SpamAssassin 3.0 Released

davemabe writes "At long last, SpamAssassin 3.0.0 has been released. I've been using the release candidates for a month or so, and the results have been far improved over previous versions. Its use of SURBL along with Bayes auto learning make it seem like this solution is the one to beat. It looks like they've introduced a new logo as well. Snazzy!"

Comments

SURBL

[alatesystems]

For those not in the know, SURBL is really cool. It actually lets you scan the message(well, SA does that) and then look for urls that it links to. It compares this to a realtime BL of other people getting spam like you and if it is a known spam TARGET url then it blocks the message based on that.

It makes it really hard for them unless they just register countless domains.

Excellent technology, and I will be upgrading to the newest stable.

Chris

Re:SURBL

[virtualone]

this sounds nice, but what if the url is put together with javascript?

Re:SURBL

[Mr Guy]

I would imagine the javascript would flag it highly suspicious on that basis alone.

Re:SURBL

[PhotoBoy]

Can you run javascript inside emails? I thought even Outlook and Outlook Express would be blocking that by now?

Re:SURBL

[thing12]

I'm not aware of any (modern) mail clients that execute javascript, so what would be the point of sending an email with js links?

Re:SURBL

[slaad]

Ahh, the same principal as MT Blacklist. Good stuff, works half way descent and you're pretty much sure to not get a false possitive, unless...

From: Mom
Hi, honey, I just wanted to see how you were doing. We're doing great around here. Write back soon. I love you.

Do you yahoo? Enlarge your penis [penis-enlarge.com] today!

You never know I guess...

Re:SURBL

[Mr Guy]

If you don't turn it off, you CAN. Now why you WOULD is a whole different issue.

Re:SURBL

[NKJensen]

Well, buy your mom access to a spam-free E-mail provider, then. Getting rid of spam is well worth it!

Re:SURBL

[hey]

I suppose this will driver spam-advertizers to obviscate their URLs in the spam mails. Eg use javaScript to build the URL so the real URL can't be detected -- like we do with our mail addresses on webpages so they won't be harvested by spammers!

Re:SURBL

[virtualone]

thats right.. but that does not scare away spammers.

i am not aware of any user that has no spam filer or would even consider buying something from a spammer, and nevertheless i recieve 200 spam mails a day.

Re:SURBL

[BlowChunx]

Probably some argument along the lines that made e-mail clients render HTML...

<rant>
You know, if we just dropped the whole notion of using HTML in e-mails, and only allowed plain text most of this would never have happened in the first place.
</rant>

Re:SURBL

[Anonymous Coward]

Obviscate? Is that like obfuscate?

Re:SURBL

[Anonymous Coward]

obfuscate(obfuscate) = Obviscate

Re:SURBL

[Myen]

You don't need to actually drop HTML, you just need something much more restricted. Say, RTF. (Or, for that matter, Tex...)

I imagine this is what Mozilla's Simple HTML mode does (and I assume other sane clients would have something similar). If you restrict the HTML inside mail to a very limited subset that can't do anything (and that includes no plugins!), it should be fine. Until you hit one of them image buffer overflow vulnerabilities... :)

Re:SURBL

[thing12]

It's not about scaring away the spammers -- its the simple fact that if you were to click a link that's supposed to be created by javascript it won't work. I'm sure the spammers take the time to check that their links will, at the very least, work in Outlook Express at the default security level. As I said - what would be the point of sending an email that could not result in a sale?

Just because *you* don't know anyone who doesn't have a spam filter and who doesn't buy from spammers does not mean they aren't out there. A very small fraction of people do buy from spammers. That's unfortunately why it's an economically viable method of marketing... there's no mystery here.

1. Spam to a million email addresses
2. Get one sale
3. Profit!

To change their behavior, it would have to become unprofitable.

Re:SURBL

[Darby]

I'm not aware of any (modern) mail clients that execute javascript,

Well, Kmail and thunderbird to name 2 off the top of my head.
Granted it's off by default, but the functionality is there.

Re:SURBL

[ChaosDiscord]

I suppose this will driver spam-advertizers to obviscate their URLs in the spam mails. Eg use javaScript to build the URL so the real URL can't be detected...

Which is fine. There are two defenses, both of which work now: 1. Javascript in a message is a big spam flag; legit mail almost never uses it. SpamAssassin and most other hybrid systems assign mail a score, more points means more likely to be spam. HTML typically adds a small penalty, javascript adds a bit penalty. Bayesian systems that see the Javascript will quickly learn to penalize any javascript tags. 2. The filter can filter based on what the user sees, not the raw feed. SpamAssassin already does this to catch people using HTML to try and break up words.

All in all, this isn't worrying to me at all.

Re:SURBL

[Anonymous Coward]

Then what happens when all the spammers put random but real urls in their spam like http://news.nasdaq.com/ or http://www.yahoo.com/ ? Sure, it'll drop it alright, but how many others would also get canned in the process? Ever look at the bottom of your emails that come from listservs? Most online email sites promote their own services at the bottom, or at least provide a link to their site.

If the spammers make enough disturbance with regular email *not* getting through then everyone will just be forced to turn SURBL off. Then it doesn't do anybody any good at all. How long do you think it will be until spammers trounce your regular email stream just to spite you? Baybacks are a b!Tc!-! and you know how much spammers care about your silly a$$ being on the line. I can hear the users now...

SURBL simply is not a solution!

Re:SURBL

[myov]

As much as I hate to say this, if you can't make it work for you make it work against you. Spammers are already including domains which have nothing to do with the spam, in an effort to make it totally useless (ie: increasing false positives).

Of course, no content filtering helps if you get your spam as an image attachment, which seems to be the new trick.

Go after the source - zombies, and ideally their servers. I can use spamassassin to block dynamic ip's, but those aren't always zombies. Message sent from a zombie, +20 points, goodbye.

Re:SURBL

[Anonymous Coward]

Not true ...we'll always have our beloved txt based p0rn!

Re:SURBL

[bareshiyth]

This place is full of attempts to be clever and cute, but I gotta say, your

<rant> </rant>

succeeds!
Wonder if there would be any good way to render that in real HTML?? :)

Comment removed

[account_deleted]

Comment removed based on user account deletion

Artificial intelligence was born...

[Anonymous Coward]

Filtering spam.

Re:Artificial intelligence was born...

[Duke Thomas]

"Here I am, brain the size of a planet and they ask me to filter your spam."

Re:Artificial intelligence was born...

[Scarblac]

Artificial intelligence was born... Filtering spam.

In Greg Egan's _Permutation City_, spam filters and spam become ever more intelligent. Your spam filter runs the interactive video mail in a sandbox trying to detect whether it's spam, the spam tries to detect that it is in a sandbox or that it is talking to an AI construct, so that it can hide its commercial intent. Your filter tries to mimic you (and you review its reactions now and then, try to get its facial expressions ever more like yours, etc), the spammers try to get more information about you so they can try to fool your filter by making the spam look like on of your friends, etc.

This is an obvious arms race and in that book, AI and uploaded individuals etc exist - but the trick is to make your AI spam filters as good as possible without making them actually self-conscious, since using self-conscious AI software for spam filtering would be torture.

I rather liked that idea.

Re:Artificial intelligence was born...

[Paulrothrock]

Spammers fight back with artificially intelligent spam sending bots. They decide it's really the humans who are at fault, and decide to turn us all into vegetables living in clear plastic pods, hooked up to a totally fake world through a hole in the back of our skull.

Plugin Architecture

[CleverFox]

The real news here is not Bayes filtering or SURBL, but the totally rebuilt plug-in architecture of SA 3.0. Plug-ins for the 2.x version were quite a bit harder to write.

Version 3.0 will result in a proliferation of good third party plug-ins that are going to put SA into more direct competition with some of the commercial vendors out there.

Re:Plugin Architecture

[GreyWolf3000]

I wonder if a plugin will be made to filter viruses as well?

It would seem they would go hand in hand, since mails containing viruses often fail some spamassassin tests.

Re:Plugin Architecture

[Anonymous Coward]

That's what ClamAV is for.

Re:Plugin Architecture

[felicity]

It's certainly possible to do so, but by our definition, viruses aren't spam, so that's why "... mails containing viruses often fail some spamassassin tests." :)

It would be semi-trivial, though, to write a plugin to push out application/* parts to clamav or something and score a rule hit if clamav flags it.

The devel work on 3.1 is (currently) including a generic "find binaries" plugin which would let you search for generic snippets of attachment such as Microsoft executables, ZIP attachments, etc. It's more for demonstration than standard use, but ...

Re:Plugin Architecture

[ADRA]

Or, you could use a great tool like MailScanner to take care of both for you. It definitly is a good management glue between MTA's, Spam Scanners and Virus Scanners.

actually i've always felt their name's not right

[Build6]

You know, *assassins* are the type to take out single, lone, "high value" targets, right?

Sneaking into fortresses/castles, creeping up and then offing the bad guy, or else maybe using some nice long-distance sniper rifle to take out the bad guy, or maybe choice application of poisons at the right bottle of wine, etc.

This is not appropriate for *spam*, where we're talking about waves upon waves upon unending waves in what we would call a "target rich environment". Assassination? No, more like machine-gunning, or artillery, or, I dunno, nukes.

Assassination would take too long.

anto-spam

[Outsider_99]

Ive been playing with DSPAM which seems very good. They claim a 99.991% accuracy. Apparently this is 10 times more accurate then a human. But Ive heard that most anti-spam solutions are very good.

Re:anto-spam

[Skuto]

There was a good scientific test linked on slashdot a while ago, comparing spamfilters and including DSPAM and SpamAssassin.

Contrary to DSPAM author's claims, both it and and CRM-114 (another package which likes to self-hype) performed quite a bit worse than SpamAssassin.

Then again, I've heard people being happy with DSPAM that were not happy with SA.

Guess it depends on the mailfeed you get.

Re:anto-spam

[gl4ss]

..but it can't be better than human.

for the human is the reference, what the human considers spam is spam - the rest isn't.

Re:anto-spam

[Anonymous Coward]

for the human is the reference, what the human considers spam is spam - the rest isn't.

and humans don't make mistakes? I'll give you 1,000 messages - lets see if you don't hit delete by mistake...

Re:anto-spam

[slaad]

They claim a 99.991% accuracy. Apparently this is 10 times more accurate then a human.

So humans are only 9.9991% accurate at detecting spam?..

Re:anto-spam

[ryanvm]

They claim a 99.991% accuracy. Apparently this is 10 times more accurate then a human.

Isn't a human 100% accurate by definition?
"I could have sworn I wanted to read that email, but I guess I was wrong."

Re:anto-spam

[MartinB]

SpamAssassin 2.x with well trained (>1 year of spam @ 100+ spams/day) Bayes:
~5% false negative (~95% spam filtering accuracy, 1 in 20 spams let through).

DSPAM with large training corpus (~10k spams from a honeypot) plus 6 weeks of real mail at same spam rate:
0.45% false negative (99.55% spam filtering accuracy, 1 in 222 spams let through).

I now publicise an inoculation honeypot address: yumyum@easyweb.co.uk for spammers to harvest, which adds super-strength training.

I'm very happy with my move to DSPAM.

Further, I don't believe heuristic filtering works any more, particularly if you're using published heuristics/shared rules. Spammers adapt too quickly, and test their spam against known rulebases. The solution is I believe to go entirely statistical, allowing each user to have their own definition of spam that is untestable by spammers.

(Incidentally, ever seen the SpamAssassin header forgery spam now being used?

Re:anto-spam

[WoodenRobot]

Maybe it's caused by momentary indecision about the offer of a B*I*G*G*E*R P3NI5.

Re:anto-spam

[bourne]

I switched from SpamAssassin (back in 2.62 days) to dspam and have been extremely happy with its accuracy; far less false negatives than spamassassin for me. There are a few false positives but generally predictable enough that I can search my quarantine for them quickly. My wife, on the other hand, never got good results from dspam. She consistently got troublesome false positives, including mail from my account. We removed and retrained her several times, to no avail. Eventually she had me turn her filtering off because it was too much trouble. So, yeah, dspam can be great but results vary. And the other negative about dspam is it doesn't integrate well at the SMTP/MTA layer, it has a marked design preference for the delivery agent layer.

Re:anto-spam

[tonywong]

Any numbers on the false positives?

Just thinking that 1 in 222 spam let through doesn't help much if it block 1 in 10 legitimate emails.

Re:anto-spam

[Emrys]

That "test" was far from being either good or scientific. Critique here: http://www.nuclearelephant.com/papers/cormack.html

And if you're going to rebut the critique, please use actual data and not just something like "he must be biased".

Re:anto-spam

[AGTiny]

I made the switch a few weeks ago to DSPAM for my family's email, and let me tell you, it's amazing. We were using bogofilter before and it never did a very good job learning about false negatives.

I could never get the web interface working so I don't have any stats, but I can tell you I get maybe 1 false negative PER WEEK! The rate of false positives is higher than that, maybe 1 per day, but this seems to be getting better the more it learns. My wife's email is also working amazingly well after an initial training period of a few days, because she subscribes to alot of lists that look like spam to me. :)

I have it setup through fetchmail+postfix+procmail into Courier IMAP, and use special IMAP folders called False-Negatives and False-Positives with a cron job to check them, so we just have to drag misclassified email into those folders. Much faster than using the email method DSPAM mentions in their docs.

The learning curve for setting it up is pretty steep though... it took me maybe 4+ hours to get it working right.

Re:anto-spam

[DrSkwid]

"They claim"

"But Ive heard"

Thems some pretty solid facts, wtg!

Re:anto-spam

[gl4ss]

yes, when you compare against human behavior the computer can't get better results.

for all you know i might consider some of the messages useful.

Release notes?

[degradas]

Anybody have a link to the changes compared to the last stable version?

Re:Release notes?

[AnotherScratchMonkey]

You can browse the version 3.0.0 Subversion repository. I'd suggest looking at the files UPGRADE and Changes.

Re:Release notes?

[Anonymous Coward]

The wiki included a link to http://issues.apache.org/eyebrowse/ReadMsg?listNam e=spamassassin-users@incubator.apache.org&msgNo=15 757 ; it would have been nice to have a list on the front page.

Buzzword use detection alert.

[Grumpy Troll]

Snazzy!

This word has triggered the filter of the buzzword use control, as a level 5 'useless/idiotic buzzword'. This is the last time we would like to have to alert, severe sanctions will prevail on next use of such a buzzword.

Thank you for your coordination,

the Buzzword Police.

Purple Bayes...

[jav1231]

I use SA and like it. I only get about 75% reduction because SA-Learn doesn't seem to work very well. I've been told it takes a lot of mail to get it to learn. Though I would think, "If you see this again kill it" wouldn't take but once. hehe

Re:Purple Bayes...

[kzinti]

I only get about 75% reduction because SA-Learn doesn't seem to work very well.

Try CRM114 My SA results weren't very good either, despite training it with a year's worth of both spam and non-spam, and two month of continuous re-training. CRM114 was easier to train even though its author recommends that you do NOT train it with your spam cache. Its accuracy was only about 50% at first, but within two weeks it was over 90. After about three months, I'd guess its accuracy is around 98% - not quite the 99.94 its author claims, but still very good. My only gripe is about the occasional false-positive, but it does have a whitelisting feature you can use to make sure mail from known correspondents doesn't get misclassified.

Re:Purple Bayes...

[BenjyD]

I think it depends on how you call it - I could never get sa-learn data to have any effect using spamc/spamd, but just piping to /usr/bin/spamassassin in my procmailrc seemed to work. YMMV.

Re:Purple Bayes...

[alatesystems]

It actually takes a certain amount of mail before the bayes even turns on. It doesn't want to turn itself on and then start scoring messages with a limited amount of intelligence.

If you want, I have put one of my user's spambox into a tgz if you want to untarball it and then run

sa-learn --mbox < Spam

Chris

Re:Purple Bayes...

[alatesystems]

Also, I forgot to mention this SA wiki.

According to it, "The bayesian classifier can only score new messages if it already has 200 known spams and 200 known hams."

Also, my code was wrong. It should be

sa-learn --showdots --mbox --spam Spam

Chris

Re:Purple Bayes...

[YetAnotherDave]

good idea - here's 2 years' worth of mid-scored spam for your bayes-training pleasure (really high scores get bounced by my milter)

http://dave.clendenan.ca/SPAMBOX.gz

anyone else got spam to share?

ps: remember to sa-learn YOUR OWN non-spam messages to balance this...

Re:Purple Bayes...

[PhilipPeake]

I can tell you what works for me, and works well:

I have sendmail using RBL checks, first against spamhaus.org, then against mail-abuse.org. Spamhaus stops a LOT of mail dead in its tracks before it is ever transfered, reducing my network traffic noticably. Mail-abuse.org is useful because a few things that get through the spamhaus RBL checks get caught by it.

Finally procmail is set up to run the mail through SpamAssassin before delivery. This catches virtually all the remaining junk.

The way I use SpamAssassin for high-volume mail users is to initialise their beysian filters with my own collection of spam and ham - that gets beysian filtering turned on and effective. Then I create a SPAM folder, and have any spam detected deposited in that folder by a suitable procmail rule. I also ask users to put their read mail in an OLD-MAIL folder (either dump it there, or copy it there). Every night I run an sa-learn for these users against the SPAM and OLD-MAIL (ham) folders.

I know this is not the way it is supposed to be used, but it works very effectively for me and all my mail users.

I have the spam detection level set to 3.5, I check my SPAM folder from time to time for false positives, but havn't seen any for a LONG while now. I see maybe two or three spam messages in my inbox on a bad day.

I installed 3.0 this morning. It looks as though this might be even better. The only SPAM to sneak through so far was a plain text one written entirely in Spanish!

oh cool!

[Sharp Rulez]

This is a great news! (a bad for spammers)

And now, Spam assassin is under Apache Licence :)

A spam arms race?

[zaxios]

And will SpamAssassin's effectiveness erode as spammers adopt smarter methods in response? Escalation is not a long-term solution to any arms race or conflict. We can continue to fight spam, but the only way we will decisively defeat it is by acknowledging it as a social problem and legislating against it, with an common sense certainty and determination no one in Western goverments seems to be providing.

Re:A spam arms race?

[joshtimmons]

Well, I'm using spamassassin on my server (and have been for the past 2 years). Unfiltered, I get around 200 spam per day. 1 or 2 get through.

It's been that way since the day I installed it. and it doesn't appear that the spammers are using any substantially "smarter methods"

Maybe it really is easier to write a filter than it is to write filter-proof spam.

Re:A spam arms race?

[garcia]

The only way to stop drugs is to realize that it is a social problem and legislate against it. Use enforcement to stop drugs in their tracks.

Re:A spam arms race?

[Jeff DeMaagd]

Legislate social problems is ineffective.

Like something that has been posted to the internet, legislating the internet is alot like cleaning pee from the swimming pool. And spammers are like five dozen kids in the swimming pool, half of them trying to see if they can get away with peeing in it.

Re:A spam arms race?

[IIEFreeMan]

That's so great !

Drug is a social problem so you respond with (more) laws and repressive action ?

I'm happy I don't live in the same world as you...
Wait...
Fuck, I do !

Answers to social problems are preventive action and removing the roots of the problem (if possible) not repressive laws that are just ignored by the real bad people.

Re:A spam arms race?

[hackstraw]

The only way to stop drugs is to realize that it is a social problem and legislate against it. Use enforcement to stop drugs in their tracks.

Waaay offtopic, but...

Huh? The only way to stop drugs is to kill everyone the first time they try them.

The human persuit of mind and mood altering substances is prehistorical. Its common to all cultures. There are some sociologists that believe that human society came together in order to form a more organized structure and division of labor for the fermentation of grains and fruits.

Re:A spam arms race?

[Peyna]

Is this sarcastic? We've all seen the "great successed" of the War on Drugs.

It's like abortion. Making abortion illegal will not stop it from happening. It will just make it more hidden from mainstream society (and entirely unregulated and thus very dangerous to those involved). If you want to stop abortion, you have to attack the causes of abortion. There are any number of things which can be shown to lead to the desire for an abortion. To name a few: poverty, lack of knowledge of birth control, unavailability of birth control, lack of understanding of the full consequences of child bearing, etc.

That said, I can't possibly see anyway that the statement you made is not satirical. Here's hoping I'm right.

Re:A spam arms race?

[Peyna]

by acknowledging it as a social problem and legislating against it

Heh, I can't stop laughing. I'll spare you the embarassment of pointing out how many social problems we've tried to legislate against ineffectively (including SPAM, as in the CANSPAM Act.) The problem is that is such a widespread problem (which can very easily be moved outside the jurisdiction of the United States) that you're not going to resolve it this way. Enforcement is almost impossible. It would cost an incredible amount of money to even try to enforce such an act, and result in minimal gains, which will not be any deterrant at all (sound familiar, say, War on Drugs?)

Legislation without adequate enforcement does no good, and in many cases, enforcement is simply impossible. It'd be like making smoking tobacco in the home illegal. Yes, it's a social problem, because we all end up paying for smokers' healthcare; however, it's not going to stop them from smoking in their homes.

Re:A spam arms race?

[Peyna]

After reviewing the context of your comment, I think it's definitely certain that you were be sarcastic. I should be more careful =]

Re:A spam arms race?

[Azghoul]

Yeah, because drug prohibition, raising the drinking age to 21, strict DWI laws, making prostitution illegal and the "war on poverty" have made such astounding inroads in combating those social problems.

Hopefully you were joking.

Spam is absolutely technical. People are assholes whether or not they are spammers, telemarketers, or con men.

Re:A spam arms race?

[celerityfm]

We use SpamAssassin in between our post office and our smtp server and its been working great at filtering spam. But I always wonder why the spammers don't first try running their spam through spamassassin before sending it us. I mean sure they can't beat the bayes filter, but really theres no excuse for sending out mail that trips any of SA's other filters! WTF are they thinking sending out messages that trip even the simplest of filters like malformed headers or whatever? Goes to show you that spammers aren't interested in spamming people with spam filters if they don't even bother to see if their spam can make it past them in the first place.

Its kinda like The Club(tm). Its just enough to make the spammer go to the other car, so to speak.

Re:A spam arms race?

[squisher]

I have to disagree with you, I've also been runnin spamassassin for a long time now and in the last couple of months, more and more spam gets through the filter (despite of using sa-learn with a number of emails)...

Re:A spam arms race?

[Anonymous Coward]

If you want to stop abortion, you have to attack the causes of abortion.

Please don't attack sex :)

Re:A spam arms race?

[Anonymous Coward]

Actually the "idiots who want to make money off it and are willing to hire programmers to enable it" are becoming vastly outnumbered by the "intelligent programmers who are annoyed to death by it" and as such I believe the war on spam is being won by products like SA.

Re:Improved Performance?

[xcomputer_man]

I've been using RC1 for over a month now, and I'll tell you confidently that

-- Performance is MUCH better than it used to be. It scans messages much faster than I've ever seen SA 2.x do, and doesn't hog my server's resources anymore.

-- THIS THING ROCKS. For almost two weeks after I installed it I kept instinctively sending myself test emails to make sure I hadn't broken my mail system, because my volume of incoming mail had reduced so drastically. I was used to getting at least a new spam every 2 minutes. After installing SA 3.0 I got one false negative in a 72 hour period. It is *that* good. To date I still have not recorded a single false positive. I really had to convince myself that this thing was real.

This spamfilter rocks. I'd award it product of the year if I could.

New logo ...

[YetAnotherName]

Didja notice the Apache feathers on the arrow in the new logo? Nice touch!

Re:New logo ...

[tlayne]

Yeah, nice logo. I wonder if they bought it from the guy who keeps emailing me with a pitch to move my company forward with a low cost custom designed logo? All this time I've just been deleting those messages. I guess I better check it out.

Re:New logo ...

[SuperBanana]

Personally, I would have liked the logo better if it had shown green(good) messages near the arrow but not pierced - and the red message nailed. Would've been very symbolic. The new logo makes me think "what, it nails both good and bad email?"

Re:New logo ...

[Anonymous Coward]

Uh... Try taking another look after you drink your coffee. :)

Re:New logo ...

[bogado]

That's exactly what the logo shows. The two green letters are in sequence in front and beghind the arrow, the only one pierced is the red one.

In the real world there would have 100's of red letters and a single green letter. :-)

Re:New logo ...

[duncf]

You can look at the other options we considered here.

Having green and red messages, while symbolic, makes for a much less pretty logo. The green, blue, orange colours are nicer. Furthermore, you can't necessarily tell good from bad at a first glance from the envelope. :-)

And yeah, the arrow only pierces one of the three envelopes.

New logo

[slaad]

I feel like that new logo should be subtitled "Message for you, sir!"
Perhaps a good "thwooop!" sound effect would go well with it too.

Re:New logo

[choas]

http://newmail.monsterserve.com/keepout/movies/pyt hon.wav

Love that one, raise your hand if you haven't got it installed for your new mail sound :)

sa-exim

[Anonymous Coward]

Does anybody know if version 3.0
works with sa-exim??

Performance

[smooc]

What I would like to know, how does SA scale? About a year ago a talked to my ISP about it and they said they could not use it as it did not scale well and could not handle big loads.

It would be nice if it could be implemented now as I personally receive about 1000 spam messages a week.

Re:Performance

[richie2000]

how does SA scale?

That's in their FAQ.

Re:Performance

[revscat]

You might also consider getting a GMail account. I've had mine for about 3 months now, and I have *yet* to receive any spam. Pretty impressive.

Re:Performance

[Anonymous Coward]

how is that an exmaple? you've only been using the account for 3 friggin months!

Kind of reminds me of that simpsons episode with the bears, and the homer tax

Re:Performance

[troon]

Yeah? What's the address?

Re:Performance

[City Jim 3000]

I get around 30 spam a day and about 5 a day gets through the filter.

Apart from spam, have you actually received any *mail* to your account?

Re:Performance

[Inda]

I get 300+ a day and 15-20 make it past the filter. There is a lot more work still left to do.

Re:Performance

[kzinti]

I've had a Gmail account for about the same length of time, and I see a huge amount of spam getting past its filter. I'm forwarding all my e-mail to Gmail from an address that - unfortunately - the spammers know very well. So I'm hitting my Gmail account with a stream of 100 to 150 spams per day. Its accuracy rate is, I would guess, in the 80 to 90 percent range. A help, but far from overwhelming.

That said, I don't understand why Gmail's filtering isn't better. They've got a huge number of people (the users) looking at every message that comes in. Once the number of people who have classified an e-mail as spam passes a certain threshold, then no one else should have to see it. In other words, I'd like to see Google combine the massive power of all those eyeballs with their magical search/categorization capabilities to provide its users with the most effective spam filter ever. Sure, some people are going to see spam every now and then, but on the average not very much. Surely the rate would be better than it is now.

On the other hand, what is spam to one person may not be spam to the next, so they'd have to leave a way to opt out, but I would bet that most people wouldn't.

Re:Performance

[grandmofftarkin]

My ISP Panix uses it on all accounts.

Re:Performance

[revscat]

revscat@gmail.com

Re:Performance

[SCHecklerX]

It scales just fine. We are using it in comination with Mimedefang's multiplexor here. Mimedefang is great, since you can totally reject stuff that fails basic tests without having to even bother invoking your spam filters.

We have 3 linux dual-processor mail servers, and have basically maxed them out with memory so that we can use ramdisks for Mimedefang processing. CPU Utilization is currently <10%.

Some stats from yesterday:

Spam stats:
Total Mail In and out: 39320
Processed by MimeDefang: 24210
Spam: 1519
Non-spam: 22691

Rejected stuff:
Completely discarded: 6453
Reject 554 total: 31343
Reject 550 total: 18151
Reject 501 total: 4376
Rejected pre-greeting total: 1273
Suspicious Header total: 1
Partial MIME type total: 0
Non-multipart total:
Forbidden File attachment total: 60

Re:Performance

[gmhowell]

1000 per week? That's nothing. If you try to do it in one setting, SA might choke, but I see several times that amount (the problem with having had an address unchanged for a LONG time) and it is handled by a celeron 400.

Re:Performance

[kindbud]

About a year ago a talked to my ISP about it and they said they could not use it as it did not scale well and could not handle big loads.

They're just being cheap. Yes, they will need more than one mail server. SA scales the same way LAMP scales: more boxes.

Re:Performance

[GSloop]

A sneek peek shows...


This suggests that a single brawny server running spamd can comfortably handle 5 messages a second and may peak up to 30 messages per second.


At 5 per second:

That's about 430,000 messages a day if queued evenly throughout the day. 215,000 if all were delivered during a 12 hour period.

Even if performance is 1/5th of that for a wimpy server, we're talking more than 40,000 messages a day.

Cheers,
Greg

Re:Performance

[Anonymous Coward]

Who is your ISP? They are correct, SA doens't scare for crud. We use MailFoundry (I've posted this a few other places) and I just got my ISP I use at home onto it. No spam at work, and now no spam at home. Scales easily. We tried SA on a few servers to see if we could roll our own, but it was a total pain in the arse so we went looking for something else. We almost bought Barracuda when we stumbled across MailFoundry and we're glad we did. Head to head, it trounced Barracuda, etc.

Re:Performance

[Anonymous Coward]

Well, GMX (a huge german freemail provider where you get 1 GB of space) uses SpamAssassin on all accounts succesfully. And they have millions and millions of accounts.

Does it use IP's or URI's ?

[NKJensen]

From the SURBL site: "parse URIs in message bodies, extract their domains, and check those against a SURBL...."

I would rather extract the domain, look up the IP, and check the IP.

That way the server will have to move to a new IP - not just get a new bogus domain name.

Yes, I know that servers many host many domains:

This will only increase pressure on the spamheaven server admins to get rid of the people who use spam to spamvertize their sites.

Re:Does it use IP's or URI's ?

[Anonymous Coward]

Yeah, and fuck over regular emails. Great idea.

Re:Does it use IP's or URI's ?

[sjalex]

How do you figure that?

Re:Does it use IP's or URI's ?

[jlrobins_uncc]

I would hope that it would use IPs also. Our site is currently receiving mortgage spam that slips past our current amavisd-new + spamassasin setup, as well as client-side Apple Mail.app baysean filtering. But one thing is consistent between all of em -- the hostnames in the single link within each of the mails resolve to the same IP address.

So, would either SA 3.0 take care of this naturally, or allow me to easily write a plugin to resolve the addresses in links and apply my own IP address based blacklist?

Re:Does it use IP's or URI's ?

[Ewan]

our Spamassassin 3 release candidate seems to filter on both IP addresses and URIs, seems very effective - our spamassassin now marks over 50% of incoming email as spam.

Ewan

Re:Does it use IP's or URI's ?

[Anonymous Coward]

Do you already use an RBL on the server and is it not catching this IP? Have you tried reporting the IP to spamcop?

Re:Does it use IP's or URI's ?

[NKJensen]

Sorry, I've found the question and some pros and cons here:

http://www.surbl.org/faq.html#numbered

Re:Does it use IP's or URI's ?

[krunk7]

Are you using Rules Du Jour

Re:Does it use IP's or URI's ?

[Anonymous Coward]

This is just a small nitpick, Apple's Mail.app uses latent semantic analysis, not baysean filtering.

Re:Does it use IP's or URI's ?

[platipusrc]

One of the problems with using IPs is the massive amount of Virtual Hosting being used. Say I'm a 1&1 customer, and there are 400 other domains going to the same IP as one of my domains, and I send you an email with a link to something on my site, but one spammer has managed to get an account with 1&1 for now. If they're on the same box as me, you just blacklisted 399 other domains that shouldn't have been blacklisted.

Re:Does it use IP's or URI's ?

[Anonymous Coward]

I can beat that. I wrote a little perl scrpt to use with procmail that marks 100% of incoming email as spam. 100% vs 50%. My way is better :)

Re:Does it use IP's or URI's ?

[jlrobins_uncc]

Aha, well, can you define the diffence between the two? Inquiring minds want to know!

And inquiring minds want to know what technology can combat the paragraph of random english words or just pseudo-words that seem to throw-off the 'spam-ness' score using either tech.

Re:Does it use IP's or URI's ?

[AKnightCowboy]

If they're on the same box as me, you just blacklisted 399 other domains that shouldn't have been blacklisted.

Extreme spamfighters don't care though. You're guilty by association in their eyes and deserve to feel the same wrath that the spammers do. It's so that you'll bitch to your provider and in turn your provider will shut down the spam site because all their other customers are complaining vs. some random guys on the Internet complaining they're receiving that URL in spam.

Re:Does it use IP's or URI's ?

[Kainaw]

I would rather extract the domain, look up the IP, and check the IP.

I wanted that a long time ago. At the time, I couldn't find a program written by anyone else, so I wrote my own. It works well for me and anyone who wants the script is free to use it. It is at my homepage.

Re:Does it use IP's or URI's ?

[Aggrazel]

Ideally, yes, but realistically, it would take quite some time to do reverse DNS lookups on domain names inside of messages, especially if there were many domain names, and if some of those domain names have invalid nameservers, the timeout factor would take a long time to process those mails. With the SURBL a company like mine that processes millions of e-mails a day can cache the SURBL locally to make the SURBL queries happen in milliseconds, so its a nice check.

Re:Does it use IP's or URI's ?

[NKJensen]

The difference between URI and IP is that you need to resolve an URI via DNS to an IP.

I like the thought of all mail which is spamvertizing some site (or even the IP of a server hosting just one spamvertized site) to be marked as spam.

I didn't mention any other filtering techniques.

Re:Does it use IP's or URI's ?

[NKJensen]

If the admins are too slow to take down the spamvertized site and report back to the reporter, yes, and only then.

Which is fine with me.

Re:Does it use IP's or URI's ?

[jlrobins_uncc]

I didn't mean URI vs. IP -- I mean the difference between Baysean and latent semantic filtering.

Re:Does it use IP's or URI's ?

[marmoset]

Best human-readable discussion of the techniques I've read is here.

Re:Does it use IP's or URI's ?

[Ignignot]

And so what happens if I decide to send out spam that links to URL http://www.dina.kvl.dk? It looks up the IP address, and blocks it. Then everything that you ever send will be blacklisted. Go get a new host.

Your suggested technique would be exploited by script kiddies everywhere (who already have access to large zombie networks) to basically ban someone from the internet. What a fantastic idea.

Re:Does it use IP's or URI's ?

[ePhil_One]

Extreme spamfighters don't care though.

May fvorite was a Washington DC news company that had implemented extreme spamfighting measures. Since our outgoing mail server doesn't receive incoming mail, its not in the MX records. This guy was bouncing our mail because of that. God hopes that the next Deep throught doesn't try to contact his news organization...

Re:Does it use IP's or URI's ?

[Anonymous Coward]

... And punish their customers who aren't spammers.

Re:Does it use IP's or URI's ?

[pqdave]

SpamAssasin is for email, and won't affect anyone trying to browse to your site. At worst, a properly-configured SpamAssasin would see a mention of your URL in an email, resolve it to the same IP as a spammer, and give it a few more points towards the spam threshhold. SpamAssasin (at least as used by my mail admin) scores messages based on various factors rather than giving pass/fail tests, so a suspicious URL in an otherwise non-spammy message wouldn't necessarily send it over the spam threshold.

Re:Does it use IP's or URI's ?

[pjrc]

I would rather extract the domain, look up the IP, and check the IP.

That won't help against "bulletproof hosting", commonly used by spammers, where a nameserver in a country like Russia or Poland resolves the name to one of thousands of zombie machines hosting the site.

The SURBL approach does.

Yes, I know that servers many host many domains: ... This will only increase pressure on the spamheaven server admins to get rid of the people who use spam to spamvertize their sites.

Spammers don't use $10/month shared virtual hosting for their websites.

Re:Does it use IP's or URI's ?

[ChaosDiscord]

If they're on the same box as me, you just blacklisted 399 other domains that shouldn't have been blacklisted.

You're not blacklisting; you're marking as "more likely spam". In practice the damage will be minimal. First, legit email from the other 399 domains will in general be non-spam-like. The positive hit on the IP address won't be enough to push them over the edge. The penalties for being found in the SURBL at the moment are all relatively small, all less than 1 (5 points are needed in the default configuration to mark a message as spam). The only exception is data from the Spam Cop database, which is fairly small and more carefully vetted. If they broaden from hostnames to IPs, you might have to tweak the scores down, but that's it. Second, what's the realistic chance of your getting email containing a URL linking to that IP? There are millions of web sites. The Big Important Web Sites aren't on the sort of massive shared server you describe. The chances that you'll get an email mentioning one of those smaller sites is pretty small. There is a risk, but it's small enought that I won't lose any sleep over it.

Re:Does it use IP's or URI's ?

[davidsyes]

Does' that app process the males in the closet, since it's latent?

Re:Does it use IP's or URI's ?

[abulafia]

Extreme spamfighters don't care though.

That's pretty funny. Complaining that some people tars a group of things with the same brush, you tar a group of things with the same brush.

Although I'm not sure what you mean by "extreme spamfighter", but I am rather vehement about the topic, and do not belong to the subset of pople who think that high collateral damage is a good method of stopping spam (You seem to be thinking of the ORBS jerks from back-when).

Re:Does it use IP's or URI's ?

[Anonymous Coward]

Human readable? Total bullshit. Here's an excerpt:

A Bayes net is a graph structure whose nodes are terms or concepts with attached truth values or probabilities, and whose links are conditional probabilities.

It gets worse from there.

As near as I can tell, a Bayes net is nothing but a series of tests to determine probability of spam or whatever, dressed up with hand waving and fancy words. I might be wrong, I have no idea, this incomprehensible article you linked to gives me no clue.

Here's a closing quote for those masochists looking for a headache (and mind you this is from a BULLET POINT):

It computes a mathematically provable least squares best fit model to the data you feed in, which is unlikely with a hand-engineered or even automatically generated Bayesian network. Both techniques try to generate a reduced dimensional space in which most of variance of the original data is captured - SVD guarantees it's the best one.

Re:Does it use IP's or URI's ?

[jeffcsu]

Why use a scalpel when you can use a sledgehammer, eh? That's not our approach with SURBLs. We want to list only the spammer domains not the resolved IPs for some of the reasons already mentioned, such as virtual hosting on a shared server. We're not interested in *causing* collateral damage as that only makes SURBLs less useful in the larger picture. Ideally we'd like a tool that an ISP could "set and forget" blocking only spam and not ham (legitimate messages), for example at the MTA level. That said, SpamAssassin 3.0 uses IPs of URIs in the command uridnsbl, which looks at URI domains, resolves their NS records, then checks those name server IPs against sbl.spamhaus.org. That turns out to be highly effective (about as effective as SURBLs), since so many spams mention domains served by the same spammer name servers. This is only useful because Spamhaus is very careful to add only purely spammer nameservers to sbl. If you use both SURBLs with urirhssub and SBL with uridnsbl, you will have very powerful spam filtering that uses both domains and IP addresses (of name servers).

Re:Does it use IP's or URI's ?

[jack_csk]

Does your perl script supports QMail? Mine does.

I Win!

3.0 New Features

[CleverFox]

Major feature list:

- SpamAssassin is now part of the Apache Software Foundation and has an
improved software license, the 2.0 version of the Apache License.

- SpamAssassin now includes support for SPF (the Sender Policy
Framework, http://spf.pobox.com/).

- Web site links contained in the message are checked against SURBL and
SBL. SURBL and SBL track sites that advertise with spam, known spam
sources, and spam services.

- The new 3.0 architecture allows third-parties to easily add plugin
modules.

- There is now SQL database support for both the Bayes and
auto-whitelist modules, allowing more large sites to easily deploy
SpamAssassin.

- A more accurate simulation of email client handling of MIME and HTML
improves our accuracy. In addition, there is better detection and
handling of spammer techniques that try to trick anti-spam software.

Important installation notes:

- The SpamAssassin 2.6x release series was the last set of releases to
officially support perl versions earlier than perl 5.6.1. If you are
using an earlier version of perl, you will need to upgrade before you
can use the 3.0.0 version of SpamAssassin.

- SpamAssassin 3.0.0 has a significantly different API (Application
Program Interface) from the 2.x series of code. This means that if
you use SpamAssassin through a third-party utility (milter, etc,) you
need to make sure you have an updated version which supports 3.0.0.

- The --auto-whitelist and -a options for "spamd" and "spamassassin" to
turn on the auto-whitelist have been removed and replaced by the
"use_auto_whitelist" configuration option which is also now turned on
by default.

- The "rewrite_subject" and "subject_tag" configuration options were
deprecated and are now removed. Instead, using "rewrite_header Subject
[your desired setting]". e.g.

rewrite_subject 1
subject_tag ****SPAM(_SCORE_)****

becomes

rewrite_header Subject ****SPAM(_SCORE_)****

- The Bayesian storage modules have been completely re-written and now
include Berkeley DB (DBM) storage as well as SQL based storage (see
sql/README.bayes for more information). In addition, a new format has
been introduced for the bayes database that stores tokens in fixed
length hashes. All DBM databases should be automatically converted to
this new format the first time they are opened for write. You can
manually perform the upgrade by running "sa-learn --sync" from the
command line.

The "sa-learn --rebuild" command has been deprecated; please use
"sa-learn --sync" instead. The --rebuild option will remain
temporarily for backwards compatibility.

- "spamd" now has a default max-children setting of 5; no more than 5
child scanner processes will be run in parallel. Previously, there
was no default limit unless you specified the "-m" switch when
starting spamd.

- If you are using a UNIX machine with all database files on local
disks, and no sharing of those databases across NFS filesystems, you
can use a more efficient, but non-NFS-safe, locking mechanism. Do
this by adding the line "lock_method flock" to the /etc/mail/spamassassin/local.cf file. This is strongly recommended if
you're not using NFS, as it is much faster than the NFS-safe locker.

