Re: Spamassasin over RBL, was Re: rblsmtpd -t?
> On Thu, May 02, 2002 at 06:52:33PM +1000, Jason Lim wrote:
> > Well, they are not exactly comparable, as the rule-based Spamassassin
> > does things based on "keywords and "keyphrases" and that kind of
> > thing, while RBLs do things based on actual spam activity. In my view,
> > the collateral damage of using Spamassassin's rule based blocks is too
> > great.
>
> your view isn't based on much experience, then.
Okay, i think it comes down to personal preference. I saw the
Spamassassin's "rule" list... someone typing in the word "AMAZING" gets
0.125 or something points, "FREE" gets how many points, etc. All it takes
is for spammers to simply change their wording a bit (as they have in the
past... like A.M.A.Z.I.N.G), and it defeats Spamassassin, whereas the RBLs
are immune to such tampering.
>
> i've been using and developing anti-spam systems for years. in my view,
> spamassassin is probably the best thing since sliced bread - it does an
> EXCELLENT job of identifying spam using a scoring system based on
> detecting patterns seen in many spams over the years. if the score gets
> too high (user configurable) then it is flagged as spam. what happens
> to it then is up to the user's delivery filter (or up to the system if
> there's a system-wide filter).
>
> actually, spamcop is about the worst RBL anyone could use if they wanted
> to avoid collateral damage.
>
> spamcop's automation sucks. all it takes for a postmaster to get
> mailbombed by spamcop is for some cretin to send in a spam complaint
> because they're too stupid to figure out how to unsubscribe from a
> mailing list they voluntarily subscribed to. btw, that would be
> confirmed opt-in subscription because ALL of the lists i run for
> customers require subscription confirmation...the list software has been
> hacked so that it isn't an option, it's mandatory.
Yes, but here is the thing you did not mention. Spamcop does not
automatically block an IP just because a few people complained. It takes
into consideration the ENTIRE mail volume. So, using your example, if the
mailing list sends out 50,000 emails per day, and some cretin is, as you
said, too stupid to unsubscribe and submits to spamcop, then it would be
1-2 emails out of 50,000 tagged as spam.
As far as I remember, spamcop needs to have total volume of spam exceed 2%
of the total in order to consider it spam. So unless a large number of
cretins get together to block the company, then the company that runs the
lists is fine.
> or because they're too stupid to realise that a certain mail server is
> forwarding spam to them BECAUSE they used to have an account on the
> system and the alias or .forward file that they asked for is still
> working as requested. yes, this DOES happen - the last one of these i
> got was today (and that wasn't even about a mail server i have any
> control over...not that there was a problem with it, it was a
> well-maintained postfix server which certainly was NOT an open relay).
The solution is above.
> these aren't even the stupidest examples of spamcop's lameness.
>
> that's all it takes to get listed in their RBL too.
I might also mention that it is not hard to get out of spamcop's lists,
even if you are listed. Unless a site continually gets spam complaints, I
think spamcop checks the RBL database ever 24... or was it every week...
and removes stale/old entries. Try to get off some of the OTHER RBLs...
they make you beg and plead for your innocence, and then most times they
say "screw you spammer" and thats it.... you are left being blocked until
kingdom come.
> i've seen these and many other stupid complaints from spamcop over the
> years. i am so sick of getting bullshit reports from spamcop that i've
> been on the verge of adding spamcop's domains & servers to my own block
> lists on dozens of occasions over the years....the only thing that
> stopped me is the fact that their intentions are basically good even if
> their method is idiotic.
Well, I should *also* mention that you can have the complaints BLOCKED at
the spamcop level. Thats right... you can have all that email to you
redirected somewhere else. Spamcop uses "abuse.net" for their emailing, so
if you put in the correct entries in abuse.net, then you can have the mail
delivered to the relevent person. You could also chose to ignore the
complaints, if you truely don't have spamming customers, and it will go
away.
No RBL is perfect, I'm only looking for "the better" RBL, and after
looking around carefully, reading all the RBL's policies, and now from
experience, Spamcop.net is the "better" of the RBLs, IMHO. YMMV, and
certainly if enough people starting rising up against Spamcop, I would
reconsider my view (and so would many sysadmins i think). But so far, I've
seen VERY few people complaining about spamcop's way of doing things
compared with other lists. So maybe the lack of complaints against Spamcop
also verifies my view that Spamcop is better?
--
To UNSUBSCRIBE, email to debian-isp-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: