Interview With The SpamAssassin 202
comforteagle writes "Howard Wen has conducted an interview with Daniel Quinlan of SpamAssassin. In it he explores what keeps Daniel motivated in the face of the unrelenting torrent of spam and new spamming techniques, as well as, what is working - what is not, and what he predicts spammers have up their sleeves next for defeating spam detection." From the interview: "If you don't mind deleting spam manually, that's your prerogative, but don't complain about it. If your ISP doesn't do a good job fighting spam, then switch ISPs or install your own anti-spam software. There are a lot of choices out there."
gmail has good spam protection (Score:5, Informative)
Cloudmark SpamNet (Score:5, Informative)
Disclaimer: No interest in the company. Just a satisfied customer.
My view (Score:3, Informative)
Quinlan: That would probably be advance fee fraud, also known as "Nigerian" or "419" scams. These messages are often literally sent individually to each recipient, mutating each time, by scammers typically located somewhere in West Africa. Because they often are sent in low volume, and almost every one is somewhat different, they are a bit tricky to catch.
An easy solution for home users who don't happen to know anyone from West Africa is to just block all e-mail from there. But even without that, I have had decent success in the past with a combination of SpamAssassin tagging e-mails and Thunderbird filtering. Stay away from OE. Far, far away.
We use a Brightmail tool on Ironport appliances (Score:3, Informative)
Charles
Once again.. (Score:4, Informative)
When they start spamming "Linux IPF Apache LOOK! Vi@GR@ makes your peNi$ PHP Bug CSS" I will be concerned.
Re:Cloudmark SpamNet (Score:2, Informative)
Am I alone? (Score:4, Informative)
SpamAssassin has SURBL support (Score:1, Informative)
If you can't run your own mailserver... (Score:4, Informative)
A pop3 proxy works great. I recommened SpamBayes
http://spambayes.sourceforge.net/ [sourceforge.net]
Re:Complain as much as you can! (Score:2, Informative)
personalized training (Score:3, Informative)
What's wrong with personalized training? I get more spam than almost anyone I know, and SpamBayes does a fantastic job for me.
Re:you'ved been spammed! (Score:3, Informative)
That said, SA has been a saviour of unimaginable proportions. I get 400-600 pieces of spam a day, and normally it's very good about getting all but 1-2 of them each day with hardly any false positives. Lately it's been letting 10-20 slip through, though.
Re:Complain as much as you can! (Score:5, Informative)
This is false. The SpamHaus list [spamhaus.org] shows the USA hosts more spammers than the other countries put together.
the FBI who has bigger fish to fry
This is somewhat true. We won't put a dent in spam from a legal perspective until a federal agency devotes some serious infrastructure to the job.
That's mainly due to lack of willpower and expertise rather than funding, however. A competent "Spam Czar" armed with the authority to seize spammer's personal assets could easily achieve self-funded operation within a year.
Re:you'ved been spammed! (Score:4, Informative)
Part of the problem with open source spam filters, the Bad Guys can reverse engineer what's currently being tested.
I kinda wish that the SpamAssassin group would separate their tests from their product development, so we could get more frequent update of the "offical" spam assassin filters. However, I remember reading somewhere that testing and evalutating any new rules against their current corpus takes quite a long time.
Also, make sure you check out http://www.rulesemporium.com/ [rulesemporium.com] for more frequently updated rules.
Re:My view (Score:2, Informative)
The "trick," such as it is, is to maintain three separate Bayes databases - a "good" one, a "spam" one, and a "419" one. Filter with good vs. spam first, and then with good vs. 419. This seems to work better than just lumping 419 mail in with other spam, since as Quinlan notes, the 419 scam mail tends to have little content in common with other spam. But with a separate filter, it can be identified with essentially 100% accuracy.
Re:Am I alone? (Score:3, Informative)
Two words: Spam Bayes (Score:2, Informative)
Spamassassin much better with personal training (Score:4, Informative)
In fact I've found it works great as a personal filter, if you configure it somewhat differently from the way the documentation suggests. That is, increase the weight of the Bayes filter, and have it train itself on every message it classifies. Then correct it on any mistakes it makes - which rapidly become few and far between.
Here's a paper [uwaterloo.ca] showing that SpamAssassin can achieve as good results as others touted for personal use.
Unfortunately SpamAssassin is a bit hard to install and set up. But if you have RedHat or Debian Linux, it is available by rpm/apt and you can install a few scripts to make it work.
I wish I had a better shrink-wrapped version, but I don't. So I'm supplying the raw files for one user in the hopes that (a) somewhat technical people can reproduce the setup and be happy, (b) somebody will make a shrink-wrapped version, perhaps with plugins or extensions or macros for more mail clients.
Here is the Linux Personal Spamassassin setup [uwaterloo.ca].
Easy manual sorting.. (Score:4, Informative)
With a full screen terminal window, I can mark spam based on the name and the subject header. I can recognize spam at a rate of about 10 per second this way. With the names spammer pick, and the mis-spelled subject headers, it is pretty easy to pick them out.
Using pine, I never give a spammer info by opening web bugs. I can look at the raw email by typing "h" to show the headers, so all those phishing emails are immediately obvious.
Keeping the email on the isp's server means that when I rebuild a machine, I don't have to worry about about backing up my email.
How I beat spam (Score:5, Informative)
Since I implemented the above as a Postfix ruleset, I don't get spam anymore, and it's not exactly like I've actually kept my primary address secret. No, I'm not kidding or exaggerating - basically, my mailbox is my own once again. Viva Postfix! Viva greylisting!
How I do it ... (Score:3, Informative)
First Qmail setup to use RBLs
cbl.abuseat.org sbl-xbl.spamhaus.org relays.ordb.org dynablock.njabl.org list.dsbl.org dul.dnsbl.sorbs.net
That bunch will block a whole lotta spam before it ever gets to discuss sending mail with the SMTP server.
Next, SimScan from Inter7.com, this little c app runs at the front end of the SMTP process, it will scan incoming mail at SMTP level with ClamAV and SpamAssassin, anything scoring over 10 in SA is dropped at SMTP level with a 5xx error.
SimScan allows you to fine tune settings on a per domain and per user level if you so desire, so it is easy to turn SA off entirely for a user who wants all the spam they can get, ditto for those who'd rather not be protected from viruses.
Using these features you stop a LOT of spam, likely in the 80% or higher range. Most domains we've applied this to have gone from hundreds per day to less than 10 per day.
It is imperative you also use the SURBL features in SA to stop more spam than ever, you should also use Razor2, DCC and Pyzor. I suggest upping the Razor2 scores a bit as well the defaults are quite low.
& for Windoze users... (Score:3, Informative)
Re:gmail has good spam protection (Score:3, Informative)
I've seen several of my filtered messages end up labeled as spam. Since they *were* spam, I was quite happy to see this.
MOD DOWN PARENT (Score:3, Informative)
From the article:
Yahoo! Anyone? (Score:2, Informative)
Personally, I have the upgraded (2GB) account so I can take advantage of what I consider the best anti-spam feature available anywhere: disposable email addresses.
Not sure if you want to divulge your address to for a free iPod contest? Give them a disposable address where email is directed straight past your inbox and into a separate folder. When you lose that iPod contest and the spam starts pouring in, just delete the disposable address.
Sure, you can set up a free "junk mail" address with Hotmail, Yahoo!, but I've found that "checking in" on my spam is a waste of time.
Of course, the best solution is to not give out your email address.