Slashdot Mirror

An interesting thread here about how TMDA, a C/R filter, used in conjunction with SpamAssassin, can provide the best of both worlds. While TMDA is by itself effective, there seem to be some humanistic issues involving the assumption that all e-mailers are spammers unless they prove otherwise. The thread explains how Bayesian filtering can be improved by using a decent C/R filter like TMDA without alienating people that send legitimate e-mail.

Personally, I figure anyone thin-skinned enough to be insulted by my C/R filter probably isn't worth talking to anyways, but I digress...

If the list managers and TMDA users had things configured correctly, this wouldn't happen at all. Next time you get a TMDA auth request from a mailing list subscriber, point them to Tim Legant's Cookbook for using TMDA with mailing lists - also linked from The TMDA FAQ.

It's free. It works. It catches all the spam, not "most". Grab it now, be happy.

CT: "If Microsoft starts giving my address to even more companies, [...] my inbox will likely fill up faster than I can empty it."

The trick of creating company specific addresses works if you have full control of you e-mail domain. If you don't, it's possible that plussed addresses do work. If your e-mail address is john.doe@company.com, enter john.doe+evilcompany@company.com when Evil corporation wants your e-mail address to download, say, their Evil Player.

If plussed addresses don't work at your provider, bug them.

A really sophisticated way of doing this is to use TMDA, which extends this concept into time-limited addresses as well as more classic notions of "tagging" an e-mail address.

That looks pretty cool but it sounds just like Tagged Message Delivery Agent (TMDA). Is there any difference?

Here is, what I believe to be, a better approach to fighting SPAM: Tagged Message Delivery Agent(TMDA)

We're about to install a service that will do just that.

It's called Tagged Message Delivery Agent, or TDMA. You can find more information on it at http://software.libertine.org/tmda/.

Basically it works on a whitelist, you can automatically add people to this whitelist and they are free to send you email anytime. For people not already on your whitelist, when you send that user a message, it will pop back a email with instructions on how to confirm your message, once you do that (usually simply by replying to the message), your on the whitelist.

It works with qmail, Sendmail, Exim and other popular mailers.

Try looking at TMDA... I'm running it on my mail server and I am down from 10 spams a day to one a month. That one is through a mailing list that I would rather not unsubscribe from.

Basically it adds a whitelist of people that you will accept mail from, a blacklist that you will reject mail from, and will allow people to automatically add themselves to your whitelist.

You can also have time limited addresses, keyword addresses that you can revoke, and so on...

It is working for me, if it's not working for you, why not. :-)

Z.

Blocking spam is almost futile. Spam is always changing, and new spam is always being created.

Traditionally e-mail has been a open system, and we try to solve the spam problem by black-listing spam. However, because it doesn't look like open-relays will be going away anytime soon, the only way we can effective make spam a dead-end is to use a white-list strategy.

An alternative to Vipul's Razor trying to Block spam is TMDA.

Implicitly all "good" emails are reply-able to, and once they confirm themselves, they can be on your whitelist and will be able to send email to you from that point forward. While it is a bad thing (tm) to close the openess of email (the true nature of the Internet is the free flow of information), this may be the only way to effectively stop spam from being a viable means for spammers to get their messages out. Only by making it totally worthless will spammers ever stop.

An alternative is to use a White List strategy.
Try using TMDA.

An alternative is TMDA.

While most attempts are to blacklist spam, new spam will still get through. TMDA attempts to deny everything until it's confirmed. A bit inconvenient and painful? Yes, but perhaps this is the only strategy that will be effective against spam.

An alternative to razor is TMDA.

While razor attempts to blacklist spam, new spam will still get through. TMDA attempts to deny everything until it's confirmed. A bit inconvenient and painful? Yes, but perhaps this is the only strategy that will be effective against spam.

Opps.. The URL is TMDA

Seriously consider using something like Tagged Message Delivery Agent, it covers just about every feature on your list, but no 4-digit codes for people to fiddle with-- they just reply to the reply to. Since 99% of all spam has a bogus return address, this works very well. I installed it Monday, and after some testing found it to be quite nice. I don't think I'll have much work to convince my associates at work to adopt it. We're all so sick of getting spam.

You can configure TMDA to create an automatic whitelist for people so you don't have to manually add people to it. I'm so happy with it that I no longer munge my e-mail addresses anymore. And I haven't even gotten into using the self-destructing e-mail address features yet.

You don't need to use an external service to do this. You can do it yourself. There are several programs that do this. The one that I use is TMDA. Another is Kiwispam.

I'm seriously considering moving my mail servers over to using TMDA, which I hear stops about 99% of SPAM. At this point, I have to do something.

Phone solicitation creates costs for the initiator. Not just the calling costs, but somebody actually has to pay a couple persons to stay on the phone and talk to you. They don't call you 3 times in a row within an hour and ask you the same question. I do agree that phone solicitation is annoying, especially for people that get a load of these calls each day. I get a maximum of 10 calls per year (live in Italy), and I can live with that. I am definitely more annoyed by junk sms messages on my mobile.

Spam creates costs for the recipient (=me), and very low costs to the initiator. The "sender" can be a 15 years old jerk with his nice 2-CD-set of harvested email addresses and a "klick-and-go" software that sends out mails promising BIZ-domains, a big penis and a loan free life to millions of persons who have not requested this information.

I have my server at an ISP, and I pay for every MB that runs into, out of or through its network card. And when I read my mail over IMAP, I pay every second I'm connected from home via ISDN. So each time I get a spam message I pay for it a) when the spam hits my mail server, b) when I download it from my server, c) while I am connected from home. Point a) still applies when I filter my mail server side, and unfortunately it applies also when using systems as TMDA. And even when I'll get my flat rate ADSL I have pay about 1.000 Euro per year for it, so I do expect that only the stuff _I_ want and _I_ request travels on _my_ expense.

I'd rather waste my bandwith with The Weekly Kernel Update than with spam.

If you have your own mail server running postfix, qmail or exim, then TMDA will perform this service for you (the reply-to-mail-through policy).

For everyone else, SpamCop does a similar job.

TMDA
(Tagged Message Delivery Agent).

Since I've started using it, I never (literally) see SPAM.

It has a whitelist and a blacklist. It challenges unknown senders and holds their mail in a pending queue. When you send email, it can generate a new address that's only good for a set amount of time, or only good for the recipient to respond to. It does other neat things as well. It is amazing.

The only problem that you might find is that you need to use qmail for a lot of the functions to work.

Another method, and the one I personally use now, is to use Tagged Message Delivery Agent, or TMDA. It requires Python and qmail, though, so if you hate either one of those don't bother looking.

I turned it on at the beginning of July and I have yet to see one piece of spam since. I have it set up so that all my friends don't even know I'm running it.