[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Measuring "should I greylist?" false positive rate [was: greylisting on debian.org?]



Le mar 18 juillet 2006 10:03, Pierre Habouzit a écrit :
> Le mar 18 juillet 2006 10:00, Lionel Elie Mamane a écrit :
> > On Mon, Jul 17, 2006 at 11:48:21PM +0200, Pierre Habouzit wrote:
> > > Le lun 17 juillet 2006 22:29, Lionel Elie Mamane a écrit :
> > >
> > >
> > > the discussion (...) was about enabling greylisting on *certain*
> > > *specificaly* *suspicious* hosts. a suspicious
> > > host is:
> > >  * either listed on some RBL's (rbl listing "dynamic" blocks are
> > > a good start usually)
> > >  * either having no reverse DNS set
> > >  * either having curious EHLO lines (that one may catch too much
> > > good mail sadly, so it's to handle with care).
> > >  * ...
> > >
> > > I apply greylisting on the two first criteriums on a quite used
> > > mail server (around 300.k mails per week, which is not very big,
> > > but should be representative enough).
> > >
> > > there is less than 50 mails a week over those that *may* be
> > > legitimate mails that are actually slowed down.
> >
> > On second thought, I'm very interested in how you measured this
> > false positive rate. Do all the recipients of the 300k mails per
> > week check for every mail if it was greylisted (that means you
> > would put a header or something like that saying "this mail was
> > greylisted"?), and they _always_ check on _every_ legitimate mail
> > and _always_ report false positives to you? Probably not. So, are
> > these 50 mails a week all the mail that undergoes greylisting but
> > *still* goes through (i.e. gets retried, roughly)? Something else?
>
> it's the number of mails that are beeing resubmited per week with my
> system. so in fact, in them, there is 49 spams.

oh and as a matter of a fact, I just happen to see that you Cc-ed me on 
the exchanges, I just received the first mail you sent. Just see by 
yourself how fast and furious master runs:

Received: from master.debian.org (master.debian.org [70.103.162.30])
	by mx1.polytechnique.org (Postfix) with ESMTP id 7512D33176
	for <pierre.habouzit@m4x.org>; Tue, 18 Jul 2006 10:05:31 +0200 (CEST)
Received: from 5.xs4all.nl ([213.84.114.29] helo=capsaicin.mamane.lu)
	by master.debian.org with esmtp (Exim 4.50)
	id 1G2k5n-0007ft-48; Tue, 18 Jul 2006 02:34:07 -0500

Yeah, master took 31 minutes to deliver the mail to the next SMTP 
server, and I'm an admin on it (that's the mail server I was speaking 
of earlier in the thread) and it was its first submission.

so maybe it's time you revise your jugements on how efficient debian.org 
mails servers are recently.
-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org

Attachment: pgpEBNTe1g8ug.pgp
Description: PGP signature


Reply to: