[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

user control of an anti-spam strategy



hi,

i am currently employing spamassassin and looking at bogofilter along
with some other methods. in all cases, the anti-spam product will be
employed at the mailspool system-wide for all users. users can
obviously opt in and out individually, and things like whitelists are
kept for each user privately. but since 98% of all users (approx)
don't know how to spell UNIX and use POP3 or IMAP to get at their
mail, they cannpt really retrospectively influence the spam filters.

spamassassin, bogofilter, and many other filters allow the user to
submit false-positives and false-negatives to the system for it to
learn from its mistakes. in all cases does that require the user to
simply pipe the message that passed into an executable that is called
with different options, one for piping false-negatives and one for
piping false-positives.

i'd like to somehow give the POP and IMAP users a chance to
retro-influence the filter(s) from their clients. one way of doing
this, which would be understood by most is bouncing the message to
a special address employing address extensions:

  user1+notspam@mailserver.com for false-positives
  user1+spam@mailserver.com for false-negatives

and then use /etc/procmailrc to do the appropriate thing.

the problem with this approach is twofold:

  - if bouncing, then the message will have Resent-To etc. headers
    added. In the case of false-negatives, the presence of these
    Resent-* headers might well cause the heuristics of filters to
    pick up on that (bogofilter for instance) and consequentially tag
    all messages that have been bounced as spam candidates. this is
    clearly unacceptable.

  - some clients, notably on the windoze side, don't know how to
    bounce but can only forward or reply. this leaves me with the same
    problem as with the bounces, as additional information is added in
    either case, which might cause the filter to take something like
    "forwarded message" to become an indicator of spam.

so my question is this: how can i offer my users a universal,
OS-independent and easily comprehensible method to submit messages
back to the mailserver without the message being modified?

one way, receiving the message and obtaining the message ID, then
searching that message ID in the user's spool, won't work because some
users delete their messages after POP3ing them off.

do you have other ideas? is there maybe a program specialized in
stripping bounce and forward additions from mail messages?

-- 
martin;              (greetings from the heart of the sun.)
  \____ echo mailto: !#^."<*>"|tr "<*> mailto:"; net@madduck
 
quantum mechanics: the dreams stuff is made of.

Attachment: pgpVJ_XwYZESD.pgp
Description: PGP signature


Reply to: