Re: Unusual spam recently - hummm

[Rick Moen <rick@linuxmafia.com>]

Quoting s. keeling (keeling@spots.ab.ca):

> Yes.  The problem with Alvin's solution is it only looks at the crap
> that spammers send.  A lot of legitimate mail does all the silly
> things that spammers do, and users do want to receive that mail.

1.  Content-based filtering doesn't work very well (if that's what
    you mean, which you probably don't).

2.  Most silly things legitimate mail does can be accomodated by an
    efficient antispam regime; a few cannot.  Remember the screams
    of outrage when people started being told "You shouldn't run 
    open relays any more?"  We're entering another round of that.
    Some of the you-can't-do-that-any-more items will be RFC 
    violations (lack of postmaster@ and abuse@ addresses, failure to 
    accept DSN mail, lack of deliverability to the alleged sender),
    others are not (lack of DNS RRs sufficient to serve as SPF data,
    support for revised forwarding standards such as SRS).  Exactly
    as with open relays, the Net will be full of admins saying "I 
    don't have to do that; screw you".  Increasingly, they'll find
    their mail refused at SMTP time, or stuffed into spamboxes and 
    neglected.  Some admins learn only when struck forcefully by
    Papa Darwin.

    So, that's how reality works.  Deal, or be dealt.

> Add to that all the broken-ness of many mail systems and you're left
> with little to count on.

I have no problem with my MTA issuing 55x Reject to broken systems.  If
you feel otherwise, cool.  Go for it.

> You and I may see no legitimate point to html mail, but ordinary users
> do.

Delightful red colour on that herring of yours.

(If you think this discussion concerns HTML mail, you have badly
misunderstood.  See also point #1, supra.)

> The same is true for undisclosed-recipients: and "From "'s that don't
> match mailhosts.

Whoever said "block mail for "undisclosed-recipients" has rocks in his
head and needs to reconsider.  (I have no time to debate with such
people.)  And, hey, de-facto standards for forwarded mail handling (and
thus envelope sender headers) have recently changed.  Adapt or die.

"Die" in this case means expect to see your mail rejected at an
accelerating rate.

Nobody's going to insist that you not "die".  If death becomes you,
enjoy!

> For a big organization with thousands of users, what's Spam is not
> really all that easy to quantify.

And another fine, ruddy herring!  Delicious, thanks.

-- 
Cheers,
Rick Moen                                     Age, baro, fac ut gaudeam.
rick@linuxmafia.com