RE: [Declude.JunkMail] Whitelisting flaw in Declude?

Thu, 19 Oct 2006 21:54:04 -0700

A new tag (whitelistunique) which only would whitelist if the email had a single recipient would solve the problem and be much safer.

 

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Colbeck, Andrew
Sent: Thursday, October 19, 2006 11:45 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude?

 

Yeah, what Matt said.

 

Message splitting before junkmail filtering would be punishing for CPU time and somewhat more for disk time; message splitting for the sake of whitelisting (or alternate actions) after junkmail filtering would be an incremental cost.

 

And message splitting before junkmail filtering on a system that has a wildcard email address would be lethal for that system.

 

Andrew.

 

 

p.s. In my corporate network, we email each other a lot, and we see that Exchange "single instance storage" of a message only saves us 20% of the disk space.  And that includes single storage of a message in my Sent Items as well as in my neighbour's Inbox and the next guy's Deleted Items.

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt
Sent: Wednesday, October 18, 2006 8:20 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude?

I have some stats here that suggest otherwise.  We only have 5% more recipients than messages that make it through our gateway, and we only return permanent errors presently for mail bombing related activities.  This however is a dedicated gateway and not a hosted mail server, so stats from a hosted mail server would see a slightly higher rate since most multiple-recipient E-mails are internal to a server.  If you are splitting on a gateway and not splitting internal E-mail, you should see no increase beyond my numbers.

It's a doable solution if one has the need.

Matt


Jay Sudowski - Handy Networks LLC wrote: 

Also, realize that on servers processing a large volume of messages per
day, the additional IO necessary to create duplicate messages and header
files for each specific recipient would be a death sentence...
 
 
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of
David Barker
Sent: Wednesday, October 18, 2006 9:30 AM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude?
 
To create a duplicate message for each recipient is not a trivial issue.
This is a function of the mail server not Declude.
 
David Barker
Director of Product Development
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
 
 
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of
Kevin
Bilbee
Sent: Tuesday, October 17, 2006 5:08 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude?
 
Delcude has always functioned like this.
 
What declude could do in this case is to duplicate the message for each
recipient and write a new header file to each recipient. Not a big
issue.
Deliver to the one that whitelists and run the spam checks for the
others.
 
 
 
Kevin Bilbee
 
  


-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of 
Darin Cox
Sent: Tuesday, October 17, 2006 12:37 PM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude?
 
It's actually more of an issue of how the mail server handles the 
message.
In the case of multiple recipients, since there is only one message 
file addressed to multiple recipients in the headers, it's either 
deliver or not deliver unless you rewrite the headers to modify the 
recipient list.  I think I'd rather not have the spam filtering system
    



 
  



alter that.  Add to the header, yes.  Alter the recipients, no.
 
Also, I have not come across a situation where I wanted to let a 
message go through to one recipient and not to others, except in the 
situation of lists which is a whole other topic.
 
Darin.
 
 
----- Original Message -----
From: "Dave Beckstrom" <[EMAIL PROTECTED]>
To: <declude.junkmail@declude.com>
Sent: Tuesday, October 17, 2006 3:11 PM
Subject: RE: [Declude.JunkMail] Whitelisting flaw in Declude?
 
 
I would call that a flaw, then, in how Declude processes the
    



whitelist.
  



I have a listserver email address for which I do not want email spam 
checked.  This is because I don't want messages going out to the list 
that say SPAM in the subject line.  Because nobody who is not a member
    



 
  



on the list can post to the list, there is no problem whitelisting the
    



 
  



"TO"
address
for mail sent to the list server email address.
 
However, spammers will send an email to a dozen of our mail addresses
(12
recipients) one of which is the whitelised "TO" address for the 
listserver.
Because of the way Declude processes the whitelist, that means that 
the other 11 recipient receive the spam even though mail to them is 
not whitelisted.
 
That is a bad design on Declude's part, wouldn't you agree?  Anyone 
else feel that this needs to be rectified?
 
 
 
    



-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of
      



Darrell
    



([EMAIL PROTECTED])
Sent: Tuesday, October 17, 2006 11:25 AM
To: declude.junkmail@declude.com
Subject: Re: [Declude.JunkMail] Whitelisting flaw in Declude?
 
If one user is whitelisted they all will be whitelisted for that
      



email.
    



There are some things you can do to prevent this like 
BYPASSWHITELIST
      



test.
    



Darre;;
 
--------------------------------------------------------------------
-
      



---
    



Check out http://www.invariantsystems.com for utilities for Declude
      



And
    



Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI
      



integration,
MRTG
    



Integration, and Log Parsers.
 
----- Original Message -----
From: "Dave Beckstrom" <[EMAIL PROTECTED]>
To: <declude.junkmail@declude.com>
Sent: Tuesday, October 17, 2006 11:18 AM
Subject: [Declude.JunkMail] Whitelisting flaw in Declude?
 
 
If an email is received that is addressed to multiple recipients, 
one
      



of
    



whom is whitelisted, does Declude treat the email as whitelisted for
      



all
    



recipients?
 
 
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.
 
 
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.
      



 
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.
 
 
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.
    



 
 
 
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 
 
 
 
 
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
 
 
 
  





---

This E-mail came from the Declude.JunkMail mailing list. To

unsubscribe, just send an E-mail to [EMAIL PROTECTED], and

type "unsubscribe Declude.JunkMail". The archives can be found

at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.

Reply via email to