- Please note that the use of the following command line parameters for
spamassassin and spamd have been deprecated and are now removed. If
you currently use these flags, please remove them:

in the 2.6x series: --add-from, --pipe, -F, -P, --stop-at-threshold, -S
in the 3.0.x series: --auto-whitelist, -a

- The following flags are de

Mailscanner?

[HogynCymraeg]

Hopefully mailscanner will upgrade to use this. Mailscanner is really awesome and combined with SA makes a great mail delivery option.

Re:Mailscanner?

[hiss]

They have been adding support for 3.0 for a while now. I am not sure if it is enterprise ready though.

And I second that mailscanner is an incredible tool.

Re:Mailscanner?

[diablobsb]

afaik mailscanner accesses the mailer files directly, which is not a good solution...
(the postfix authors state that this format might change without notice so it should not be used directly for compatibility)...
I personally rather use amavis-new (ng?) ...

Re:actually i've always felt their name's not righ

[Anonymous Coward]

How about SpamDribeBy(tm) ?

Re:Improved Performance?

[slobbargoat]

does anyone know of any GPL win32 anti-spam utilities capable of working with exchange?

Curse you ISP!

[Anonymous Coward]

"Perl v5.6.1 required"

Sigh. Now I have to fight with my ISP to get a semimodern version of Perl installed.

Re:Curse you ISP!

[numbski]

Just e-mail them, and ask them to do the following (I had posted this above):

# perl -MCPAN -e shell;
cpan > install Mail::SpamAssassin

Tell them to have it fulfill prerequisites. What will happen along the way is the CPAN will build the latest Perl in order to make 3.0 build nicely. ;)

Sure, it's devious and underhanded, but darn it...it works. :P I'm an ISP admin myself, and I do these things as soon as the latest is released, but maybe you have a BOFH or something.

Re:Curse you ISP!

[eyeye]

But you might break somethings by upgrading perl outside of your OSes package management system.

Re:Curse you ISP!

[Technonotice_Dom]

Wow, when you said that, I just checked a Redhat 7.3 based SA server and thankfully that has Perl 5.6.1 on it. Even Debian Woody has 5.6.1!

Re:Curse you ISP!

[Anonymous Coward]

Now I have to fight with my ISP to get a semimodern version of Perl installed.

There is no law saying that perl has to go in/usr/bin. Unless you have very limited disk space, you should be able to do your own install.

Seriously: I really like that logo.

[Ayanami Rei]

Whoever designed it gets a gold star.

For those who may have forgotten

[numbski]

I'm building the latest on all of my clients' mail exchangers and our primary boxen. ;)

Here's the command to install/upgrade 3.0 via CPAN:

# perl -MCPAN -e shell;
cpan > install Mail::SpamAssassin

(many lines, type in the administrator's e-mail address, say no to network tests)

exit

#

Very difficult stuff. :) Keep up the good work.

Oh! Some link whoring as well:

SpamAssassin Milter for Sendmail - Filters everyone without procmail

SpamAssassin Milter Quarantine - Quarantines spam messages and sends summaries in digest for 1 or more times daily rather than simply delivering to the end user.

Re:For those who may have forgotten

[davemabe]

There's also sa-exim which is a local scan plugin for Exim that does site wide spam filtering at SMTP time. It is quite nice.

Dave

Re:For those who may have forgotten

[moggie_xev]

I would highly recommend MIMEDefang which allows you to write your milter in perl which is a good thing(tm)
http://www.roaringpenguin.com/penguin/open_source_ mimedefang.php

Re:For those who may have forgotten

[GreyWolf3000]

Also, you can use exiscan as well. They'll both reject at SMTP time.

I've been using both sa and clamav for a few days, so I don't have a good real world test yet, but it's nice to see my tests bounce back.

Re:For those who may have forgotten

[Anonymous Coward]

With current versions of perl, you simply need only type:

cpan Mail::SpamAssassin

Re:For those who may have forgotten

[The_ForeignEye]

Rats I'm typing those commands, but CPAN tells me that SpamAssassin is up to date. However, when I type "spamassassin --version" I get 2.64. What am I doing wrong?

Re:For those who may have forgotten

[SavoWood]

The mirror you use for CPAN isn't updated with it yet. It took me a bit to figure that out as well. =-)

Re:Improved Performance?

[Anonymous Coward]

This is a point I'd like to carry out a bit. I hate to be a whiner though, so I'll do it AC. But why isn't there a simpler install for Linux users. I resorted to using SpamPal on Windows boxes and just getting my mail on them and it works great. In fact, it's one of the last things I keep a Windows machine around for. I mean how twisted can it get, I use Linux desktops for almost everything but mail? That's totally bass ackwards, but the fact is I can install almost everything I want from Synaptic. I guess that's the other question, what about .deb that has all the dependencies or something.

Re:Improved Performance?

[LnxAddct]

You can get SpamAssassin to work with it, I've never had to but their are tutorials. You may just be better off using two machines and have SA filter it before it sends it to the exchange server.Steve

Re:actually i've always felt their name's not righ

[HeelToe]

Maybe they have picked the right metaphor... you ever watched what happens to a box that gets a few copies of SA running in parallel? It takes a long time!

Re:Improved Performance?

[eddy]

[...] and doesn't hog my server's resources anymore.

Got any numbers on memory use? I would love to run SA on my home server, but it has "only" got 80MB of RAM. I tried running 2.x, but it seriously brought the system to its knees (swapping)

I must say, Python might be a nice language and all, but as it's making inroads everywhere it's also wrecking havoc on ones ability to convert older hardware into a competent server. YMMV (mailman + bittorrent + (apache + exim + samba) and you're pretty much down to the last few megabytes )

razor?

[numbski]

I could use some help. I've been trying to get Vipul's Razor working with SpamAssassin on FreeBSD 5.2.1, and I keep running into problems. Anyone out there have a working config and like to share?

Re:razor?

[David_W]

I've been trying to get Vipul's Razor working with SpamAssassin on FreeBSD 5.2.1

Did you install it (well, them) via the ports? It "just worked" for me when I did that.

Re:razor?

[numbski]

No. :( I always install via CPAN for Perl modules. That makes me evil I guess. I can try installing razor again from ports...but somehow I think I'm missing something.

Re:razor?

[Xabraxas]

SpamAssassin looks for Vipul's Razor if it is present on your system. There is no need for configuration. Just install it and it should work.

Re:actually i've always felt their name's not righ

[Kjella]

Assassination also implies a considerable level of skill in choosing your target. Nukes are pretty indiscriminate. Weapons are typically low-volume high-percision or vice versa. In that sense, I don't think a "nuke" describes it better.

Damn...

[Anonymous Coward]

Am I the only one that loved those cheesy little plastic ninja dudes in the old logo?
In fact, I thought their logo contest rules suggested that they would prefer the new one to contain those guys still, in some way or another.

CRM114?

[quigonn]

I absolutely don't want to troll, but has anybody here managed to moved an existing SpamAssassin setup to a CRM114 setup? While I don't plan to move away from SpamAssassin, I want to evaluate both how effective CRM114 is and how easy it would (theoretically) be to eventually move some or all of our customer's existing SA installations to CRM114.

Re:CRM114?

[kzinti]

CRM114 is a filter, just like SpamAssassin, so you can run it alongside SA if that helps you make the transition. Run everyone's e-mail through both filters; each will leave its own X-headers in the message. Users can then filter against whichever headers they prefer.

CRM114's author recommends against training it with a history of spam, and instead recommends train-on-error only. This means that, at first, you get a LOT of errors, both false positives and negatives, but the accuracy improves very very quickly.

One thing I like about CRM114 is that it's easy to retrain. If you get a false positive or negative, you simply run it through the filter again, with a special command-line flag, and CRM114 retrains itself. This makes fixing errors easy with a Courier IMAP server - you just set aside a special folder as a train-on-error folder. When you see misclassified e-mail, you just drop it into that folder. Every hour or so, you have a cron job wake up and look in the corresponding Maildir directory; if there's any messages in there, run them through CRM114 again to reclassify them. This, in effect, means that you can reclassify any errors with any IMAP client that can move mail from one folder to another - in other words, from pretty much anywhere. You can probably do the same thing for SA too.

Re:CRM114?

[quigonn]

Thanks for your insight!

Better names?

[Da Twink Daddy]

Well, since it's capable of removing a certain caste of emails entirely how about SpamGenocide or SpamacialCleansing?

Perhaps we should identify it with (im)famous person(s) to drive up hits like SpamHitler, SpamNazi, or SpamlobodanMilosevic?

Maybe something that has an associated coolness factor, instead of being (almost) universaly hated, like Dr. Spamibal Lecter?

Well, there's still the problem of overwhelming evil there. It's not really evil, just heartless and calculating. Hmm, heartless, calculating, killer... I got it! How about SpamAssassin? Oh, wait...

Re:Better names?

[Anonymous Coward]

Back, in the days [early 90's], we used to write little scripts, to sort through and filter [and, occasionally, respond to] incoming email. Many of us referred to these scripts as 'Stalins' [killfiles].

Re:Better names?

[4minus0]

Perhaps we should identify it with (im)famous person(s)...

imfamous...that means more than famous right?

Re:Better names?

[PsychoKiller]

I think Spamicide would be appropriate.

Millions of those little guys swimming in the net trying to get into your Inbox. :)

Re:Better names?

[Anonymous Coward]

It's funny beacause it's RACIST ...

Ha ha ha, spamgenocide ...

Oh the laughs never stop ...

Genocide -- funny on Slashdot.

Spam is a technical problem, not political

[ftzdomino]

Email was designed to trust everyone, making it hard to reject email from people you don't want it from. We must get everyone to move to a better architecture which can force sender authentication if desired by the receiver. My own personal preference would be to have the sending MTA sign outgoing mails with a public key. Any scheme be much easier than getting 100% of governments to outlaw spam, which is what is needed to be effective. Legislation is not the answer to a technical problem.

Re:actually i've always felt their name's not righ

[shadowkoder]

Well, though there may be a large amount of spam, doesn't like 90% of it get sent by the top 10% of spammers, or something to the same effect? If you could whack off a couple of the top guys ...

fillters vs. stallers

[Anonymous Coward]

When do people learn that
what we need is not spam filters but spam stallers.

With spam filters your just precipitating in a arms race.

The spammers will send more and more spam
and your spam filters will use more and more
of your processor time to filter the spam.
It is a uphill battle against the spammer.

With spam stallers like sa-exim and tarproxy
your are stalling the spammers smtp connection
and the effect is that the spammer can't send
as much spam or that they drop you email from there email database.

Re:fillters vs. stallers

[Anonymous Coward]

This is not exactly true. If you can manage to get fewer eyeballs viewing the spam, you should get fewer people responding to spam. This is removing the economic incentive while keeping the costs the same. In other words it becomes less profitable.

Re:fillters vs. stallers

[Anonymous Coward]

With spam stallers like sa-exim and tarproxy
your are stalling the spammers smtp connection
and the effect is that the spammer can't send
as much spam or that they drop you email from there email database.

Stalling has been proven NOT TO WORK. If the spammers were using a single threaded application, it would slow them down. But spammers are smarter than that. They have large distributed networks of spam zombies with multithreaded applications that aren't slowed at all.

And how do you determine if you should stall a connection? Blocklists only go so far - you have to scan anyway to determine if you should stall.

Spammers NEVER DROP YOUR ADDRESS FROM THEIR DATABASE. My company still gets spam addressed to employees who left years ago.

Re:fillters vs. stallers

[Anonymous Coward]

With spam stallers like sa-exim and tarproxy your are stalling the spammers smtp connection and the effect is that the spammer can't send as much spam or that they drop you email from there email database.

My personal account receives one spam every eight minutes. Multiply that by thousands of users, and you will soon realise that stalling a connection for a spammer will result in a denial of service as open connections will accumulate faster than they are shut down.

Re:fillters vs. stallers

[Anonymous Coward]

Yes, filters reduce the eyeballs and keep the cost for the spammer
but stallers reduce the eyeballs and increase the cost for the spammer.

Re:fillters vs. stallers

[SnarfQuest]

Are you actually stalling the spam producer, or are you stalling someone who is just forwarding the mail? Most mail does not go directly from the producer to your machine, but goes through numerous forwarders before it gets to you.

What you are likely doing is pissing off the people who are willing to forward your mail to you, and they may decide to just drop all of your mail instead of being screwed with.

Re:fillters vs. stallers

[Anonymous Coward]

Stalling has been proven NOT TO WORK
Do you have a link to the prove ??
If only one person run a staller it would
not have a big effect but if 0.01% would run
a staller it would have a big effect.

My hope is that the debian/gento/freebsd
would have a spam stalling MTA as the default MTA
at some time soon.

And how do you determine if you should stall a connection?
Please, see sa-exim or tarproxy.
Spammers NEVER DROP YOUR ADDRESS FROM THEIR DATABASE.
Why should the spammer drop your address if
your are not stalling them ???

Re:fillters vs. stallers

[Anonymous Coward]

Just config your staller only to use 100 ports.
Your got to start somewere.

Re:fillters vs. stallers

[mdfst13]

"This is not exactly true. If you can manage to get fewer eyeballs viewing the spam, you should get fewer people responding to spam. This is removing the economic incentive while keeping the costs the same. In other words it becomes less profitable."

I was listening to one of the local idiots on the radio. He was talking about a recent state government decision to allow more doe hunting to cut down the deer population. His take was that it would make more sense to kill buck than doe, after all a single buck can cover (impregnate) ten doe during a season. Therefore, by his logic, killing one buck would reduce the number of fawns born by 10. However, it doesn't work that way. Coming out of the womb, there is roughly one buck per doe. Thus, to have *any* effect on the deer population by killing buck, one would have to kill 90% of the buck. Until you do that, killing buck has no effect, because you start with a massive surplus of buck.

Spam is the same way. The products are so high margin that even if it takes ten times the effort to send one message, they will still send messages. You have to remember, most *legitimate* forms of advertising expect to be seen by far more people who do not buy than who do. Of course, this applies to stalling tactics as well. The main effect of these is to *increase* the spammer's efforts. In many cases, this now involves virus infected zombies sending email. Thus, the main effect of these is to make spammers try harder to infect more machines.

Re:fillters vs. stallers

[Anonymous Coward]

Yes, spammer normally go after your lowest ranking MX record.
A trick is to configure a spam staller as your lowest ranking MX record and insure that those who forward mail to you also run a spam staller.

Re:fillters vs. stallers

[Anonymous Coward]

Spammers NEVER DROP YOUR ADDRESS FROM THEIR DATABASE.
Why should the spammer drop your address if
your are not stalling them ???

Gee, maybe a 550 message from the mailer? 550 means a permanent failure. Spammers IGNORE permanent failures and keep trying anyway. Spammers ignore stalls as well.

Well behaved software doesn't try again with a 550.

450 is a temporary delivery failure - ie you should try and deliver again.

Spammers ignore delivery failures and keep trying.

(yes, there are many other smtp status messages - this is just an example)

Re:fillters vs. stallers

[apachetoolbox]

"...or that they drop you email from there email database"

... your kidding right?

Re:fillters vs. stallers

[Anonymous Coward]

Stalling has been proven NOT TO WORK
Do you have a link to the prove ??

Look at this.

Re:fillters vs. stallers

[Anonymous Coward]

This is a link to someone posting he's feelings
not a prove.

Please, see sa-exim and tarproxy for better
information.

Re:fillters vs. stallers

[Coppit]

With spam filters your just precipitating in a arms race.

True, but the purpose of a spam filter is to only let legitimate email through. If that encourages spammers to start writing legitimate emails, great! You might argue that they are writing legitimate looking emails, but SpamAssassin has always been 1 step ahead of them.

With spam stallers like sa-exim and tarproxy your are stalling the spammers smtp connection and the effect is that the spammer can't send as much spam or that they drop you email from there email database.

I agree. However, you still need to first figure out they are a spammer, right?

Re:fillters vs. stallers

[mikefe]

"The main effect of these is to *increase* the spammer's efforts. In many cases, this now involves virus infected zombies sending email. Thus, the main effect of these is to make spammers try harder to infect more machines."

And stalling will still slow down those zonbies. The more who stall, the more the advantages are in doing so. Yes, more zombies, but that's like telling your friends to drink and drive just because other people do it.

The fact is that by having the possiblities of zombies they're forcing the need of better security or you will see the results in your face (slow computer, popups, identity theft and etc).

So, on the spam front, it is not going to hurt to slow down the spammers, and nobody is saying to stop filtering. Doing both is better than filtering alone, it's that simple.

Re:fillters vs. stallers

[mikefe]

You think it's one spammer?

No they sell the lists so it's a lot of spammers, and the ones who spam don't have to be tech savvy, just "follow this list of steps" and you're "leveraging the power of the internet".

And the software is usually really rinky dink (low quality). So even if it does keep a list of addresses that didn't deliver, it would require said non-tech savvy (can't type, barely can use a mouse, etc) user to manually remove the non-deliverables from the database.

Re:fillters vs. stallers

[Burning1]

Dude... David F. Skoll is the author of MIMEDefang and CanIT Pro. The dude is huge in the spamfighting business. He knows what he's talking about.

New logo.

[suso]

The new logo is nice, but I was kinda partial to the nunchaku wielding ninjas knocking the crap out of spam.

Alien vs. Predator

[NoSuchGuy]

Think of it like the scene from Alien vs. Predator.

SA is a Predator on top of this pyramid and all the Aliens are spam.

The Predators fight a fierce battle against the Aliens. If everything fails and the Aliens win the Predators destroy everything!

Like in real world.
Spamassassin kills/marks every mail with a $score > $spamscore. If the server crashes/explodes, you have other problems than Spam

still waiting for spammerassassin

[Daniel Ellard]

This looks great, and I look forward to using it, but it doesn't address the root of the problem. Anyone working on spammerassassin yet?

Re:still waiting for spammerassassin

[Anonymous Coward]

Ready and waiting.... just awaiting the target, sir!

Re:still waiting for spammerassassin

[geeklawyer]

Yes,
The spammerassassin team is active, but on my legal advice they are not documenting their work: it could, technically, be argued to be murder.

Re:still waiting for spammerassassin

[Anonymous Coward]

Well, I've been thinking along the same lines but from a different direction. For instance, my idea for eliminating the "Make Penis Fast!!!" spams which seem to make up the majority of the crap I get is as follows :

1. Using a large sample group, calculate the average penis length of the male population.

2. Using this new data, round up everybody with a below average sized penis. Shoot them in the head, bury in a mass grave and cover with quicklime.

In just two easy steps the entire customer base of the spammers is eliminated!

Now I know there are probably some wooly headed liberals and "frea speach" advocates that will object to this approach. But that's not a problem - just see step 2 above.

Re:still waiting for spammerassassin

[Dovregubbens Hall]

There is a long-term solution: It is going to take a while, but with genetically engineered chickens that specifically target spammers. Spammer eats chicken, but chokes on the bones. The great advantage is that spammers will not realize the danger before they are all terminated. Very effective. ;-)

Re:still waiting for spammerassassin

[jeffguy]

from a legal dictionary.

murder
n. the killing of a human being by a sane person, with intent, malice aforethought (prior intention to kill the particular victim or anyone who gets in the way) and with no legal excuse or authority...

No worries, spammers don't qualify as human.

Re:still waiting for spammerassassin

[Anonymous Coward]

No one has been locked up for stepping on a cockroach.

Sounds like Monty Python?

[tburt11]

Try using Squirrelmail....

The Monty Python clip is included, and will play upon delivery of your email..

Maybe you already knew that..

Anyone else having installation problems?

[PGillingwater]

Here's what I get, both with perl Makefile.pl and perl CPAN:

[root@actrix Mail-SpamAssassin-3.0.0]# perl Makefile.PL
What email address or URL should be used in the suspected-spam report
text for users who want more information on your filter installation?
(In particular, ISPs should change this to a local Postmaster contact)
default text: [the administrator of that system] decoy@actrix.co.at

Check network rules during 'make test' (test scripts may fail due to
network problems)? (y/n) [n]

Run SQL-based Auto-whitelist tests during 'make test' (additional
information required) (y/n) [n]

Run Bayes SQL storage tests during 'make test' (additional
information required)? (y/n) [n]

<b>Warning: I could not locate your pod2man program. Please make sure,
your pod2man program is in your PATH before you execute 'make'
</b>
Writing Makefile for Mail::SpamAssassin
Makefile written by ExtUtils::MakeMaker 6.03
[root@actrix Mail-SpamAssassin-3.0.0]# echo $PATH
/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bi n:/usr/local/sbin:/usr/bin/X11:/usr/X11R6/bin:/roo t/bin
[root@actrix Mail-SpamAssassin-3.0.0]# <b>whereis pod2man
pod2man: /usr/bin/pod2man /usr/share/man/man1/pod2man.1.gz</b>
[root@actrix Mail-SpamAssassin-3.0.0]# pod2man -v </dev/null

.\" Automatically generated by Pod::Man v1.34, Pod::Parser v1.13

Re:Anyone else having installation problems?

[Anonymous Coward]

type "export LANG=C" and try again

Re:Anyone else having installation problems?

[aquadood]

This fixed the installation problems for me under RHEL ES3

Win32 ?

[Anonymous Coward]

i guess that would be too much to ask, i would love this technology for personal use, but alas us in corporate hell will have to stick to whatever [insert multi million $ synergistic leveraging VFM solution] our massers give us

ColorAssassin 3.0 Released

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=04/09/22/1 30254

Re:actually i've always felt their name's not righ

[jstave]

SpamMassacre? SpamAbbatoir? WeaponOfSpamDestruction?

Debian installation

[Eater]

Any word of a .deb for this? I am so tired of v2.64.

Re:Debian installation

[Dovregubbens Hall]

I don't know, but AFAIK, they included some debian control files in the SA distribution itself, to make it easy to build debs independently.

However, the Debian SA maintainers have actively pushed pre-releases and rc's into experimental, so clearly they have a lot of experience with packaging it. Besides, they are active SA developers too, so the packages are in the best possible hands.

I'm not on debian-devel, so I haven't seen the most reason discussion, but there was something seen from debian news that indicated they might not get 3.0 in Sarge, which would be shame IMHO, it is no point in releasing with 2.64, it would be deprecated for use by then anyway...

Re:Debian installation

[Doctor Crumb]

keep an eye on backports.org if you're using debian stable.

McAfee SpamKiller based on SpamAssassin no good

[aardwolf204]

A lot of closed source software has open source counterparts, (i.e. MS and Open Office) but its always interesting to see closed source commercial software based on an open source project.

McAfee has a product for Exchange servers that is based on Spam Assassin called Spam Killer. I found out about it from the Spam Assassin site when I was looking for a windows version. Spam Killer isnt free yet its not as expensive as some of the other solutions out there.

The major problem I've been having with it is it creating zero byte emails which cannot be downloaded via pop3. When a user gets 30 messages, and message 10 is a zero byte email the client will constantly download the first 10 over and over, creating duplicates, until the user logs into outlook web access (webmail) and deletes the zero byte message. This doesnt happen to the MAPI users but we have quite a few POP3 users.

The support people are useless, I'm about to try out Microsoft Intelligent Message Filter for exchange, and hopefully with some good RBLs it should be ok.

Re:McAfee SpamKiller based on SpamAssassin no good

[Scutter]

I'm about to try out Microsoft Intelligent Message Filter for exchange

A couple of my customers asked me to install that for them. It's not very configurable or very granular, but it seems to work at least passably well. Plus, it's very easy to install and configure and requires little maintenance.

Re:McAfee SpamKiller based on SpamAssassin no good

[Anonymous Coward]

try GFI MailEssentials i've been loving this product. free for 30 to 60 days

http://www.gfi.com/mes/

Re:McAfee SpamKiller based on SpamAssassin no good

[Anonymous Coward]

tried it before trying spam killer. it sucks. too many false positives and whitelist is hard as hell to configure, and why the hell cant anyone produce a product that can attach to the microsoft management console? you know what I'm talking about.

Re:McAfee SpamKiller based on SpamAssassin no good

[aardwolf204]

requires little maintenance.

Thats exactly what I'm looking for. The overviews make it look nice, havent plunged into the installation guide yet but I'm happy to hear from another ex03admin that its not too bad.

Any idea what SCL threshold you were using on the gateway? thanks.

Re:McAfee SpamKiller based on SpamAssassin no good

[illumin8]

McAfee has a product for Exchange servers that is based on Spam Assassin called Spam Killer. I found out about it from the Spam Assassin site when I was looking for a windows version. Spam Killer isnt free yet its not as expensive as some of the other solutions out there.

The major problem I've been having with it is it creating zero byte emails which cannot be downloaded via pop3. When a user gets 30 messages, and message 10 is a zero byte email the client will constantly download the first 10 over and over, creating duplicates, until the user logs into outlook web access (webmail) and deletes the zero byte message. This doesnt happen to the MAPI users but we have quite a few POP3 users.

The support people are useless, I'm about to try out Microsoft Intelligent Message Filter for exchange, and hopefully with some good RBLs it should be ok.

It sounds like you should really consider making your external SMTP relay a Linux box. You throw a cheapo Linux box with Postfix, Spamassasin, and ClamAV in your DMZ, make it the primary MX (mail exchanger) for your internet domain name. Then, it will scan all incoming mail and forward only the non-spam, non-virus containing messages inside to the exchange server, which sits inside your firewall. This is much more secure as well, because everybody knows you should never expose anything running Windows to the internet, especially port 25. I'd much rather have the Linux box be sitting in the DMZ with port 25 open, than the alternative: forwarding port 25 through my external firewall past the DMZ, through my internal firewall, and right into my Exchange server. Yeowch!

Re:McAfee SpamKiller based on SpamAssassin no good

[Scutter]

Any idea what SCL threshold you were using on the gateway?

I think it's generally set to 7 or 8. There's a procedure in one of the guides to track hit rate to help you adjust it for your environment.

Re:actually i've always felt their name's not righ

[WoodenRobot]

Weapons are typically low-volume high-percision or vice versa. In that sense, I don't think a "nuke" describes it better.

It describes what many people, myself included, would like to do to spammers. Although it might be a bit too quick and painless...

So does it...

[Ionizer7]

actually assasinate the spammer? That would put an end to most spam I would think.

Re:actually i've always felt their name's not righ

[curtoid]

Just spray on some Spamicide...

loose the spelling errors!

[Anonymous Coward]

Please go and look up

their, there

and

your, you're

in a dictionary and stop spreading these errors.

Also you precipitate something, not in something.
A precipitate may appear in a solution in the literal sense. Perhaps you meant participating?

PS I like your poetic formatting,
but given that nothing rhymes,
I feel cheated somehow.

Re:loose the spelling errors!

[Azghoul]

Really funny considering your horrid misuse of "loose".

Nothing funnier than a grammar nazi who fucks up.

Re:loose the spelling errors!

[Anonymous Coward]

Nahthing like somewon hoo misses the point. (yuo)

Re:loose the spelling errors!

[Anonymous Coward]

Sorry about that, English is not my first language.
I think that the best way to stop this from happening again,
is to write a grammar checker for Linux ;-)

It's easy...

[Da Twink Daddy]

just

emerge mail-filter/spamassassin-ruledujour

or have you not switched to Gentoo, yet?

Re:It's easy...

[Anonymous Coward]

You have to emerge a shell script? Sheesh.

I no longer get spam

[Anonymous Coward]

The solution is extremely simple if you use OpenBSD.

rdr on $ext_if from any os "Windows" to any port smtp -> 127.0.0.1 port 8025

99.9% of all spam comes from compromised Windows boxen, and nobody with a clue would run a mail server on windows.

Turbo Smorgreff

Re:I no longer get spam

[dougmc]

99.9% of all spam comes from compromised Windows boxen

I imagine you've got a few too many 9's there. Of course, most spammers probably spam from Windows boxes, but they're doing what they told them to do. Do you consider that to be a compromised box, if it's doing what the owner wants it to do but not what you want it to do?

and nobody with a clue would run a mail server on windows.

That sounds good in theory, but in practice, lots of people with a clue run mail servers on Windows.

