -0700, The Amazing Dragon wrote:
> >>
> >>>Most servers get patches to fix security holes. SpamAssassin gets patches
> >>>to spam holes. Both are annoying.
> >>
> >>Or get DSPAM that the users train and the SysAdmin can got fix security 
> >>holes ;^)
> >
> 
> Using SpamAssasin+custom rulesets (ask me if you want them) and
> then combined with Bayes, you'll eliminate close to 99% of the
> spam that hits the reiser mailing list..
its already eliminates 99.
without bayes.

160:2 ratio for today.

you see what passes through :)
i see what was stopped...


-- 
"the liberation loophole will make it clear.."
lex lyamin

Re: Please /dev/null html-only mail rather than sending it out on this list

[Philippe Gramoullé]

Hello,

Maybe you should give a try at crm114 ( http://crm114.sf.net ) by Bill Yerazunis Ph.D

It's using Markovian filters instead of Bayesian ones and the homepage claims
1 spam out of 8738 messages (4240 spam, 4498 nonspam) which translates into an
accurracy of 99.984%

One nice aspect is that it learns *fast*

Thanks,

Philippe

--

Philippe Gramoullé
philippe.gramoulle@mmania.com
Senior System and Network Architect
Lycos Europe



On Mon, 19 Apr 2004 17:37:32 +0400
Alexander Lyamin <flx@msu.ru> wrote:

  | its already eliminates 99.
  | without bayes.
  | 
  | 160:2 ratio for today.

Re: Please /dev/null html-only mail rather than sending it out on this list

[Alexander Lyamin]

Mon, Apr 19, 2004 at 04:26:50PM +0200, Philippe Gramoull? wrote:
> 
> Hello,
> 
> Maybe you should give a try at crm114 ( http://crm114.sf.net ) by Bill Yera=
> zunis Ph.D
> 
> It's using Markovian filters instead of Bayesian ones and the homepage clai=
> ms
> 1 spam out of 8738 messages (4240 spam, 4498 nonspam) which translates into=
>  an
> accurracy of 99.984%
> 
> One nice aspect is that it learns *fast*

sound like pretty sharp accuracy.
i'll take a look :)


-- 
"the liberation loophole will make it clear.."
lex lyamin