Re:I no longer get spam

[jonabbey]

That sounds good in theory, but in practice, lots of people with a clue run mail servers on Windows.

Why?

Re:I no longer get spam

[Doctor Crumb]

Many legitimate corporate IT teams do it because they CTO has declared it to be a windows-only shop. MSexchange is popular in the not-so-technical corporate world.

Re:I no longer get spam

[HSpirit]

Nice theory, but our company's major contractor uses MS Exchange (they're a M$oft shop). Such a rule on our OpenBSD 3.5 gateway would kill our business in about a week.

So, as you can see, this is not an "extremely simple" solution for most people who actually conduct real-world business with electronic mail. The solutions must be a little more flexible than that.

Great Book on it

[Erwos]

I recently read an excellent book on SpamAssassin by Alan Schwartz, published by O'Reilly and Associates, Inc. My views might be biased since he's my first cousin, but if you're a mail server admin, it's probably a must-have. I don't think it covers desktop usage as well, but then again, Evolution's getting that integrated anyways.

The sections on rules are extremely nice, and I found them pretty informative as to how the software works underneath. It covers version 3, too, so it's damned timely.

-Erwos

Re:Great Book on it

[SCOX_Free]

I thought the book was ok. He does take for granted some key things. For example:

What if I have never written a rule before?
Where do I save it?
Is it just a plain text file?
Does it need to have a .cf extension?

After reading the whole book, I thought it did a good job of teaching someone how to get SA running. Modifying it on the other hand... that's where google saved the day

Spaminator

[KaiBeezy]

Earthlink Spaminator(TM)

Seems like they're kind of wasting a name that would work pretty well in the market.

Re:Spaminator

[Anonymous Coward]

Better than Sperminator, I guess.

Antispam Gateway Distribution?

[Darth_Burrito]

This may seem a tid bit lazy but...
It seems like there are linux distributions for just about anything you might want: routers, pvrs, etc. Are there any linux distributions designed to be a mail anti-spam/anti-virus (or just anti=spam) gateway? ... something that would install and configure postfix, spam assassin, etc to receive mail and forward it to another server after filtering it.

The reason I think this would be cool is because configuring mail apps on linux can be hard and because this would be a great linux foot-in-the-door distribution for Exchange admins who didn't want to pay thousands of dollars for antispam gateways.

Re:Antispam Gateway Distribution?

[mortonda]

This is exactly the direction we are planning to go with Maia Mailguard, plus features such as tarpitting, network reporting, and p2p associations. It's going to take a while to get there, though.

Re:Antispam Gateway Distribution?

[Anonymous Coward]

sorry - I missed this post and alrady commented about the product that we use ... forget Barracuda. Sure, it's cheap, but iit's the same old SA crap. We use Mailfoundry - about the same price, but WAY better. They have the same 30 day free trial - try it and you'll HATE Barracuda. Period.

disclaimer - we have two of their boxes. What can I say, it's made my admin duties a lot easier since I don't have to deal with that silly spam crap anymore.

Re:Antispam Gateway Distribution?

[Anonymous Coward]

Google for "email toaster" -- you'll find lots of projects out there that are doing
this sort of thing, and "mail toaster" or "email toaster" is the usual term for it.

The fifth element

[celerityfm]

Heh that reminds me of The Fifth Element. In the beginning of the movie a mugger fools the main character into thinking the coast is clear by wearing a special hat that had painted onto the top of it what the main character would normally see when looking on his surveillance screen so when the mugger pressed the hat up against the surveillance camera, the main character couldn't tell there was actually a mugger waiting for him on the other side of his door:

46A INT. KORBEN'S APARTMENT - DAY

A thermo nuclear explosion fills a T.V. screen..Which Korben's cat watches with interest.

Korben is about to exit the apartment.

KORBEN
Don't watch it all day, it'll rot your mind. Bye sweetie..

In response, the cat meows. Korben opens the door to..A huge gun, brandished by a nervous MUGGER, pointing right in his face.

MUGGER
The cash man!

KORBEN
Been here long?

MUGGER
Don't fuck with me man or I'll blow you into tomorrow!

Unperterbed, Korben looks at the mugger's fearsome weapon.

KORBEN
Isn't that a Z140? Alleviated titanium. Neuro charged assault model?

MUGGER
(off balance)
Uh..

KORBEN
You know you could hurt someone with this puppy..good thing it's not loaded..

The mugger is lost. He looks at his weapon.

MUGGER
It's not?

KORBEN
You gotta push the little yellow button...

Korben points to the button on the side of the gun. The mugger takes his advice.

MUGGER
Thanks..

KORBEN
You're welcome..

And with lightning speed, Korben blasts the mugger with a straight right hand, sending him down for the count. Korben retrieves the gun.

KORBEN ..you know these things are VERY illegal..you could get in a shit load of trouble..I better hang onto it for you..

As the mugger clears his head, Korben opens a drawer next to him which is full of similar guns! The mugger's eyes pop out of his head. He scampers to his feet and runs off.

Korben shrugs, exits his apartment, and closes the door. The cat watches a nuclear holocaust on T.V., uninterrupted.

==

Damn I love that movie

MySQL part of install seems bitched up

[brassman]

It's hard to read the docs ahead of time if you're installing off CPAN... are we supposed to set up the autowhitelist and bayes users manually before launching the install?

I'm getting errors that seem to indicate that DBD::MySQL is just plain borked. "Database version 0 is different than we understand"... Tried to upgrade (found one hit on Google that said I might need to DOWNgrade instead)... either way, DBD::MySQL thinks the root MySQL user doesn't need a password. :rolleyes:

Re:MySQL part of install seems bitched up

[Anonymous Coward]

Switch to PostgreSQL.

Redirection from google, rd.yahoo, etc.

[Anonymous Coward]

I've been using a form of SURD for over a year.

It works good, but they are already defeating this by using things such as RD.YAHOO.COM which redirects to their spam site. This defeats the SURD I use.

Granted, RD.Yahoo is secure now, but there are many others.

Once folks really start using SURD, how hard will it be for the spammers to link to:

http://64.233.167.104/search?q=cache%3Agetvisito rs .net%2F&safe=vss

Which is a Google copy of a spam site.

Re:Redirection from google, rd.yahoo, etc.

[felicity]

As an FYI: SpamAssassin 3.0.0 handles the redirectors internally, so http://example.com/?http://myexample.com/ becomes 2 SURBL queries: example.com and myexample.com.

SA will also deencode parts appropriately, so that doesn't help them either. :)

There are definitely some ways to get around this type of thing, but we'll deal with that when we get to it.

Re:actually i've always felt their name's not righ

[Aero]

If you could whack off a couple of the top guys ...

No thanks. I want no part of giving sexual satisfaction to spammers.

Oh wait...you want to whack them, or knock them off...go for it, then!

Love this software

[JimLynch]

Great stuff. My hosting company uses it and it works extremely well. Filters out tons of crap for me. Nice to see a new version out.

Exciting!

[theamarand]

I've been using the 2.63 version of Spamassassin for a few months now, and it's surprising how well it works, especially when you use the "spam/ham" folder saving feedback system. I've noticed a lot fewer miscategorizations, which gives me a better feeling about using the app site-wide (I'm just using it for three users right now). I'm really excited about the potential for a major release like this having significant and noticable improvements in key features like heuristics and integration. The logic improvements will help end-users feel better about setting things up a certain way, then forgetting about it. Integration (it's great that it's under the Apache S.F. umbrella now) means that more people will get behind supporting it, which follows with increased feature richness, improved algorythms and rapid filter development. In the end, though, myself and my users just love seeing the spam marked out in an increasingly accurate way...so it becomes second-nature to just rapidly press the delete key without much thought....

Re:Improved Performance?

[Tim Macinta]

I must say, Python might be a nice language and all, but as it's making inroads everywhere it's also wrecking havoc on ones ability to convert older hardware into a competent server.

Spamassassin is actually written in Perl, not Python. I'm not saying your point about certain languages making it difficult to maintain older machines isn't valid, I'm just clarifying what Spamassassin uses.

You'd be amazed

[CmdrGravy]

Someone in the place I used to work at had an e-mail of someone else which had a signature which scrolled in from the right of the page and flashed and stuff and from there in around 2 months more than 90% of everyone else in the office had the same thing. I believe this relied on Javascript and Outlook was more than happy to comply.

Re:You'd be amazed

[Anonymous Coward]

Commas are your friend.

Re:You'd be amazed

[lizrd]

The ones that have infested my office use the marquee tag rather than javascript. Outlook 2003 defaults to having e-mail in the restricted sites zone. All the scripting options in restricted sites are set to disabled by default.

Milter Note

[YetAnotherDave]

if you use spamass-milter, you should check this thread if you use the '-r' option to reject high-scoring mail.

http://lists.gnu.org/archive/html/spamass-milt-l is t/2004-08/msg00009.html

Re:Milter Note

[numbski]

Moral of the story when dealing with spamass-milter:

build from cvs, not release.

At least until he finally releases 0.3.0 :P

Re:actually i've always felt their name's not righ

[Jarl]

SpamSlaughter

Re:actually i've always felt their name's not righ

[An ominous Cow art]

Then perhaps someone should release a product called "SpammerAssassin". It might be a nice tie-in with the article on humanoid robots from a few days ago.

Plague !

[CmdrGravy]

How about SpamGeneticallyTargettedBioPlagueWeapon ? Not quite as catchy but probably more accurate.

Offtopic Rebuttal

[celerityfm]

If you consider my reply off topic you either don't like The Fifth Element :P or I need to make the analogy clearer. My explanation of the analogy is what makes THIS post even more on topic then the parent:

The Mugger was the spammer

The main character was the user

The video camera was "the spam filter" and

The Mugger's special hat was the mechanism used to defeat the spam filter.

If you don't see that mugging and spamming are essentially the same then thats your problem ;)

The one for whom to beat???

[cipher chort]

For other OSS anti-spam projects to beat? I have to ask, because in every bake-off of contest with the leading commercial tools, SA has been thurougly beaten and plagued with both high false negative and high false positive rates. The dependence on PERL also makes it significantly slower than other solutions, except of course those built on PERL as well (like Sophos').

SA is no where near the class of accuracy of CipherTrust, Proofpoint, Tumbleweed, or any of the other major anti-spam vendors.

Re:The one for whom to beat???

[evilNomad]

Do you have any documentation on this, or are you just making it up? :)

Re:The one for whom to beat???

[Anonymous Coward]

That's fine and dandy, but those solutions are WAY expensive. One of the reasons everyone uses SA is because of it's "price". Though for the first time, there's a comperable solution to those BIG pricey ones, but it's about as expensive as Barracuda, and WAY more effective. The guys at MailFoundry have a network appliance that really works for less than $3000. (they have a spam assasin upgrade program right now where you can save like 20% off of their product when you 'upgrade' from SA ... pretty good idea IMHO.) disclaimer - we have two of their boxes in our network. Bottom line - it's easy to use and it works. And the false positives are almost nonexistant. I'll pay for that anyday (ok, my boss pays for it...) but you get the idea.

Stalling = sabotage

[Anonymous Coward]

Except that, doing so, you're deliberately screwing up the email system, which may also include legitimate emails in the same queue, and that spammers don't care, since they just own more windows boxes to increase capacity.

SA 3 is a good step in keeping things under control until a technological solution to email authentication is combined with good law enforcement.

An invitation to fellow spam-fighters

[bigberk]

SpamAssassin, when properly configured, has spectacular spam detection accuracy. For your account or for a small domain, you should be able to see SA yield "near perfect" filtering (i.e., probably as good as a human could pull off).

That's the point at which we become interested in SpamAssassin users joining WPBL, an automated spam reporting system. Powered by scripts living in procmail and cron, participating systems send WPBL lists of IP addresses sending spam and ham. The central server crunches this data hourly to produce a list [rsync://rsync.pc9.org/wpbl/wpbl-blocks.cidr] of blocked IP addresses that are spam sources.

If your site uses SA and you have verified your spam detection accuracy as nearly-perfect, you might be interested in contributing your spam/ham sighting stats to WPBL. The resulting block list can be used by anyone (and is used by some ISPs for spam scoring). The way I think of it is, after you've taken care of the spam problem at your site why not help tell the rest of the world where spam is coming from.

Re:actually i've always felt their name's not righ

[Lord_Slepnir]

There is a problem, though its not with the second word of the name 'Spam Assassin'. The problem is the first word needs to have an 'mer' on the end of it. Then we're talking about the most effective solution for spam that I can think of.

The already is one

[cipher chort]

It's called Barracuda, and they practically give it away for free. That's not to say that the quality is any good, but it's exactly what you're asking for.

Beavis and Butthead say.....

[Anonymous Coward]

.... Huh huh huh, like Dude, SpamAssassin has "ass" in it, like TWICE! huh huh huhuhuhuhuhuhuh.

Re:Improved Performance?

[Tassach]

Python might be a nice language and all, but as it's making inroads everywhere it's also wrecking havoc on ones ability to convert older hardware into a competent server.

Tell me about it. While not applicable to SA (which is perl based), you're dead on. My home server is a K6-2/500 with 256M of RAM, and I had to stop running Mailman because it was just sucking up over a third of my RAM for a few low-volume lists. I just created aliases to remail the list traffic and that works almost as well and doesn't use any extra resources.

TMDA

[Gudlyf]

I've used SpamAssassin for quite some time now, but I was still getting spam through, mostly because I'm a paranoid freak and figured I'd be missing out on mails that it mistakenly tagged as spam.

What I use now (alongside SpamAssassin) is TMDA. This is basically an "approval queue" for messages. If someone not in your approved list send you mail, they get a reply telling them they need to send mail to a specificly generated address in order to allow the mail to pass through to me. Eventually mails that don't get approved time-out and get added to a blacklist for the future. I also quickly review the queued items every morning in case someone didn't see the approval mail (it has a tool that allows you to easily peruse the list with just subject and sender info). So far I've gotten NO spam through this method -- NONE. I used to get hundreds a day, and now I have a spam-free INBOX because of TMDA.

While I highly recommend using TMDA, it may not be for people running businesses or waiting for mail from clients. The auto-reply message can perhaps strike some as inconvenient, even though they only have to do it once (once they've sent mail to the approval address, they're added to the whitelist for all future mails). So far spammers haven't found a way around TMDA it seems...so far.

Re:TMDA

[kindbud]

TMDA inconveniences legitimate correspondents. It is not your correspondents' job to manage your whitelist. If you want my email, you put me on your whitelist. I never respond to TMDA notices or other crap like that.

Re:TMDA

[Anonymous Coward]

TMDA is a bad solution. Most spam is sent from forged email addresses, so all your TMDA requests are effectively sending spam to the poor misfortunates that had their identity stolen by spammers.

Greylisting (temporarily rejecting email from a new combination of sender/recipient), on the other hand, doesn't send out email, and blocks about 95% of current spam. Most spammers don't resend on temporary rejects, so it gets blocked.

Re:TMDA

[darksoulz]

And have you considered how much crap you are now spewing back to innocent users that have their address forged as the from address in spam runs?

It fixes your spam problem but only makes it worse for other people.

Re:TMDA

[Gudlyf]

"I never respond to TMDA notices or other crap like that."

And those are just the kind of people I wouldn't care if they emailed me or not anyway. Those who I want to hear from know the spam struggle and don't have a problem to reply that ONE time to the address. For all others, I manually add them to the whitelist if I know I'm expecting to hear from them.

I already said that it'll possibly inconvenience legit senders, but you know what? My spam issue is/was more of a problem than making people send one extra email to get through to me.

Re:TMDA

[kindbud]

And those are just the kind of people I wouldn't care if they emailed me or not anyway.

And you're the kind of person pompous self-important person I hate having to correspond with. If I were attempting to establish a relationship of some kind with you, professional or otherwise, the TMDA notice serve as a gigantic "HERE THERE BE ASSHOLES" sign.

I solved my spam problem without inconveniencing any of my senders, or making them jump through hoops.

Those who I want to hear from know the spam struggle and don't have a problem to reply that ONE time to the address.

Then why aren't they already on your whitelist? Duh!

Allow me to paraphrase Morbo:

Email does not work that way! Good night!

Re:TMDA

[Anonymous Coward]

And you're the kind of person pompous self-important person I hate having to correspond with. If I were attempting to establish a relationship of some kind with you, professional or otherwise, the TMDA notice serve as a gigantic "HERE THERE BE ASSHOLES" sign.

Amen. I run a technical mailing list of 20K subscribers, and when I get 300 of these they go straight to /dev/null.

You signed up for my list, so whitelist my server yourself or FOAD.

Re:TMDA

[Gudlyf]

Yeah, I may look like a huge prick to anyone I don't know trying to get in touch with me, but I don't really care. The spam drives me more nuts, and if I piss one person off because of what I put in place (and it is a polite message that gets sent), then fuck 'em.

As for mailing lists, it handles them flawlessly and I always add them to my whitelist when I sign up anyway. The only addresses not in my whitelist already are people who are friends of friends or people trying to get me through my website or whatever. I've never had a complaint, so I'm not going to sit and sweat about it, worrying about what I look like to them because I'm controlling my spam. I just listen to their spam woes and how nothing they do works. Well, this works. End of story.

Re:TMDA

[Anonymous Coward]

I use ASK. It's a lot like TMDA.

I admit I inconvience people I do not know that are trying to get ahold of me, but it is my email inbox, and if I don't know you well enough to add you to my whitelist by hand then I need proof that you are PROBABLY a real person. If you are offended by this pratice it is your right NOT to send me email, just like it is my right to ask you to confirm that you are PROBABLY a real person. I screen my phone calls too. :)

So far I've not recieved any complaints, and several people have asked how they can set something like it up.

I've recieved one (that's right ONE) spam in the last 6 months. That was from a spammer that replied. Considering that I've blocked about 36,000 I'd say the s/n is fairly good.

And for the record I added all the mailing lists that I'm on prior to making it live, and I add new ones prior to hitting the submit/send button. I want the email so I take action to ensure it is not blocked. It's more work for me this way, but it's still less key strokes then hitting delete for several min each morning.

Re:TMDA

[Gudlyf]

Amen to all of that. It seems like there are two kinds of people out there -- those who've used TMDA (or simimar) and love it, and those who've never used TMDA and hate it.

ASSP

[Anonymous Coward]

I've been successfully blocking almost all spam (except for really incredibly poisoned stuff, which is why SURBL sounds interesting) with ASSP for about a year.

http://assp.sourceforge.net

-Easy to install and uses web-based management
-Users can forward spam to it to help train the filter
-Now with SPF
-Whitelists, redlists, spam bomb prevention, antivirus built in

Mozilla/Tbird extension?

[ckolar]

I have been using spamnix for filtering my Eudora mail and have had a great experience (it is spamassassin + bayes). Does anyone know if there is a project/plan to looking into a spamassassin extension for Mozilla/Thunderbird that would augment the built-in bays filtering? I am not at all impressed with the current mozilla performance. Cheers.

Making it up

[cipher chort]

Of course, anyone who questions the quality of an OSS project must be "making it up", as we all know OSS projects are above reproach!

Well how 'bout http://archive.infoworld.com/article/03/11/14/45FE spam_1.html?s=feature for instance? Apparently they require reg now, anonymous/anonymous seems to work. I've seen similar reviews in other (printed) IT pubs, but I haven't been able to find any of them on-line yet.

Re:Making it up

[Flower]

Of course, anyone who questions the quality of an OSS project must be "making it up", as we all know OSS projects are above reproach!

No you made an assetion and didn't back it up with a link. The parent *nicely* asked you for one and now you're acting like being questioned wounded you. Welcome to the Internet. You must be new here.

Thanks for providing the link. Thanks evilNomad for being civil about it. But seriously, next time when you see the smiley just remember that it doesn't mean "with both guns blazing."

Re:Making it up

[Anonymous Coward]

Wasn't 2.44 a pre-Bayes version? If so, no wonder it didn't perform all that well.

[OT] DSPAM MTA layer setup

[Tony]

And the other negative about dspam is it doesn't integrate well at the SMTP/MTA layer, it has a marked design preference for the delivery agent layer.

It's really layer-agnostic. Most implementations include a quarantine area and mail body markup. But, you aren't stuck with that.

I've had no problem integrating it into the MTA layer. Our mail store is on the inside of a firewall. Our external MTA is on the DMZ-- this is where DSPAM lives. I have DSPAM marking the headers of the email. I have a Sieve filter on the internal mail store checking the headers, and delivering messages marked as SPAM to a user's SPAM folder. Under the spam folder are two other folders: "Drop_Spam_Here," and "False_Positives." Users drop mail into those two folders for DSPAM training.

I have some simple Perl programs that scan the mail store and move mail out of the training folders, passing the messages on to DSPAM.

It's all much simpler than it sounds, especially for the user.

Email me at tee oh en why at searhc.org if you want the DMZ Exim config, Sieve filter, and Perl scripts.

Re:[OT] DSPAM MTA layer setup

[mikefe]

Yes, I'm interested, but you don't have an email address configured.

What do you do with the message after they've put a message in "False_Positives"?

Also, I'm using SA now, and have taken a quick look at Dspam. Does it have a global bayesian database, and a user database, or something similar? That's what I'm looking for mostly.

Thanks

What about Joe Jobs?

[Anonymous Coward]

I'm concerned about blocking by URLs/IPs in messages. What if a bad person sends lots of spam with links to my site? Wouldn't that make any email *I* send with links to my site (my .sig, for example) more spammy?

Installing on Windows....you're kidding, right?

[Chris Carollo]

So I've heard good things about SpamAssassin and headed over the webpage to figure out what I needed to do to install, and I found this.

I'm probably going to flamed for this, but that install process is ridiculous. I'm not even close to being a newbie, but there's no way I'd go through that much hassle to install a spamblocker compared to something like SpamBayes that does a standard windows install and hooks right into Outlook. Does anyone thing that these things are reasonable?

1. I'm supposed to extract it to the root of my drive. Sorry, my root is sacrosanct. If the /. crowd is going to complain about RealPlayer dumping shortcuts in my desktop, quickstart bar, and main start menu, how is SpamAssassin making directories in my root any better? At least I can delete the stuff RealPlayer litters around.

2. I've got to install Perl modules? And it doesn't work with certain versions of Perl? The install should include whatever it needs to run. Don't make me track down some particular version of outside software.

3. I've got to generate a batch file and run it to generate the documentation? Why not just include the generated documentation?

4. Step 10 of the install FAQ mentions a D drive. I don't have a D drive. Does SpamAssassin really require TWO drives to run/test properly?

5. The whole install process includes 13 steps, some of which are fairly complicated.

This is one of the reasons why the whole open-source initiative has such a bad, pointy-headed reputation. Where is the focus on usability and user-friendliness? I often get the impression that it's "not cool" to actually put time and energy into making your software anything other that esoteric in its usage. I realy would like to try SpamAssassin, but dealing with the minor annoyances of SpamBayes for the next six months is clearly less work than installing SpamAssassin today. Why doesn't that bother anyone?

I'm probably going get either flamed or ignored for this post, but I would appreciate a reasonable response if there is one. We'll see I guess.

Re:Installing on Windows....you're kidding, right?

[realmolo]

I don't disagree.

BUT...use CPAN. Makes it a million times easier. You might still have to install a dozen Perl modules, but at least each install is automated.

Back in March I set up a new mailserver for the ISP I work for. Postfix/Courier-IMAP/SquirrelMail/Maildrop/SpamAss assin/ClamAV... the works. SpamAssassin was the EASIEST thing to install.

Re:Installing on Windows....you're kidding, right?

[Anonymous Coward]

That is the reason we installed a network appliance in front of our Exchange server. ;-) No software to muck with, etc. We just installed it and poof, no more spam. No 'learning' for the filters and best of all, our employees also don't deal with false positives that spam assasin creates. They'd kill me if they lost any email. (obviously our network appliance doesn't use SA)

Duh - forgot to mention - we use MailFoundry since it's cheap and easy and kicks the crap out of SA.

Re:Installing on Windows....you're kidding, right?

[Clover_Kicker]

SpamAssassin on Win32 is an afterthought at best.

The Win32 stuff is provided as a courtesy. I don't think they really expect anyone to use it, since it is so much easier to install on *nix.

Re:Installing on Windows....you're kidding, right?

[slappyjack]

I think the point you're missing is that these instructions are very complete and fills in every step of the process. Far different from doubleclicking a big fat executable and watching the pretty progress bar.

I for one prefer this kind of install when loading up geeky type things like this. You learn more about your machine and the application, what its doing, and where it is in case you want to modify or otherwise play with it. And really, how can you NOT want to konw this? Your computer is a tool. The more you konw about it the more powerful it becomes.

If you don't want to do all of that, then suffer with what is probably an inferior product. Not all freeware is entirely "free".

On the flip side: when I'm installing games, I'm more than happy to just sit back, drink my beer, and watch the pretty little installation graphics twirl and dance for me. I just wanna get to the killin'.

Re:Installing on Windows....you're kidding, right?

[Anonymous Coward]

Normally I'd agree, but CPAN for Win32 users hasn't been a good option generally. It works ok with cygwin, but

- the make tests have failed too often (and thus confuse users) for anything but a manual install. There are long turgid reasons for this but the upshot is that few builds of SA have completely finished all tests via CPAN successfully. (This has greatly improved recently).
- Net::DNS until recently was very problematic and it was generally not safe to run any but an old copy - this tended to muck up CPAN newbies.
- Also, SA via CPAN assumes an installed C compiler, which is rarely the case for Win32 folks.

As you can see, most of this has improved rapidly, but it's still true that it's meant to be an MTA integrator - and outlook integration etc, require more work

People can (and have) created self-contained spamassassin.exe installs with the Perl Dev Kit. So Far no one has regularly maintained such a setup for the community and the PDK is not free.

See http://www.openhandhome.com/howtosa.html for detailed instructuctions on a standard Win32 setup of SA

Re:Installing on Windows....you're kidding, right?

[sublimespot]

Yes it was a very tough install...

perl -MCPAN -e shell

> install Mail::SpamAssassin

Re:Installing on Windows....you're kidding, right?

[Christopher_G_Lewis]

First of all, there is no install. This is a pure source release. Quite common, and after a little bit of testing, (you wouldn't blindly put this on a production box, would you :-) it's quite easy.

Your points...
1. Extract it where ever you want.
2. So? PPM and CPAN are simple.
3. or you could use the docs on the web site you were looking at.

4. Step 10 does *not* require a D drive, the -D is for Debug mode. It spits out everything that SpamAssassin is doing, i.e. what config files, what db's what tests are being run. Actually quite usefull.

5.

Re:Installing on Windows....you're kidding, right?

[Henk Poley]

All of these things are pretty much automated on any modern operating system. Only Microsoft Windows doesn't include a decent (de)centralized package management.

This is more of an overall problem, than a problem with SpamAssassin in particular. I think every widely used operating system has it is strength and weaknesses, but ease of installation is not always microsoft windows strength.

They (microsoft) should really do something about the ability to easily create and maintain packages and package repositories.

Re:Installing on Windows....you're kidding, right?

[sidney]

I did a lot of the work of getting SpamAssassin to build and run on Windows. My goal was to have SpamAssassin build and install on Windows using the unmodified sources before version 3.0 was released. It does that now.

SpamAssassin was written in Perl on Unix and Gnu/Linux, for use in high volume server environments. The installation for an ISP or for anyone running a *nix mail server is a piece of cake. Their users get their mail filtered without having to install anything on their own PCs.

The fact that it works on Windows at all is a bonus. It is an open source project. Would anyone like to volunteer to help with the next steps of getting the server daemon, spamd, working properly in Windows as a service; writing or adapting an existing mail proxy that would integrate SpamAssassin with mail clients such as Thunderbird, Mozilla Mail, Eudora, Outlook Express; packaging it up in a standard Windows install package?

Addressing the 5 points in the parent post:

1. Nothing has to go in the root directory. The instructions show an example of Perl having been installed in C:\perl and configuration going in directories underneath a C:\etc\mail directory.

2. Yes you have to install Perl. And a recent enough version that doesn't have certain bugs. And the required modules. SpamAssassin was written in Perl, which makes it useful on systems that have Perl, such as most Unix and GNU/Linux systems. If you install Perl and the modules on your Windows system then you have a system that meets the minimum requirements. If you have a Palm Pilot or or an Xbox or Windows without Perl then your system does not meet the minimum requirements and you are not going to even try to run SpamAssassin on it. In that case install SpamBayes, or get an ISP who uses SpamAssassin for your mail, or any of many other alternatives.

3. Making the doc files is easier in *nix. I'll file a request for enhancement suggesting that generating the HTML be made part of the Makefile and that it be made to work under Windows. The doc files are generated from the sources as part of the build, so they are not included in a source distribution, which is what we are talking about here. If someone built a binary distribution they would include the doc files.

4. That -D command line option stands for Debug, not D drive

5. The whole install proces consists of 13 steps, some of which are things like "download SpamAssassin", some of which are "if you are installing the old version 2.6x do this extra step", and some of which have to do with getting the required Perl and Perl modules. The actual installation pretty much happens in three lines of step 7. It really is quite easy for a build and installation starting from source files. A binary installation package would be a lot easier. Does anyone know how to package perl plus modules plus a built SpamAssassin into a Windows install package? If you do, feel free to volunteer.

The focus on usability and user friendliness is where it should be in this particular project, on the sysadmin who installs SpamAssassin on a server and on their end users who don't have to install anything at all.

If you have the ideas and the expertise to also make SpamAssassin more useful and friendly to the end user owner of a PC running Windows, please volunteer to help.

Re:Installing on Windows....you're kidding, right?

[Anonymous Coward]

And ... dont forget this ... http://wiki.apache.org/spamassassin/SaProxy

or how to have a pop3 proxy integrated with SA just in case you are a poor windoze like me and your mails are in the ISP server ...

Description is mine. I did myself have to learn some perl just to be able to install saproxy ...

But it works so nicely ...

There is even a perl -> exe thingy that works marvelous, so perl installation can be skipped!

Should there be any perl monk wishing to help ...

Re:Installing on Windows....you're kidding, right?

[iamcf13]

I'm probably going to flamed for this, but that install process [for SpamAssassin on Windows] is ridiculous.

The 'installation' routine for my mail filter/mailserver is this:

1) Download it.

2) Copy/move it to a brand-new empty hard disk subdirectory.

3) Run it.

Simple. :)

Re:Installing on Windows....you're kidding, right?

[HSpirit]

You invited flames, so here you go.

Read me lips: this is open source software. OSS works because people get a buzz out of developing software that is more effective, more efficient, less buggy, or just plain achieves something that nothing else (free) can do.

There aren't many developers out there that get sufficient joy from making a point-and-click installer to donate hundreds of person-hours of their time. OTOH there are plenty of developers who get paid for doing just that, but their wages have to get paid somehow.

So if you want a point-and-click installer, then there are plenty of alternatives around. You may have to pay for them, and if you don't want to pay then you may have to put up with something that fails on the effectiveness/efficiency criteria I outlined above - that is your choice.

FWIW I've installed SpamAssassin on my MacOSX Powermac (using sendmail and procmail) and it is just about the easiest built-from-source installation I've ever performed on the Mac. The documentation is good, it told me what dependencies it had (I don't like using CPAN). I'm "not even close to a newbie" either, but looking at the Windows installation instructions I can only conclude that (like much *nix OSS software) Windows isn't the best platform for SA.

If you insist on wanting to build OSS software from source on a Win32 box, I really suggest you try cygwin.

License

[wikinerd]

SpamAssassin 2 was GPL and Artistic licensed. Now SpamAssassin 3 is under the Apache Software License.

What am i going to do now?!?

[mj2k]

Those viagra spams were the few bright spots in my mundane life... And those XXX spams... nevermind, I won't go there...

SURBL's site is not browser-agnostic

[Anonymous Coward]

At least I *hope* it renders better under other browsers.
The text in the top frame is halfway gone at some zoom levels under Gecko (Mozilla 1.7.2).

I hope the rest or their operation is better than their website designer.

gewg_

Poisoning SURBL?

[Sneeper]

What will keep spammers from poisoning SURBL by including URLs to known valid companies like yahoo.com, google.com, amazon.com, etc?

This seems like it would be even more effective than bayesian poisoning.

Re:Poisoning SURBL?

[jeffcsu]

We've created exclusion lists of all the whitehats we could think of, including google, ebay, etc., etc., etc. We call those exclustion lists "whitelists" but they are only used intenally to keep domains out of SURBLs. See: http://www.surbl.org/faq.html#joe

Re:Poisoning SURBL?

[jeffcsu]

I should also add that we ask people to send us any false positives (e.g. innocent bystanders, legitimate URIs mentioned in legitimate messages or newsletters, etc.) to whitelist at surbl dot org .

Are anti spam programs necessary?

[Espectr0]

I get roughly 100 messages a day, and i recognize spam by practically reading their subject line. If i see a spam, i hit delete and continue. This process takes the time needed to hit the delete key x number of times.

If current antispam technologies just move a message to a spam folder, which we have to check its full quantity of messages to make sure there isn't a false positive, then where is the improvement?

Re:Are anti spam programs necessary?

[iamcf13]

If current antispam technologies just move a message to a spam folder, which we have to check its full quantity of messages to make sure there isn't a false positive, then where is the improvement?

My approach 'autodeletes' spam and malware either before or after it reaches your email inbox. The user sets the criteria to use and any email containing any unwanted content is summarily delted.

Want to learn more about SA 3.0?

[felicity]

At ApacheCon 2004, there will be 3 presentations about SpamAssassin: a 3-hour tutorial covering SpamAssassin as a whole, a 1-hour talk about the new features in 3.0, and a 1-hour talk about using the new SQL features.

Sorry for the plug, but I thought may be interested. :)

Re:I MISS TEH LITTLE PLASTIC NINJA DUDES...

[Anonymous Coward]

Why is the parent interesting, while a comment on the old logo is offtopic? The old logo WAS those little plastic Ninjas.

Re:Improved Performance?

[Clover_Kicker]

Are you running spamd?

My old mailserver was a 233MMX /w 32MB of RAM. Performance was OK once I started using spamd.

stallers vs. filters

[Burning1]

When do people learn that we do not need spam stallers.

Listen dude, you obviously have little experience with spam fighting. Tarpiting (or stalling as you refer to it) is ineffective against modern spammers.

Modern spamming software is highly multithreaded and will continue sending thousands of emails even if it's being actively tarpitted by several servers.

Your ISP sucks then. :P

[EvilStein]

I'm using it on a dual 1.6ghz Xeon box with Gentoo here in the office - the box processes over 70,000 emails per day (spamassassin, amavisd-new and clamav/f-prot) and the load average barely goes above 0.02.

Your ISP just didn't want to take any time to actually learn about it. :)

Re:Your ISP sucks then. :P

[Anonymous Coward]

70,000 a day on a 1.6ghz Xeon? MailFoundry is a 550mhz Ultra SPARC IIi that benches over a million messages a day! (and better kill rates and lower false positives to boot)

CPAN

[cayce]

The question is:

Will it work if I just simple type (in cpan)
install Mail::SpamAssassin ?

2.6 is working very good on my production servers and certainly I don't have the time to go install a test server. I guess I'll wait until somebody else test it out.

Spam nazis would say...

[Anonymous Coward]

No more spam for you!

Re:Improved Performance?

[Anonymous Coward]

Yup, you really should run spamd.

I ran spamassassin on a 200MHz with 32MB which got horribly beaten if I got a lot of mails at once.

Running spamd means there's no overhead for starting loads of spamassassin clients at once. Plus it's written in C.

Re:actually i've always felt their name's not righ

[Anonymous Coward]

Obligatory Family Guy:

The Don: I have asked you here tonight so that you can perform a service.
Peter: Oh, what are you gonna make me do? Whack a guy? Off a guy? Whack off a guy? Cause I'm married ya know.

Re:Improved Performance?

[Clover_Kicker]

I wish the OpenBSD folks hadn't re-used that name.

You're talking about this:

SPAMD(8) OpenBSD System Manager's Manual SPAMD(8)

NAME
spamd - spam deferral daemon

And I'm talking about this:

SPAMD(1) User Contributed Perl Documentation SPAMD(1)

NAME
spamd - daemonized version of spamassassin

Assuming that is true....

[Anonymous Coward]

How long do you get left on the list after the problem is removed?

This is a significant part of the original problem with RBL's. Innocents slammed and slammed hard, with no access to due process.

While not commenting specifically on SpamAssassin, their methods or procedures, it as been clear for some time that many RBL maintainers need to crawl out from under their rock.

So "Extreme Spamfighters" are what we're calling immature sore penis slap nutters now?

Dude! Diagram!

[Anonymous Coward]

You really need to start diagramming your sentences.

"it could, technically, be argued to be murder."

WTF is up with that!???

Bull*hit

[akbkhome]

I've been blacklisting / whitelisting for over a year now with detail logs. >95% of spam is now comming from virus infected bots. 5% are serial spammers, or 'opt-in' idiots. - these are pretty easy to pick up and blacklist these days. Open relays, and Some idiot sending mail via their ISP's (eg. Forwarders) are such a small percentage of spam that it's not even worth the time of day blocking them. (eg. nigerian) The defer greylisting method of spam reduction, along with smart white/blacklisting, is really the only solution to the problem. - SA, Is probably more hastle than it's worth.

Parent is actually funny

[kundor]

...in case you didn't notice.

Closed Source?

[skinfitz]

I've often wondered about this - for something like SA, obviously spammer scumbags are going to be picking apart the source with a fine tooth comb looking for ways to beat the filters.

For applications like this, would closed source be a better choice?

Obviously the more people working on filters should (theoretically) lead to better filters, however this will also be true for spammer scum.

Re:Improved Performance?

[shaka]

I use SA 2.63 on a Debian system. Since upgrading from 2.20 and at the same time starting to use Vipul's Razor (as well as setting up sa-learn to use the same bayes_seen and bayes_toks files as amavis, which wasn't intuitive on Debian), I have literally ZERO false negatives, while still working on a few false positives (mass-mailings from Def Jam, Roskilde Festival and one or two more).

If the difference in performance is as big as you say, though, I might look into doing an upgrade.

Re:Improved Performance?

[Shadowlore]

(mailman + bittorrent + (apache + exim + samba)

It isn't Python causing the problem there. Unless you are doing this for a very low level site, it's all of that combined causing memory use. Besides, of that list, 60% is in C.
Besides, I'd expect bittorrent given what it is to be the biggest resource drain in that list. ;)

I'v ebeen muckign with mailman and have been testing lists with upwards of 1 to 1.5Million subscribers on a machine with 256MB RAm on an old HP 550MHz (it also runs apache, postfix, and djbdns).

Btw, SA is in Perl, not Python.

And finally, it isn't the language, it is the never ending desire to have servers do more stuff dynamically.

Good lord!

[gorilladf]

It's like I've seen the entire spam discussion of the last year in 4 pages of slashdot comments! :) SA 3.0 rocks. SURBL rocks, and if you read the FAQ, you will see all your questions answered. I remember the first time /. mentioned SURBL and all the nay sayer comments. Well, go ahead and use it now, then tell me what you think. Rule Dejour Rocks. (Which autoupdates SA rules with 3rd party ones from www dot rulesemporium dot com) With the combination of Bayes, SURBL, and SARE (SpamAssassin Rules Emporium) rules, spammers can't hide from SA 3.0 A thank you to ALL who made this release possible!

FYI

[lorcha]

I hate those things. Seems every time I post a message to a mailing list, I get 30 of those stupid "I won't see your email unless you click this link or hit reply" messages.

Take a wild guess if I go through all those messages clicking the stupid links.

Better check what email you're missing.

Re:FYI

[Gudlyf]

TMDA is smart enough to not reply to mailing lists, and I always add mailing lists to my whitelist when I join, just in case.

Re:stallers vs. filters - I stop multithreded spam

[iamcf13]

Modern spamming software is highly multithreaded and will continue sending thousands of emails even if it's being actively tarpitted by several servers.

My mailserver tarpits and disconnects multithreaded spamware connecting to it from the same IP address. That is to say it strictly enforces a '1 connection only' limit. Unfortunately, if it is 'attacked' by a unblacklisted zombie spamnet, it will have to use other measures available within itself to slow down these machines and ultimately 'autodelete' the spam they spew.

Re:stallers vs. filters - I stop multithreded spam

[Burning1]

Sounds like a great way to block legitimate email. : \

We use some sendmail throttling to reduce our load.

Re:Improved Performance?

[slobbargoat]

ok well i tried that and it was working 100% for about 2 hours, then suddenly all my IIS and exchange settings seemed to have gone corrupt. Thank god for backups.

I'm not sure if its related to running the exchage sink script provided by microsoft though, since it doesn't change anything in the registry afaik. And im too damn scared to try it again to find out.

Re:stallers vs. filters - I stop multithreded spam

[iamcf13]

Sounds like a great way to block legitimate email. : \

All you need is ONE TCP/IP connection to a remote SMTP server to transfer email. That is what my mailserver does when it sends email to remote mailservers. Sad to say, allowing more than one TCP/IP connection per remote IP address nowadays is just asking for spam!... (>_<);;;

Re:stallers vs. filters - I stop multithreded spam

[Burning1]

Something I've learned as a sysadmin: developers will ignore RFCs, common sense, and best practices if they feel they can get away with it.

Non RFC compliant email servers make Greylisting a real PITA. I wouldn't be surprised to find out that there are some legitimate multithreaded systems out there.

Re:stallers vs. filters - I stop multithreded spam

[iamcf13]

Thank you for your comments, Burning1.

While everyone else goes gaga over SpamAssassin 3.0 and whatnot, I've gone from barely restrained outrage over spammers/computer crackers to now feeling rather sorry for them as they are wasting their time and resources sending me their garbage to me at iamcf13@hotpop.com -- I'll (effectively) never see it. It would be nice if I could use my mailserver program directly and avoid even having to download the crap as it would 'autodelete' it for me.... =/